Photo of Natascha Gerlach

Natascha Gerlach

Subscribe to Natascha Gerlach's Posts

Natascha Gerlach’s practice focuses on electronic discovery and European data protection law.

In February of this year the German antitrust agency, the Federal Cartel Office (“FCO”), issued a decision against Facebook regarding their handling of user data. Please see our previous blog-post detailing the FCO’s arguments here

Facebook appealed and on August 26, 2019, the Düsseldorf Court of Appeal (“DCA”) in an interim decision granted suspensive effect to Facebook’s appeal against the FCO decision.

The DCA can order suspensive effect to an appeal if it has serious doubts whether the prohibition decision is legally valid.  Despite the preliminary character of the DCA’s decision, this could represents a significant setback for the FCO and have signaling effect beyond the German borders,. The DCA made certain important points on issues of law, which it will likely not revers during its main proceedings.
Continue Reading German Court Divorces GDPR and Competition Law in Facebook Appeal

On July 29, 2019, the Court of Justice of the European Union (“CJEU”) issued its judgment in Case C-40/17 (Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV). This is a landmark decision regarding the assessment of who has the responsibility for complying with data protection legislation in the context of embedding third-party features that regularly takes place on websites.

The CJEU adopted a broad view of the situations in which a “joint controllership” can arise. It held that, under EU data protection legislation, the operator of a website featuring the Facebook ‘Like’ button (a social plugin that causes the transmission to Facebook of website users’ personal data) can qualify as a controller, jointly with Facebook. Consequently, the website operator is directly responsible for complying with legal obligations in this respect, including by informing its users that their personal data will be transferred to Facebook.

However, the CJEU importantly clarified that the website operator’s role as controller (and the corresponding legal obligations) is limited to the collection and transmission of the data to Facebook and does not include any subsequent personal data processing that Facebook carries out.

The CJEU’s findings will potentially affect third-party technologies other than the Facebook ‘Like’ button, which are often incorporated into websites, such as cookies and pixels.Continue Reading CJEU Judgment in the Fashion ID Case: The Role as Controller Under EU Data Protection Law of the Website Operator that Features a Facebook ‘Like’ Button

On February 6, 2019, the German antitrust agency, the Federal Cartel Office (“FCO”), imposed limitations on Facebook’s current practice of collecting and processing user data and prohibited using the related terms of service.  After an almost three-year long investigation, the FCO found that some of Facebook’s business practices amounted to an abuse of a dominant position.  For the first time, the FCO based its abuse-of-dominance analysis also on whether the dominant company complied with the GDPR – throwing compliance with the GDPR into their competition law assessment.[1]
Continue Reading Germany Limits Facebook’s Data Collection and Processing, Refers to GDPR

Knuddels GmbH & Co KG, a German social media app, has received the first administrative fine issued by a German supervisory authority under the General Data Protection Regulation (“GDPR”).

The fine of € 20,000 has been levied on Knuddels by the Commissioner for Data Protection and Freedom of Information in Baden-Württemberg (one of 16 regional data protection authorities in Germany) following a hack reported by Knuddels in September which resulted in the personal data of approximately 330,000 users being stolen and subsequently published. Such personal data included users’ emails addresses and passwords.
Continue Reading First German Fine Issued Under the GDPR

On October 18, 2017, the European Commission published its report on the functioning of the EU-U.S. Privacy Shield framework (the “Privacy Shield”), marking the conclusion of its first joint annual review of the regime.  The Privacy Shield, which is administered by the International Trade Administration within the U.S. Department of Commerce (“DOC”), provides companies on both sides of the Atlantic with a mechanism to comply with data protection requirements when transferring personal data from the European Union to the United States.  To join the Privacy Shield, a U.S.-based organization is required to self-certify to the DOC and publicly commit to comply with the Privacy Shield requirements.  While joining the Privacy Shield is voluntary, once an eligible organization makes the public commitment to comply with the Privacy Shield requirements, the commitment will become enforceable under U.S. law.
Continue Reading EU-U.S. Privacy Shield Functions Well, with Scope for Improvement, According to its First Annual Review

From May 2018, organizations established or providing services in the EU will be subject to new national and EU-wide cybersecurity legislation, as regulators in EU Member States begin to apply both the General Data Protection Regulation and national legislation implementing the Network and Information Security Directive.

These new laws will significantly increase the territorial and

…