Website plugins are a common feature of online retail as companies seek to promote their products on popular social networks, but critics fear the data transfer may breach privacy laws.

The ruling from the Luxembourg-based Court of Justice of the European Union (ECJ) came after a German consumer body sued German online fashion retailer Fashion ID for breaching personal data protection rules via its use of the button on its site.

A German court subsequently sought guidance. ECJ judges said websites and Facebook share joint responsibility.

Under EU data privacy rules, a data controller determines why personal data must be collected and processed, as well as how, while a data processor only processes personal data on behalf of the controller and is usually a third-party company.

“The operator of a website that features a Facebook ‘Like’ button can be a controller jointly with Facebook in respect of the collection and transmission to Facebook of the personal data of visitors to its website,” the judges said.

The German retailer benefited from a commercial advantage as the ‘Like’ button made its products more visible on Facebook, the court said, though it noted the company is not liable for how Facebook subsequently processes the data.

Facebook said the ruling sheds clarity on the issue.

“We are carefully reviewing the court’s decision and will work closely with our partners to ensure they can continue to benefit from our social plugins and other business tools in full compliance with the law,” Jack Gilbert, Facebook’s associate general counsel, said in a statement.

The ruling is in line with strict data privacy laws adopted by the 28-country bloc last year, said Nils Rauer, a partner at law firm Pinsent Masons.

“The court was right in assessing whether Fashion ID had an interest in collaborating with Facebook by way of embedding the ‘Like’ Button,” Rauer said, adding plugins will continue to be popular notwithstanding the judgment.

“Personally, I do not think that companies will turn away from embedding ‘Like’ buttons due to the judgment. Presumably, they will pay more attention to the embedding process, by way of obtaining dedicated data privacy advice,” Rauer said.

REUTERS