Social networking giants are subject to EU data protection laws, say regulators

According to privacy law expert William Malcolm the opinion offers clarity for companies and users, but should not contain surprises for followers of data protection law.

"This finally puts to bed the argument that social networking sites might not be data controllers and therefore might not be subject to the Data Protection Directive and its local implementing legislation," he said. "This restates some of the previously defined positions in relation to privacy issues affecting social networking sites."

The opinion makes it clear that users of social networking sites have no legal obligations as data controllers as long as the use is purely personal.

"The Directive does not impose the duties of a data controller on an individual who processes personal data 'in the course of a purely personal or household activity'," it said, citing the 'household exemption' to the provisions of the Directive.

Individuals will have those responsibilities if their use extends beyond the personal, it said, quoting EU Information Society Commissioner Viviane Reding's view that use is shifting from "web 2.0 for fun [to] web 2.0 for productivity and services".

"The activities of some SNS users may extend beyond a purely personal or household activity, for example when the SNS (social networking site) is used as a collaboration platform for an association or a company," said the opinion. "If an SNS user acts on behalf of a company or association, or uses the SNS mainly as a platform to advance commercial, political or charitable goals, the exception does not apply. Here, the user assumes the full responsibilities of a data controller who is disclosing personal data to another data controller (SNS) and to third parties."