2018
Victory for the Privacy Commission in Facebook proceeding
The 16th of February, the Court of First Instance rendered its judgment in the proceedings on the merits in the case of the Privacy Commission vs. Facebook.
The court supported all of the arguments put forward by the Privacy Commission.
First, the court declared itself competent to rule on this matter. Facebook contested the jurisdiction of the Belgian judges vis-à-vis its American parent company and its Irish subsidiary. However, the Court found that it effectively has the jurisdiction to evaluate whether Facebook complies with Belgian privacy legislation when it tracks the browsing behavior of Internet users in Belgium.
The Court also found that Facebook does not comply with Belgian privacy legislation on the basis of the investigation undertaken by the Privacy Commission.
The investigation shows that Facebook collects information concerning all of us when we browse the Internet. To this end, Facebook uses various technologies, such as the well-known "cookies" or "social plug-ins" (for example, the "like" or "share" buttons) or also "pixels", which are invisible to the naked eye. It uses them on its own website, but also and most importantly on websites of third parties. The investigation reveals, for example, that even if you have never visited the Facebook domain, Facebook is still able to track your browsing behavior without you realizing it, let alone want it, through these invisible pixels that Facebook has placed on more than 10,000 other websites.
The Court concludes, in line with the Privacy Commission, that Facebook (1) does not sufficiently inform users about the fact that it collects information about us, on the nature of the collected information, on the use of this information and on how long it retains this information and 2) does not obtain valid consent from users to collect and process all this information.
In short, the Court orders, as requested by the Privacy Commission, that:
- Facebook must stop tracking and recording the browsing behavior of persons browsing from Belgium as long as it does not bring its practices in line with Belgian privacy legislation.
- Facebook must destroy all illegally obtained personal data.
- Facebook must publish the entire 84-paged judgment on its website and must publish in Dutch- and French-language Belgian newspapers the last three pages of this judgment where the imposed measures are listed.
If Facebook does not comply with this judgment, it will be forced to pay a penalty to the Privacy Commission amounting to 250,000 euros per day of delay, with a maximum of 100 million euros.
“Of course, we are very satisfied that the court has fully supported our position. Facebook is currently conducting a big advertising campaign through which it underlines its commitment to privacy.
We hope it will put this commitment into practice", says the Privacy Commission.