Consumentenbond – Court Ruling (Netherlands, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Dutch court dealt with a complaint against Google for allegedly tracking a user's location without proper consent. The court found that the Irish DPA should handle the case since Google's European base is in Ireland. This highlights the complexities of cross-border data privacy issues and the role of lead supervisory authorities.
What happened
A complaint was filed against Google for allegedly using dark patterns to track a user's location without proper consent.
Who was affected
A consumer using a Samsung Galaxy A3 smartphone running Google's Android operating system.
What the authority found
The court determined that the Irish DPA should investigate the complaint because Google's European headquarters is in Ireland, making it the lead authority for cross-border issues.
Why this matters
This case underscores the challenges of handling cross-border privacy complaints and the importance of understanding which authority has jurisdiction. It also highlights ongoing concerns about tech companies' use of dark patterns to obtain user consent.
GDPR Articles Cited
National Law Articles
On 26 November 2018, the Consumentenbond (a Dutch non-profit organisation which promotes consumer protection), on behalf of consumer [A], filed [https://www.consumentenbond.nl/nieuws/2018/gezamenlijke-actie-europese-consumentenorganisaties-tegen-google a complaint with the Dutch DPA], the Autoriteit Persoonsgegevens (AP), against Google LLC. The complaint was part of a joint action with other European consumer organisations, such as the umbrella organisation BEUC and the Norwegian, Swedish and Czech consumer associations. The complaint concerned the unlawful tracking of the consumer’s location by the consumer’s Samsung galaxy A3 smartphone, which runs the operating system Android (by Google). According to the complaint, crucial information was hidden and users were guided by dark patterns to consent to share their location, in violation of Article 5 GDPR, Article 6 GDPR, Article 7 GDPR, Article 13 GDPR, and Article 25 GDPR. The DPA, however, claimed that the Irish DPA (the DPC), is the leading supervisory authority pursuant to Article 56(1) GDPR, because the complaint concerns cross-border processing and Google’s European headquarters is located in Ireland. On 5 June 2019 and 2 September 2019, the DPA notified the Consumentenbond and the consumer that the Irish DPA was investigating the complaint and further information would follow. On 26 November 2019, the Consumentenbond and consumer served the DPA with a notice of default for failing to make a timely decision, but the DPA replied on 2 December 2019 that the notice was premature since they had until 2 December 2019 to reply. Moreover, they informed the Consumentenbond and consumer that Google had made changes related to the complaint and additional evidence in relation to the consumer had to be filed before 6 January 2020. The DPA kept informing the Consumentenbond and consumer every three months, on 27 Febryary 2020 and 27 May 2020, of the “progress” by the DPC, stating that an update would follow in three mon
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Consumentenbond in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Consumentenbond - Netherlands (2021). Retrieved from cookiefines.eu
Last updated: