The ECJ already ruled on July 4, 2023 in case C‑252/21 in the proceedings between the German BKartA and Meta (Facebook) decided (here to the Final motions of the GAwhich the ECJ largely agrees with) that
- member state antitrust authorities in the Examination of the abuse of a dominant market position check or determine that the general terms and conditions of the company in question violate the GDPR – this, insofar as this finding can prove the existence of market abuse. However, the authority may not deviate from relevant decisions of the data protection authorities and, in case of doubt, it must consult the supervisory authorities for clarification or ask whether such a decision is imminent; it may then only continue its own investigation if the supervisory authorities do not raise any objections or do not deal with it;
- The dominant market position of a platform does not preclude effective consent, but it is an “important aspect for the assessment” of whether consent is voluntary.
With regard to data protection, the ECJ states, among other things, that
- Facebook special categories of personal data processed if Facebook registers via cookies or similar that a user uses a website or app with reference to the subject of special personal data, registers there, places orders, etc., and links this data to the user account. Whether this is the case here must be examined by the referring Higher Regional Court of Düsseldorf;
- the user does not disclose his or her surfing data by accessing a website or app “Obviously public” (Art. 9 para. 2 lit. e GDPR) – this would only be the case if the user explicitly states beforehand, in full knowledge of the facts, that they wish to make the relevant data publicly accessible to an unlimited number of people. This can also be done by a “like” or similar, provided the user is aware of what they are doing;
- the Legal basis of the contract only applies if the cookie (etc.) data is objectively indispensable for a “necessary part of the contractual performance”. It is not sufficient that the contract mentions the processing in question or that it is merely helpful for the performance of the contract. The personalization of advertising is probably not necessary; however, the OLG Düsseldorf must also examine this;
- legitimate interests of Facebook would only exist if the processed usage data is “absolutely necessary” for the legitimate interest – this includes marketing, security and product improvement, but not the prevention of criminal offenses; this has nothing to do with Meta’s economic activity (?) – and these interests cannot otherwise be safeguarded and do not outweigh the interests of the data subjects. User expectations play a key role here:
[…] even if the services of an online social network such as Facebook are free of charge, the user of this network [can not reasonably expect […] that the operator of this social network may use his personal data without his consent processed for the purpose of personalizing advertising.
However, users must have the freedom to Consent to refuse consent to data processing operations that are not necessary for the performance of the contract, individually,
which means that they, if necessary for an appropriate fee, a Equivalent alternative which is not associated with such data processing operations.