Austrian court asks EU court whether Facebook ‘undermines’ GDPR with user data
The Austrian court has asked the Court of Justice of the European Union whether Facebook is legally allowed to process user data. The question revolves around the difference between when there is consent and a contract.
Under the GDPR there are several ways to process data; for example, there may be permission from a user, or a contract with a user. Before the GDPR came into effect, Facebook spoke of a user’s consent. However, Facebook says it has had a contract with users since the introduction of the GDPR for showing personalized advertisements.
Facebook wants to circumvent European legislation with this, writes privacy platform None of Your Business, or noyb. There are other requirements for a contract than for permission; in the case of a contract, consent does not have to be ‘freely given’, nor does it need to be ‘informed consent’. This is in contrast to permission, where these two requirements do apply. That is why Facebook would say that there is a contract rather than consent. Noyb writes of a ‘reinterpretation’ of the GDPR.
Noyb, founded by activist Max Schrems, therefore went to court in Austria. The court is now seeking clarification from the European Court of Justice. According to the Austrian court, a central question is whether Facebook can indeed view the processing of user data as a contract and thus can ‘undermine’ the better protection that users have if they themselves give permission.
The Austrian court also asks the EU court whether Facebook is doing enough data minimization according to the GDPR and whether Facebook is allowed to use sensitive data such as sexual preference and political preference for personalized advertising. The Austrian court refers to data minimization as whether Facebook is allowed to use all data from Facebook.com and other websites for advertising purposes. For example, Facebook offers to third-party websites to incorporate Like buttons into articles; Facebook may use this data for advertising purposes. The court now asks whether this is legal.
In a separate case, Facebook also has to pay 500 euros in compensation to Schrems. The activist asked the platform for his user data, but Facebook did not give full access to it. According to the court, Schrems never got all the raw data, he was not told the legal basis on which his data was processed and Facebook refused to answer questions from Schrems. The fine of five hundred euros is in line with an earlier decision against which Schrems appealed.