The Court of Justice of the European Union (CJEU) has been asked to rule on Facebook’s use of “contracts” to circumvent “consent”. The Austrian Supreme Court has made the request. It is a response to the long-running case between Max Schrems and Facebook. The referral seeks to resolve an earlier ruling by the Austrian Superior Court.
That earlier ruling said that Facebook did not require consent from users to use their data. It was based on the move by Facebook to copy consent into its civil law terms and conditions of use. That move meant that by using Facebook, users were giving up their right to consent to the use of their data. The ruling surprised and shocked several privacy activists, not least Schrems and the privacy organisation he leads, noyb.
What are the questions for the CJEU?
- Do contracts allow a company to infer that using a free service allows it to use personal data to show ads targeted to that user without their explicit consent? This refers to Article 6(1)(a) and (b) and Article 7 of the GDPR.
- Can all data held by a platform, including third parties who hold the data off the platform, be aggregated, analysed and processed for targeted advertising without any restriction on the time or nature of the data? This refers to Is Article 5( 1 )(c) of the GDPR.
- Is Art 9(1) of the GDPR to be interpreted as applying to the processing of data which permits the targeted filtering of special categories of personal data such as political opinion or sexual orientation (for example, for advertising), even though the controller does not differentiate between these data?
- Is Article 5(1)(b) in conjunction with Article 9(2)(e) of the GDPR to be interpreted as meaning that a statement about one’s sexual orientation for the purposes of a panel discussion permits the processing of other data on sexual orientation for the purposes of aggregating and analysing data for the purposes of personalised advertising?
A serious challenge that could cost Facebook billions
If any of these questions go against Facebook, it could cost the company billions in lost sales. Commenting on the first question, Schrems said: “Basically all data usage that generates profits for Facebook in the EU relies on this legal argument. If Facebook loses at the CJEU, they would not only have to stop this and delete all illegally generated data, but also pay millions of users damages. I am very happy about this reference.”
On questions 2-4, Schrems commented: “These further questions are crucial. Facebook may not be allowed to use all data for advertisements anymore, even when it got valid consent. Equally, it may have to filter sensitive data like political opinions or data on sexual orientation. So far, Facebook has argued that it does not differentiate between these types of data.”
According to Statista, Facebook’s monthly active users for Europe for Q1/2021 was over 400 million. The question is what level of damages would the court then award. At a miserly €10 per user, that’s a hit of €4 billion for Facebook. The company banked US$ 25.4 billion (€21.5 billion) in advertising revenue for Q1/2021. That amount would mean a 20% reduction in revenue which is not an insignificant amount. Of more concern for Facebook is that the court awarded Schrems €500. Any award to users based on that number would be hugely significant.
Another issue would be the risk of a class-action lawsuit which could cost Facebook considerably more.
Enterprise Times: What does this mean?
It is important to note that the Austrian Superior Court has already ruled that Facebook was acting lawfully. However, that the Austrian Supreme Court has seen fit to refer this to the CJEU is a significant move. It opens the door to a major review of what the GDPR does and does not cover. This is a case that will be watched very carefully. Its outcome will have a serious impact on the GDPR, whatever the CJEU decides.
For Facebook, this is just one more serious headache for it to deal with and one it could do without. The recent moves at a global level to harmonise tax laws and remove loopholes for tech companies already threatens its profits. Apple and Google moving to increase privacy on their platforms is also a major problem for Facebook and has made advertising on its platform less attractive.
Other technology platform owners such as Google and Twitter will also be nervously watching this space. They know that a ruling on consent will have repercussions for their platforms and advertising as well.
All eyes are now on the CJEU and how it will rule. However, the wheels of justice, especially at a European level, are not quick. Given the implications of any ruling, the court will likely take some time to consider its answers.