# UNABHäNGIGES LANDESZENTRUM FüR DATENSCHUTZ SCHLESWIG-HOLSTEIN v. WIRTSCHAFTSAKADEMIE SCHLESWIG-HOLDSTEIN GmbH - Type: Case Law - Source: CJEU - Date: 2018-06-05 - Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62016CJ0210&ref=6136 - Canonical: https://overview.legal/posts/6136 - Topics: Controllers, Territorial scope (GDPR), Social Media, Processors, Processing, Processing Agreement, Personal Data, Direct Marketing, Data Controller, Supervisory Authorities ## Summary Territorial Scope / Concept of “establishment”: Facebook Germany is responsible for promoting and selling advertising space and carries on activities addressed to persons residing in Germany. Given that a social network such as Facebook generates a substantial part of its income from advertisements posted on the web pages set up and accessed by users, and given that Facebook’s establishment in Germany is intended to ensure the promotion and sale in Germany of advertising space that makes Faceboo ## Sections (8) ### ¶1 English (en) Bulgarian (bg) Spanish (es) Czech (cs) Danish (da) German (de) Estonian (et) Greek (el) English (en) French (fr) Croatian (hr) Italian (it) Latvian (lv) Lithuanian (lt) Hungarian (hu) Maltese (mt) Dutch (nl) Polish (pl) Portuguese (pt) Romanian (ro) Slovak (sk) Slovenian (sl) Finnish (fi) Swedish (sv) Language ### ¶57 Next, it must be pointed out that Article 4(1)(a) of Directive 95/46 does not require that such processing be carried out ‘by’ the establishment concerned itself, but only that it be carried out ‘in the context of the activities of’ the establishment (judgment of > Applies: gdpr-art-4-par-1-en ### ¶58 In the present case, the order for reference and the written observations submitted by Facebook Ireland show that Facebook Germany is responsible for promoting and selling advertising space and carries on activities addressed to persons residing in Germany. > Topics: Social Media ### ¶59 As noted in paragraphs 33 and 34 above, the processing of personal data at issue in the main proceedings, carried out by Facebook Inc. jointly with Facebook Ireland, consisting in collecting personal data by means of cookies installed on the computers or other devices of visitors to fan pages hosted on Facebook, is intended, in particular, to enable Facebook to improve its system of advertising, in order better to target its communications. > Topics: Cookies, Social Media, Personal Data, Processing ### ¶60 As the Advocate General observes in point 94 of his Opinion, given that a social network such as Facebook generates a substantial part of its income from advertisements posted on the web pages set up and accessed by users, and given that Facebook’s establishment in Germany is intended to ensure the promotion and sale in Germany of advertising space that makes Facebook’s services profitable, the activities of that establishment must be regarded as inextricably linked to the processing of personal data at issue in the main proceedings, for which Facebook Inc. is jointly responsible with Facebook Ireland. Consequently, such treatment must be regarded as being carried out in the context of the activities of an establishment of the controller within the meaning of Article 4(1)(a) of Directive 95/46 (see, to that effect, judgment of > Topics: Social Media, Personal Data, Processing, Controllers · Applies: gdpr-art-4-par-1-en ### ¶61 It follows that, since German law is applicable to the processing of personal data at issue in the main proceedings in accordance with Article 4(1)(a) of Directive 95/46, the German supervisory authority was competent under Article 28(1) of that directive to apply that law to that processing. > Topics: Supervisory Authorities, Supervision, Personal Data, Processing · Applies: gdpr-art-4-par-1-en, gdpr-art-28-par-1-en ### ¶13 Paragraph 12 of the Telemediengesetz (Law on electronic media) of 26 February 2007 (BGBl. 2007 I, p. 179, ‘the TMG’) reads as follows: ‘(1) The service provider may collect and use personal data for the provision of electronic media only where this law or another provision of law expressly relating to electronic media permits it or the user has consented. ... (3) Except as provided otherwise, the provisions in force for the protection of personal data are to be applied even if the data is not processed automatically.’ The dispute in the main proceedings and the questions referred for a preliminary ruling > Topics: Personal Data ### ¶56 As regards, second, the condition ## Cited law provisions (2) ### GDPR — gdpr-art-4-par-1-en ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ### GDPR — gdpr-art-28-par-1-en Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. --- Generated by overview.legal · https://overview.legal/posts/6136 · 2026-08-22