Guide to information obligations and data protection for Fan pages, Like Buttons & Co. in social media

The following contribution shows guidelines for the use of social media as part of promotional measures. Here the focus should be on compliance with general information obligations and data protection, in which it should not be lost sight of that the use of social media can also pose further problems, particularly under the German unfair commercial practices laws. It should be noted that in this area some legal uncertainties still exist. The contribution therefore attempts to show an as legally secure as possible way of dealing with the social media and indicates currently existing dangers and legal uncertainties. These cannot always be completely eliminated, if one does not want to dispense with an integration of social media in their entirety, which at the present time is seriously considered for hardly any industry.

Depending on the kind of integration (“Fan page”, “Like-Button”, “Custom Audience”) different problems arise.

1. Legal notice

Companies, which use “Fan pages” (company websites, which are established on social-media portals), are obligated to provide a complete legal notice with the information specified in Section 5 Telemedia Act. The information must be easily identifiable, immediately accessible and constantly available. Above all, the easy identifiability can cause problems, because a provision under the term “Info” (unlike under “Contact”) should not suffice, but some social media providers permit no other possibility of linking to the legal notice (Facebook, however, has recently changed this). If the provision occurs via a link, the content must be accessible with maximally two clicks.

2. Data protection notice

Reference can be made for the placement of data protection notices to the above explanations. Additional problems result, however, with regard to the legally valid design. Comprehensive instruction is necessary on the way personal data are used.

In detail:

2.1 “Fan pages”

It is not conclusively clarified to what extent operators of commercial “Fan pages” are responsible for the data processing during the visit to the site by users. At present this is predominantly denied on the grounds that the operators of the “Fan pages” are not responsible for the processing of data by the social-media portal triggered by the visit. Thus, the data protection notices of the social-media portal itself are sufficient. The use of "Fan pages" is therefore possible without great expense and legal risks.

The situation is different, however, if the operator uses the personal data obtained via the “Fan page” in his own, independent manner (for example, as part of the organization of competitions). In this case, the way in which the data are used must of course be completely disclosed in the data protection notices.

2.2 “Like-Buttons”

The integration of “Like-Buttons” (application/plugin for connecting the social media portal with one's own website, through which contents can be directly shared on the portal, can clearly be more problematic. Unlike in the case of “Fan pages” the company participates directly in the data processing operation through the integration of plugins on its website. Thus, the user also bears a joint responsibility for a possibly unlawful processing.

Such an unlawful processing already exists, if the way in which the personal data is handled is not comprehensively disclosed. Due to the lack of transparency for which the portal operators are responsible an appropriate disclosure is practically impossible for companies at present. In the case of integration of “Like-Buttons” a certain danger of cease-and-desist warnings therefore exists. This danger can be reduced only by a comprehensive clarification in the data protection notices or explicit consents of the user.

2.3 “Custom Audiences”

“Custom audiences” allow companies to align their customer data with the social-media portals and to filter out those, which are members of these portals. This facilitates to contact existing customers via social-media. Here it should be noted that due to the data processing a mandatory consent of the parties concerned must exist according to Section 4(1) Federal Data Protection Act. Any such consent must specifically indicate which data are transmitted for what purpose to whom. Otherwise fines or claims for damages are threatened.

Conclusion:

The use of social media portals as promotional measures is extremely attractive and effective for companies. The legal requirements are often difficult to understand, however, and even more difficult to satisfy. Therefore, companies are advised to keep an eye on the legal problems and developments in order not to run the risk of finding oneself exposed to cease-and-desist-warnings, fines or claims for damages.