Facebook’s dodgy defaults face more scrutiny in Europe
Italy’s Competition and Markets Authority has launched proceedings against Facebook for failing to fully inform users about the commercial uses it makes of their data.
At the same time, a German court has today upheld a consumer group’s right to challenge the tech giant over data and privacy issues in the national courts.
Lack of transparency
The Italian authority’s action, which could result in a fine of €5 million for Facebook, follows an earlier decision by the regulator, in November 2018 — when it found the company had not been dealing plainly with users about the underlying value exchange involved in signing up to the “free” service, and fined Facebook €5 million for failing to properly inform users how their information would be used commercially.
In a press notice about its latest action, the watchdog notes Facebook has removed a claim from its homepage — which had stated that the service “is free and always will be” — but finds users are still not being informed, “with clarity and immediacy” about how the tech giant monetizes their data.
The Authority had prohibited Facebook from continuing what it dubs “deceptive practice” and ordered it to publish an amending declaration on its homepage in Italy, as well as on the Facebook app and on the personal page of each registered Italian user.
In a statement responding to the watchdog’s latest action, a Facebook spokesperson told us:
We are reviewing the Authority decision. We made changes last year — including to our Terms of Service — to further clarify how Facebook makes money. These changes were part of our ongoing commitment to give people more transparency and control over their information.
Last year Italy’s data protection agency also fined Facebook $1.1 million — in that case for privacy violations attached to the Cambridge Analytics data misuse scandal.
Dodgy defaults
In separate but related news, a ruling by a German court today found that Facebook can continue to use the advertising slogan that its service is “free and always will be” — on the grounds that it does not require users to hand over monetary payments in exchange for using the service.
A local consumer rights group, vzbv, had sought to challenge Facebook’s use of the slogan — arguing it’s misleading, given the platform’s harvesting of user data for targeted ads. But the court disagreed.
However, that was only one of a number of data protection complaints filed by the group — 26 in all. And the Berlin court found in its favor on a number of other fronts.
Significantly, vzbv has won the right to bring data protection-related legal challenges within Germany even with the pan-EU General Data Protection Regulation in force — opening the door to strategic litigation by consumer advocacy bodies and privacy rights groups in what is a very pro-privacy market.
This looks interesting because one of Facebook’s favored legal arguments in a bid to derail privacy challenges at an EU Member State level has been to argue those courts lack jurisdiction — given that its European HQ is sited in Ireland (and GDPR includes provision for a one-stop shop mechanism that pushes cross-border complaints to a lead regulator).
But this ruling looks like it will make it tougher for Facebook to funnel all data and privacy complaints via the heavily backlogged Irish regulator — which has, for example, been sitting on a GDPR complaint over forced consent by adtech giants (including Facebook) since May 2018.
The Berlin court also agreed with vzbv’s argument that Facebook’s privacy settings and T&Cs violate laws around consent — such as a location service being already activated in the Facebook mobile app; and a pre-ticked setting that made users’ profiles indexable by search engines by default
The court also agreed that certain pre-formulated conditions in Facebook’s T&C do not meet the required legal standard — such as a requirement that users agree to their name and profile picture being used “for commercial, sponsored or related content,” and another stipulation that users agree in advance to all future changes to the policy.
Commenting in a statement, Heiko Dünkel from the law enforcement team at vzbv, said: “It is not the first time that Facebook has been convicted of careless handling of its users’ data. The Chamber of Justice has made it clear that consumer advice centers can take action against violations of the GDPR.”
We’ve reached out to Facebook for a response.
