Facebook Data Privacy Case Referred to EU Court

A German court reviewing Facebook’s appeal against a privacy-focused directive from the nation’s competition authority is set to seek guidance from Europe’s highest court.

Court's Decision to Seek Clarification

The Düsseldorf court announced today, in a published statement, that a ruling on Facebook’s complaints cannot be reached without a referral to the Court of Justice of the European Union (ECJ).

The court determined that the question of whether Facebook is leveraging a dominant position in the German social network market through data collection practices that potentially violate the General Data Protection Regulation (GDPR) requires ECJ interpretation of European law.

The Bundeskartellamt's Case

The case brought by the Bundeskartellamt (Federal Cartel Office, FCO) centers on Facebook’s ability to aggregate user data from various sources. This includes data collected via third-party websites through plug-ins and tracking pixels, as well as data gathered across its own platforms – Facebook, Instagram, WhatsApp, and Oculus.

The FCO argues that this data collection is unlawful under EU privacy regulations, as users are not given sufficient opportunity to opt-out.

Competition Concerns

The competition-related argument posits that Facebook’s contractual terms enable the creation of detailed user profiles, granting the company an unfair advantage over competitors lacking similar access to comprehensive user data.

Innovative Approach to Regulation

The FCO’s approach is considered groundbreaking, as it merges the traditionally separate areas of competition and privacy law. This offers the potential for structural changes within Facebook’s business operations without necessarily requiring a complete breakup of its individual units.

Prolonged Legal Battle

However, the enforcement of any such changes remains uncertain, especially given that the FCO initiated its investigation into Facebook’s data practices back in March 2016.

Facebook initially blocked the FCO’s February 2019 order through a court appeal in August 2019.

Subsequently, Germany’s federal court reinstated the “superprofiling” case last summer, reviving the FCO’s challenge to Facebook’s default data harvesting practices.

Waiting for a Resolution

This latest development indicates a further delay in determining whether competition law can effectively address concerns that EU privacy regulators have, thus far, been unable to resolve. Numerous GDPR complaints against Facebook remain pending with the Irish Data Protection Commission.

Currently, neither regulatory path appears capable of swiftly curbing the power of large platforms.

Court's Questions Regarding Data Collection

The Düsseldorf court’s opinion raises concerns about the extent of Facebook’s data collection. It suggests that the company could mitigate antitrust issues by allowing users to base profiling solely on data they directly upload, rather than relying on a broader range of data sources. The court also questioned the inclusion of data from Instagram and Oculus.

Procedural Concerns

The court also identified flaws in the FCO’s process, stating that Facebook’s U.S. and Irish entities were not afforded a fair hearing before the order was issued to its German subsidiary, among other procedural objections.

Lengthy ECJ Review Process

Referrals to the ECJ typically require years to yield a definitive interpretation.

In this instance, the ECJ will likely be asked to assess whether the FCO exceeded its authority. The specific questions to be referred by the court have not yet been finalized, with a written reference expected in the coming weeks.

Facebook's Response

A Facebook spokesperson released a statement in response to the court’s announcement today.