Facebook is facing fines of €250,000 per day unless it alters the operation of tracking cookies in Belgium after a data protection court ruling. Facebook has said it will be appealing.
The court action dates back to June when the country’s data protection watchdog filed a civil suit against Facebook, following a highly critical report of Facebook’s data protection practices which the Belgian DPA commissioned following updates to Facebook’s privacy policy at the start of this year.
At specific issue in this court case: how Facebook deploys tracking cookies and social plug-ins on third party websites to track the Internet activity of users and non-Facebook users. At the time of filing the suit, the Belgian DPA said Facebook had failed to answer questions about how it tracks non-users and what it does with the data it gleans — hence the watchdog’s decision to challenge the company in court. It also said it wanted to seek legal clarity on whether it had jurisdiction.
In seeking to combat the suit, Facebook had argued the Belgian privacy commission had no jurisdiction over its European business, given it is headquartered in Ireland. However the court slapped this down, ruling that Belgian data protection law does indeed apply and that Belgian courts have jurisdiction.
On this point it’s worth noting the Brussels’ court ruling aligns with recent landmark rulings by Europe’s top court, the ECJ, also relating to jurisdiction and data protection — including the so-called right to be forgotten ruling involving Google Spain, and a more recent judgement where the ECJ ruled that the Hungarian data protection authority is able to impose data protection-related fines on a Slovakian website which was offering services in Hungary — because it judged the latter to have some establishment in the country.
Returning to the Belgian data protection case, Facebook has since sought to argue its tracking cookies are an important security measure for users of the site — albeit it has not provided any public comment on how it is proportionate for an online service to systematically track non-users even for, ostensibly, security purposes.
Writing a blog post on the case last month, Facebook’s CSO Alex Stamo claimed: “We use the datr cookie to help differentiate legitimate visits to our website from illegitimate ones.”
“If the court blocks us from using the datr cookie in Belgium, we would lose one of our best signals to demonstrate that someone is coming to our site legitimately. In practice, that means we would have to treat any visit to our service from Belgium as an untrusted login and deploy a range of other verification methods for people to prove that they are the legitimate owners of their accounts. It would also make Belgian devices more attractive to spammers and others who traffic in compromised accounts on underground forums,” he added.
However again the court was again unimpressed by this line of argument. The Belgian DPA says the court found it “not credible” that systematic collection of a tracking cookie each time a social plug-in is loaded on a website should be necessary for the security of Facebook’s services — ergo it dubbed Facebook’s processing of personal data of people who do not have a Facebook account as “disproportionate”.
Facebook had also sought to argue that the data it collected via the datr tracking cookie was not personal data — but rather a means for it to identify a computer — with Stamo claiming “the datr cookie is only associated with browsers, not individual people” and saying: “It doesn’t contain any information that identifies or is tied to a particular person.”
“At a technical level, we use the datr cookie to collect statistical information on the behavior of a browser on sites with social plugins, such as the Like button, to help us distinguish patterns that look like an attacker from patterns that look like a real person,” he added.
Again the court evidently disagreed with this depiction, determining that the info being gathered and processed by Facebook via this cookie is indeed personal data. And — given the lack of consent for Facebook to gather and process the personal data of non-users — the court also judged this to be a “manifest” violation of Belgian data protection, according to the Belgian DPA.
Facebook provided the following statement to TechCrunch in response to the ruling: “We’ve used the datr security cookie for more than five years to keep Facebook secure for 1.5 billion people around the world. We will appeal this decision and are working to minimize any disruption to people’s access to Facebook in Belgium.”