Data Privacy Stichting – Court Ruling (Netherlands, 2023)

This case concerns a class action filed by the Data Privacy Foundation, an organisations which pursues redress on behalf of victims of privacy intrusions in the Netherlands, against social media company Meta. The complaint filed by the foundation was directed at unlawful personal data processing practices by Meta, through their Facebook service. The three defendants in the lawsuit were three companies of the Meta group (Meta Platforms Inc; Meta Platforms Ireland Limited; and Facebook Netherlands BV). The complaint filed by the Foundation consists of four main issues. Firstly, the claim submitted that Meta infringed their transparency obligations in Articles 5, 12, 13 and 14 GDPR by failing to sufficiently inform users of a number of processing operations. Secondly, the Foundation submitted that Meta processed personal data in lack of a legal basis in violation of Article 6 GDPR. Thirdly, it was claimed that Meta unlawfully processed special categories of personal data (Article 9 GDPR). Fourth, and finally, Meta did not obtain valid consent for the use of cookies, tracking of surfing behavior, and app use outside the Facebook service – for advertising purposes – in violation of the Article 11.7a of the Dutch Telecommunications Act. Each of these issues, and the details of the claims made by the Foundation, will be discussed further below. Issue 1 – Transparency obligations The complaint filed by the Foundation detailed a number of ways through which Meta infringed its transparency obligations under the GDPR. Firstly, the controller did not inform data subjects about the disclosure of personal data to external developers who could process personal data for their own purposes. From 2010, Meta (then called "Facebook") introduced an API (Graph API 1.0) to allow other software developers to link their software to the Facebook service. This API makes it possible to exchange data and communicate between different software systems. Prior to the first use, permission was requested from the Facebook user. Subsequently, after obtaining the consent, data from both the Facebook user and friends of the Facebook user were collected by the third-party developer. The most well-known and used application of this API is the login function of the Facebook service, which is used to register with a third party. In 2015, a new version (Graph API 2.0) was introduced in which access to personal data of Facebook friends is no longer offered, subject to a transition period for developers who used the API before 2015. In principle, a forced migration to the 2.0 version applied after the transition period, but documents showed so-called 'whitelisted developers' could still use the 1.0 version after the transition period and could therefore still process data from Facebook friends. The foundation claimed that, throughout this period Meta did not, or at least did not clearly, inform the data subjects about such access granted to third party developers. Secondly, it was alleged that Meta did not inform the data subjects about the disclosure of personal data to third parties who subsequently disclosed personal data to other parties; in particular, these are the circumstances which led to the notorious Cambridge Analytica scandal. Thirdly, Facebook users had the option to secure their account by means of two-factor authentication, by providing their telephone number and receiving a login code. Facebook was accused of using these telephone numbers to send users personalised advertisements, without informing them in a clear and timely manner. Fourth, and finally, it was submitted that Meta did not provide sufficient information about the sharing of data with third parties as part of the “integration partnership program”. Meta had entered into a collaboration with integration partners in the past, with the aim of giving Facebook users access to the service on different devices, because there were no uniform applications available in the App store and Google Play store at that time. Through collaboration with external developers, an API was introduced to enable the partners to develop applications and functionalities for the Facebook service. Via this API, the partners also gained access to the personal data of the Facebook users and their friends. Issue 2 - Processing of personal data without a valid legal basis With regard to the processing of personal data for advertising purposes, the Foundation noted that Meta did not have a legal basis to carry out this processing. This case concerns processing which took place between 2010 and 2020, as the GDPR did not enter into force until 25 May 2018. A distinction must be made between the lawful basis for processing before and after this date. Before 25 May 2018, the relevant European legislation was the Data Protection Directive, implemented in Dutch domestic law through the Personal Data Protection Act WBP. Meta claimed that, during the former period, it relied on consent, contractual necessity and legitimate interest to process personal data for advertising purposes. After 2018, Facebook Ireland Ltd generally based such processing on contractual necessity (Article 6(1)(b)) and for some specific situations on consent (Article 6(1)(a)). Meta’s argument for using "contractual necessity" as a lawful basis was based on the assertion that the Facebook service is essentially a personalized service, which includes, as a core function, the provision of personalised content and advertisements. Meta also claimed that this was made clear by the Terms of Use. On the contrary, the Foundation argued that the personalisation of advertisements is not the reason why users signed up for the Facebook service. Furthermore, it cannot be argued that the core of the contract between users and Meta is personalized advertising, as it is clearly a social network. Issue 3 – Processing of special categories of personal data The Foundation claims that Facebook Ireland Ltd has violated Article 9 GDPR by processing special categories of personal data for advertising purposes outside the scope of the exemptions provided for in Article 9(2) GDPR. For example, a report of the Dutch DPA stated that in the period from 2012 to 2017, advertisers were offered the opportunity to select interests based on, among other things, "health", "Islam" and "pregnancy". Facebook refuted these accusations by stating that they only analysed the 'likes' of users and kept track of which advertisements the user clicked on. In their view, the categorisation as a result of this analysis did not constitute processing of special categories of personal data. In addition, Facebook stated that the categorisation associated with a particular profile cannot in any way guarantee that this information is correct. For example, someone who likes a page about pregnancy is not necessarily pregnant, so there can only be an indirect connection between the interest and the special personal data. Issue 4 – Cookie tracking and use of location data Finally, the Foundation claimed that Meta used third-party cookies to compile a profile based on users' surfing behavior in order to offer targeted advertisements. According to the Dutch legislation (Art. 11.7a of the Dutch law implementing the e-Privacy Directive), before one wishes to access information or to store information in a user's peripheral equipment, one must (i) clearly and completely inform the data subject; and (ii) obtain the consent of the user. The Foundation argued that Meta did not comply with its information obligations and the requirement to obtain valid consent. In response, Meta cited the Fashion ID judgment of the CJEU to defend the position that it is not obliged to comply with the requirements of Article 11.7a of the Dutch Law if it receives personal data via cookies on third-party websites, and that this obligation is applies to the operator/manager of the third party website. Firstly, regarding the initial issue of whether the foundation has a sufficient interest to bring the claim. Meta had argued that the case should be rejected due to 'absence of sufficient interest' on the part of the Foundation. According to Meta, the Foundation only invokes an alleged loss of control over personal data without making it clear why this could cause legal damage. However, a single infringement of a privacy right does not in itself lead to damage. Addressing this question, the court stated that, in principle, a sufficient interest is to be presumed and the court would be reluctant to rule that a sufficient interest does not exist. Accordingly, the court held that, in light of Article 6:106 of the Dutch Civil Code, if it is plausible that liability exists for damages or that unlawful action has been taken, then the court must assume that the plaintiff has an interest in bringing the claim. As a result, it was found that the Foundation has such a sufficient interest. The court then issued its judgement regarding each of the four issues which are central to this case. The fundamental assumption underlying the court's decision is that Meta, as the entity determining purposes and means of the processing, was the controller. Issue 1 – Transparency obligations With regards to the first claim made by the foundation (failure to inform data subjects of disclosure to third party developers) the court observed that Meta could not delegate or transfer their obligations of transparency to third-party developers. As a matter of fact, Meta installed a pop-up window for the purposes of providing information to data subjects. This pop up window was sufficient in informing data subjects that personal data was being shared with third party developers. However, Meta had not sufficiently informed data subjects as to the purposes of the processing. Furthermore, users were not sufficiently informed, when registering from an account, that external developers would be able to access their personal data when one of their friends downloaded a third party application. With regards to the second question, the court held that the transfer of personal data to Cambridge Analytica was not relevant for the assessment in these proceedings, since Meta had no influence or control in granting Cambridge Analytica access to the personal data. Meta was therefore not a data controller in the context of this processing. As for the third point (use of telephone numbers for personalised advertising) the court held that, as there was no legal basis for the processing of personal data including telephone numbers (see below), the Foundation no longer had an independent interest in a declaratory judgement concerning whether or not Facebook fulfilled its obligation to provide information in this regard. This question was therefore no longer relevant. Concerning the fourth point (insufficient information about the integration partnership program), the court stated first and foremost that granting access to personal data of Facebook users can be regarded as relevant data processing for which Meta was responsible. As a result, the information obligation rested on it as data controller. Moreover, in the absence of any evidence to the contrary, the court concluded that, at the relevant time, Facebook users were not informed at all about this data processing. Issue 2 – Processing of personal data without a valid legal basis Regarding the legal basis for processing (Article 6 GDPR) the court held that Meta could not rely on any of the alternatives it put forward for the processing of personal data for advertising purposes. Addressing the “contractual necessity” argument, the court clarified that in the context of a contractual online service, the specific purpose is decisive. In this regard, in order to prove that the processing is necessary in this way, the controller must demonstrate that the main object of the contract cannot take effect if the specific processing of the personal data does not take place. The court held that the most essential feature of the agreement consists in offering a profile on a social network; and that behavioral advertising is subordinate to this. The core function of the contract was therefore providing a social media service, not advertising, and the processing in question could not be considered necessary for the performance of this contract. In addition, the EDPB guidelines on the provision of online services state as a general rule that the processing of personal data based on browsing behavior is not necessary for the performance of a contract for online services. The court concluded that during the part of the period that the GDPR applied, there was no legal basis for the processing of personal data for advertising purposes. Regarding consent, the court stated that none of the methods used on the Facebook service resulted in a consent validly given. There was not a specific, informed and unambiguous expression of will for processing for advertising purposes and, as a result, Meta could not claim to rely on consent as a legal basis. Furthermore, legitimate interest was also not recognised by the court as a basis for processing personal data for advertising purposes. The court stated that the CJEU still has to decide if legitimate interest is even a legal basis that can be used for advertising purposes. In any case, although the court confirmed that commercial interests on the part of Meta could in principle constitute a legitimate interest, it noted that Meta did not make a concrete balancing test of interests. In addition, Meta's legitimate interest does not pass the necessity test because the sale of advertisements that are not personalized, or are less personalized, would be sufficient to achieve the goal. Also, it cannot be argued that data subjects, as users of a free service such as Facebook, generally expect that their personal data is being processed and their activities are being closely monitored, resulting in a negative assessment in terms of proportionality and subsidiarity. Issue 3 – Processing of special categories of personal data With regards to the processing of special categories of personal data, the court’s assessment was limited to the period that was subject to the investigation by the Dutch DPA – namely between 2012 and 2017. In order to address the question of whether Meta unlawfully processed special categories of data during that period, the court referred to the judgment of the CJEU of 1 August 2022 (OT/Vtec). In this case, the CJEU found that a higher level of protection applies to special categories of personal data. Meta asserted a distinction between special data that users specifically enter into the website; and data that Meta obtains by deducing certain interests from browsing history. Meta claimed it did not use the former for advertisement, and that the latter cannot be considered special category data. The court did not accept Meta’s arguments in this regard. Firstly, the Dutch DPA investigation found that Meta allowed advertisers to show users personalised adverts based on sexual orientation indicated in their profiles. Secondly, in terms of browsing habits, the court found that this data is cable of revealing special category personal data, in accordance with the high level of protection afforded to such information. Furthermore, the court also referred to the EDPB guidelines on targeting social media users. The classification of users on the basis of religion, philosophical belief or political opinion is considered processing of special categories of personal data, regardless of the accuracy of the classification. In light of all of the above, the court found that Meta unlawfully processed special category personal data, in violation of Article of the Dutch law implementing the Data Protection Directive and Article 9 GDPR. Issue 4 – Cookie Tracking and Use of Location Data With regard to the use of cookies, the court addressed Meta’s argument that the obligation to inform users and obtain consent was not theirs, but it concerned rather the operator of the third party website. The court held that the obligations rest with the legal person responsible for placing data in the peripheral equipment and obtaining access to the information stored in the peripheral equipment. Meta is also responsible in the case of third party cookies. However, it can delegate this to the website administrator via agreement. Therefore, in view of insufficient evidence to the contrary, it could not be established that Meta violated Article 11.7a of the Dutch law implementing the e-Privacy Directive. However, this does not alter the fact that Meta did not have a valid legal basis to process personal data via cookies for advertising purposes (see above). With regard to the location data, the court ruled that, insofar as this data is part of the data of which the processing has not been sufficiently communicated or for which no legal basis has been demonstrated (see above), the above judgments also apply to this data. Summary Overall, the court held that Meta had violated Articles 5(1)(a) and 6(1) GDPR by processing personal data for advertisement without a legal basis. Meta also violated Article 9(1) GDPR by unlawfully processing special category data for advertisement. Finally, Meta violated its transparency obligations in accordance with Article 13 GDPR. In addition, the controller was ordered to pay the costs of the proceedings. It has to be stressed that the decision adopted by the court is just a declaratory judgement, which means that the questions concerning the existence and the amount of damages and the related right to compensation remained open.