Facebook has told a court in Vienna that: “We don’t need user’s consent [to process data].” It went on to say that since May 25, 2018, it has been collecting and processing data without the user’s consent. The admission will shock most governments and privacy groups, especially after multiple public statements by Facebook’s CEO, Mark Zuckerberg, insisting that the company adheres to all privacy laws.
The claims came in a case before the Vienna Regional Court (Landesgericht für Zivilrechtssachen). The case has been brought by European privacy advocacy group, noyb.eu. The group, led by privacy advocate Max Schrems, sought to prove that Facebook was deliberately circumventing GDPR and continuing to process users PII.
The result is that the case has now been postponed to February. The court will expect Facebook to provide someone more competent to answer the technical questions from noyb.
Facebook claims users signed an advertising contract
Facebook claims that it is no longer bound by GDPR because of the way it changed its terms and conditions. It is relying on Article 6(1)(b) of the GDPR which states: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”
In court, lawyers for Facebook said: “when users accepted its new terms and conditions on May 25, 2018, they concluded such an advertising contract.” They went on to say that this means users: “ordered ‘personalized advertising.’”
To counter this claim, noyb produced the results of a neutral study by the Austrian Gallup Institute (in German). It showed that only 4% of users want advertising. According to nyob, this means: “the ‘ads contract’ seems to be forced upon the other 96%.”
Katharina Raabe-Stuppnig, lawyer for noyb said: “There can be no question of an ordered ‘service’ to the user. If Facebook wants to aggregate user interests and track people on the internet, this can only be done with the consent of the users. Anything else would be a circumvention of the GDPR.”
There raises are two significant questions.
- How many users actually bothered to read the terms and conditions?
- How many who did read, understood the implications of the “ad contract”?
Enterprise Times: What does this mean?
As statements go, Facebook admitting that it doesn’t need users consent to process their data is a bombshell. It continues what may believe to be a complete disregard for the privacy of users in order to make money. It is likely that privacy regulators across Europe will be watching this case very closely to see what happens in February. The court will expect Facebook to provide a witness who is competent when it comes to understanding privacy rather than one who has what can only be described as a trophy job title.
If Facebook cannot make a better case for the way it handles and processes user data it could also find itself in deeper trouble. It won’t take much to prove that the wording of the terms and conditions are such that even educated users had no clue of the implications.
This case is unlikely to be resolved in Vienna unless Facebook does a rapid about face. That means it will inevitably end up at the European Court of Justice. If Facebook loses there, it is highly likely that regulators will go for the maximum possible GDPR fine. In 2018, Facebook reported turnover of $55.8 billion. A fine of 4% would be $2.23 billion.
There are also other ramifications of this for Facebook. It is struggling with regulatory approval for its virtual currency Libra. It has already seen several of its initial backers step away from the project. Given its approach here over circumventing GDPR, expect EU lawmakers to use this an evidence that it cannot be trusted.