The Irish Office of the Data Protection Commissioner (“ODPC”) appears set to examine the legality of Facebook’s “Like” button following the finding that this feature is in breach of local, federal and European law by the data protection regulator of the federal German State of Schleswig-Holstein, Thilo Weichert.

By gathering data through web servers based outside the European Union (“EU”) on the web surfing habits of users by logging their IP addresses when they visit web pages that contain the “Like” feature, Facebook was found by Weichert to be in contravention of EU law.

As discussed in our previous article, the ODPC has also received a complaint from an Austrian activist grouping called “Europe v Facebook”. This group supports Weichert’s argument that the “Like” feature allows Facebook to build a profile of the web browsing habits of internet users (including those who are not Facebook members). This information may then be used commercially by Facebook, according to the group.

Weichert further stated the browsing history of users was retained by Facebook for up to two years. Facebook has rejected this and stated that all such data are deleted within 90 days, which it says is in keeping with “normal industry standards”.

The Austrian lobby group has already filed various complaints with the ODPC, in particular, that Facebook retains data even after deletion from the user’s profile and also that Facebook is capable of developing “shadow profiles” on non Facebook users by collecting data that has been entered by users of Facebook, such as contact and phonebook data. These complaints are being lodged with the ODPC due to the fact that under Facebook’s Terms of Use, users of the site outside Canada and the United States contract with Facebook Ireland Limited.

An ODPC spokesperson has stated that while it is aware of the decision of its German counterpart, it was yet to initiate a review of the compliance of the “Like” feature with Irish data protection law. The spokesperson continued however to say that the ODPC will engage in a review of “different aspects of Facebook Ireland’s compliance with Irish data protection law”.

Facebook has refuted the findings in Germany. It will be interesting to see how the German decision will be viewed by the ODPC and data protection regulators in other jurisdictions.

Contributed by David Cullen.