Facebook – Court Ruling (Germany, 2024)

The data subject is a user of the Facebook, Instagram and WhatsApp platforms. On 3 November 2023, Facebook (“the controller”) introduced their “Pay or Okay” model. On 10 November 2023, the data subject consented to the use of their data for ads on Facebook and Instagram. On 15 May 2023, the data subject requested access, damages and injunctive relief from the Regional court Regensburg (“Landgericht Regensburg”). The controller answered that it could not reply within the deadline under Article 12(3) GDPR, but only within three months’ time. The controller replied on 5 June 2023. The controller stated that it does not forward any information for advertising purposes to advertisers who personally identify users in the context of the processing at issue, unless the user has consented to the forwarding of their data to a specific advertiser. On 13 February 2024, the data subject amended its application and requested the Regional court Regensburg (“Landgericht Regensburg”) to order the controller to provide access under Article 15 GDPR and answer the specific questions the data subject had about their personal data in connection with the targeted advertising. Moreover, the data subject requested the Court to order the controller to pay the data subject non-material damages and to erase the personal data collected in the period between 25 May 2018 and 6 November 2023 under Article 17 GDPR. The data subject argued that they suffered a loss of control over its personal data. The inadequate information provided by the controller resulted in the data subject not knowing how their personal data had possibly been passed on to which third parties, or how it had been used by the controller for targeted advertising. Moreover, the data subject argued that they had received a lot of spam due to leaked data from his Facebook account. The data subject also argued that they always found the use of their personal data for the purposes of advertising aimed at them personally unpleasant. The data subject admitted they gave consent on 10 November 2023 to allow the controller to use personal data for advertising purposes. But the data subject argued that they had no choice, as this would have meant breaking off contact with numerous friends and acquaintances. The controller argued that they already complied with the access request by providing the information either in their privacy policy or in the letter of 5 June 2023. Moreover, the controller argued that there was no claim for damages as there had been no violations of the GDPR. Access Request The Court dismissed the data subject’s request for access after looking at the specific questions the data subject asked the controller in their access request under Article 15 GDPR. Regarding the data subject’s question on which personal data the controller processes for advertising purposes, the Court held that this could be found in the controller’s privacy policy. The privacy policy also explained how it collects personal data to provide personalised advertising. In that regard, the controller already provided the necessary information. Regarding the data subject’s question how often the above data was processed, the Court stated that this did not fall within the scope of Article 15 GDPR. Regarding the data subject’s questions on the forwarding of data to third parties for advertising purposes, the Court held that they were already answered by the controller in their reply of 5 June 2023. The Court thus found that the controller complied with the access request regarding this aspect. The Court stated that it was irrelevant whether the answer of the controller contained any inaccuracy and referred to national commercial case law ([http://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=en&az=III%20ZR%20136/18&nr=110327 BGH III ZR 136/18]). The question regarding what data was collected for targeted advertising purposes using WhatsApp, the Court stated that Whatsapp is not operated by the controller, but by the controller WhatsApp Ireland Limited. Moreover, the controller stated in its letter of 5 June 2023 that it does not process any data of European WhatsApp users for the purpose of personalised advertising. Thus, the Court found that the controller already complied with the access request. Non-material Damages The Court found that the data subject was not entitled to compensation for non-material damages pursuant to Article 82(1) GDPR, because the data subject did not proof it had suffered any non-material damage. The Court found the argumentation of the data subject too generalised as the data subject did not indicate to what extent the alleged loss of control should constitute damage that goes beyond a mere negative consequence. Moreover, the alleged increased volume of spam could not be categorised as damage within the meaning of the GDPR. The data subject also did not proof there was a causal link between the increased volume of spam and the controller’s processing for the placement of personal advertising. The Court stated that people who do not have a Facebook account also receive unsolicited text messages and spam emails. Regarding the data subject’s argument that they had no choice but to give consent, the Court took into account the CJEU case Bundeskartellamt. The CJEU ruled that the controller’s dominant position on the market for online social networks did not in itself preclude the users of such a network from effectively consenting to the processing of their personal data by the controller. According to the CJEU, the freedom of the user is safeguarded if an equivalent alternative is offered for a reasonable fee that does not involve such data processing operations. Thus, the Regional court Regensburg held that this freedom was ensured by the controller with the introduction of their “Pay or Okay” model. The data subject decided against the ad-free paid subscription and consented to receiving personalised advertising. Erasure Request Regarding the request for erasure, the Court stated that the data subject was not entitled to erasure of their data under Article 17 GDPR, as the data subject expressly consented to the controller for continuing to use their personal data for advertising purposes. According to the Court, the requirements for the right to erasure pursuant to Article 17(1)(b) GDPR were therefore not met in any case due to the existence of consent. Conclusion The Court thus dismissed the case and ordered the data subject to pay the costs of the case, which was set at € 7,000.