Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 19 October 2026 · Updated daily
Court case Tussenarrest 2022/AR/292
The Belgian 'Gegevensbeschermingsauthoriteit' (DPA) received multiple complaints against IAB, a digital advertising company (alleged controller). The complaints concerned the ‘Transparency and Consent Framework (TCF), which was developed by the alleged controller. TCF is a standard technical framework that enables websites, advertisers and ad-agencies to obtain, record, and update consumer consent, objections and preferences for web pages. TCF was meant to help companies to become more GDPR compliant. Also, TCF makes it overall easier to record preferences of data subject for companies that use the so called ‘consent management platform’ (CMP), which is an interface that appears when a data subject first navigates to a websites or uses an application for the first time. Here, a data subject can give consent for the collecting and/or sharing of personal data or object to the processing of his/her data. These preferences are then saved and encoded in a ‘TC-string,’ which can be shared with other companies. The CMP also places a cookie on the device of the data subject in question. The TC string and this cookie could also be coupled with the IP-address of the data subject. Following the several complaints, the DPA started an investigation into IAB. After the DPA finished its investigation, it fined the alleged controller €250,000. In its decision, the DPA held amongst other things that IAB was the controller with regard to the processing of the registration of consent and objection of data subjects in the TC-string. The DPA also held that the alleged controller had to bring its processing activities in compliance with the GDPR. It had to provide a legal ground for processing in the context of TCF. It also needed to restrict its customers from using an opt-in consent in the CMP-interface, where data subjects would consent to legitimate interest (Article 6(1)(f) GDPR) as a legal basis. In addition, the alleged controller had to implement appropriate technical and organizational measures to guarantee the integrity and confidentiality of a TC-string and had to check its customers taking part in TCF if they were GDPR compliant. The alleged controller appealed the DPA’s decision at the Belgian Court of Appeal. It requested the Court to overturn the previous decision on various grounds. It held amongst other things that it wasn’t the (joint) controller for processing operations with the TC-string. It also stated that it didn’t process personal data in the first place. During this appeal, the complainants voluntarily joined the proceedings with their own requests, primarily supporting the DPA in its arguments. The main request of the complainants entailed the referral of questions to the European Court of Justice (CJEU). These were in essence the following: Question 1: Is the TC-String (with or without a combination with an IP-address) personal data for the controller? Is a TC-String personal data? And in combination with an IP-address? Question 2: Is IAB a (joint) controller? The Court suspended the case and referred the following questions to the CJEU: 1) Is the TC-string personal data (with or without a combination with an IP-address) for the alleged controller and/or with regard to companies that use the TC-string? (Article 4(1) GDPR) 2) a) Is IAB a (joint) controller (Article 4(7) GDPR and Article 24(1) GDPR)? b) Does it matter whether or not IAB has access to the personal data which is processed by companies that use the standards of IAB? c) If IAB is indeed a (joint) controller, does this also entail responsibility for further processing by third parties regarding the preferences of data subjects, such as targeted online advertising?
Amazon Europe Core
The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded this complaint to the Luxembourg DPA under the 'one stop shop' mechanism of Article 56 GDPR. The luxembourg DPA started an investigation regarding Amazon's use of cookies and its compliance with the GDPR and the ePrivacy directive. However, the French DPA started its own investigation into Amazon's compliance with Article 82 of the French Data protection act, a national implementation of Article 5(3) of the ePrivacy directive. (directive 2002/58/EC). This investigation regarding Article 82 had resulted in decision [https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729 SAN-2020-013]. In this decision, the French DPA fined Amazon €35,000,000 for the failure to obtain prior consent and the failure to inform users of their rights with regards to the processing of their data, which was mandatory under Article 82 of the Data Protection Act. The DPA found that when a user visited the "Amazon.fr" site, a large number of cookies with advertising purposes were automatically placed on the data subjects computer. Because this type of cookie was not essential to the service provided by the controller, the DPA considered that the controller had not complied with the obligation to obtain the consent of Internet users before depositing the cookies. Amazon appealed this decision at the Conseil d'Etat, the French Supreme Administrative Court, and requested its annulment. Amazon also asked the Conseil to refer several questions to the CJEU for a preliminary ruling. Among other arguments, Amazon claimed that the French DPA had made an incorrect interpretation of the law regarding its competence and had disregarded its competence by imposing the contested sanction. The controller also stated that the involvement of the French DPA, when the Luxembourg DPA was already involved, constituted a violation of Article 50 of the Charter of Fundamental Rights. According to this article, the same person may not be prosecuted more than once for the same acts. With regard to the application of the "one-stop shop" mechanism and the CNIL's jurisdiction: The Conseil ruled that the application and enforcement of the ePrivacy directive was the responsibility of national DPAs according to Article 15a of the directive. The "one-stop shop" mechanism did not apply in this case, even when there was a form of a cross-border processing. The Conseil also stated that the absence of a 'one-stop shop' mechanism did not imply any infringement of Article 50 of the Charter of Fundamental Rights, because the DPA only ruled on breaches of national law transposing EU law in the contested decision, and not on GDPR related violations. The Conseil also assessed the compatibility of Article 3 of the French Data protection Act with the ePrivacy Directive. The Conseil determined that Directive 2002/58/EC did not prevent the French DPA to apply the French data protection Act (including Article 82). The Directive would therefore also not prevent the French DPA from penalising the controller for supposed violations of Article 82 of the French data protection Act. Therefore, the Conseil established that the French DPA could enforce the French data protection act against any person or legal entity responsible for the processing of data who had an establishment in France, irrespective of the location of the principal establishment of the responsible entity. This enforcement by the DPA would also not constitute violations of articles 49 (Freedom of establishment) or 56 (Freedom to provide services) of the TFEU. With regard to the sanction imposed by the CNIL: The Conseil deemed that the applicant was sufficiently informed regarding the scope of the DPA's investigations, the facts and the legal grounds on which the sanction was based. Moreover, the Conseil considered that the applicant was given sufficient time to present its defence. The Conseil also ruled that the involvement of the French DPA, while the Luxembourg DPA was the lead supervisory authority, was not enough to constitute a breach of the equality of arms principle. Amazon had argued that the involvement of the French DPA in the procedure had enabled the French DPA to gain access to privileged and confidential information and had used this information as a basis for its own decision. The Conseil determined that Amazon did not provide enough proof for this argument and stated that Amazon was not able to prove that was the procedure contrary to Article 15a(4) of Directive 2002/58/EC. On a possible violation of Article 50 of the Charter of Fundamental Rights: The Conseil explained, based on the CJEU's case law (Aklagaren v Akerberg Fransson C-617/10, Powszechny Zaklad Ubezpieczen na Zycie SA of C-617/17 and bpost SA v Belgian Competition Authority C-117/20), that the principle invoked by the applicant, that the same person may not be the subject of several proceeding in respect of the same facts, was not violated by the French DPA. The Conseil stated that the principle could only be enforced when criminal proceedings had been definitively terminated. This was in particular the case when a criminal penalty had become final. The Conseil held that Amazon was not found to be the subject of a final sanction issued by the Luxembourg DPA for the facts that had resulted in the €35,000,000 fine in the contested decision. The Conseil rejected the applicant's claim for a reference for a preliminary ruling on the matter. Regarding the application of French Data Protection Act by the French DPA, Amazon had argued that the legal framework regarding cookies was not stable and unclear at the time when proceedings against Amazon were started. The Conseil concluded that it had published guidelines detailing obligations for entities under the applicable law, and considered that the fact that other national supervisory authorities had taken divergent positions in interpreting the conditions and procedures applicable to the collection of user consent had no bearing on the application of the French Data Protection Act by the French DPA. On the proportionality of the sanction imposed: Taking into account the elements assessed by the French DPA to calculate the imposed fine, the Conseil ruled that the DPA had not imposed a disproportionate penalty on the controller. Consequently, the Conseil rejected the entirety of controller's claims.
Commissioner of the Garda Síochána
In March 2015, the plaintiff was sentenced to life imprisonment for murder. He appealed his conviction before the Court of Appeal in Ireland, criticising in particular that the first-instance court had incorrectly admitted traffic and location data relating to telephone calls as evidence. He based that argument on the ground that his rights guaranteed by EU law were infringed by the 2011 Act governing the retention of such data, on which the police investigation had been based. That appeal is currently pending. The plaintiff brought civil proceedings before the High Court in order to be able to contest the admissibility of that evidence. The High Court held that section 6(1)(a) of that act was indeed incompatible with Article 15(1) of Directive 2002/58 ("privacy and electronic communications directive" - in the following "Directive") when read in light of Articles 7, 8 and 52(1) of the Charter. Ireland appealed against that decision to the referring court, the Supreme Court. The Supreme Court stayed the proceedings and referred six questions to the CJEU: Questions 1, 2 and 4 asked whether "whether Article 15(1) of Directive [...], read in the light of Articles 7, 8, 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation that provides for the general and indiscriminate retention of traffic and location data for the purposes of combating serious crime." By its question 3, the referring court essentially asked whether "Article 15(1) of Directive [...] must be interpreted as precluding national legislation pursuant to which the centralised processing of requests for access to retained data, issued by the police in the context of the investigation or prosecution of serious criminal offences, is the responsibility of a police officer, assisted by a unit established within the police service which enjoys a degree of autonomy in the exercise of its duties and whose decisions may subsequently by [sic!] subject to judicial review." Questions 5 and 6 concerned the issue "whether EU law must be interpreted as meaning that a national court may limit the temporal effects of a declaration of invalidity which it is required to make, under national law, with respect to national legislation imposing on providers of electronic communications services the general and indiscriminate retention of traffic and location data owing to the incompatibility of that legislation with Article 15(1) of Directive [...]." = First, the CJEU confirmed its settled case-law that traffic and location data relating to electronic communications may not generally and indiscriminately be retained for the purposes of combating serious crime. It laid out the purpose of the Directive as a framework to protect such data as well as enshrining the principle of the prohibition of the storage thereof. Retaining such data constitutes both a derogation from that general principle of prohibition and and interference with the fundamental rights of Articles 7 and 8 of the Charter. Member States that want to limit the exercise of those rights for the purpose of combating crime, which is generally allowed by the Directive, must comply with the principle of proportionality. The objective of combating serious crime does not, by itself, justify measures. Instead, a proper balancing exercise must be executed. However, the CJEU named several legislative measures that are not precluded by EU law. First, "the targeted retention of traffic and location data which is limited, according to the categories of persons concerned or using a geographical criterion". Second, "the general and indiscriminate retention of IP addresses assigned to the source of an internet connection". Third, "the general and indiscriminate retention of data relating to the civil identity of users of electronic communications systems". And fourth, the expedited retention of traffic and location data in the possession of those service providers. The central requirement for the legality of such measures is that they provide "clear and precise rules, that the retention of data at issue is subject to compliance with the applicable substantive and procedural conditions and that the persons concerned have effective safeguards against the risks of abuse." = Then, the CJEU held that EU law precludes national legislation "pursuant to which the centralised processing of requests for access to data, which have been retained by providers of electronic communications services, issued by the police in the context of the investigation or prosecution of serious criminal offences, is the responsibility of a police officer, who is assisted by a unit established within the police service which has a degree of autonomy in the exercise of its duties, and whose decisions may subsequently be subject to judicial review." The court clarified that national legislation must, in order to satisfy the propotionality requirements, clearly and precisely govern the scope and application of the measure in question as well as minimum safeguards which sufficiently guarantee the protection of those data. In order to ensure compliance with the strict conditions, national authorities that want to access such data must be subject to prior review carried out by either a court or an independent administrative body. A police officer does not constitute such administrative body since they are not subject to the same guarantees of independence and impartiality. = Finally, the CJEU held that EU law precludes a national court from limiting the temporal effects of a declaration of invalidity that it is required to make under national law "with respect to national legislation imposing on providers of electronic communications services the general and indiscriminate retention of traffic and location data". In this context, the court also clarified that, considering the principle of procedural autonomy of the Member States, the admissibility of evidence obtained by means of such retention is a matter of national law.
CNIL
On 7 December 2020, the French DPA (CNIL) imposed two fines totaling € 100 million on Google LLC and Google Ireland Ltd for violating Article 82 of the French Data Protection Act (which transposes the ePrivacy Directive). Google (1) had not obtained the user’s consent before depositing advertising cookies in the user’s terminal equipment, (2) had lacked to provide information, and (3) had not implemented a mechanism to refuse the cookies. Google did not agree with the CNIL’s decision and brought the issue before court. First, it claimed that, since there is cross-border processing, the Irish DPA (DPC) is the lead supervisory authority since Google’s main establishment in the EU is in Ireland, and the CNIL therefore did not have competence to rule on this matter according to the one-stop-shop mechanism. Second, it found the fine to be disproportionate. Hence, it requested the Council of State to annul the decision, and to refer two preliminary questions to the CJEU, asking: (1) whether the one-stop-shop mechanism provided for in Article 56 GDPR is excluded in the context of cross-border processing that falls within the scope of both the ePrivacy Directive and the GDPR, and (2) whether Article 15a ePrivacy Directive violates the right to data protection because does not provide an obligation, but rather an option, “for the competent national regulatory authorities to adopt measures to ensure effective cross-border cooperation in the enforcement of national laws adopted pursuant to the directive and to create harmonised conditions for the provision of services involving cross-border data flows”. The Council of State rejected Google’s appeal. First, according to the Council, the ePrivacy Directive, implemented in the French Data Protection Act, does not provide for the application of the one-stop-shop mechanism as mentioned in Article 56 GDPR. Although the requirements for consent are regulated by the GDPR the deposit of cookies is regulated by the ePrivacy Directive. Hence, even if cross-border processing takes place, the CNIL is competent to monitor compliance with the objectives of such Directive. The Council then notes that “it follows that, as regards the control of the operations of access and recording of information in the terminals of users in France of an electronic communications service, even if they are the result of cross-border processing, the measures to monitor the application of the provisions transposing the objectives of Directive 2002/58/EC fall within the competence conferred on the CNIL by the Law of 6 January 1978.” The Council stipulated that there is no need to refer preliminary questions to the CJEU, because it had no doubt as to whether the one-stop-shop mechanism should be excluded in the context of cookies. Second, the Council rejected Google’s argument that their right of defense had been infringed by the CNIL because they did not provide a prior formal notice, since it is not required to provide such a formal notice before imposing a sanction. Third, on the substance of the matter, the Council confirmed the three violations of Article 82 of the Data Protection Act: (1) not obtaining the user’s consent before depositing advertising cookies in the user’s terminal equipment, (2) not providing clear information on the deposit of cookies, and (3) not implementing a mechanism to refuse the cookies. Lastly, the Council stated that the fines were not disproportionate in light of the financial capacities of the “two” companies. It considered Google’s market share of more than 90% with (an estimated) 47 million users in France and the large profits that follow from the targeted online advertisement. Moreover, it stated that Google did not genuinely cooperated with the CNIL since it did not provide advertising revenues, and the breaches were serious.
Städtische Werke Lauf a.d. Pegnitz GmbH
eprimo, a German electricity supplier, distributed advertisements consisting of displaying banners in the email inboxes of the T-Online free email service. When users opened their inbox, those advertisements were shown to them at random, indistinguishable from the list of emails in the users' inbox except for the fact that the date was replaced by the word ‘Anzeige’ (advertisement), no sender was mentioned and the text appeared against a grey background. When clicking on what looked like an email at first glance, the users were shown that advertisement. This procedure is known as inbox advertising. Städtische Werke Lauf a.d Pegnitz GmbH (‘StWL’) is a competitor of eprimo and considered eprimo's inbox advertising unlawful under the rules of unfair competition because there was no prior consent by the users. StWL, after at first succeeding with an action before the Regional Court of Nuremberg-Fürth, lost the case in the second instance before the Higher Regional Court of Nuremberg. When it appealed at the BGH, it referred the subject to the CJEU. In particular, it asked whether inbox advertising was compatible with the ePrivacy Directive and the Unfair Commercial Practices Directive which require consent for electronic mail that is sent to users for the purposes of direct marketing, prohibiting unsolicited communications. The CJEU decided that inbox advertisements require prior consent. The BGH agreed with the StWL and overturned the Regional Court's decision, taking into consideration the CJEU's ruling. It held that eprimo had violated competition law and had to compensate StWL. According to the court, pursuant to § 7(2)(3) Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb - UWG), any direct marketing using the email inbox of the user requires prior consent. Such consent had not been obtained by eprimo. It assumed that it is irrelevant whether potential users of the free email service had been made aware of the use of parts of the internet pages by advertising providers. A merely general consent to receive advertisements, which is not related to the specific advertising complained of, in order not to have to pay for the use of the e-mail service, does not fulfil the requirements of consent pursuant to Article 13(1) ePrivacy Directive. For the court, one important factor for the unlawfulness and the impact on the user's privacy was the fact that the inbox advertisements are displayed at a position where one would normally find personal email, thus constituting a significant burden on the user.
RheinMain University of Applied Sciences
Controller is the RhineMain University of Applied Sciences. On its website (https://www.hs-rm.de), it used the consent manager “Cookiebot” to obtain users' consent to the use of cookies, and the "Google Tag Manager". Data subject regularly visits the website to look for specialist literature in their online catalogue, and found that their IP address is automatically transmitted to Google’s server each time they visit the website, without having given consent. In addition to their IP address, all kinds of information on the hardware and software of the user’s terminal device is sent, i.e., the accessed’ website, their operating system and its version, the browser and its version, the screen resolution etc. Moreover, Cookiebot is a service offered by the Danish provider Cybot. Although the company is established in Denmark, the target domain “consent.cookiebot.com” refers to a server with an IP address registered with the US-based cloud company Akamai Technologies Inc. (hereafter: Akamai). Although the server might be located in the EU, the cloud company has access to the data on this server. Therefore, the US Cloud Act applies, which means that US governmental agencies can request access to this data, without a court order or mutual legal assistance agreement. After the data subject had written three warning letters to the controller, the latter responded on 7 June 2021 that it no longer used the Google Tag Manager, but refused to submit the obligation to cease and desist regarding Cookiebot. Hence, on 8 June 2021, the data subject applied for interim relief. The Court upheld the appeal and ordered controller to terminate the integration of Cookiebot for the purpose of obtaining consent on its website, since the transmission of personal data is unlawful. First, it noted that the data subject could invoke the right to effective judicial remedy, pursuant to Article 79 GDPR, and that this provision does not have a blocking effect for further judicial remedies. Second, the Court confirmed that the conditions of the right to injunctive relief have been fulfilled. It considered that the controller processes the unabridged IP-address of data subject, after which the company behind “Cookiebot”, Cybot, also processes this IP-address. Although the controller claimed that this was an anonymised version of the IP-address, it follows from the information provided by Cybot that this is not the case. Moreover, the Court noted, referring to Breyer (Case C-582/14), that an IP address is personal data. Because Cybot uses the processing services of Akamai by storing their data on its servers, a data transfer to a third country, namely the USA, takes place. The Court acknowledged that the data might be stored on the servers of the European affiliate of Akamai, namely A Technologies GmbH. However, according to the Court, this was irrelevant since the company's headquarters are located in Cambridge, Massachusetts, USA. Then, the Court stated that this transfer is inadmissible according to Article 48, and Article 49 GDPR. Because Akamai is an American company, it is subject to the US Cloud Act, and therefore obliged to disclose all data in their possession. There is no international agreement between the EU and USA to serve as a legal basis, so Article 48 GDPR does not apply. Moreover, the Court considered that none of the conditions referred to in Article 49(1) and Article 49(2) GDPR is fulfilled, so this provision does also not apply. Lastly, the Court stipulated that the controller is responsible for the data transfer, pursuant to Article 24, in conjunction with Article 4(7) GDPR, although the controller does not transmit the data itself. The Court concluded that, because the controller embedded Cookiebot on its website, it indirectly decided on the purposes of the processing.
Richard Lloyd
Google secretly tracked Apple iPhone users between late 2011 and early 2012 and using their data collected in that way for commercial purposes. Google bypassed privacy settings on Apple iPhones and the default blocking of third party cookies on Safari with its “DoubleClick Ad” cookie by relying on an exception devised by Apple. Google placed this cookie without the user’s knowledge or consent. This cookie was enabled if users visited a website that included DoubleClick Ad content (advertising content). The cookie identified visits by a specific device on websites using this advertising content, including data and time of visit; time spent by the user on the website; what advertisement was viewed for how long; and using IP address, the user’s geographical location. As a result, Google could infer the user’s internet surfing habits, location, as well as interests, race or ethnicity, social class, political or religious beliefs, health, sexual interests, age, gender and financial situation. Google then used this aggregated information to give them labels (eg “football lovers”) and eventually offering these group labels to advertising organisations looking to target specific groups when using Google’s DoubleClick service. This allegation was brought in the US and Google settled a charge of $22.5 million with the US Federal Trade Commission and $17 million to settle consumer based actions in the US. Three individuals in the UK sued Google in 2013 for the same allegation and their claim was settled by Google (Vidal-Hall v Google Inc). Lloyd has filed a claim before the UK courts on behalf of everyone that resides in England and Wales and owned an Apple iPhone at the time of the secret tracking. Lloyd filed this class action with the intention of recovering damages for more than 4 million people affected. He claimed that compensation (£750 suggested) should be awarded under the Data Protection Act 1998 for loss of control of personal data without having to demonstrate that the claimant suffered financial or mental distress as a result of the infringement. = Section 4(4) of the Data Protection Act 1998 (DPA 1998) imposes a duty on data controllers to comply with data protection principles. These are laid out in Schedule 1 of the DPA 1998. Section 13 of the DPA 1998 gives individuals a right to compensation from the controller if they suffer damage as a result of a contravention of the Act by that controller. Individuals can bring claims which give rise to a common issue of fact or law can apply for a Group Litigation Order to be made under Rule 19.11 of the Civil Procedure Rules. This is an “opt-in” regime where claimants must take steps to join the group. They can also do so under a representative action, reflected in Rule 19.6 of the Civil Procedure Rules (CPR). However, as a detailed legislative framework is missing, the representative action rules within common law have been considered by the Supreme Court. The following principles are relevant: * “same interest” requirement where the representative must have the same interest or common issues as the persons they represent (within Rule 19.6 CPR); * “court’s discretion” as to whether to allow the claim to proceed as a representative action. This is an objective assessment as to whether the case can be dealt with justly and at a proportionate cost (within Rules 1.1 and 1.2 CPR); * “no requirement of consent” or awareness required from the people represented; * “class definition” requirement where the class of people represented must be clearly defined; * “liability for costs” requirement where the persons represented will not have to pay costs of being represented incurred by the representative; * “scope for claiming damages” where claiming damages is limited by the nature of the remedy of damages at common law, or by the fact that damages may require an individual assessment. = The UK Supreme court did not object to a representative claim brought to establish whether Google was in breach of DPA 1998. The Supreme Court also determined that the individuals had similar interests or common issues caused by tracking of their behaviour without consent. According to the Court, there was no uniform effect caused by Google’s actions across the represented class. Instead, the effect and the amount recoverable by each individual would depend on the circumstances particular to the individuals (eg how often they used Safari or website with DoubleClick Ad content). Contrary to Lloyd’s claim, the Court held that DPA 1998 cannot be read to mean that individuals are entitled to compensation for any contravention of the DPA 1998 without needing to prove financial loss or distress. According to the leading judgement, under Section 13 DPA 1998, it is not enough to prove an infringement by a data controller as “damage” (interpreted as only meaning material damages) or “distress” must be suffered as a result. Following an analysis of Vidal-Hall v Google Inc (discussing Section 13 DPA 1998) and Gulati v MGN Ltd (discussing tort for misuse of private information) the court outlined that it would be possible for Lloyd to claim (1) damages under Section 13(1) DPA 1998 for distress suffered due to Google’s infringement of the Act; (2) and /or damages for the misuse of private information without the need to show material damage or distress. However, the court outlined that the case was not made for either (claim for misuse of information tort having not be made). Again, the Court reiterated that to recover damages for distress under Section 13(1) DPA 1998, it would be necessary to provide evidence of this distress for each individual represented – making this incompatible with the nature of representative action. The UK Supreme Court rejected the argument that an infringement of the DPA 1998 should be dealt with in the same way as the tort of misuse of private information and that therefore compensation can be recovered for interference by an organisation without the need to demonstrate material damage or distress. The UK Supreme Court relied on the fact that Section 13(1) DPA 1998 cannot be interpreted using that analogy, as highlighted above. The wording of the DPA 1998 and its interpretation in caselaw cannot be detached from the fact that material damage or distress must be demonstrated: "…the wording of section 13(1) draws a distinction between “damage” suffered by an individual and a “contravention” of a requirement of the Act by a data controller, and provides a right to compensation “for that damage” only if the “damage” occurs “by reason of” the contravention." Section 14 DPA 1998 also supports the interpretation that a damage, and not purely an infringement of the legislation, must be demonstrated. The Court also relied on the interpretation by the Court of Appeal in Vidall-Hall v Google Inc, which distinguished material damage or distress suffered and contravention of a requirement in the DPA 1998. The Court also did not consider that it was possible to rely on an analogy between the tort of misuse of information and Section 13 DPA 1998 simply because they are both founded in the common route of “right to privacy” embodied in Article 8 European Convention on Human Rights. Additionally, the Court held that it would be, in any case, necessary to identify damage or distress suffered by each individual for the purpose of awarding compensation (even if it was not necessary to show individual material damage or distress as a result of the infringement). Factors like extent of Google’s tracking; quantity of data processed; nature of the data processed (sensitive nature?); use of that information and benefit from it by Google would all need to be assessed for individual cases. Without such individualised assessment, Lloyd’s argument that the “lowest common denominator” on which the claim is based (proof that the individual is part of the class by having an iPhone at the time) would not be sufficient to be something more than trivial (as required under Section 13 DPA 1998). Therefore, compensation could not be quantified beyond 0. The UK Supreme Court concluded and decided unanimously that: “In order to recover compensation under the DPA 1998 for any given individual, it would be necessary to show both that Google made some unlawful use of personal data relating to that individual and that the individual suffered some damage as a result.”
DSB (Austria)
The data subject called the helpline of the Österreichsiche Post AG (Austrian Postal PLC). He gave his phone number to the employee with the request for a callback, thereby stating that he did not want the phone number be given to a third party. Afterwards the data subject was called twice by a market research institute – the processor. The controller and the processor had concluded a processing-contract under Article 28 GDPR. The data subject filed a complaint with the DSB (Austria) arguing that the transmission of his data (name and phone number) to the processor was illegitimate since he had already denied consent to any form of data sharing with a third party. During these proceedings the data subject amended their submission by also tackling the use of cookies by the controller. The DSB dismissed the complaint. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision of the DSB. The court determined that the processor is to be seen as a dependent extension of the controller (“verlängerter Arm”) (cmp. Article 29 GDPR). If the processing of data is in accordance with Article 6 GDPR, the controller is free to deploy a processor. As a result, the transmission of data from the controller to the processor itself does not need to be justified under Article 6 GDPR. In the case at hand, the court came to the conclusion that the processing of data by the controller - and therefore also the transmission to the processor - is justified under Article 6(1)(c) GDPR. The controller in this case - the Österreichsiche Post AG - is obliged under national law (§§ 6(8), 32(3) PMG) to provide for a complaint management system to improve their services. According to § 6(8) PMG a postal service must further develop its service in accordance with the needs of users and to contribute to securing the provision of postal services and to the further development of them by means of appropriate measures and proposals. Pursuant to § 32(3) PMG postal service providers must have a complaints management system in place so that users can raise disputes or complaints. Besides, the court decided the amendment of the data subject’s complaint was inadmissible pursuant to § 13(8) AVG and a data subject has no subjective right to the initiation of administrative fine proceedings under the GDPR and according to § 25(1) VStG.
Court case HFD:2021:125
The Regional Government of Åland had appointed Mr A as head of the regional Ålandic DPA for a probationary period of one year. Pursuant to section 10(2) of the Act on Public Officials in the Region of Åland, the Government of Åland stated that they would not propose the appointment of A to a permanent post and that A's term of office would therefore automatically come to and end after the one-year probationary period. At the end of the probationary period, the Government of Åland issued a notice confirming that Mr A's term of office had ended. Mr A however applied to the Supreme Administrative Court of Finland for the annulment of this decision, which he considered contrary to the GDPR. The Supreme Administrative Court considered that the notice issued by the Government of Åland constituted an administrative decision terminating Mr A's mandate. The Supreme Administrative Court found that, in addition to national legislation, A's role as head of the data protection authority is also regulated by EU law, and in particular by the GDPR. Although the GDPR does not contain explicit provisions regarding probationary period, the minimum length of the term of any member of any data protection authority is "no less than four years", as set in Article 54(1)(d) GDPR. As a consequence, the termination of A's mandate at the end of the probationary period could not be considered in line with the GDPR. The Supreme Administrative Court further noted that leaving Mr A without any possibility of appeal against that decision would be contrary to the right to a fair trial as protected under the Finnish Constitution, Article 19 TFEU and Article 47 CFR. As Mr A's mandate and termination had not been assessed in the light of the provisions of the GDPR, the Supreme Administrative Court concluded that the decision to terminate Mr A's mandate had to be annulled and the matter referred back to the Government of Åland for reconsideration.
Court case 2 C 133/21
The case focused on unauthorized marketing emails and lack of consent, unrelated to cookie or consent banner issues.
Facebook Ireland
In the proceedings, the plaintiff filed a total of 12 applications. The court ruled on 6 of these applications by partial judgment of 23 June 2021. The proceedings were interrupted with regard to the remaining 5 applications until the CJEU has ruled on the preliminary ruling proceedings initiated by order of 23 June 2021. An overall short summary can be found [https://noyb.eu/en/breaking-austrian-ogh-asks-cjeu-if-facebook-undermines-gdpr-2018 here]. This partial judgment only concerns applications 1 - 4 as well as 11 and 12, so that only the relevant facts are reproduced in abbreviated form below. The facts relevant for the remaining interrupted proceedings, for which the preliminary ruling procedure has been initiated at the CJEU, are presented there. The plaintiff is Max Schrems. The defendant is Facebook Ireland. The court first explains how Facebook works. These findings are only presented in a roughly abbreviated form in the following: Facebook provides a platform on which more than 2.2 billion users worldwide can upload data and respond to data uploaded by other users. This includes text contributions, pictures, videos, events, comments, "likes", markings on photos and much more. In addition, users network with each other in so-called "friendships". Facebook itself does not generate any content itself and only provides the infrastructure (free of charge). Facebook receives the (linked) personal data. The economic model of the defendant is to generate revenue through personalised advertising and commercial content based on preferences and interests of users. The plaintiff has been using his Facebook account for private purposes since 8 June 2008. In doing so, he decides himself with whom he is in contact, whether and to whom he sends messages, what information he enters in his profile, etc. The plaintiff's Facebook friends also regularly save posts by the plaintiff or about the plaintiff. The first four applications dealt with the "division of roles under data protection law" between Facebook and the plaintiff. Among other things, the plaintiff took the position that he was both the data subject and the data controller for the information he provided, while Facebook was only a processor in this respect. With application 11), the plaintiff asserted a right of access. In application 12), the plaintiff sought non-material damages for breach of the duty to provide access in the amount of €500. The plaintiff still has no conclusive overview of the actual extent of his data used. In addition, he was unsolicited invited to events for homosexuals on Facebook. The court of first instance granted the applications for 11) and 12). The remaining applications were rejected. It first found that the plaintiff had actively or passively accepted all terms of use before and after the introduction of the GDPR - whereby his account had been blocked in the meantime for lack of consent - as well as any updates. It also stated that there was no realistic possibility for the plaintiff to circumvent Facebook's services (400 Facebook friends, some of whom only use Facebook and some of whom only provide certain information there). Facebook has set up tools to give users insight into and control over their stored data. Not all processed data can be seen in these tools, but only those that Facebook considers interesting and relevant for the users. A first tool was introduced in 2010. With the entry into force of the GDPR, a new tool was introduced. Subsequently, the court describes all access tools: "AYI tool - Access Your Information Tool", "DYI tool - Download Your Information Tool" and others. The "Your Off-Facebook Activity" tool, for example, lists partners to whom data about users has been transmitted by Facebook, but not what the data is. Finally, various data setting options are explained. Furthermore, the court states that Facebook uses cookies, social plugins and pixels. Roughly summarised, these tools enable Facebook to collect information about internet users who use external sites, even if they are not Facebook users themselves - and do not use the social plugins, for example. The plaintiff filed a request for information against Facebook in 2011, 2012, 2013, 2015 and 2019. He initially received a PDF file of 18 pages after extensive email correspondence. After further interventions, the parent company of Facebook Ireland sent a CD-ROM with a further PDF file of 1,222 A4 pages in July 2011. In its tools, Facebook only makes available the data that it considers relevant and interesting for the user. In the download tool, one sees much less data than via the developer interface API. The court explains in detail how the information provided by Facebook does not cover all necessary information. For example, Facebook did not provide the plaintiff with individual information on the purpose, source and concrete use of his data. The plaintiff is "massively annoyed" by the defendant's data processing, but not psychologically impaired. There is data stored and processed about him by the defendant over which he has no control because it is not displayed in the tools. The court of appeal confirmed the principle of the judgement of the court of first instance. The court rejected the applications 1 to 4 and confirmed the judgements regarding applications 11 and 12. = The OGH first states that the household exception under Article 2(2)(c) GDPR applies to non-public Facebook pages. Therefore, the first four requests of the plaintiff were rejected, which in particular dealt with the relationship between the plaintiff and the defendant under data protection law (controller, processor). In principle, the application presupposes the exercise of a "private" or "family" (note difference to other GDPR versions where it says “household”) activity. Recital 18 GDPR explicitly mentions the use of social networks and online activities in the context of such activities. The provision aims to avoid unnecessary burdens for individuals. The state's regulatory power should end where data is processed in a private context and thus in the exercise of the general right of personality. The wording "exclusively" shows that mixed use, i.e. private and professional, is covered by the GDPR. Preceding this, the court states that the use of social networks only falls under the household exception if it is restricted to a certain group of users. This does not apply as soon as data is made publicly accessible online. The online posting of a private family tree is mentioned as an example (decision of the OGH 6 Ob 131/18k). In this respect, the household exception does not apply to public Facebook pages. This interpretation also corresponds to the CJEU case law on the household exception under the old Directive 95/46/EC. The legislative history of the GDPR also supports this interpretation. The European Parliament wanted to clarify that the household exception only applies if the circle of recipients is likely to be limited. Even if this ultimately did not become part of the text of the regulation, the intention of the legislator is nevertheless clear. = In an obiter dictum, the Supreme Court further commented on the "distribution of roles under data protection law" between the parties. The Supreme Court ruled that the plaintiff was the data subject and Facebook the controller. A deviating opinion of the plaintiff was rejected. The plaintiff argued that, with respect to his own data uploaded to Facebook, he was both the controller and the data subject. When he processed third party data (e.g. by posting a photo in which a third party could be seen), he was only a controller. In both cases, Facebook was only a processor. The court first addresses a literature opinion according to which such a constellation is possible in principle, at least according to the wording of the legal definition of controller. The data controller could entrust data to a third party for processing. This third party could possibly be obliged to comply with the GDPR provisions as a processor, while the controller could invoke the exemption of Article 2(2)(c) GDPR. The court then refers to the CJEU decisions on publicly accessible Facebook fan pages to determine the concept of a person responsible. In C-210/16, the CJEU had classified the operators of such fan pages as controllers. This was primarily justified by the fact that the operator of a fan page allows Facebook to place cookies on the devices of persons visiting the fan page, regardless of whether that person has a Facebook account. With similar reasoning, the CJEU ruled that the operator of a website who integrates a so-called Facebook Like button into his website is a controller. After all, the integration of the button allows Facebook to obtain data of website visitors, regardless of whether the button is pressed or the visitor has a Facebook account. The OGH concludes from this that the mere use of a social network such as Facebook does not in itself make the user a controller. This is ultimately justified by the fact that the general user of Facebook does not enable Facebook to obtain not inconsiderable amounts of user data. The court also argues that otherwise every user of Facebook would be the controller and this would not be compatible with the intention of the GDPR. = In order to delimit the obligation to provide access, the court first refers to Recital 63 GDPR, which reads as follows: “A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing.” According to the case law of the CJEU, it is sufficient if the applicant receives a complete overview of these data in an understandable form, i.e. in a form that enables them to become aware of these data and to check whether they are correct and processed in accordance with the GDPR, so that they can exercise their rights if necessary. This decision was issued under the old Directive 95/46/EC, but is fully transferable to the GDPR. Facebook had initially provided the plaintiff with a PDF file and a CD with further PDF files amounting to 1,222 pages in 2011 and later referred to the information tools that had been introduced in the meantime. Initially, Facebook had only provided information on the data that it itself considered "relevant". This is obviously not sufficient. The court explicitly states that it does not require further elaboration that the duty to provide information cannot depend on Facebook's mere self-assessment. The information on the online tools also does not meet the requirements of Article 15 GDPR. There, at least 60 data categories with hundreds, if not thousands of data points are available for the plaintiff to download, which would require several hours of work to search through. Thus, the plaintiff cannot obtain complete information. The plaintiff correctly pointed out that the GDPR assumes a one-time request for access, not an "Easter egg search". Another violation is that not all purposes of processing have been disclosed. Facebook's claim that sharing information could infringe the rights of third parties is not valid for two reasons. First, Facebook has not shown what specific rights would be involved. Secondly, it would be up to Facebook to reach agreements with clients who are advertisers so that Facebook can fully comply with its disclosure obligations. Facebook's objection that the scope of the requested information was too large was also rejected. On the one hand, the corresponding case is hardly conceivable with current data. Secondly, it is by no means to be classified as "excessive" if five requests for information are made within nine years. With regard to the question of the extent to which recipients or categories of recipients are to be disclosed, the Supreme Court interrupted the proceedings and referred to a similar preliminary ruling case pending before the CJEU in another case. It had to be decided whether the person responsible had the right to choose whether to present recipients or categories of recipients or whether the data subject could decide on the type of information (6 Ob 159/20f). In this case, Facebook only provided information on categories of recipients. Finally, the court states that the right to information does not extend to data processing in the future. = Finally, the court awarded the plaintiff a claim for compensation for non-material damage due to the breach of the access right under Article 82(1) GDPR in the amount of €500. The court first states that in another case before the Supreme Court, a plaintiff relied exclusively on the "loss of control over personal data" or "processing of political opinions" as such. This was too definite for the Court; it referred the question to the CJEU whether a violation of the provisions of the GDPR as such can give rise to a claim for damages (6 Ob 35/21x). However, this was different in the present case, as the court of first instance had expressly found that the plaintiff was "massively annoyed" by the Facebook's data processing, but not psychologically impaired. The court then states that emotional impairments resulting from the violation of rights, such as fears, stress or states of suffering due to exposure, discrimination or the like, which have occurred or are only threatened, can lead to a claim for damages as immaterial damages. A particularly serious impairment of the emotional world is not required. This is justified solely on the basis of Recital 146 sentence 3 GDPR, according to which the concept of damage is to be interpreted broadly. The Package Travel Directive and the related case law concerning compensation for "loss of holiday enjoyment" do not provide any guidance, according to the court. There, restrictive terms such as "substantial effects" and " substantial problems" are used. The GDPR does not know these restrictions. Rather, non-material disadvantages of rather minor weight were also relevant. Next, the court establishes standards for determining entitlement. On the one hand, according to Recital 146 GDPR ("full and effective compensation"), the damages should not be too limited. Otherwise, the practical effectiveness of Union law would not be ensured. The damages must be appreciable in order to have a preventive and deterrent effect. On the other hand, the effectiveness criterion is only of limited significance, since the GDPR provides for high penalties anyway, so that high damages cannot easily be claimed. Otherwise, there would be a danger of an "effectiveness spiral". The court then states that "massively annoyed" without being psychologically impaired is sufficient for the assumption of non-material damage. Causality already followed from the fact that the plaintiff argued that it bothered him not to have control over the data because they were not displayed in the tools. The use of the word "because" established the necessary connection. For the amount of damage, the court took into account that the plaintiff had no control over his data for a long time
Google LLC
On December, 7 2020, the French DPA imposed a financial penalty of 60 Million euros fine against Google LLC and a 40 million euros against Google Ireland Limited in accordance with the General Data Protection Regulation (GDPR) and ePrivacy Directive 2002/58/EC, for lack of transparency, inadequate information and lack of valid consent regarding for violating the regulation on cookies while operating the website [https://google.fr google.fr]. The sanction was accompanied by an order to comply with [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 article 82 of the French Law on data protection] (Law Informatique et Libertés), under three months on penalty of a €100,000 fine per day of delay. The companies appealed to the Conseil d’État in interim procedure against the CNIL's decision, arguing that the French DPA was not the competent authority because it was not the lead supervisory authority for Google LLC or Google Ireland Limited. Is the CNIL territorially competent to investigate and sanction a company for violating the information principle when depositing cookies if it is not the lead supervisory authority of the company? The CNIL considered that Google does have EU headquarters in Ireland, but that this Irish entity ‘did not have a decision making power’ in relation to the relevant cross-border data processing activities to which the complaints related. For that reason the CNIL decided that the One Stop Shop mechanism did not apply and that the CNIL, like any other European supervisory authority, was therefore competent to make a decision. The Conseil d’État rejected the request made by Google and ruled that the French DPA was territorially competent on this matter even though it is not the lead supervisory authority. The court stated that Article 82 of the Law Informatique et Libertés was a transposition of Article 5(3) ePrivacy Directive 2002/58/EC into French Law when dealing with cookies and that the CNIL is charged with enforcing this Directive. As such, the one-stop shop mechanism provided for in Article 56 GDPR does not apply in the present case.
Proximus N.V.
In this case Proximus had failed to grant a woman's right of erasure of her personal data and had passed the data on to other telephone directories and directory enquiry services even after receiving several complaints and correspondence from the data subject. On request of the data subject, Proximus had changed the code linked to the data subject's data from 'visible' to 'confidential'. After adjusting the code regarding publication, Proximus received new contact details of the person concerned from her operator, as a result of which the data in the underlying database was automatically overwritten with the new data from the operator. The Belgian DPA imposed a fine of €20,000 on the defendant defendant for infringement of Articles 6, 7 and 12 of the GDPR. In the contested decision, the Belgian DPA found the infringement of Article 6, 7, 12, 13 and 24 GDPR sufficiently proven. In addition, the DPA ordered the defendant to cease any further disclosure of personal data of subscribers to third parties of telephone directory or inquiry services when Proximus acquired these data only as a provider of telephone directories and directory enquiry services, taking into account a transition period in order to give Proximus (and the telecommunications sector in a broader context) the opportunity to develop a new privacy compliant system. With regard to the question of whether consent is required to be included in telephone directories or not and what scope of this consent is, the Court of Appeal also considered that: 1° In situations where the e-Privacy Directive specifies the rules laid down in the GDPR, these specific provisions of the e-Privacy Directive as lex specialis prevail over the more general provisions of the GDPR. (principle of Lex specialis derogate legi generali) 2° Article 12(1) and recital 38 of the ePrivacy Directive refer to the requirement of informed consent within the meaning of Directive 95/46/EG of subscribers for being included in public directories. Following article 94 GDPR that states that all references to 95/46/EG should be considered as references to GDPR, the abovementioned articles thus refer to ‘consent’ in the light of GDPR and thus the condition for a valid consent (Article 7 GDPR) must be met. 3° This consent relates to the purpose of publication of the personal data in the directories, but not to the identity of the directory provider. Consequently, the court states that the consent given will also be valid for subsequent processing of the personal data by other directory providers, provided that this processing serves the same purpose Given the fact that this is a complex matter which raises some questions that are not yet tackled by the legislator, the Brussels Court of Appeal stayed the proceedings to request the Court of Justice for a preliminary ruling regarding following questions: 1° Should Article 72.2 of the e-Privacy Directive 2002/58/EC, read in conjunction with Article 2(f) of that directive and with Article 95 of the General Data Protection Regulation to be interpreted as allowing a national supervisory to be interpreted as permitting a national supervisory authority to require the 'consent' of a subscriber within the meaning of the General Data Protection Regulation as the basis for the publication of the subscriber's personal data in public directories and directory enquiry services, both those published by the operator itself and by thirdproviders, providers, in the absence of national legislation to the contrary? 2° Should the right of erasure contained in Article 17 of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from considering a request by an individual for removalfrom public directories and directory enquiry services as a request for erasure within the meaning of Article 17 of the General Data Protection Regulation? 3° Must Article 24 and Article 5(2) of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from concluding from the accountability obligation contained therein that the controller must take appropriate technical and organisational measures to inform third-party controllers, namely the telephone service provider and, inter alia, providers of telephone directories and directory enquiry services who have received data from that controller, of any withdrawal of consent by the data subject in accordance with Article 6 juncto Article 7 of the Regulation? 4° Must Article 17.2 of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from ordering a provider of public directories and directory enquiry services who is requested to cease disclosing data relating to an individual to take reasonable steps to inform search engines of that request for deletion of data?
Facebook Inc.
On the 29th of November 2018, following a complaint filed by three consumer associations, the Italian Competition Authority (Autorità Garante della Concorrenza e del Mercato – AGCM) adopted a decision against Facebook Inc. and Facebook Ireland. The Authority found that Facebook engaged in an unfair commercial practice towards its users by failing to inform them adequately and immediately about the commercial nature of the processing of their personal data, while emphasizing that registering to the platform was free of charge. For this reason, Facebook Inc. received a fine of € 5,000,000. The AGCM also found that Facebook engaged in an aggressive commercial practice towards its users by unduly influencing its users’ preference concerning the processing of data for commercial purposes. This was done by pre-selecting the option to consent to sharing data with third parties, while presenting them with the prospect of significant limitations in case they de-select such options. For this reason, Facebook Ireland received a fine of € 5,000,000. On the 18th of December 2019, the Regional Administrative Tribunal (Tribunale Amministrativo Regionale – TAR) of Lazio partially upheld two separate appeals brought by Facebook Inc. and Facebook Ireland. On the one hand, the TAR agreed with AGCM findings that Facebook misled its users into registering to the Facebook platform “for free”, without providing adequate and timely information about the commercial use of their personal data. On the other hand, the Tribunal found that the pre-selected options provided to Facebook’s users during their registration does not actually gather their consent to the transfer of data to third parties. This actually occurs at a later stage and on a granular level. Moreover, the TAR found that the AGCM failed in properly demonstrating the aggressive nature of such practice, and how it influenced the choices of the users. Both Facebook and the AGCM appealed against the TAR decision. Among others, Facebook presented the following arguments: * That the AGCM had no authority to impose a fine against the company. According to Facebook since there was no monetary price to be paid to subscribe to its services, hence there was no commercial activity at all, and consumer law could not be applied. Moreover, Facebook held that personal data cannot be considered a commodity that the user trades in exchange for the social networking services. To support this statement, the platform referred to Recital 24 of Directive 2019/770 on certain aspects concerning contracts for the supply of digital content and digital services, which “fully [recognises] that the protection of personal data is a fundamental right and that therefore personal data cannot be considered as a commodity (…)”; and the EPDS opinion on the proposal for the same Directive (Opinion n. 4, 2017). * That there was an absolute lack of jurisdiction ratione materiae with regard to the AGCM. According to the platform, which referred to Articles 3 and 4 of Directive 2005/29 (the “Unfair Commercial Practices Directive”), only the GDPR could be applied to the practices addressed by the decision according to the principles of speciality and harmonisation of EU law. Moreover, the informative practices were indeed relevant to information obligations related to profiling and that are specifically regulated by the GDPR. * That there was a violation of Article 288(2) TFUE, since applying the national consumer law would impair the application of the GDPR and partially amend it. * That there was a violation of the principle of speciality concerning fines: if indeed there was an illicit conduct concerning the use of users’ personal data, that conduct is liable to be sanctioned according to GDPR rules, and not according to the more general rules of consumer law. * That there was a violation of Article 56 GDPR, according to which the Irish DPA is the only authority who can supervise Facebook’s processing activities in the EU. * The absence of any unfair commercial practice. Facebook contested that the term “free” is true to the fact that no monetary price is requested, and that the average user is well aware that the income from targeted advertising is at the core of the business model of any online free services. Moreover, Facebook argued that it used a layered approach in providing information to its users, in line with Article 12(7) GDPR and the Article 29 Working Party Guidelines on Automated individual decision-making and profiling (paragraph 35). The appeal brought by the AGCM focused on the part of the TAR’s decision concerning Facebook’s alleged aggressive commercial practice. According to the Authority, its initial findings were accurate, and the aggressive nature of those practices is evident from the continuous use of pre-selected options by Facebook, in several stages of users’ registration process. The text of the appeal referred to by the Council of State reads: “the mechanism of multiple pre-activations undoubtedly deprives the consumer of the possibility of choosing, by means of the positive action also required at European level, whether and what to transfer to third parties, placing – contrary to the approach of the rules set out in the Consumer Code – this prerogative of the user in the hands of Facebook (i.e. the professional)”. Concerning the overlap between consumer and data protection law, the Council of State held that because of Article 4(2) GDPR, data protection laws provides for a very broad scope of application, which might very well extend to any human activity. However, it is not possible to conclude, given the content of the GDPR and the case law from the Court of Justice of the EU, that “that the scope of application of the special and exclusive discipline (also in the sense that it excludes the application of other disciplines) can be «absolute».” This would be “unreasonable”, according to the Council, as any human activity, as well as any field of law, involves the processing of personal data. Hence, an “absolute speciality” of data protection law would mean the inapplicability of any other legislation. On the contrary, when the processing of personal data is involved, the legal system is meant to avoid “any expropriation of the application of other sectoral disciplines, such as, in the case in point, consumer protection, to reduce the protections guaranteed to natural persons.” According to the Council of State there is also no overlap between the two systems of penalties. While GDPR penalties apply to the violation of data protection rules, which are not relevant in the present case, consumer law is concerned with “the conditioning of the awareness of the user who, in order to obtain benefits described as free of charge, must give up personal data which will not be used exclusively to obtain the services which he is seeking, but will constitute a tool for profiling the user for commercial purposes, in the absence of adequate prior information for the consumer.” And indeed, the information provided in Facebook’s privacy and cookie policy are, according to the Council, “general and unspecific” and the stress is on the free nature of the services, rather than the actual use of personal data. On the other hand, the user is presented with “intimidating” information about the consequences of opting out to the use of personal data for commercial purposes. Hence, the “user remains convinced that the achievement of the advantages associated with access to the platform is free, not being able […] to recognise and realise that in return for the advantage there is automatic profiling for commercial use, not clearly and immediately indicated at the time of first access, as an inevitable consequence of the provision of the data.” The Council hence agreed with the AGCM and the TAR in sanctioning Facebook’s informative practices as unfair commercial practice, among others for the following reasons: * Facebook did not give to its users information that is critical for the informed decision of the consumer concerning a commercial act such as registering to Facebook; * The information given was neither clear nor immediate; * The information was “general and incomplete”, and did not distinguish between the use of data for the purpose of customizing the service and for the purpose of providing with targeted advertising; * In the same way, the commercial and “cultural” purposes related to the use of the services were not clearly distinguishable for users; * Before the claim “Facebook helps you to connect and stay in touch with the people in your life”, there was a “lack of an adequate alert informing users, immediately and effectively, about the centrality of the commercial value of their data with respect to the social networking service offered”. Concerning the alleged aggressive commercial practice, the Council of State upheld the first instance decision and stated that, according to the information and statements gathered from Facebook, there is no reason to consider that the opt-out mechanism “would prevent the user from understanding how and for what purpose the data collected as a result of cross-platform integration is used, both by third parties and by Facebook.” Indeed, the “pre-selection” of certain options does not involve any direct and immediate data sharing with third parties, and “it is followed by a further series of necessary steps, in which the user is asked to decide whether and which of his or her data he or she wishes to share in order to enable integration between the platforms.” Moreover, the commercial practice does not constitute, according to the Council, a “concrete manipulation”, a coercion of the behaviour, and hence freedom of choice, of the user, so that it cannot be considered aggressive according to consumer law. Eventually, the Council of State rejected both appeals on the grounds that the arguments presented were not well-founded, and hence upheld the first instance decision adopted by the TAR of Lazio.
Facebook Ireland
On the 29th of November 2018, following a complaint filed by three consumer associations, the Italian Competition Authority (Autorità Garante della Concorrenza e del Mercato – AGCM) adopted a decision against Facebook Inc. and Facebook Ireland. The Authority found that Facebook engaged in an unfair commercial practice towards its users by failing to inform them adequately and immediately about the commercial nature of the processing of their personal data, while emphasizing that registering to the platform was free of charge. For this reason, Facebook Inc. received a fine of € 5,000,000. The AGCM also found that Facebook engaged in an aggressive commercial practice towards its users by unduly influencing its users’ preference concerning the processing of data for commercial purposes. This was done by pre-selecting the option to consent to sharing data with third parties, while presenting them with the prospect of significant limitations in case they de-select such options. For this reason, Facebook Ireland received a fine of € 5,000,000. On the 18th of December 2019, the Regional Administrative Tribunal (Tribunale Amministrativo Regionale – TAR) of Lazio partially upheld two separate appeals brought by Facebook Inc. and Facebook Ireland. On the one hand, the TAR agreed with AGCM findings that Facebook misled its users into registering to the Facebook platform “for free”, without providing adequate and timely information about the commercial use of their personal data. On the other hand, the Tribunal found that the pre-selected options provided to Facebook’s users during their registration does not actually gather their consent to the transfer of data to third parties. This actually occurs at a later stage and on a granular level. Moreover, the TAR found that the AGCM failed in properly demonstrating the aggressive nature of such practice, and how it influenced the choices of the users. Both Facebook and the AGCM appealed against the TAR decision. Among others, Facebook presented the following arguments: * That the AGCM had no authority to impose a fine against the company. According to Facebook since there was no monetary price to be paid to subscribe to its services, hence there was no commercial activity at all, and consumer law could not be applied. Moreover, Facebook held that personal data cannot be considered a commodity that the user trades in exchange for the social networking services. To support this statement, the platform referred to Recital 24 of Directive 2019/770 on certain aspects concerning contracts for the supply of digital content and digital services, which “fully [recognises] that the protection of personal data is a fundamental right and that therefore personal data cannot be considered as a commodity (…)”; and the EPDS opinion on the proposal for the same Directive (Opinion n. 4, 2017). * That there was an absolute lack of jurisdiction ratione materiae with regard to the AGCM. According to the platform, which referred to Articles 3 and 4 of Directive 2005/29 (the “Unfair Commercial Practices Directive”), only the GDPR could be applied to the practices addressed by the decision according to the principles of speciality and harmonisation of EU law. Moreover, the informative practices were indeed relevant to information obligations related to profiling and that are specifically regulated by the GDPR. * That there was a violation of Article 288(2) TFUE, since applying the national consumer law would impair the application of the GDPR and partially amend it. * That there was a violation of the principle of speciality concerning fines: if indeed there was an illicit conduct concerning the use of users’ personal data, that conduct is liable to be sanctioned according to GDPR rules, and not according to the more general rules of consumer law. * That there was a violation of Article 56 GDPR, according to which the Irish DPA is the only authority who can supervise Facebook’s processing activities in the EU. * The absence of any unfair commercial practice. Facebook contested that the term “free” is true to the fact that no monetary price is requested, and that the average user is well aware that the income from targeted advertising is at the core of the business model of any online free services. Moreover, Facebook argued that it used a layered approach in providing information to its users, in line with Article 12(7) GDPR and the Article 29 Working Party Guidelines on Automated individual decision-making and profiling (paragraph 35). The appeal brought by the AGCM focused on the part of the TAR’s decision concerning Facebook’s alleged aggressive commercial practice. According to the Authority, its initial findings were accurate, and the aggressive nature of those practices is evident from the continuous use of pre-selected options by Facebook, in several stages of users’ registration process. The text of the appeal referred to by the Council of State reads: “the mechanism of multiple pre-activations undoubtedly deprives the consumer of the possibility of choosing, by means of the positive action also required at European level, whether and what to transfer to third parties, placing – contrary to the approach of the rules set out in the Consumer Code – this prerogative of the user in the hands of Facebook (i.e. the professional)”. Concerning the overlap between consumer and data protection law, the Council of State held that because of Article 4(2) GDPR, data protection laws provides for a very broad scope of application, which might very well extend to any human activity. However, it is not possible to conclude, given the content of the GDPR and the case law from the Court of Justice of the EU, that “that the scope of application of the special and exclusive discipline (also in the sense that it excludes the application of other disciplines) can be «absolute».” This would be “unreasonable”, according to the Council, as any human activity, as well as any field of law, involves the processing of personal data. Hence, an “absolute speciality” of data protection law would mean the inapplicability of any other legislation. On the contrary, when the processing of personal data is involved, the legal system is meant to avoid “any expropriation of the application of other sectoral disciplines, such as, in the case in point, consumer protection, to reduce the protections guaranteed to natural persons.” According to the Council of State there is also no overlap between the two systems of penalties. While GDPR penalties apply to the violation of data protection rules, which are not relevant in the present case, consumer law is concerned with “the conditioning of the awareness of the user who, in order to obtain benefits described as free of charge, must give up personal data which will not be used exclusively to obtain the services which he is seeking, but will constitute a tool for profiling the user for commercial purposes, in the absence of adequate prior information for the consumer.” And indeed, the information provided in Facebook’s privacy and cookie policy are, according to the Council, “general and unspecific” and the stress is on the free nature of the services, rather than the actual use of personal data. On the other hand, the user is presented with “intimidating” information about the consequences of opting out to the use of personal data for commercial purposes. Hence, the “user remains convinced that the achievement of the advantages associated with access to the platform is free, not being able […] to recognise and realise that in return for the advantage there is automatic profiling for commercial use, not clearly and immediately indicated at the time of first access, as an inevitable consequence of the provision of the data.” The Council hence agreed with the AGCM and the TAR in sanctioning Facebook’s informative practices as unfair commercial practice, among others for the following reasons: * Facebook did not give to its users information that is critical for the informed decision of the consumer concerning a commercial act such as registering to Facebook; * The information given was neither clear nor immediate; * The information was “general and incomplete”, and did not distinguish between the use of data for the purpose of customizing the service and for the purpose of providing with targeted advertising; * In the same way, the commercial and “cultural” purposes related to the use of the services were not clearly distinguishable for users; * Before the claim “Facebook helps you to connect and stay in touch with the people in your life”, there was a “lack of an adequate alert informing users, immediately and effectively, about the centrality of the commercial value of their data with respect to the social networking service offered”. Concerning the alleged aggressive commercial practice, the Council of State upheld the first instance decision and stated that, according to the information and statements gathered from Facebook, there is no reason to consider that the opt-out mechanism “would prevent the user from understanding how and for what purpose the data collected as a result of cross-platform integration is used, both by third parties and by Facebook.” Indeed, the “pre-selection” of certain options does not involve any direct and immediate data sharing with third parties, and “it is followed by a further series of necessary steps, in which the user is asked to decide whether and which of his or her data he or she wishes to share in order to enable integration between the platforms.” Moreover, the commercial practice does not constitute, according to the Council, a “concrete manipulation”, a coercion of the behaviour, and hence freedom of choice, of the user, so that it cannot be considered aggressive according to consumer law. Eventually, the Council of State rejected both appeals on the grounds that the arguments presented were not well-founded, and hence upheld the first instance decision adopted by the TAR of Lazio.
The claimant Walter Tzvi Soriano and the defendants, including Forensic News LLC
The High Court of England and Wales examined a claim against the news website Forensic News LLC and several journalists contributing to its articles. Both the news website and the journalists are based in the US. The claim concerned different news articles containing allegations on the claimant’s connection with an Israeli intelligence company, which the claimant asserted represented a breach of the GDPR and several other laws. As preliminary point of law, the court considered the question whether GDPR is applicable to the situation at hand. Concretely, the court examined whether the matter could fall under any of the three criteria for the extraterritorial application of the GDPR, as prescribed by Articles 3(1), 3(2) and 79(2) of the GDPR. The criteria considered were – whether Forensic News LLC had an establishment in the EU, whether it offered goods and services to individuals in the EU, and whether it monitored the behavior of individuals in the EU. On the first point, the court found that Forensic News LLC did not have any stable arrangements in the UK, and the “establishment” criteria was therefore not met. For this conclusion, it was decisive that the news website had no employees or representatives in the UK. On the other hand, the fact that Forensic News LLC had a readership in the UK and a “handful” of UK subscriptions was not sufficient to prove establishment. On the second point, the court’s position was that Forensic News LLC did not directly target UK consumers with its goods and services. The fact that the UK is a shipping destination for the website’s merchandise was disregarded due to lack of actual purchases – the court found that, in the UK, only one baseball cap was purchased from the website. Finally, on the third point, the court considered that the monitoring undertaken by Forensic News LLC was not sufficient to justify extraterritorial application of the GDPR. Namely, the news website used cookies for the purpose of behavioral profiling or monitoring in the context of targeted advertising. The court found that this is not the “monitoring” that GDPR had in mind. An argument used by the court was that the website did not use such monitoring to propagate the news but rather for an activity unrelated to the claimant’s claim (advertising). As none of the three criteria was met, the court established that the GDPR did not apply to Forensic News LLC.
SERGIC SAS
The case focused on security issues and data retention violations, with no mention of cookies or consent banners.
La Quadrature du Net
In France, multiple NGOs lodged actions for annulment of national regulation which required electronic communication providers and operators to massively and automatically store and process data in order to detect terrorist threats. They considered that these regulations were not compliant with (among others) Directive 2022/58. The Conseil d’Etat stayed the proceedings and referred three questions to the CJEU for a preliminary ruling: (1) Is the general and indiscriminate retention obligation imposed on providers on the basis of the implementing provisions of Article 15(1) of [Directive 2002/58] to be regarded, against a background of serious and persistent threats to national security, and in particular the terrorist threat, as interference justified by the right to security guaranteed in Article 6 of the [Charter] and the requirements of national security, responsibility for which falls to the Member States alone pursuant to Article 4 [TEU]? (2) Is [Directive 2002/58], read in the light of the [Charter], to be interpreted as authorising legislative measures, such as the measures for the real-time collection of the traffic and location data of specified individuals, which, whilst affecting the rights and obligations of the providers of an electronic communications service, do not however require them to comply with a specific obligation to retain their data? (3) Is [Directive 2002/58], read in the light of the [Charter], to be interpreted as meaning that it is a prerequisite for the lawfulness of the procedures for the collection of connection data that the data subjects are informed whenever their being so informed is no longer liable to jeopardise the investigations being undertaken by the competent authorities, or may such procedures be regarded as lawful taking into account all the other existing procedural safeguards where those safeguards ensure that the right to a remedy is effective?’ The Court joined the multiple cases. In short, it held that according to its caselaw, UE regulation precludes national legislative measures providing for the general and indiscriminate retention of traffic and location data. However, a national indiscriminate retention regulation is possible provided that: * The member state is facing a serious threat for national security that is shown to be present or forseeable; * The retention is limited to targeted groups or geographic regions; * Recourse to real-time collection of traffic and location data is limited to data subjects suspected to be involved in terrorist activities; and * These processing activities must be limited in time to what is necessary.
Privacy International
Privacy international has challenged the lawfulness of the practices of collecting and using the bulk communications data (BCD) by the UK security and intelligence agencies. The Investigatory Powers Tribunal referred to the Court of Justice of the European Union the questions whether the existence of such practices fall within the scope of EU law and of Directive 2002/58 and if yes, does the EU law precludes national legislation enabling State authority to require providers of electronic communications services to carry out the 'general and indiscriminate' transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security. The referring court asked two questions : firstly, having regard to Article 4 TEU (referring to national security) and Article 1(3) of Directive 2002/58, ("Directive shall not apply to activities ..... which fall to the activities concerning public security, defence, State security") does a requirement in a direction by a Secretary of State to a provider of an electronic communications network that it must provide bulk communications data to the security and intelligence agencies of a Member State fall within the scope of Union law and of Directive. The second question reffered to the court was seeking to ascertain whether Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of the Charter, is to be interpreted as precluding national legislation enabling a State authority to require providers of electronic communications services to carry out the general and indiscriminate transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security. The UK and several EU members states highlighted that the activities of security and intelligence agencies are the sole responsibility of Member States as it guaranteed in the treaty (Article 4(2) TEU), and the Directive should not apply to national legislation as the purpose of that legislation is to safeguard national security. In addition, the governments stated that the Article 1(3) of the directive defines the scope of that directive and excludes from that scope the activities concerning public security, defence, and State security, and the those provisions perfectly reflect the allocation of competences defined in Article 4(2) TEU. Contrary to the governments arguments, the CJEU ruled out that national legislation to require providers of electronic communications services to forward traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security falls within the scope of that directive, adding the settled case law of the Court: “although it is for the Member States to define their essential security interests and to adopt appropriate measures to ensure their internal and external security, the mere fact that a national measure has been taken for the purpose of protecting national security cannot render EU law inapplicable and exempt the Member States from their obligation to comply with that law.” The EU Court started from the point that, although the Article 1(3) of directive excludes from its scope ‘activities of the State’ in the areas of national security, these activities are unrelated to fields in which individuals are active (judgment of 2 October 2018, Ministerio Fiscal, C‑207/16, EU:C:2018:788, paragraph 32 and the case-law cited). The Court determined that the directive requires the Members states to ensure the right to privacy and confidentiality, with respect to the processing of personal data in the Electronic communications services, and not only its scope extends to a legislative measure that requires providers of electronic communications services to retain traffic data and location data, but also to a legislative measure requiring them to grant the competent national authorities access to that data, referring to the article 1 and 3 and 15 of that directive. As regards to the second question, the Court stated that yes, directive precludes the Member states to adopt legislation intended to restrict the scope of its confidentiality obligations and that current legislation where the national security agencies have general and indiscriminate access to the traffic data and location data exceeds the limits of what is strictly necessary and cannot be considered to be justified, within a democratic society, as required by Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of the Charter. The CJEU has reiterated again that 'that derogations from and limitations on the protection of personal data must apply only in so far as is strictly necessary' and that the deviation from the directive obligations should be by exceptions based on the famous test: when such restrictions are necessary, appropriate and proportionate for the national security purposes. The national legislation 'must lay down the substantive and procedural conditions governing that use' and the access should be consistent with the objective pursued by the legislation.
Claimant: Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv)
The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit against advocado GmbH (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with pre-ticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries. The claimant argued that the data processing in connection with the placed cookies was unlawful under Article 6(1) GDPR: A user's consent under Article 6(1)(a) GDPR could not be considered valid under Articles 4(11) and 7 GDPR, especially since the boxes were pre-ticked. Moreover, the claimant claimed that the defendant had violated Articles 5(1)(a), 13/14, 26 and 44 et seqq. GDPR as it had failed to properly inform users of the scope of intended processing activities, joint controllers and international data transfers in connection with the use of cookies. The defendant stated that it had based the use of cookies on legitimate interests under Article 6(1)(f) GDPR until the CJEU issued its decision C-673/17 on 01.10.2019 ("Planet 49"). Afterwards, the defandent argued that they changed the legal basis for processing to consent under Article 6(1)(a) GDPR, which it considered valid under Articles 4(11) and 7 GDPR. The defendant also stated that it was the sole controller for the processing activities - there were no joint controllers involved, only processors. (Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law / consumer protection law perspective. This will not be discussed further in this summary.) *Was it necessary to ask for the users' consent under Article 6(1)(a) GDPR or could the processing activities in connection with the use of marketing and analytics cookies be based on legitimate interest under Artilce 6(1)(f)? *Was the consent given by users' when interacting with the defendant's cookie banner valid under Articles 6(1)(a), 4(11) and 7 GDPR? *Did the defendant violate GDPR provisions on transparency? *Was the defendant the sole controller regarding the processing activities in connection with the use of marketing and analytics cookies or were there any joint controllers? = The court held that the marketing and analytics cookies used by the defendant can only be placed with the users' consent under Article 6(1)(a) GDPR: § 15(3) Telemediengesetz that deals with such cookies must be interpreted in light of Article 5(3) e-Privacy Directive, which requires consent for cookies not strictly necessary for technical reasons. Taking into consideration the design of the cookie banner and the lack of information provided to a website user, the court held that consent given could not be considered valid under Articles 6(1)(a), 4(11) and 7 GDPR. The banner featured pre-ticked boxes and a big "OK" button. The option "use only necessary cookies" was designed to not look like an interactive button but rather a link. Consent could therefore not be considered "freely given" and was invalid. = The court further held that the defendant violated Article 13 GDPR by mentioning an incorrect transfer mechanism under Articles 44 et seqq. GDPR for data transfers in connection with the use of cookies. = Lastly, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google. Google does not qualify as the website provider's processor under Article 4(7). This is because Google does not process the data solely for the purpose of use by the website provider. Rather, Google, like other third-party providers, expressly reserves the right to process the data for its own purposes as well. The fact that the defendant and Google entered into a data processing agreement under Article 28 GDPR does not change this assessment. The court's legal view is in line with the [https://www.datenschutzkonferenz-online.de/media/dskb/20200526_beschluss_hinweise_zum_einsatz_von_google_analytics.pdf official opinion of the "Datenschutzkonferenz"], a gathering of all German DPAs.