Facebook Ireland violated the law in the processing of personal data of Dutch Facebook users in the period from April 1, 2010 to January 1, 2020. The Amsterdam District Court ruled on March 15, 2023. Personal data of users were processed for advertising purposes while in this case it was not allowed. Personal data was also given to third parties without Facebook users being well informed about this and without a basis for this in laws and regulations.
The Data Privacy Foundation, a collective action organization, had filed the case against three companies from the Facebook group. The court limited the conviction to the actions of Facebook Ireland, because only it is responsible for the processing of personal data of Dutch Facebook users.
No legal basis and no proper information
Facebook Ireland processed personal data for advertising purposes without a legal basis – such as consent – for this. This legal basis was also lacking in the processing of special personal data for advertising purposes, such as sexual preference or religion. This included both personal data that users provided themselves, as well as special personal data that Facebook Ireland obtained by tracking the surfing behavior of Facebook users outside the Facebook service.
Furthermore, Facebook Ireland has not sufficiently informed Facebook users about the sharing of their personal data with a number of third parties. Not only personal data of the Facebook users themselves are shared, but also personal data of their Facebook friends.
”Cookies” on third party sites lawfully
The court ruled that placing “cookies” on third-party websites was not unlawful. The obligation to inform users about the placement of cookies and to request permission was transferred by Facebook Ireland to the relevant website operator, and this was allowed, according to the court.
No claim concrete damage
The collective proceedings of the Data Privacy Foundation revolved around the question of whether Facebook Ireland acted unlawfully on a number of points. No compensation could be claimed in this procedure.