Slowly and bit by bit, Facebook is losing legal ground in Europe over what many member states are now calling illegal practices that violate the privacy of users and non-users alike. The case it faces in France, however, is significant because of its timing and its root cause. The French privacy regulator CNIL has ordered Facebook to stop tracking the web activities of non-Facebook users, among other things, or face hefty fines. But in addition, it has called out Facebook for transferring European data to the US, which has basically been declared illegal in the EU.
There are two simultaneous threads here. The first is something many who follow Facebook’s European misadventures might already be familiar with. Facebook has been criticized, even sued, for placing cookies that track anyone who visits its web pages, regardless of whether the visitor is a Facebook user or not. These cookies are used, as you might have guessed, for advertising purposes.
France is hardly the only European country to call Facebook to task over such practices. Last November, Belgium also issued an ultimatum to the social networking giant over the same aggression. In Germany, Facebook faced, and lost, a privacy case of a different kind, one that revolved around its Friend Finder feature. Germany’s highest court declared that to be illegal since it did not inform registered users that their address books would be crawled and harvested for information and for what purpose.
France case against Facebook, however, adds another flavor. In October last year, the European Union declared that the transatlantic Safe Harbour Pact between the US and the EU was illegal. This agreement was used by many companies to transfer data from Europe to the US, bypassing the EU’s data transfer rules. The judgment on the pact was most likely influenced by the series of US spying even among those it considers its allies.
The EU court gave affected companies three months to adjust to the ruling, a grace period that expired last week. As such, France is now pushing forward with its claims of Facebook’s illegal data transfer activities. For its part, Facebook says that it complies with the region’s data protection law and will work with France’s CNIL to resolve the matter. France is giving Facebook three months to comply or suffer financial penalties.
As for the Safe Harbour Pact itself, the US and the EU have agreed on a new pact, it still isn’t in effect and the European Union says it needs more time to discuss the finer details.