Facebook Can Use Personal Data Without Explicit Consent: Vienna Court

(This article has utilised a translation tool for analysing the judgment)

Recently at the Computers, Privacy, and Data Protection Conference, 2021 held at Brussels, Apple Inc. CEO Tim Cook criticised Facebook Inc. (not directly) for collecting too much personal information and turning a blind eye towards the age of disinformation. While not mentioned specifically by name, Mr. Cook’s remarks were undoubtedly towards the social media giant, also accusing it of only prioritising ‘high rates of engagement’. Interestingly, earlier this year, Facebook CEO Mark Zuckerberg had accused Apple Inc. of abusing its dominant position in the market. The comments from Mr. Zuckerberg were fumed on Apple’s new policy of privacy notifications which may provide users the ability to decline the collection of personal data for the purposes of targeted advertising, a business model on which Facebook is dependent for its revenues.

However, our article is not directed towards the feud between the two largest technology giants of the world. Our article focuses on a recent ruling by the Vienna Higher Regional Court (“Vienna Court”), which has potentially provided Facebook to circumvent ‘consent’ under the General Data Protection Regulation (“GDPR”). The case stems from a suit filed by privacy advocate Mr. Max Schrems in yet another case of Maximilian Schrems v. Facebook Ireland Limited. The case is in relation to Facebook’s processing of user data under the GDPR. Article 6 of the GDPR provides for instances that would be considered as lawful processing of data by a company. Article 6(1)(a) in this regard relates to the processing of data when the data subject has given lawful consent for the purposes of the processing for one or more specific purposes, and Article 6(1)(b) of the GDPR allows processing of personal data for the purposes of performance of a contract to which the data subject is a party. Essentially, the GDPR provides for strict requirements for consent which has a higher standard of regulation on the basis of Article 6 of the GDPR. However, such a strict standard has not been provided in civil law contracts which means that while under Article 7(3) of the GDPR, the data subject has the right to withdraw the consent at any time, under civil law contract, users would not be able to withdraw their consents as, unlike the GDPR, the civil law contract does not provide for separate and unambiguous consent. This legality forms one of the basis of Mr. Schrems’ complaint against Facebook.

The GDPR came into effect on May 25, 2018, when Facebook transferred the consent of its users into their civil law terms and conditions, claiming to have a contract with users. Hence, the new contract replaced the earlier consent provided by Facebook before the GDPR was enacted. This meant that Facebook could now claim to process personal data under Article 6(1)(b) of the GDPR for the purposes of the performance of a contract. This reasoning was invoked by the Vienna Court to state that Facebook did not require the explicit consent of its users for the purposes of processing data as the processing was based on Article 6 instances of the GDPR. However, the Vienna Court directed Facebook to allow Mr. Schrems access to his data, which is held by Facebook. The Vienna Court further allowed for damages amounting to EUR 500 for the incurrence of ‘emotional damages’.

BlockSuits Comments

Even though Facebook lost its appeal on the ‘right to access’ aspect, the judgment of the Vienna Court poses a necessary question of whether technology companies have the leeway for circumventing consent requirements enumerated under the GDPR. The Vienna Court has also allowed for an appeal to the Austrian Supreme Court, hence, it is a possibility that such circumvention of consent aspect is overturned and restricted. However, currently, Facebook, by transferring consent to its civil terms and conditions, is able to process data without requiring the explicit consent of its users, and collect personal information for the purposes of personalised advertising. In fact, Mr. Schrems complaint also reiterated towards aggregation and processing of data for the purposes of personalised and targeted advertising. The Vienna Court in this regard reasoned that the users of Facebook have entered into a contract to receive personalised advertising, further explaining that such targeted and personalised advertising represents Facebook’s business model. Hence, it could be argued that Apple CEO Mr. Cook’s comments on Facebook’s advertising and collection of personal information practises should be construed upon merits and to an extent, may be justified.

Authored by Shivani Agarwal, Founder, and Samaksh Khanna, Co-Founder.