The EU Court of Justice has upheld the right of national regulators outside Ireland to sue Facebook for privacy violations in the EU. In an appeal against a decision from the Belgian Data Protection Authority, Facebook had claimed that only the Data Protection Commission in Ireland, where Facebook's European operators are based, could conduct such a case. The EU court disagreed, saying the General Data Protection Regulation allows any national regulator to sue in a case of cross-border data processing.
The case was referred to the EU court for an opinion by the Brussels appeals court, which is hearing the Data Protection Authority's case. The EU court's advocate-general already backed the Belgian regulator's position in an opinion issued in January.
Under the GDPR, companies active in multiple EU countries may choose a 'one-stop shop' for regulatory supervision, usually in the country where they are headquartered. This regulator then handles all the company's compliance across the EU.
However, the Irish national authority has become overwhelmed with cases due to the many large internet companies basing their European businesses there. At the same time regulators in other countries have found it difficult to pursue cases against the internet giants, as they often have no registered legal subsidiary in the other countries.
The court found that national regulators do not have to rely on the lead supervisory authority for a company, as long as they respect the GDPR's provisions for cooperation and coordination with other countries. The company also does not have to have a local subsidiary, only a presence somewhere in the EU, in order to face a case in national courts. Furthermore, allowing local regulators to pursue their own cases before national courts is in line with the protection of the data subject's fundamental rights to privacy and to effective remedies for protection, the court noted.
The ruling was met with a quick response from the CCIA, the lobby group representing large internet groups like Facebook and Google,. The industry group said that enforcement of the GDPR is likely to become inconsistent across the EU states as a result of the ruling, something lawmakers had tried to avoid with the original one-stop-shop concept. This may also raise the costs of compliance and increase liability, counteracting the original promise to reduce the burden on businesses under the harmonised EU legislation.
