Belgium

[BE] Court orders Facebook to stop tracking users on third-party sites

IRIS 2018-4:1/14

Carl Vander Maelen

Ghent University

The Court of First Instance in Brussels has ordered Facebook to stop tracking users on third-party sites, and to destroy all similar data it has illegally collected thus far. The judgment is the latest in a long-running legal battle between the Belgian Privacy Commission and Facebook. The former started court proceedings against the social network site in 2015, when a study revealed that Facebook tracked non-users and logged out users for advertising purposes through “data cookies” on external websites (“third-party tracking”). Summary proceedings resulted in a judgment by the Brussels Court of Appeal that found that the Belgian courts do not have jurisdiction over Facebook (Court of Appeals Brussels (Nl.) (18e k.) Nr. 2016/KR/2, 29 June 2016). However, this latest judgment is the first to examine the merits of the case, and follows the reasoning of the Belgian Privacy Commission and its interpretation of the 1992 Belgian Privacy Act (Wet van 8 december 1992 tot bescherming van de persoonlijke levensfeer ten opzichte van de verwerking van persoonsgegevens).

In its judgment of 16 February 2018, the Brussels Court of First Instance established its jurisdiction over Facebook by drawing an analogy with the Court of Justice of the European Union’s Google Spain case (see IRIS 2014-6/3) to indicate that the activities of Facebook and Facebook Belgium are inextricably linked, since the activities of the latter are aimed at the economic gain of the former, and Facebook and its activities - which encompass the processing of personal data - are the means by which the Belgian establishment can carry out its activities. As a result, Belgium can apply the 1992 Privacy Act on the basis of Article 4(1)(a) of the Data Protection Directive (95/46/EC) and Facebook Ireland, which is responsible for the processing of personal data, must ensure Facebook Belgium’s compliance with national legislation.

As for the merits of the case, the court finds that Facebook’s use of cookies, social plug-ins and “pixels” on third-party websites to track browsing behaviour are in violation of Belgian privacy law. The main conclusion is that Facebook’s cookie banner, cookie policy and data policy do not adequately inform users that the company collects cookies and other data when the data subject visits a third-party website containing Facebook social plug-ins, even if the individual involved never had, or no longer has, a Facebook account, or is no longer signed in. This is a violation of Article 9, §2, d) of the 1992 Privacy Act, which in turn gives rise to two further infringements. Firstly, because of the inadequate information regarding third-party tracking, users cannot be said to have given valid consent to the processing of that data, contrary to Article 5, a) of the Act and Article 129 of the Electronic Communications Act (Wet van 13 juni 2005 betreffende de elektronische communicatie - WEC). Secondly, the inadequacy of the information renders it impossible to fairly process the data, which is a requirement under Article 4 of the 1992 Privacy Act.

As a result of these infractions, the court ordered Facebook to halt the third-party tracking of anyone browsing from Belgium, for as long as the company policy does not conform to Belgian privacy regulations. Furthermore, the social network is ordered to destroy all personal data it has illegitimately obtained in this way. Lastly, the company must publish the entire judgment on its own website, as well as publish the last three pages in both French and Dutch Belgian newspapers. Non-compliance with this order will result in the imposition of a daily fine of EUR 250,000 per day, up to a maximum fine of EUR 100 million.