Belgium ∙ Facebook Loses the First Round of Its Battle with the Belgian Privacy Commission

Abstract

1. It all started in February 2015. University researchers, commissioned by the Belgian Privacy Commission, published a report containing a legal analysis, under Belgian law, of Facebook’s revised terms of use and privacy policy. Facebook had applied them as from 30 January 2015.1 These revised terms allowed Facebook to track both users and nonusers across websites and devices, by using social plug-ins and cookies. In particular, by using the socalled ‘datr’ cookie, Facebook was able to monitor both users and non-users in a variety of ways, on and off Facebook.2 The academic research report concluded that these ‘tracking’ activities violated both European and Belgian data protection legislation.3 2. On 13May 2015, the Privacy Commission issued a formal recommendation. It criticised Facebook’s tracking activities, and it formally requested Facebook to cease these activities.4 Although recommendations of the Belgian Privacy Commission are not legally binding, they should de facto be obeyed in order to avoid non-compliance issues. According to the Privacy Commission, Facebook’s tracking activities are more intrusive than other cases of so-called ‘third-party tracking’. It is indeed able to track surfing behaviour over a large number of websites, and to link this surfing behaviour to users’ real identity, social network interactions and even their medical information and religious, sexual and political preferences. To justify its collection of data through social plug-ins, Facebook relies upon the individual’s consent. The Privacy Commission, however, concluded that the conditions for valid (free and informed) consent were not met, and that there was no legal ground for Facebook’s tracking activities, particularly when it came to the tracking of nonusers. 3. After several months of negotiations, it was clear that no amicable solution could be found. The Privacy Commission consequently sued Facebook before the President of the Brussels Court of First Instance in summary proceedings. The relief sought was an injunction prohibiting the use by Facebook of the ‘datr’ cookie through social plugins to track non-users, without first giving them sufficient and adequate information in this re-