October 5 The Belgian Data Protection Authority (APD) brought US tech giant Facebook before the Court of Justice of the European Union (CJEU) on Monday over privacy rules, Reuters reports. The two sides are at odds over which data protection authority has the power to police Facebook.
The case could escalate disputes about privacy issues across the EU and spur investigations by the bloc’s national data protection authorities into other US tech giants such as Google, Twitter and Apple.
The dispute reached the CJEU after Facebook challenged APD’s move to stop the tech giant from tracking users in Belgium whether or not they have an account, with Belgian courts seeking guidance on the matter.
According to EU’s General Data Protection Regulation (GDPR), the Irish Data Protection Commission (DPC) is the foremost authority on Facebook issues since the company has its EU head office in Dublin, as do Google, Twitter and Apple. However, GDPR allows room for manoeuvring by national privacy regulators when it comes to violations that are limited to individual member countries. Germany and France have already taken advantage of this provision.
Facebook’s attorney Dirk Van Liedekerke has argued that GDPR was created to prevent judicial fragmentation and that it would be risky to allow national authorities to sidestep rules of competences.
The European Commission sides with Facebook, stressing the importance of having a mechanism that ensures consistent application of GDPR rules across the EU as a whole. On the other hand, the APD, which enjoys the support of Poland and Belgium, maintains that GDPR allows some leeway for national agencies to police data rules in their respective countries. APD attorney Rubin Roex points out that GDPR neither grants the lead authority exclusive competence nor prohibits non-lead authorities from going to court.
CJEU President Koen Lenaerts warned that not allowing national watchdogs to protect their citizens would force citizens to file private lawsuits. CJEU court adviser Michal Bobek will issue his non-binding opinion on the matter on 17 December, with the CJEU expected to pass judgment about six months after that.
The DPC has launched cases against Facebook, Instagram, WhatsApp, Twitter, Apple, Verizon Media, LinkedIn and Quantcast.
SOURCE