ECJ on the Processing of Personal Data by Meta

13. Okt. 2023 Benn-Ibler Rechtsanwälte

The European Court of Justice (ECJ) has ruled that processing personal data is lawful if the person concerned freely consents. There must be genuine freedom of choice for consent to be considered voluntary.

With regard to the collection and processing of user data, Meta Platforms relies on the user contract that users conclude by clicking on the REGISTER button, thereby agreeing to the terms of use. Consent is an essential prerequisite for the use of Facebook, their social network.

In 2019, the German Federal Cartel Office (Bundeskartellamt) initiated proceedings against Meta, ordering the company to adapt its general terms and conditions of use. It was to be clearly stated that data would not be collected and linked to Facebook accounts and used without the consent of the user in question. The Bundeskartellamt clarified: Such consent is invalid if it is a condition for using the social network.

A few days later, Meta appealed against the Bundeskartellamt’s decision to the Higher Regional Court in Duesseldorf, Germany. The court referred the matter to the ECJ for a preliminary ruling.

The ECJ ruled as follows:

Processing personal data is lawful if the person concerned freely consents to doing so. As the Bundeskartellamt has already argued, voluntariness only exists if the data subject is genuinely free to choose and to refuse processing without suffering any disadvantages. Similarly, consent is not freely given if there is a clear imbalance between the user and the data controller.

Article 6(1)(b) to (f) of the GDPR sets out the grounds on which the processing of personal data may be justified. According to the CJEU, these grounds must be interpreted narrowly, as they may result in processing being justified despite the absence of consent.

ECJ C-252/21 (4 July 2023)