GDPR violations and ongoing anticompetitive investigation land Meta in hot water

The Amsterdam District Court has made waves by ruling that Meta violated the General Data Protection Regulation (GDPR; AVG in Dutch) from 2010 to 2020. The finding follows the European Commission’s preliminary view that the social media giant potentially engaged in anticompetitive conduct, a matter that the commission is continuing to investigate closely.

Meta owns several of the most popular social media platforms – including Facebook, Whatsapp and Instagram – which comprise a large share of the social platform market, generating and using vast amounts of personal data. Consequently, Meta has significant responsibilities with regard to its use of personal data and commercial behaviour.

In the Netherlands, Meta's use of personal data has attracted the attention of various claims organisations. Currently, no class action suits have yet been filed against Meta for possible antitrust violations – although many believe that this could be about to change.  

Court finds Facebook misused data

On 15 March 2023 the Amsterdam District Court ruled that Facebook Ireland – a Meta subsidiary – violated the GDPR in the Netherlands. The decision constituted a victory for the Data Privacy Foundation in its class action suit, affirming its claim that Facebook infringed the privacy rights of users by giving external developers access to personal data without sufficient notice.

However, the Netherland’s new Settlement of Large-Scales Losses or Damage Act (WAMCA), which entered into force on 1 January 2020, did not apply to the entire period of alleged infringements. Therefore, the court’s judgment utilised the country’s previous class action system (using a previous version of Article 3:305a of the Dutch Civil Code).

A striking difference between the two regimes is that the previous one prevented courts from directly awarding monetary damages, permitting only the issuance of a declaratory judgment. Such judgments can then go on to serve as a basis to claim damages in an individual civil court procedure or an agreement on a collective settlement – subject to the court’s approval. In sharp contrast to this, the WAMCA enables courts to award damages directly in class action proceedings.

In the case at issue, the Data Privacy Foundation claimed that Facebook infringed the privacy rights of users by giving external developers access to the personal data, without sufficiently informing them of this. The court ruled that Facebook had indeed violated the privacy rights of its Dutch users between April 2010 and April 2020. According to the court, Facebook should have informed users that their data, and the data of their Facebook friends, was being shared with and processed by external developers. Further, Facebook lacked the legal grounds to process personal data for advertising purposes and by doing so, it breached Article 8 of the European Convention on Human Rights. Lastly, Facebook unlawfully processed special categories of personal data (termed “sensitive data” by the GDPR) for advertising purposes without users’ explicit consent.

As the court founded its judgment in the former class action regime, it could not award monetary damages to the Data Privacy Foundation. Instead, it issued a declaratory judgment that Facebook acted unlawfully, which the company plans to appeal.

Antitrust class actions loom large

There have been several privacy class actions in the Netherlands – in contrast with a general sparsity of class actions involving antitrust law – with the suit against Facebook being the most recent and the first to yield a declaratory judgment.

In 2019 the Dutch Authority for Consumers & Markets and other European consumer authorities joined forces against Facebook, requiring the social media giant to adjust its general terms and conditions. This development mandated that Facebook be more transparent about its business model and collection of users’ personal data.

On 19 December 2022 the commission issued a statement of objections to Meta, expressing concern that its conduct may be in violation of Article 102 of the Treaty on the Functioning of the European Union (TFEU), which prohibits the abuse of a dominant market position. According to the commission’s allegation, Meta is abusing its dominant market position by pairing the Facebook marketplace with the platform’s personal network. This gives Facebook a significant advantage that its competitors cannot emulate. Meta also allegedly imposes unfair trading conditions with regard to the competing online ads that the platform utilises.

In the United Kingdom, Dr Liza Lovdahl Gormsen, a proposed class representative (PCR), also filed a class action suit against Meta in 2022 based on the same alleged abuse of dominance flagged by the European Commission. However, this claim has so far proved unsuccessful; the UK Competition Appeal Tribunal found no blueprint for the effective and efficient trial of the issues raised, sending the PCR  back to the drawing board in February 2023 (see ““Have another go”: UK competition claim against Meta sent back to the drawing board”).

We expect that the Dutch claim organisations will act when and if the European Commission establishes Facebook’s violation of Article 102 of the TFEU and fines the company. In the Netherlands, plaintiffs usually launch claims after the commission establishes an infringement, an approach that seems prudent in light of this recent unsuccessful suit in the United Kingdom.