Facebook's GDPR consent bypass via a 'contractual advertisement duty' before Austrian Supreme Court, with high potential for a reference to the CJEU

18 2021

Facebook's GDPR consent bypass via a 'contractual advertisement duty' before Austrian Supreme Court, with high potential for a reference to the CJEU

View 2.2K

word 859 read time 4 minutes, 17 Seconds

Austrian Press Agency (APA) and Der Standard report, a case that may determine the legality of Facebook's business in Europe has reached the Austrian Supreme Court (OGH). Facebook and Mr Schrems have both filed appeals against an earlier judgment by the Higher Regional Court of Vienna (OLG Wien). Among other issues, the alleged "bypass" of the strict GDPR's consent rules became central in the case. The Supreme Court was asked to refer the case to the European Court of Justice (CJEU) for clarification.

Facebook's "consent bypass". When the GDPR came into effect, one big benefit was the duty to have a clear opt-in consent when companies want to process user data. In addition to consent, there are five other legal bases to process data under Article 6(1) GDPR. One of these basis is processing that is "necessary for the performance of a contract". On 25.5.2018 at midnight, when the GDPR became applicable, Facebook has simply named things like "personalized advertisement" in its terms and conditions. Facebook now argues that it has a "duty to provide personalized advertisement" to the users, therefore, it does not need the user's consent to process his or her personal data.

The big difference between consent and contract? The GDPR has very strict rules on consent. Users must be fully informed, have a free choice to agree or to disagree and must be able to consent to each type of processing specifically. Users can also withdraw consent at any time and at no costs. Contracts are, however, a matter of each national law and are usually much more flexible. Users must not have understood a contract to be bound, details can be hidden in "terms and conditions" and they may come on a "take it or leave it" basis.

Katherina Raabe-Stuppnig, LGP, representing Mr Schrems: "Facebook is simply trying to relabel invalid consent to circumvent the GDPR. All other companies obtain proper consent - only Facebook thinks it can bypass that" and further "Just because you move a consent declaration into a contract, it must further be treated as consent. One has always had to interpret contracts primarily according to their true purpose. Consent in a contract must therefore be interpreted precisely as consent."

64% of users see "consent", 1,6% an "advertisement contract". noyb has commissioned a study by the Gallup Institute, in which 1,000 Austrian Facebook users were asked about their understanding of the agreement. About two-thirds interpreted the relevant page as Facebook seeking consent, only about 10% saw a "contract", of which only 16 users understood it to entail a duty to provide personalized advertisement (overall 1,6%), as claimed by Facebook. The two lower Courts in Austria however took the view that is solely in Facebook's discretion to claim a term to be a "contract" or "consent". Consequently they saw no issue with Facebook's bypass, but also held that the matter needs clarification by the Supreme Courts.

Undermining the GDPR? Facebook's approach can also be seen as a clear signal to ignore (at least the spirit of) the GDPR, while Facebook claims to be fully compliant. Der Standard cited the liberal Member of the European Parliament Sofie in 't Veld, that negotiated the GDPR and said: “The requirement to ask consent must stand firm. Contractual terms cannot be used as an escape clause for that requirement, or indeed for any other legal base for the processing of data. GDPR is clearly designed to give the users control over their data. Not to allow Facebook to swindle users out of their personal data."

Inactivity by Data Protection Authority. The same matter was also raised by noyb before the Irish Data Protection Commission (DPC) more than 2.5 years ago. The three investigations in the alleged "forced consent" were however moving slowly and the core issue of a "bypass" was found to be out of the scope of the procedure. In the Austrian case Facebook argued that the "bypass" was implemented after it had ten meetings with the DPC that developed the "bypass" with the Social Media Company. The DPC has denied this, but refused to disclose details of the ten confidential meetings with Facebook in the run-up to the GDPR. Two of the Irish cases are now the matter of a Judicial Review before the Irish High Court, the third case is on appeal before the Austrian Federal Administrative Court (BVwG).

Promising track record. The Austrian Supreme Court has previously referred similar cases to the CJEU (see e.g. C-18/18 - Glawischnig-Piesczek, C-498/16 - Schrems). The CJEU in turn has previously decided mostly against Facebook in privacy matters (see e.g. C-40/17 - Fashion ID or C-210/16 - Wirtschaftsakademie Schleswig-Holstein), most notably two cases against Facebook on EU-US data transfers dubbed "Schrems I" and "Schrems II". It is therefore not unlikely that there are serious troubles ahead for Facebook. The Austrian Supreme Court does not conduct oral hearings and usually decides about references to the CJEU in a matter of months and in a written decision. The CJEU itself however takes up to 1.5 years to conduct all hearings and reach a decision.

Source by noyb

LSNN is an independent editor which relies on reader support. We disclose the reality of the facts, after careful observations of the contents rigorously taken from direct sources, we work in the direction of freedom of expression and for human rights , in an oppressed society that struggles more and more in differentiating. Collecting contributions allows us to continue giving reliable information that takes many hours of work. LSNN is in continuous development and offers its own platform, to give space to authors, who fully exploit its potential. Your help is also needed now more than ever!

In a world, where disinformation is the main strategy, adopted to be able to act sometimes to the detriment of human rights by increasingly reducing freedom of expression , You can make a difference by helping us to keep disclosure alive. This project was born in June 1999 and has become a real mission, which we carry out with dedication and always independently "this is a fact: we have never made use of funds or contributions of any kind, we have always self-financed every single operation and dissemination project ". Give your hard-earned cash to sites or channels that change flags every time the wind blows , LSNN is proof that you don't change flags you were born for! We have seen the birth of realities that die after a few months at most after two years. Those who continue in the nurturing reality of which there is no history, in some way contribute in taking more and more freedom of expression from people who, like You , have decided and want to live in a more ethical world, in which existing is not a right to be conquered, L or it is because you already exist and were born with these rights! The ability to distinguish and decide intelligently is a fact, which allows us to continue . An important fact is the time that «LSNN takes» and it is remarkable! Countless hours in source research and control, development, security, public relations, is the foundation of our basic and day-to-day tasks. We do not schedule releases and publications, everything happens spontaneously and at all hours of the day or night, in the instant in which the single author or whoever writes or curates the contents makes them public. LSNN has made this popular project pure love, in the direction of the right of expression and always on the side of human rights. Thanks, contribute now click here this is the wallet to contribute

Similar Articles / Facebook... the CJEU