BEUC and NOYB oppose Meta's pay-or-consent model

Freepik

I am sure you have noticed that in early November, Meta launched paid subscriptions for its social media. Now you may choose to stop receiving targeted advertisements on Facebook and Instagram under one condition -  you have to pay €9.99/month on the web or €12.99/month on the iOS and Android versions of the apps. Of course, without payment, you can still use the services, but then you have to accept the personalised advertisements, which means you accept that your data is processed for this purpose. This Meta policy is the result of various disputes with European institutions and national supervisory authorities related to Meta's practices of processing users' personal data (including the July ruling in case C-252/21 where the CoJ criticised some of Meta's illegal approaches to personal data)*.

The very announcements of paid subscriptions have already triggered a wave of criticism. So it didn't take long for the first steps to challenge the legitimacy of the Meta's actions. A few days ago NOYB, which is a non-profit organization led by privacy activist Max Schrems, announced that it filed a GDPR complaint against Meta over "Pay or Okey". According to NOYB, such a "privacy fee" is not only illegal, since you cannot be forced to pay for exercising your fundamental right to privacy, but moreover, it risks having a domino effect and being taken over by other leading players in the digital services market as well. 

But this is not the only step against Meta's new practice. Today BEUC, which is a European Consumer Organization, also has voiced its opposition to this practice, stating that it is "an unfair choice for users, which runs afoul of EU consumer law on several counts and must be stopped". Thus, BEUC together with its 19 members filed a complaint on grounds of Meta engaging in unfair commercial practices in multiple ways. As BEUC stated, partially blocking the use of Facebook and Instagram until users have selected one option or the other constitutes an aggressive practice under European consumer law. What is more, opting for the paid subscription doesn't guarantee that a user gets a privacy-friendly option involving less tracking and profiling - user's personal data still may be collected and used but for purposes other than ads. More detailed assessment of Meta's subscription model you can find here. 

It remains to be seen how these actions will affect the Meta approach in the future. One thing is certain - the story will have its continuation, perhaps before the Court of Justice.

*The Court, inter alia, questioned Meta's legal grounds for processing personal data for personalization purposes, i.e. Article 6(1b) of the GDPR (the necessity of processing data for the performance of a contract), and Article 6(1f) of the GDPR (the processing of data on the basis of legitimate interests of the controller or a third party) - see paragraphs 97-126 of the ruling. 

Cookies, Google Analytics, transfers of PRN data and new guidelines on the right of access… Wrapping-up January events in data protection

The New Year brought us some interesting developments in the data protection landscape. There are a few January facts worth noting:

Fines imposed on Google and Facebook for non-compliance with the cookie rules 

At the beginning of January*, the French supervisory authority, Commission Nationale de l'Informatique et des Libertés (CNIL), imposed a 150 million euro fine on Google and a 60 million euro fine on FACEBOOK IRELAND LIMITED - both for violations related to the use of cookies. According to the authority, users of sites owned by the companies (namely google.fr, youtube.com and facebook.com) cannot reject cookies as easily as they can accept them. Accepting cookies is possible with a single click of a button on the page, while the equivalent option is not available for refusing cookies. Denying consent to cookies requires more involvement on the part of the user and at least several clicks. As a result, such a complicated refusal mechanism may act as a disincentive for users, so that they are more likely to accept cookies against their will. This in turn violates Article 82 of the French law transposing the provisions of the e-Privacy Directive. It also fails to meet the requirements of legally binding consent under the GDPR.

Freepik.com

As a reminder, this is not the first sanction imposed by the CNIL on Google. In December 2020, the CNIL also fined Google LLC and Google Ireland Limited 100 million euro, because a large number of cookies used for advertising purposes was automatically deposited on a user's computer, without obtaining prior consent and without providing adequate information. The Google companies filed an appeal against the decision, but the French Council of State in late January 2022 upheld the CNIL's decision. 

Use of Google Analytics not compliant with the GDPR

January was not a successful month for Google in terms of data protection. In addition to the above penalties, the Austrian Data Protection Authority found that a tool used on many websites, Google Analytics, violates the protection of EU citizens' personal data.** Why? Because the tool transfers personal data to the United States, and in the US, Europeans' personal data is not adequately protected. Previously, personal data from the EU to the US could be transferred under the EU Commission's decision on the adequacy of the protection provided by the EU-US Privacy Shield, but since the CJEU declared that decision invalid in mid-July 2020, data controllers should base data transfers on a different legal ground (for example, on standard contractual clauses). The problem is that the US law does not provide sufficient protection against access to personal data by various public authorities, regardless of the legal basis on which personal data is transferred. And regardless of the fact that EU-US data transfers became illegal literally overnight, many companies continue to transfer personal data to the United States, mainly using IT tools provided by US companies, just like Google Analytics or other similar technologies. The decision of the Austrian authority is therefore not surprising, but it certainly provides another confirmation that transfers of personal data to the US are legally questionable. Companies should examine their practices and consider choosing alternative European IT tool providers. But not only companies! Looks like the European Parliament should too - the European Data Protection Supervisor also issued a decision in January this year in which he questioned the legality of data transfers collected via cookies on one of the EP's websites. 

Freepik.com

EU rules on the collection of air passenger information are in line with the EU Charter of Fundamental Rights and the GDPR, but with some reservations

On the 27th of January, AG Pitruzzella delivered his opinion in case C-817/19 Ligue des droits humains concerning, inter alia, the interpretation of the provisions of Directive 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. AG Pitruzzella assumes that the transfer of PNR data and the pre-travel screening of air passengers by means of automated processing of such data is generally compatible with Articles 7 and 8 of the EU Charter of Fundamental Rights. However, he also pointed out that such data should only be stored when necessary in view of a serious and genuine threat to security and for a period limited to the minimum necessary. 

This case deserves a wider comment and a separate blog post, so we will come back to this topic shortly, as soon as the English version of the opinion is published on the Court's website. 

Guidelines on data subject rights - right of access

Finally, at the end of January, the European Data Protection Board published new guidelines on data subjects' rights, specifically on the right of access to data. For the time being, this is the version for public consultation. The feedback period is now open, so make your voice heard until March 11th!

* To be precise - CNIL's decisions were issued on December 31, 2021, but the information about the fines was published on the authority's official website in the first days of January. 

** Again, the decision was issued just before Christmas, but published on January 12, 2022. 

Facebook ventures further into social commerce: implications for consumer protection

GUEST POST BY

Dr Christine Riefa, Reader, Brunel University

@cyberchristine

Facebook has announced the launch of Facebook Shops on 19 May 2020, a feature primarily aimed at small businesses wanting to sell online. While this is announced as a solution to help during the pandemic, the move had been on the cards for a while (starting with the launch of libra, as a cryptocurrency in 2019). Yet, this launch comes at a time where many shops had to close during the pandemic and are trying to find viable solutions to continue sales. This also comes amid the backdrop of a surge in the uptake of online commerce during lockdowns around the world.

So far, sales on Facebook were limited to the use of marketplace. The Facebook marketplace only enabled users to post adverts and sellers to send direct messages with a view to conclude a sale but it did not support online payments. Marketplace was primarily built for C2C sales (although it was also used by some small businesses). Facebook Shops will drastically change this. It is billed to rival amazon and Etsy in capturing the online e-commerce market. This follows on from other social commerce ventures by Facebook on other platforms it owns, notably on Instagram. On Instagram, users can make use of a ‘shop now’ button (although this functionality is reserved to a small selection of partners). The ‘shoppable posts’ allow consumers to click on featured items and purchase without leaving the Instagram platform.

The Facebook Shops feature will enable payments to be taken and retailers to set up shops available from both Facebook and Instagram. The service will be free for businesses to use as Facebook relies on advert sales to make the venture profitable. The system also allows retailers to link to third party platforms to manage inventories. It promises to make social commerce seamless, a quality it has so far lacked, mostly because payment solutions did not exist to integrate with this new selling method.

The arrival of this new offering seems to cement the rise of social commerce as a new retail channel. Up to date, social commerce (i.e., social media tools and interactive technologies used in an electronic commerce setting) was developing but remained embryonic. Facebook’s move may well finally launch social commerce for good.

This raises some important questions for consumer protection. Most of the legislation adopted to frame online purchases has focuses on electronic commerce. As social commerce is not simply transactional, and it also builds on a rich social, interactive and collaborative shopping experience (see Yang (2015) 24 Retailing Consumer Serv.) many of the rules in place may not totally be adapted. After all the Facebook Shops is looking for people to ‘experience the joy of shopping versus the chore of buying’ (see https://about.fb.com/news/2020/05/introducing-facebook-shops/). Yet, consumer law has primarily developed based on the information paradigm. This implies that buying is more akin to a chore where the ‘average consumer’ is expected to do his homework and arrive at sound purchasing decision. It requires time spent on the small print, on studying the suitably of a product to ones’ need. As a result, this shift of emphasis as announced by Facebook for its new social commerce offering comes to question some of the underlying rationale for legislation and established policy direction. Besides, consumers will be able to easily share posts about products they are interested in or have purchased, signaling their preferences to their social networks. While Facebook promises this sharing will be at the discretion of the users, other aggregated data on browsing will be collated and shared with the businesses, as well as influence the selection of adverts a consumer may see (https://about.fb.com/news/2020/05/privacy-matters-facebook-shops/). This raises some questions relating to freedom of choice, when big data effectively comes to frame those choices and may also lead to some framing of prices (through price personalization).

This leads to reflect on whether or not, consumer law in its current form is fit for purpose and can serve consumers in their social commerce experiences. There are currently a number of pervasive legal issues associated with social commerce:

-       Legal identification of traders in a social commerce context;

-       Online reviews and notably fake reviews and endorsements.

-       Personalised advertising based on data gathered on social media

-       Potential for personalised pricing that may prove discriminatory and/or cause detriment by artificially raising the price of goods offered

-       Control of digital influencer marketing

-       Sale of fake and/or dangerous products on social media platforms

-       Controlling sales and enforcement of the law across geographical boundaries

-       Regulation of liability on social commerce platforms.

As social commerce becomes more mainstream, those questions will need to find an urgent answer. The danger is of course that while consumers may have learnt to be weary of retailers’ ability to inflate the truth about their product they are less suspicious and potentially more easily influenced in situations where a product is marketed and sold via the intermediary of influencers, or when a product is posted by someone in their social network. In this context, already failing underpinnings of information as a shortcut for protection, inflated expectations placed on consumers to behave as rational economic agents, underperforming public enforcement alongside an absence of platform liability may well all line up to create consumer detriment on a large scale.

Notes:

This blog post builds on previous research published by the author. Notably, see C. Riefa, Beyond e-commerce: Beyond e-commerce: some thoughts on regulating the disruptive effect of social (media) commerce (Alèm do comércio eletrônico: algumas reflexōes sobre a regulação dos efeitos maléficos do comércio social (mídia), Revista de dereito do consumidor RDC (Brazil) 127 (Jan-Feb 2020), 281-304, available at SSRN: <http://ssrn.com/abstract=3608016>; C. Riefa, ‘Consumer Protection on Social Media Platforms: Tackling the Challenges of Social Commerce’ in T. Synodinou, Ph. Jougleux, Ch. Markou., Th. Prastitou, EU Internet Law in the Digital Era (Springer, 2019);

C. Riefa, L. Clausen, Towards Fairness in Digital Influencers’ Marketing Practices 8 (2019) 2 EuCML 64-74, available at SSRN: <https://ssrn.com/abstract=3364251>.

Monitoring duties of online platform operators before the Court - case C-18/18 Glawischnig-Piesczek

Before the summer we briefly referred to the opinion of Advocate General Szpunar is case C-18/18 Glawischnig-Piesczek (see: Recent developments in online content moderation...). Last Thursday, the Court of Justice delivered the judgment in the case, clarifying the interpretation of Articles 15 and 18 of Directive 2000/31/EC on electronic commerce. 

Source: Pixabay

Background of the case

The case concerned a defamatory comment published on Facebook about a member of the Austrian Greens party, Ms Eva Glawischnig-Piesczek. The politician brought an action against the operator, requesting it to cease and desist from publishing photographs of her if the accompanying text contained allegations identical to those declared illegal or having equivalent content. In doing so she relied on Austrian provisions authorizing the courts to order host providers to terminate or prevent an infringement, in line with Articles 14(3) and 18 of E-Commerce Directive. The referring court, however, run into doubts whether an order to remove or disable access not only to a particular item of information, but also to equivalent items complied with Article 15(1) Directive 2000/31. Pursuant to this provision, Member States shall not impose a general obligation on providers of, among others, hosting services to monitor the information which they transmit or store, nor a general obligation actively to seek facts or circumstances indicating illegal activity. The referring court also wondered about the territorial scope of such an order (for a similar discussion about the right to be forgotten, see: No one-size-fits-all approach to search engine de-referencing...)

Judgement of the Court

The Court gave a comparably broad reading to Article 18 Directive 2000/31 concerning judicial powers to adopt measures designed to terminate alleged infringements and prevent further impairment of the interests involved. According to the Court, Member States enjoy a broad discretion in relation to actions and procedures for taking necessary measures (para. 29). Such a margin of discretion is due to, among others, the rapidity and geographical extent of the damage arising in connection with information society services. Both of these factors were also clearly at play in the present case (para. 36).

Having said that, the Court decided to distinguish between injunctions concerning information whose content is identical to the one which was previously deemed illegal and injunctions concerning information with equivalent content (whose message remains "essentially unchanged and therefore diverges very little from the content which gave rise to the finding of illegality", para. 39).

In the former case, the Court confirmed broad powers of the national court and found that a host provider can be ordered to block access to or remove information with identical content, irrespective of who requested the storage of that information. The injunction granted for that purpose cannot be regarded as imposing on the host provider a general monitoring obligation, but rather concerns the monitoring ‘in a specific case’ (paras. 34, 37). 

When it comes to information with equivalent content the Court sought a balanced solution. It considered that injunctions should generally be able to extend to information, the content of which, "whilst essentially conveying the same message, is worded slightly differently, because of the words used or their combination, compared with the information whose content was declared to be illegal" (para. 41). The objective of an injunction, however, may not be pursued by imposing an excessive obligation on the host provider. To achieve this objective, the injunction must properly identify the specific elements of equivalent information, such as the name of the person concerned, the circumstances of the infringement and equivalent content to that which was declared to be illegal (para. 45). The monitoring of and search for information required of the host provider should be limited to information containing the elements specified in the injunction and be capable of being carried out by automated search tools and technologies (para. 46). Differences in the wording of equivalent content must not, in any event, be such as to require the host provider concerned to carry out an independent assessment of that content.

As regards territorial scope, the Court once again confirmed the broad reading of Article 18(1), Directive 2000/31, which "[did] not make provision ... for any limitation, including a territorial limitation, on the scope of the measures which Member States are entitled to adopt" (para. 49). Following the judgment, therefore, the E-Commerce Directive does not preclude the relevant injunctions from producing worldwide effects. Member States must, nevertheless, ensure that the measures which they adopt take due account of the rules applicable at international level.

Concluding thoughts

The judgment of the Court has multiple implications. Firstly, it strengthens the protection of parties affected by illegal content, but seeks to achieve this without undermining the validity of Article 15. As such, it does not provide for a straightforward solution to each and every future case and sets quite demanding requirements for both national courts and host providers. The former need to define what content they consider to be equivalent to that which had been deemed illegal. How courts will cope with such a task remains an open question. Host providers, in turn, must be ready to to take steps to monitor their platforms for identical or equivalent information, which - as the Court suggests - may require the use of technological tools. The same seems to be true for smaller platforms, even if arguments related to rapidity and geographical extent of the damage may not apply to them with equal force.

The judgment in C-18/18 Glawischnig-Piesczek is clearly relevant beyond the social media context. As noted by Christian Twigg-Flesner in a recent entry, the ruling can also be applied to other platforms like online marketplaces. Operators of such platforms could be required to take steps to monitor their content e.g. as regards the recurring presence of misleading information. The question remains whether the same could also become true for persons engaging in illegal actions.

Finally, attention should be drawn to the brief part of the judgment concerning territorial scope of online moderation. One cannot help noticing the similarity between this question and the one addressed in recent Google case. In Glawischnig-Piesczek, the Court did not provide for an equally balanced framework, but limited itself to stating that injunctions with worldwide effects are not precluded by Directive 2000/31. This remains in line with the opinion of Advocate General Szpunar - notably, the same AG whose advice was followed in the Google case. Both findings are, therefore, not necessarily inconsistent. In fact, the opinion in Glawischnig-Piesczek explicitly refers to the Google case. According to the AG, like with the right to be forgotten, "the legitimate public interest in having access to information will necessarily vary, depending on its geographic location, from one third State to another" (para. 99). Consequently, the limitation of extraterritorial effects of injunctions concerning harm to private life and personality rights, for example by way of geo-blocking, may remain "in the interest of international comity" (para. 100). Whether this is how the Court's reference to "the rules applicable at international level" is going to be read, nevertheless, is far from certain.

German regulator restricts Facebook data sharing

On 07.02.2019, Bundeskartellamt, the German competition regulator, issued a decision against Facebook restricting its processing of user data. 

The Bundeskartellamt points out that Facebook is in a dominant position with a market share of 95%. The closure of Google+, one of the competitors of Facebook, has intensified its dominance. Other companies, such as Twitter or Linkedin are considered to only operate in part of Facebook's market.

The decision states that the way Facebook collects, merges and uses data between its subsidiaries ammounts to abuse of dominant position, under competition law. One of the most troubling practices employed by Facebook is that it collects third-party data on users in an almost unlimited way and attaches all of these data to the users' facebook accounts. Data is being collected not only by other Facebook owned services, but by any website that has an embedded facebook button. It is worth noting that the data of the users was collected even if they would not interact with the facebook buttons (even if they  didnt 'like' a page).

What is even more concerning is that data is collected even if there is no kind of facebook sign on the page, when the website is using facebook analytics. This widespread collection of data allows facebook to form very detailed profiles of its users. 

With its decision, the Bundeskartellamt forbids this practice. Facebook, Instagram and Whatsapp will still be able to collect data on their users. However, Facebook will be prevented from assigning this data to a single facebook account, unless they have the voluntary consent of the users. However, the consent of the users is already required for third-party websites. The decision requires Facebook to make changes to its terms of service and data processing. The processing of data from third parties without the consent of users needs to be substantially limited. Facebook will have to come up with proposals on how to achieve that.

This decision comes after the publication of the first reports on the Code of practice against disinformation, signed by Facebook and other large online companies such as Google, Twitter and Mozilla. Facebook has to strengthen its commitments to empower consumers and boost cooperation with fact-checkers. However, if Facebook is serious about making their platform a fertile ground for those who seek to spread disinformation, it should first and foremost protect its users and their data from those who want to abuse them.

The decision is not yet final, as Facebook will have one month to appeal in German courts. It remains to be seen whether Facebook will challenge the decision. This decision serves to point out the increasing intersections between consumer law, data protection law and competition law. The Bundeskartellamt points out that their investigation required close cooperation with data protection authorities.

This is the dawn of a new age where the traditional compartmentalisations of law may not serve us as well  as in the past. Consumer law will also have to adapt in order to address challenges arising from novel business models, and especially in relation to data protection.

Italy fines Facebook for data related unfair commercial practices

Yesterday the Italian Competition Commission fined Facebook 10 million EUR for breaching the relevant provisions of the Italian Consumer Code implementing the Unfair Commercial Practices Directive. The Competition Commission found that not-disclosing that consumers' data is provided for commercial purposes amounted to a misleading practice and that the pre-selected consent on data sharing comprised aggressive practices. Interestingly, in addition to the large fine, Facebook was also ordered to issue an apology to its users on its website and on its app (see for more here).

This is an important step in the aftermath of the Cambridge Analytica scandal (see for more here, and our report here), and it will be hopefully followed in other Member States where due to the global nature of social media, it is very likely that similar breaches occurred. This then leads us back to an 'old' problem of national enforcement of EU wide infringements of consumer law, and the question of whether there is a need to overhaul and improve the existing enforcement regime of EU consumer law by empowering the EU Commission to take enforcement actions against EU-wide infringements (which we discussed here). What do you think?

The Facebook-Cambridge Analytica fallout and user privacy

Dear readers, this time we need to refer to slightly less usual sources to report on some rather interesting developments concerning themes that have been often brought up on this platform. 

First, yesterday Facebook's CEO Mark Zuckerberg had the chance to exchange views for over five hours with a number of US representatives and said something interesting about privacy policies. In the most extensive coverage I could find on the issue, ie on Vice (!) he is reported to have responded to a question on data privacy and what the company intends to change going forward that 

“This  gets into an issue that we and others in the tech industry have found challenging which is that long privacy policies are very confusing,” Zuckerberg said. “One of the things we’ve struggled with over time is to make things as simple as possible so people can understand it. We don’t expect that most people will want to go through and read a full legal document.

While making disclosures more effective is certainly a theme which is dear to many of us, the conundrum which Facebook seems to struggle with would probably best be addressed by means of more stringent rules on what data can be shared by social media and other service providers, with whom, and for what purposes. According to the Vice piece, Facebook is also taking a number of other steps to improve its practices in data use and encourage whistleblowing on "abusive" advertising.

Meanwhile, quite appropriately it seems, the GDPR will enter into force next month! While previously much criticism had been raised by the industry about the new and somewhat more restrictive rules introduced by the regulation, Zuckerberg has recently announced that Facebook will - with adaptations - seek to comply with the regulation's standard across its worldwide operations (see coverage on Gizmodo). In the wake of the Cambridge Analytica scandal, it seems that somewhat more privacy protection is in fashion after all. 

Data protection in 2018: waiting for the GDPR...

Happy 2018 dear readers! 

The new General Data Protection Regulation, which may make it more difficult for websites and other providers to collect our data without express consent, will only come into force in a few months. 

Meanwhile, national authorities seem to be reaching a point where they are ready to adopt less straightforward strategies to put a halt to what feels to many as excessive practices. See for instance the German competition authority, Bundeskartellamt, whose president has just announced in the press (with an interview in the Rheinischen Post, see also here a summary in Die Zeit) that the authority is investigating Facebook's data collection activities as an abuse of dominant position.

Although Facebook has no German subsidiary, action under competition law seems to be made possible as long as the practice exerts its effects in German territory. The authority had already put Facebook on notice a few weeks ago, especially with reference to the practice of collecting data when consumers browse outside of the social network to later reconnect such data to the user's Facebook account. 

Facebook's main defence against the charge is that they are just one social network and users can easily opt for one of their competitors, so they do not enjoy the position of market dominance which is a precondition for any charge of abuse under competition law. Looking forward to seeing this issue develop!