Who's liable for GDPR compliance when embedding/hosting a self-contained 3rd-party website/service?

Question

I'm building a website for a client (a hotel) in Germany. In addition to a bunch of static pages, this website will also host a reservation system which is provided by a 3rd party software company in the form of a single page application. You just have to include their javascript snippet that builds up the whole system/website. Then it's basically a self-contained website, including a footer etc.

They're using all kinds of technologies that a user would like to be informed about in a privacy policy (Google Analytics, Google Fonts, Social media plugins). The problem is: They're not providing a privacy policy on their own and the support argues that it's the responsibility of the web developer to author this privacy policy themselves.

Question: Given that the 3rd party basically provides a whole website (including header and footer) aren't they obliged to deliver a privacy policy too?

Question: Who would be liable in case the privacy policy is incomplete in respect to the technologies used on the 3rd party software?

Answer 1

Unless there's a data processing agreement between the hotel and the third party, both would likely be joint controllers. I.e. the hotel is fully co-responsible for any data processing that happens due to any embeds. If there were an Art 28 data processing agreement, the hotel would be fully responsible as well, but would have the primary responsibility for ensuring compliance – if the third party is a data processor, they don't have to publish their own privacy policy.

This view is supported by the ECJ C-40/17 “Facebook Like-Button” case. A fashion retailer included the FB like button on the web page. The court found that the retailer was not a controller of subsequent processing by Facebook (here, Facebook is its own controller). However, the two parties are joint controllers for collecting and transmitting the personal data on the page.^[1] While the ruling was made under the previous Data Protection Directive, it is entirely transferable to the GDPR. In your scenario the on-page processing is even more substantial.

^{[1]: Which means that the website needs a legal basis for sharing data with the embed provider. For like buttons, the typical legal basis is consent, and loading the social plug-in is deferred until the visitor consents. This is more tricky for a reservation system because service may not be conditional on consent per Art 7(4).}

The definition of a data controller is the party “which, alone or jointly with others, determines the purposes and means of the processing of personal data”. The hotel is clearly a controller here because it decides purposes and means. Using the third party embed is a means for the purpose of making reservations. The hotel has a responsibility to ensure that the purposes and means are in compliance with the GDPR.

It seems like the third party the hotels wants to use is not prepared to act in a GDPR-compliant manner, or to enable its customers to achieve GDPR compliance. Another reservation system should be used, or a the hotel should set a link to the reservation system's own web page, to make it clear that they are not responsible.