Belgian Court Uses Novel Argument to Assume International Jurisdiction over Non-EU Facebook Entities

Alston & Bird
Contact

On February 16, 2018, the Brussels Court of First Instance rendered a judgment in proceedings brought by the Belgian Privacy Commission’s against Facebook. The case forms one part of two-tiered litigation brought by the Commission in regards to alleged monitoring practices vis-à-vis Belgian internet users. In parallel to the proceedings that resulted in the judgment cited above, the Belgian Privacy Commission had also initiated a procedure referred to as “summary proceedings” against Facebook – and Facebook defeated the Privacy Commission’s claim before the Brussels Court of Appeal in June 2016.

The more recent judgment comes from the Belgian Court of First Instance (the “Court”) and concerns both Facebook users (Belgian internet users with Facebook accounts) and non-users (Belgian internet users without Facebook accounts). In these proceedings, the Court found in favor of the Privacy Commission, granting claims directed at three Facebook entities for allegedly improperly tracking the online behavior of internet users on Belgian territory through the use of social plug-ins, cookies and pixels. Cookies are placed on a user’s device, usually in a first party capacity (i.e. by Facebook itself), and retrieved when the user visits a third party website (e.g. through the use of a Facebook social plug-in integrated on that website). According to the Court, this in theory allows Facebook to track the user’s browsing behavior.

The Court ordered all three Facebook entities to cease the placement and collection of cookies with tracking capabilities without obtaining the user’s informed consent and offering an opt-out mechanism. The Court also ordered Facebook to delete personal information collected via such cookies from its own servers and from servers operated on its behalf. Material non-compliance with the Court’s order could potentially result in a civil penalty of 250,000 EUR per day, capped at 100 million EUR.

While the Court’s ruling has been widely published, it raises a number of questions that may yet be addressed on the appellate level. The Court adopted the Belgian Privacy Commission’s suggestion that it had jurisdiction over two non-Belgian Facebook entities, Facebook Ireland Ltd (“Facebook Ireland”) and Facebook Inc. (“Facebook Inc.”) – and it also found that Belgian privacy law applied to each entity. The Court reasoned that the territoriality principle of public international law made it competent to adjudicate the Privacy Commission’s claims against Facebook Ireland and Facebook Inc. The territoriality principle generally permits a state to subject conduct occurring on its territory to its laws, including conduct that occurs abroad but causes effects within its territory. However, Belgian privacy statutes do not expressly state that they govern conduct occurring abroad; instead, the Court used public international law principles to arguably extend the reach of Belgian privacy law to Facebook Ireland and Facebook Inc. This is a novel argument that Facebook may elect to challenge before the Belgian appeals courts.

Note that the under the GDPR, the Court’s resort to public international law to extend the scope of privacy law to non-EU actors may no longer be necessary. Unlike its predecessor Data Protection Directive and the Belgian privacy statutes passed to implement it, the GDPR provides for explicit extraterritorial application to companies outside the EU that “offer services to” or “monitor the behavior of” EU users from (see Art 3(2) GDPR).

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Alston & Bird | Attorney Advertising

Written by:

Alston & Bird
Contact
more
less

Alston & Bird on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.