Jose Felgueroso
Abogado | Attorney
The EU Court Evaluates User Consent on Dominant Social Networks
info@josefelgueroso.com
2023-10-11
The Court of Justice of the European Union (the "EU Court") held, among other conclusions, that the fact that a social network operator has a dominant position in the market does not prevent its users from giving free and informed consent to the processing of their data by that operator.
Background
Meta Platforms Ireland, operator of Facebook and services like Instagram, WhatsApp, and Oculus, uses online advertising tailored to users by profiling them based on data they provide and data collected both on and off the social network. When joining Facebook, users accept an agreement permitting Meta to collect and associate data about their activities both inside and outside of Facebook, the latter known as "off-Facebook data". This includes data from third-party websites and apps linked to Facebook or other Meta services.
In 2019, the Federal Cartel Office in Germany prohibited Meta from making Facebook usage for German private users contingent on processing their off-Facebook data without clear consent. The Office argued that this practice was an abuse of Meta's dominant market position and contradicted the core values of the EU's General Data Protection Regulation (the "European Regulation").
Challenging this decision in court, Meta later revised its terms to state that users, instead of paying, would view ads. From January 2020, they also launched an "Off-Facebook Activity" feature, letting users view a summary of their external site data and offering an option to unlink this data from their Facebook account.
The Higher Regional Court of Düsseldorf (the Referring Court) had questions about the following:
- whether national competition authorities may review, in the exercise of their powers, whether the processing of personal data complies with the requirements set out in the European Regulation;
- whether the operator of an online social network may process the data subject’s sensitive personal data within the meaning of the European Regulation;
- the lawfulness of the processing by that operator of the personal data of the user concerned; and
- the validity of the consent given to a company with a dominant position on the national market for online social networks for the purposes of personal data processing.
The Judgment
Role of a national competition authority in evaluating compliance with the European Regulation
The EU Court had to determine whether a national competition authority, while examining an abuse of a dominant position by a company, can determine if that company’s general terms of use related to data processing are inconsistent with the European Regulation.
Under the European Regulation, member states must provide one or more supervisory authorities, and these authorities should act independently when monitoring the application of the European Regulation. They have powers like conducting investigations and imposing administrative fines. In addition, member states should facilitate the achievement of the Union's tasks and abstain from any measure that could jeopardize the objectives of the Union.
The EU Court concluded that a competition authority can make a determination about a company's terms of use for the processing of personal data if it is necessary to establish the existence of abuse of dominant position. The competition authority must cooperate with supervisory authorities and cannot contradict decisions by competent supervisory authorities regarding those terms.
Processing of special categories of data
The EU Court had to determine whether the processing of personal data by an online social network operator, when a user visits certain websites or apps and enters information, constitutes 'processing of special categories of personal data' under the European Regulation.
Under the European Regulation, personal data about sensitive subjects like race, beliefs, health, and sexual orientation cannot be processed, with certain exceptions. The EU Court ruled that if an online social network operator processes data by collecting information from user visits to certain sites or apps related to those categories of sensitive data and links that data to the user's social network account, it is processing special categories of personal data. That processing is generally prohibited unless specific conditions are met.
Whether users' of social networks make public certain data
The issue before the EU Court was whether a user of an online social network 'manifestly makes public' certain data when visiting websites or apps associated with special categories of data, especially when interacting with features like 'Like' or 'Share' buttons or entering data into those platforms.
The European Regulation provides an exception to the general prohibition on processing special categories of personal data. Specifically, it allows that processing if the data subject has "manifestly made the data public." The EU Court held that data collected by an online social network from user visits to certain sites or apps does not qualify as data that the user 'manifestly makes public'. But interactions like using 'Like' or 'Share' buttons or entering specific data do qualify, but only if the user has explicitly chosen to share that data with an unlimited audience.
In short, the EU Court held that users of social networks might make data public on social networks, creating an exception to the general prohibition on processing special categories of data, but it depends on what the users do and if they really meant to share it publicly.
Processing of personal data that is necessary for the performance of a contract
The EU Court had to determine whether the processing of personal data by an online social network operator, which involves collecting user data from various sources, linking that data to the user's social network account, and utilizing that data, can be considered as "necessary for the performance of a contract" to which the data subjects are party.
Under the European Regulation, personal data processing is lawful when necessary for the performance of a contract to which the data subject is party. The EU Court determined that the act of processing data by an online social network operator can indeed be qualified as necessary for the execution of a contract, but only if the data processing in question is "objectively indispensable" – not just helpful or advantageous, but truly essential – to achieve the core purpose of the contract.
In short, online social networks can process personal data as part of a contract, but only if it is absolutely necessary to implement the essence of the contract.
Processing of personal data that is necessary for the legitimate interests of the controller or a third party
The EU Court had to determine whether the processing of personal data by an online social network operator, which involves the collection of user data from various sources, linking that data to the user's social network account, and using that data, be considered as necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
The European Regulation states that the processing of personal data is permissible if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data. The EU Court indicated that such data processing by the online social network operator can only be regarded as necessary for the purposes of legitimate interests if (1) the operator has informed the users about the legitimate interest pursued by the data processing; (2) the processing is only carried out to the extent strictly necessary for that legitimate interest; and (3) a balance is struck between the legitimate interest and the interests or fundamental rights of the users.
In short, the EU Court held that for social networks to use data for 'legitimate interests,' they need to be clear about the interest involved, use only the data they need, and always respect users' rights.
Processing of personal data that is necessary to comply with a legal obligation
The issue before the EU Court was whether the processing of personal data by an online social network operator, involving the collection of user data from various sources, linking that data to the user's social network account, and using that data, can be justified under the provision where it is necessary for compliance with a legal obligation to which the controller is subject.
The European Regulation specifies that personal data may be processed if the processing is necessary for compliance with a legal obligation to which the data controller is subject. This means that if there is a legal rule or requirement that requires the handling of personal data, then that action is permissible under the European Regulation. The EU Court determined that that type of data processing by the online social network operator can be justified under that provision if it is genuinely necessary to comply with a legal obligation either under EU law or the law of the concerned member state. This legal basis should pursue an objective of public interest and be proportionate to the legitimate aim pursued. Furthermore, the data processing should only be carried out to the extent that it is strictly necessary.
In short, social networks can process data based on a legal requirement, but only if the processing is tied closely to the legal requirement, serves the public, is fair, and is necessary.
Processing of personal data that is necessary to protect the vital interests of the data subject or another person, or for a task carried out in the public interest or under official authority
The EU Court had to determine whether the processing of personal data by an online social network operator, which involves the collection of user data from various sources, linking that data to the user's social network account, and using that data, can be considered as necessary to protect the vital interests of the data subject or another person, or for a task carried out in the public interest or under official authority vested in the controller.
Under the European Regulation, personal data processing is permissible if it is necessary to safeguard the vital interests of the data subject or another individual. It also provides that processing is allowable if it is needed for performing a task carried out in the public interest or in the exercise of official authority vested in the data controller. The EU Court held that that data processing by the online social network operator cannot, in principle, be seen as necessary either to protect vital interests or for tasks in the public interest or under official authority. However, this is subject to verification by the Referring Court.
In short, most of the time, social networks cannot say they are using data to protect someone's vital interests or because it is a public task.
User consent and dominant position of an online social network
The issue before the EU Court was whether the dominant position of an online social network operator prevents users from validly consenting to the processing of their personal data by that operator.
Under the European Regulation, personal data processing is lawful if the individual has given clear consent for a specific purpose. It also provides that for processing special categories of personal data (for example, data about health, religious beliefs, sex life, etc.), explicit consent of the person is required. The European Regulation defines consent as any freely given, specific, informed, and unambiguous indication of the individual's wishes through a statement or clear affirmative action.
The EU Court concluded that the mere fact that an operator enjoys a dominant position does not, in and of itself, vitiate the validity of user consent. But this dominance is relevant when evaluating the genuineness and voluntariness of consent. The operator, as the steward of user data, bears the responsibility to convincingly demonstrate that the consent was offered freely and with a full understanding of its implications.
In short, market dominance by an operator does not automatically mean users cannot freely agree. But it raises the question of whether the agreement is real and without pressure. The social network has to prove the agreement is genuine.
Conclusion
In sum, the EU Court held that online social networks might violate the European Regulation when collecting and using user data, but it depends on how and why they get and use the data. In particular, the fact that a social network operator has a dominant position in the market does not prevent its users from giving free and informed consent for that operator's processing of their data. The EU Court also concluded that competition authorities can check whether a company's terms of use are consistent with the European Regulation, but they need to work with data protection authorities and respect their decisions.
Sources
Meta Platforms Inc and Others v Bundeskartellamt (Court of Justice of the European Union, 2023)
General Data Protection Regulation