Facebook case : the CJEU has ruled

---

Background : The Facebook case

In 2015, the Privacy Commission (which on May 25 2018 became the Belgian Data Protection Authority) went to court against Facebook for what it considered to be a serious invasion of the privacy of Belgian citizens : collecting information on the surfing behavior of millions of internet users in Belgium by placing cookies on their computers and then collecting these cookies via social plugins and pixels on the websites that they visit.

Before ruling on the merits of the case, the Court of Appeal of Brussels, that was examining the case, decided to refer certain questions to the Court of Justice of the European Union in order to verify whether the BE DPA has indeed the possibility to pursue its legal action against Facebook given the entry into force of the General Data Protection Regulation (GDPR) on May 25 2018, as well as the introduction of a new cooperation mechanism between European data protection authorities called the “one-stop shop” which  provides that the authority of the country where the main establishment of the respondent company is located (in the case of Facebook, the Irish DPC) is competent to take sanctions.

January the 13th, the Advocate General Michal Bobek has delivered his opinion, in which he  argues that a national authority which is not the lead authority for a cross-border data processing operation may indeed apply to a national judge under certain conditions, namely «in the situations where the GDPR specifically confers upon it competences to this end. » (Source: Press release CJEU)

Decision of the CJEU

In its judgment published today, the Court of Justice of the EU largely follows the reasoning of the Advocate General, and confirms that it is possible for an authority that is not the "lead authority" to refer a case to a national court in some situations, in case the cooperation mechanism does not function properly.

Furthermore, the Court gives a broad interpretation of the powers of national supervisory authorities, stating, for example,

• that for the supervisor which is not the lead supervisor to be competent, it is not required that there is a main establishment or any other establishment in its own Member State (question 2);
• that the authority which is not the lead authority may act against the main establishment or any other establishment of an organization as long as it is demonstrated that it concerns a data processing operation that takes place in the context of the activities of that establishment and that the authority is competent (question 3);
• that an ongoing legal action concerning facts dating from before the GDPR (25 May 2018) can be continued, provided that the other conditions are met (question 4); and
• that the provision to take legal action has direct effect (and it therefore makes no difference whether or not it has been explicitly (also) transposed into national law).

The BE DPA must now analyse the judgment more thoroughly in order to understand the possible implications for its "Facebook case".

Hielke Hijmans, Chairman of the BE DPA's Litigation Chamber explains: "We are satisfied that the CJEU has concluded that it is possible for an authority that is not the lead authority to bring a case before a national judge in certain situations. The BE DPA now needs to analyse the judgment in more details to determine whether any of the situations described in the judgment apply to the case it has opened against Facebook in 2015. Needless to say, for us, the one-stop shop system still remains crucial for the protection of EU citizens."

David Stevens, Chairman of the BE DPA concludes: "The Court has pronounced a balanced decision. We particularly welcome the wide interpretation of the powers of national supervisors (such as the BE DPA). We also find it important that the Court emphasizes the need for loyal and constructive cooperation between all supervisors. This decision is therefore a good thing for the protection of the privacy of citizens, and for the harmonized application of the GDPR. We have always been convinced of the importance of maintaining a possibility for authorities to act on behalf of users. Of course, in doing so, the conditions of the GDPR must always be complied with.."

The judgment is available here.

A press release by the Court of Justice of the EU is available here.

The case, including the questions referred to the Court of Justice, is recorded on this link.

Timeline of the Facebook case

2015

• The Privacy Commission (which on May 25 2018 became the Belgian Data Protection authority) goes to court against Facebook

February 2018

• The Court of First Instance rules in favor of the Privacy Commission.
• Facebook appeals against the judgment of 16 February 2018 of the Dutch-speaking Court of First Instance in Brussels

27 et 28 March 2019

• The BE DPA argues before the Belgian Court of Appeal that Belgian courts are competent in this case

8 May 2019

• Before ruling on the merits of the case, the Court of Appeal of Brussels decides to refer certain questions to the Court of Justice of the EU

5 October 2020

• The BE DPA argues its case before the CJEU

13 January 2021

• The Advocate General of the Court of Justice of the EU presents its opinion confirming that, in principle, national supervisors have the possibility - in certain cases - to bring cases before national courts, even in cross-border cases.

15 June 2021

• The CJEU rules on this matter in its arrest in case C‑645/19