The Data Protection Authority defends its arguments before the Court of Appeal in Brussels in the Facebook case
Facebook collects information on the private surfing behavior of millions of internet users in Belgium every day. To this end, it places cookies on their computers and then collects these cookies through its social plug-ins and pixels. In this way Facebook can track internet users when they surf from one website to another. Facebook not only tracks the surfing behavior of Facebook members but also of other millions of internet users in Belgium who do not have a Facebook account.
Since Facebook’s social plug-ins and pixels are present on millions of websites, Facebook can identify a large part of everyone's surfing behavior. It can also concerns websites of a very sensitive nature, such as websites concerning health problems, sexual orientation and political preferences. Facebook then uses that information to profile your surfing behavior and uses that profile to show you targeted advertising, such as advertising about products and services from commercial companies, messages from political parties, etc.
According to the DPA, Facebook (still) not complies with Belgian and European privacy legislation. Since it concerns serious infringements, of which almost each Belgian internet user is the victim, the Privacy Commission already decided in 2015 to go to the court. On 16 February 2018, the Court of First Instance ruled in favor of the Privacy Commission. Facebook decided to appeal that judgment.
As legal successor of the Privacy Commission, the Data Protection Authority has the competence to pursue this claim. The new so-called "one-stop shop" mechanism in the GDPR does not change anything to this either. The GDPR nowhere states that it has the effect of suddenly ending all legal proceedings pending on 25 May 2018.
Despite the changes that Facebook has made during the run-up to the GDPR, Facebook still violates the fundamental rights of millions of residents of Belgium. The obligations that were previously in the Privacy Act have been strengthened since 25 May 2018. The DPA will therefore ask the Court of Appeal of Brussels to confirm the judgment of the Court of First Instance of 16 February 2018, also for the future.