Linkedin – Court Ruling (Netherlands, 2024)

The data subject visited several popular websites and refused all cookies. However, tracking cookies were still placed on the data subject’s device. The controllers are Linkedin Ireland, Linkedin Netherlands, Microsoft Corporation (US), Microsoft Ireland Operations, Microsoft (NL) and Xandr (US). LinkedIn offers an advertising service and allows for companies to place tracking cookies on the browsers of a user after they view or click their ads. Microsoft has an advertising service that sells ad space on various websites. The service also allows advertisers to show their ads on the ad space of 'third-party' website operators and can place tracking cookies on the devices of website visitors. Xandr is an online platform that buys and sells digital ads. To use the services of Xandr, website users need to install a Java-script that places tracking cookies on the devices of website visitors. All of them are part of the Microsoft Group. The data subject hired a third party specialist to make an independent analysis of the controllers’ collection of personal data via the placed cookies. The analysis confirmed that out of the 30 websites the data subject visited, 27 websites placed and/or read cookies without the data subject’s consent. 24 websites did this even after explicit refusal to consent. Thus, the controllers were collecting personal data of the data subject’s browsing habits without their consent. The data subject filed an urgency procedure (“kort geding”) at the Amsterdam District Court (“Rechtbank Amsterdam”), asking the court to forbid the controllers to place tracking cookies without the data subject’s consent. Jurisdiction of the court [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Brussels I bis Regulation] regulates which courts of the EU Member States have jurisdiction in cases with links to more than one Member State in the EU. [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 7(2) Brussels I bis Regulation] states that, in matters relating to tort, delict or quasi-delict, a person domiciled in a Member State may be sued in another Member State if the harmful event occurred or may occur in that Member State. [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 8(1) of the Regulation] states that a person can also be sued in another Member State when one of the defendants is domiciled where the court is also located, "provided the claims are so closely connected that it is expedient to hear and determine them together to avoid the risk of irreconcilable judgments resulting from separate proceedings.” Although some of the controllers are established in Ireland, the court held that it had the jurisdiction to rule on this matter: a) under Article 79(2) GDPR, as the data subject had their habitual residence the Netherlands and, b) under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 7(2) Brussels I bis Regulation], as Amsterdam is the place where the harmful event occurred and, c) under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 8(1) Brussels I bis Regulation], as two of the controllers are established in the Netherlands and there is a close link between the claims against the controllers. The court rejected the controllers’ argument that the “place where the harmful event occurred” is only applicable when the data subject demands a claim for damages, because it could not be inferred from the legislative history and case-law that jurisdiction on the bases of where the harmful event occurred only applies to compensation claims. The court held that with regards to the controllers established in the US, Brussels I bis Regulation did not apply, but [https://wetten.overheid.nl/BWBR0001827/2024-01-01 Articles 1-14 of the Dutch Civil Procedure Code] did. The court held it had the jurisdiction under [https://wetten.overheid.nl/BWBR0001827/2024-01-01 Article 6 of the Dutch Civil Procedure Code] (in case of unlawful acts, jurisdiction is based on the place of the harmful event) and [https://wetten.overheid.nl/BWBR0001827/2024-01-01 Article 7 of the Dutch Civil Procedure Code] (there is such a connection between the claims against the various defendants that reasons of efficiency justify a joint procedure). Urgency Furthermore, the court held that the data subject had an urgent interest, because if the controllers were acting unlawfully by violating the data subject’s privacy rights, the court must put an end to this as soon as possible. Therefore, the court held that the data subject cannot be asked to wait for a decision through a normal court procedure and allowed for the urgency procedure. Joint controllership The court rejected the controllers’ argument that they were merely processors and that the responsibility lied with the website operators. The court ruled that under Article 4(7) GDPR, LinkedIn, Microsoft and Xandr were controllers as they determined the means and purposes of data processing. This responsibility remains even if the controllers outsourced the obtaining of consent to their partners (the website operators). Under Article 26 GDPR, multiple parties can be jointly responsible for the processing of personal data. Therefore, the court held that LinkedIn, Microsoft and Xandr were considered joint controllers, and thus responsible for complying with the GDPR. Personal data and consent The court rejected the controllers’ argument that they do not process personal data with their tracking cookies under Article 4(2) GDPR. The court stated that the controllers acknowledged that most of the cookies were set for the purpose of capturing personal data, which can be used to build profiles that can be read for advertising purposes. Moreover, the court held that already placing a cookie that automatically collects personal data constitutes a processing of personal data, and not only when personal data collected by the tracking cookie is actually read for the purpose of advertising. The court dismissed the argument of the controllers that some of these cookies were not tracking cookies and thus not processing personal data. The court held that under Article 6 GDPR and [https://privacy-web.nl/wetgeving/telecommunicatiewet/hoofdstuk-11-bescherming-van-persoonsgegevens-en-de-persoonlijke-levenssfeer/%C2%A7-11-1-algemene-bepalingen/artikel-11-7a/ Article 11.7a of the Dutch Telecommunications act], the placing and reading of tracking cookies requires consent of the data subject. Controllers must demonstrate that they have consent under Article 5(2) GDPR. The court took into account the independent analysis that showed that websites placed cookies without the consent of the data subject, even after rejecting consent. The court also found that the controllers failed to prove that their tracking cookies were only placed on the data subject’s devices after his consent.  The fact that the findings in the analysis are not representative because hundreds of other websites that have the controllers’ tracking cookies do comply with the GDPR by not placing cookies without consent was deemed irrelevant. Responsibility of the controllers The court stated that controllers were allowed to contractually outsource the obtaining of consent to their partners (the websites placing these tracking cookies), meaning that these websites provide information about and obtains consent for the placement of cookies. The controllers do not necessarily have to provide this information and obtain consent themselves as well. However, the court held that the controllers cannot put the sole responsibility on their partners for obtaining consent. The controllers remain (also) responsible themselves for ensuring consent is obtained in a legally valid and lawful manner for the placement and reading of the tracking cookies. The court thus held that controllers can be held liable for this on the basis of Article 26(3) GDPR, regardless of what the contract with its partners states. The court stated that the controllers could have made tools available to their partners that made it impossible to place tracking cookies without consent. If that would have been the case, there would be no unlawful conduct by the controllers. However, this was not done by the controllers. Therefore, the court held that the controllers could not rely on the fact that they have done everything necessary, or at least everything that can be required of them, to prevent the placement of tracking cookies on the data subject’s devices without his consent. Conclusion The court concluded that the controllers violated the GDPR and the Dutch Telecommunications Act by placing and reading tracking cookies without the consent of the data subject. The court thus prohibited the controllers from placing or reading tracking cookies on the data subject's devices without his consent. The court also imposed a penalty of €500 per violation (or €1000 per day), up to a maximum of €25,000 per company until they complied. Lastly, the court ordered the controllers to pay the data subject’s legal costs.