Today January the 13th, the Advocate General of the Court of Justice of the European Union (CJEU) has delivered his opinion in the case opposing Facebook and the Belgian Data Protection Authority. According to his opinion, which reiterates the principle defended by the BE DPA, the one-stop shop mechanism established by the GDPR does not prevent supervisory authorities from bringing proceedings to court before a national judge as long as it is in situations specifically provided for in the GDPR. The CJEU will now take a decision in this case. The date of delivery of the judgment is not yet known.
The Belgian Data Protection Authority (DPA) as well as the Hessian authority of Germany have been notified by Mastercard company of a data breach detected on 19 August 2019 which would have affected a large number of data subjects, a significant portion of which would be German customers. Since the main establishment of Mastercard is located in Waterloo, the Belgian DPA is working closely with its Hessian counterpart and the other competent authorities to defend the interests of the persons affected by this incident.
The Court of Appeal of Brussels refers the Facebook case to the Court of Justice of the European Union
On 8 May 2019, the Court of Appeal of Brussels ruled in the Facebook case following the pleadings of 27 and 28 March 2019. The Authority argued that the Belgian courts are competent and demanded that Facebook comply with Belgian and European privacy rules. Before ruling on the merits, the Court of Appeal wants to ensure that the Authority can pursue the case against Facebook given the entry into application of the GDPR as of 25/05/2018. For this reason, the Court of Appeal decided to refer certain questions to the Court of Justice of the European Union.
The Data Protection Authority defends its arguments before the Court of Appeal in Brussels in the Facebook case
On 27 and 28 March 2019, pleadings in the Facebook case will take place before the Court of Appeal in Brussels. Facebook appealed against the judgment of 16 February 2018 of the Dutch-speaking Court of First Instance in Brussels. The DPA will argue that Belgian courts are competent and that Facebook should be ordered to respect Belgian and European privacy rules when it processes personal data through its cookies, social plug-ins and pixels.
The 16th of February, the Court of First Instance rendered its judgment in the proceedings on the merits in the case of the Privacy Commission vs. Facebook.