EU’s top court rules Big Tech privacy complaints can bypass Irish regulator, leaving Facebook and others exposed to more challenges

  • The ECJ ruled any country in the EU can challenge Facebook on the bloc’s data privacy rules, not just Ireland where the tech giant’s European headquarters are
  • Tuesday’s ruling could pave the way for a fresh onslaught of privacy cases
  • Irish watchdog has been criticised for a slow response to Big Tech complaints

The EU’s top court has ruled that watchdogs in any country in the EU can challenge Facebook on the bloc’s data privacy rules, not just Ireland where the tech giant is based.  

The ruling on Tuesday has implications for other big tech companies operating in Europe as experts say it could pave the way for a fresh onslaught of privacy cases across the European Union’s 27 member nations.

Under the bloc’s stringent privacy rules, known as the General Data Protection Regulation, only one country’s national data protection authority has the power to handle legal cases involving cross-border data complaints in a system known as ‘one-stop shop.’ 

For Facebook, which has its European headquarters in Dublin, it is Ireland’s Data Protection Commission.

However, the European Union’s Court of Justice ruled that ‘under certain conditions,’ a national watchdog has the power to take a company to court over a GDPR violation even if it’s not the lead regulator.

The EU’s top court has ruled that watchdogs in any country in the EU can challenge Facebook on the bloc’s data privacy rules, not just Ireland where the tech giant is based [Stock image]

The ruling held that the GDPR ‘authorises, under certain conditions, a supervisory authority of a Member State to exercise its power to bring any alleged infringement… before a court of that State’ where cross-border data processing is involved. 

A GDPR cooperation requirement meant that a ‘lead supervisory authority may not ignore the views of the other supervisory authorities,’ which can raise objections that would block ‘at least temporarily’ the lead authority’s decisions, it said.

The ruling is in line with a preliminary opinion from a court adviser.

The court’s decision brings to an end a lengthy legal battle between Facebook and Belgium’s data protection authority over jurisdiction for the case, which centred on the social network’s use of cookies to track behaviour of internet users, even those who weren’t account holders. 

The company had argued that the Belgian watchdog no longer had jurisdiction after GDPR took effect in 2018.

The ECJ noted that the case pre-dated the 2018 entry into force of the EU’s data privacy laws, called GDPR or General Data Protection Regulation. 

Facebook painted Tuesday’s ruling as a victory, noting that under the it, the Irish regulator would remain in the lead except in limited circumstances.

Facebook painted Tuesday’s ruling as a victory, noting that under the it, the Irish regulator would remain in the lead except in limited circumstances. Pictured: Facebook’s Dublin headquarters [File photo]

‘We are pleased that the CJEU has upheld the value and principles of the one-stop-shop mechanism, and highlighted its importance in ensuring the efficient and consistent application of GDPR across the EU,’ Jack Gilbert, the company’s associate general counsel, said.     

The 2015 Belgian case was brought by the president of the Belgian Privacy Commission – since superseded by the country’s Data Protection Authority – alleging Facebook infringed on Belgian internet users’ rights by collecting their information on their browsing behaviour whether they were Facebook users or not.

 The Belgian court in 2018 found against Facebook and ordered it ended the practice where it took place without users’ consent, under threat of a daily fine of 250,000 euros (£215,310.99).

Facebook appealed, with the matter being kicked up to the ECJ to determine the effects of the ‘one-stop shop’ mechanism on the legal wrangle.

The European Consumer Organisation BEUC welcomed the ECJ’s ruling on Tuesday, saying it ‘should have positive repercussions in the fight to better protect consumers’ personal data’.

The ruling by the European Court of Justice on Tuesday has implications for other big tech companies operating in Europe as experts say it could pave the way for a fresh onslaught of privacy cases across the European Union’s 27 member nations. Pictured: The ECJ’s headquarters in Luxembourg [Stock image]

It noted that many Big Tech companies were registered in Ireland and argued ‘it should not be up to that country’s authority alone to protect 500 million consumers in the EU, especially if it does not rise to the challenge.’

Ireland’s under-resourced privacy watchdog has been criticised for taking too long to resolve a growing number of cases involving tech giants including Apple, Twitter, Google and Instagram. Ireland argues that the cases are complicated.

The GDPR allows the Irish Data Protection Commission to issue fines of billions of euros, however its biggest fine so far has been $548,000 (£389,274.54), to Twitter over a 2019 data breach, Fortune reported.

Ireland’s low taxes have attracted tech giants including Apple, Facebook and Twitter, which all have their headquarters in the country. 

Source: Read Full Article