German Court Says Facebook Violated Consumer-Data Rules -- WSJ

By Sara Germano 

This article is being republished as part of our daily reproduction of WSJ.com articles that also appeared in the U.S. print edition of The Wall Street Journal (January 25, 2020).

BERLIN -- A state court in Berlin ruled that some user terms set by Facebook Inc. violated consumer-data protection law, in the latest example of back-and-forth between companies and courts to define the boundaries of the European Union's extensive privacy rules.

The ruling Friday, from the highest court in the city-state of Berlin, is a regional interpretation of the EU's General Data Protection Regulation, which after nearly two years of being in effect still isn't uniformly enforced across Europe.

The Berlin ruling partially upheld a complaint from the Federation of German Consumer Organizations, finding that certain Facebook terms violated a principle of GDPR requiring that "informed consent" be given by users before their data is collected.

The cited terms include a default setting to allow search engines to display a link to a user's Facebook profile, and a requirement that users allow Facebook to use their name and profile picture for commercial purposes.

The consumer group bringing the suit, known in German by the acronym VZBV, said the ruling indicated that entities like itself could seek legal enforcement of GDPR without the involvement of an affected consumer.

"The Chamber of Justice has made it clear that consumer advice centers can take action against violations of the GDPR," said Heiko Dünkel, counsel at VZBV.

Part of the advocacy group's complaint, a challenge to Facebook's slogan that the social network "is and remains free" of cost, was struck down by the court.

Facebook said the case dated back to 2015 and terms cited by the VZBZ in its complaint "have long ceased to exist" as the company had updated its user settings.

"Independent of these German proceedings, we substantially revised our Terms of Service and Data Policy in the spring of 2018," Facebook said.

Enforcement of GDPR, particularly in Germany where privacy enjoys strong legal protection, has proved onerous for companies. Last February, Germany's Federal Cartel Office instructed Facebook to stop combining data it collects across its suite of products, which include WhatsApp and Instagram, arguing that the practice was anticompetitive.

That ruling was later overturned on appeal to a higher court, which found insufficient proof that Facebook's data collection methods violated competition law.

Facebook has argued in recent months that data is not a finite resource capable of monopolization, like oil, but something that can be both shared and stored. The Menlo Park, Calif., company is facing antitrust scrutiny by state and federal authorities in the U.S. as well as by the European Commission, the EU's enforcement arm.

Write to Sara Germano at [e-mail]

(END) Dow Jones Newswires

January 25, 2020 02:47 ET (07:47 GMT)

Copyright (c) 2020 Dow Jones & Company, Inc.