2019
The Data Protection Authority defends its arguments before the Court of Appeal in Brussels in the Facebook case
On 27 and 28 March 2019, pleadings in the Facebook case will take place before the Court of Appeal in Brussels. Facebook appealed against the judgment of 16 February 2018 of the Dutch-speaking Court of First Instance in Brussels. The DPA will argue that Belgian courts are competent and that Facebook should be ordered to respect Belgian and European privacy rules when it processes personal data through its cookies, social plug-ins and pixels.
Background
Facebook collects information on the private surfing behavior of millions of internet users in Belgium every day. To this end, it places cookies on their computers and then collects these cookies through its social plug-ins and pixels. In this way Facebook can track internet users when they surf from one website to another. Facebook not only tracks the surfing behavior of Facebook members but also of other millions of internet users in Belgium who do not have a Facebook account.
Since Facebook’s social plug-ins and pixels are present on millions of websites, Facebook can identify a large part of everyone's surfing behavior. It can also concerns websites of a very sensitive nature, such as websites concerning health problems, sexual orientation and political preferences. Facebook then uses that information to profile your surfing behavior and uses that profile to show you targeted advertising, such as advertising about products and services from commercial companies, messages from political parties, etc.
Procedure
According to the DPA, Facebook (still) not complies with Belgian and European privacy legislation. Since it concerns serious infringements, of which almost each Belgian internet user is the victim, the Privacy Commission already decided in 2015 to go to the court. On 16 February 2018, the Court of First Instance ruled in favor of the Privacy Commission. Facebook decided to appeal that judgment.
GDPR
As legal successor of the Privacy Commission, the Data Protection Authority has the competence to pursue this claim. The new so-called "one-stop shop" mechanism in the GDPR does not change anything to this either. The GDPR nowhere states that it has the effect of suddenly ending all legal proceedings pending on 25 May 2018.
Despite the changes that Facebook has made during the run-up to the GDPR, Facebook still violates the fundamental rights of millions of residents of Belgium. The obligations that were previously in the Privacy Act have been strengthened since 25 May 2018. The DPA will therefore ask the Court of Appeal of Brussels to confirm the judgment of the Court of First Instance of 16 February 2018, also for the future.