Meta Platforms Ireland (hereinafter “Meta”) operates Facebook in the EU. By registering on Facebook, users agree to the terms and conditions established by Meta, and consequently to the data usage policies and cookie policies. Under these terms, Meta collects data relating to users both on and off the social network and associates it with the Facebook accounts of the users concerned. With regard to the latter data, also referred to as “off-Facebook data,” this includes both data related to visits to third-party websites and applications and data regarding the use of other online services belonging to the Meta group (Instagram and WhatsApp). The data collected in this way enables, among other things, the personalization of advertisements targeted at Facebook users.
The German Federal Cartel Office has, in particular, prohibited the use of the Facebook social network by private users residing in Germany from being made conditional in the general terms and conditions on the processing of their data by Facebook, and that such data be processed without their consent. It justified its decision by stating that, since this processing was not in compliance with the GDPR, it constituted an abuse of Meta’s dominant position in the German online social media market.
In its judgment, the Court of Justice held that, when assessing whether an undertaking has abused its dominant position, it may prove necessary for the competition authority of the Member State concerned to also examine whether the conduct of that undertaking complies with standards other than those of competition law, such as the rules set forth in the GDPR. However, if a national competition authority identifies a violation of the GDPR, it does not replace the supervisory authorities established by the GDPR. Indeed, the assessment of compliance with the GDPR is limited solely to the purposes of establishing an abuse of a dominant position and imposing measures aimed at bringing such abuse to an end in accordance with competition law. To ensure consistent application of the GDPR, national competition authorities must consult with one another and cooperate in good faith with the authorities responsible for ensuring compliance with the GDPR. In particular, if a national competition authority considers it necessary to examine whether an undertaking’s conduct complies with the GDPR, it must verify whether that conduct or similar conduct has already been the subject of a decision by the relevant national supervisory authority or the Court of Justice. If so, it may not depart from that decision, but it may draw its own conclusions from it in terms of the application of competition law.
Furthermore, the Court of Justice noted that Meta’s data processing appears to also involve special categories of data, the processing of which is, in principle, prohibited by the GDPR. It will therefore be for the national court to determine whether any of the data collected may in fact reveal such information, regardless of whether it concerns a user of this social network or any other natural person. If we ask whether the processing of such so-called “sensitive” data is exceptionally permitted on the grounds that the data subject has clearly made it public, the Court of Justice clarified that the mere fact that a user visits websites or applications that may reveal such information does not in itself mean that the user is making their data publicly available within the meaning of the GDPR. The same applies if a user enters data on such websites or clicks on selection buttons on those websites or in those apps, unless the user has expressly indicated in advance their choice to make data concerning them public to an unlimited number of people.
With regard to processing carried out by Meta in general, including the processing of personal data, the Court further examined whether that processing falls within the scope of the grounds set forth in the GDPR, on the basis of which data processing carried out without the data subject’s consent may be considered lawful. In this context, it held that the need to perform a contract to which that person is a party justifies the practice at issue only on the condition that the data processing is objectively necessary, such that without such processing, the main purpose of the contract could not be achieved. Subject to verification by the national court, the Court of Justice had doubts as to whether the personalization of content or the consistent and seamless use of services provided by the Meta Group could meet these criteria. Furthermore, according to the Court of Justice, the personalization of advertising, which finances Facebook, cannot, as a legitimate interest pursued by Meta, justify the data processing in question without the consent of the data subject. Finally, the Court of Justice stated that the fact that the operator of an online social network holds a dominant position in the social media market does not in itself prevent users of that social network from validly giving their consent to the processing of their data by that operator within the meaning of Article 4(11) of the GDPR. However, given that such a position may affect the freedom of choice of those users and create a clear imbalance between them and the operator, this circumstance is an important factor in determining whether consent was in fact validly given, and in particular, freely given. This, of course, must be demonstrated by the controller.
