New EU problems for Facebook regarding privacy protection

The European Court has ruled in case C‑319/20 Meta Platforms Ireland Limited, formerly Facebook Ireland Limited, v Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V.

The case concerns the issue of whether consumer protection associations bring legal proceedings for breach of privacy even without a particular mandate from consumers. The dispute has the following background:

Meta Platforms Ireland, which manages the provision of services of the online social network Facebook in the European Union, is the controller of the personal data of users of that social network in the European Union. Facebook Germany GmbH, which has its registered office in Germany, promotes the sale of advertising space at the internet address http://www.facebook.de. The Facebook internet platform contains, inter alia, at the internet address http://www.facebook.de, an area called ‘App-Zentrum’ (‘App Center’) on which Meta Platforms Ireland makes available to users free games provided by third parties. When consulting the App Center of some of those games, an indication appears informing the user that the use of the application concerned enables the gaming company to obtain a certain amount of personal data and, by that use, permission is given for it to publish data on behalf of that user, such as his or her score and other information. The consequence of that use is that the user accepts the general terms and conditions of the application and its data protection policy. In addition, in the case of a specific game, it is stated that the application has permission to post the status, photos and other information on behalf of that user.

The Federal Union, a body which has standing under Paragraph 4 of the Law on Injunctions, considers that the information provided by the games concerned in the App Center is unfair, in particular in terms of the failure to comply with the legal requirements which apply to the obtention of valid consent from the user under the provisions governing data protection. Moreover, it considers that the statement that the application has permission to publish certain personal information of the user on his or her behalf constitutes a general condition which unduly disadvantages the user.

In that context, the Federal Union brought an action for an injunction before the Regional Court, Berlin, Germany against Meta Platforms Ireland based on Paragraph 3a of the Law against unfair competition, the first sentence of point 11 of Paragraph 2(2) of the Law on Injunctions and the Civil Code. It brought that action independently of a specific infringement of a data subject’s right to protection of his or her data and without being mandated to do so by such a person.

The Regional Court, Berlin ruled against Meta Platforms Ireland, in accordance with the form of order sought by the Federal Union. The appeal brought by Meta Platforms Ireland before the Higher Regional Court, Berlin, Germany was dismissed. Meta Platforms Ireland then brought an appeal on a point of law (Revision) before the referring court against the dismissal decision adopted by the Higher Regional Court, Berlin.

The referring court considers that the action brought by the Federal Union is well founded, in so far as Meta Platforms Ireland infringed Paragraph 3a of the Law against unfair competition and the first sentence of point 11 of Paragraph 2(2) of the Law on Injunctions, and used an invalid general condition, within the meaning of Paragraph 1 of the Law on Injunctions.

However, that court has doubts as to the admissibility of the action brought by the Federal Union. It takes the view that it cannot be ruled out that the Federal Union, which did indeed have standing to bring proceedings on the date on which it brought the action – on the basis of Paragraph 8(3) of the Law against unfair competition and point 1 of the first sentence of Paragraph 3(1) of the Law on Injunctions – lost that status during the proceedings, following the entry into force of the GDPR and, in particular, Article 80(1) and (2) and Article 84(1) thereof. If that were the case, the referring court would have to uphold the appeal on a point of law brought by Meta Platforms Ireland and dismiss the action of the Federal Union, since, under German procedural law, standing to bring proceedings must endure until the end of the proceedings at last instance.

According to the referring court, the answer in that regard is not clear from the assessment of the wording, scheme and objectives of the provisions of the GDPR.

As regards the wording of the provisions of the GDPR, the referring court notes that the existence of standing to bring proceedings of not-for-profit bodies, organisations or associations which have been properly constituted in accordance with the law of a Member State, pursuant to Article 80(1) of the GDPR, presupposes that the data subject has mandated a body, organisation or association for it to exercise on his or her behalf the rights referred to in Articles 77 to 79 of the GDPR and the right to compensation referred to in Article 82 of the GDPR where the law of a Member State so provides.

The referring court states that standing to bring proceedings under Paragraph 8(3)(3) of the Law against unfair competition does not cover such an action brought on the basis of a mandate and on behalf of a data subject in order to assert his or her personal rights. On the contrary, it confers on an association, by virtue of a right peculiar to it and stemming from Paragraph 3(1) and Paragraph 3a of the Law against unfair competition, standing to bring proceedings on an objective basis against infringements of the provisions of the GDPR, independently of the infringement of specific rights of data subjects and of a mandate conferred by them.

In addition, the referring court observes that Article 80(2) of the GDPR does not provide for an association’s standing to bring proceedings in order to secure the application, objectively, of the law on the protection of personal data since that provision presupposes that the rights of a data subject laid down in the GDPR have actually been infringed as a result of the processing of specific data.

Furthermore, an association’s standing to bring proceedings, such as that provided for in Paragraph 8(3) of the Law against unfair competition, cannot result from Article 84(1) of the GDPR, under which the Member States are to lay down the rules on other penalties applicable to infringements of that regulation and are to take all measures necessary to ensure that they are implemented. The standing of an association, such as that referred to in Paragraph 8(3) of the Law against unfair competition, cannot be regarded as constituting a ‘penalty’ within the meaning of that provision of the GDPR.

As regards the scheme of the provisions of the GDPR, the referring court considers that it may be inferred from the fact that it harmonised, inter alia, the powers of the supervisory authorities that it is principally for those authorities to verify the application of the provisions of that regulation. However, the expression ‘without prejudice to any other … remedy’, which appears in Article 77(1), Article 78(1) and (2) and Article 79(1) of the GDPR, may undermine the argument that oversight of the application of the law is exhaustively governed by that regulation.

As regards the objective of the provisions of the GDPR, the referring court notes that the effectiveness of that regulation may support an argument in favour of associations having standing to bring proceedings on the basis of competition law, in accordance with Paragraph 8(3)(3) of the Law against unfair competition, independently of the infringement of specific rights of data subjects, since that would allow an additional opportunity to supervise the application of the law to remain, in order to ensure as high a level as possible of protection of personal data, in accordance with recital 10 of the GDPR. Nonetheless, accepting that associations have standing to bring proceedings under competition law may be considered to run counter to the objective of harmonisation pursued by the GDPR.

In the light of those considerations, the Federal Court of Justice decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:

‘Do the rules in Chapter VIII, in particular in Article 80(1) and (2) and Article 84(1), of [the GDPR] preclude national rules which – alongside the powers of intervention of the supervisory authorities responsible for monitoring and enforcing the Regulation and the options for legal redress for data subjects – empower, on the one hand, competitors and, on the other, associations, entities and chambers entitled under national law, to bring proceedings for breaches of [the GDPR], independently of the infringement of specific rights of individual data subjects and without being mandated to do so by a data subject, against [the person responsible for that infringement] before the civil courts on the basis of the prohibition of unfair commercial practices or breach of a consumer protection law or the prohibition of the use of invalid general terms and conditions?’

The Court’s decision:

Article 80(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as not precluding national legislation which allows a consumer protection association to bring legal proceedings, in the absence of a mandate conferred on it for that purpose and independently of the infringement of specific rights of the data subjects, against the person allegedly responsible for an infringement of the laws protecting personal data, on the basis of the infringement of the prohibition of unfair commercial practices, a breach of a consumer protection law or the prohibition of the use of invalid general terms and conditions, where the data processing concerned is liable to affect the rights that identified or identifiable natural persons derive from that regulation.

Brief IP news

  1. Who’s IP is it? The AI Inventor or the AI’s Inventor? For more information here.     
  2. Building High-Quality Patent Portfolios in the United States and Europe: Part III – Examiner Interviews. For more information here.  
  3. High-growth technology business forum – Licensing, 30 September 2021. For more information here.

Source: Intellectual Property Center at the UNWE. More information can be found here.

A new trademark database for some Andean countries is available

The EUIPO launched a new trademark database called CAN TMView that covers four Andean countries – Bolivia, Colombia, Ecuador and Peru.

The new trademark database, which is similar to the TMView database, will give access to more than 1.3 million trademarks in those for countries which population exceed 111 million people.

This is a good news for every trademark practitioner that has interest in registration of trademarks for these countries. The database is easy to use and will help a lot for conducting preliminary trademark searches and building appropriate trademark strategies.

For more information here.

Madrid System Online Services will not be accessible for several days

WIPO reports about the fact that some of the Madrid system online services will not be accessible between 09 and 11.07.2021. This happens due to scheduled maintenance of the system. In particular the services that will be disconnected are:

Happy World Intellectual Property Day – 2021

Happy World Intellectual Property Day!

This year WIPO celebrates the day focusing our attention on the critical role of small and medium-sized enterprises for the economy and how they can benefit from intellectual property rights.

More information can be found here.

Daren Tang is the new WIPO General Director

Daren Tang officially become Director General of the World Intellectual Property Organization. He succeeds Francis Gurry in this position after tense election in the light of the economic and political conflict between the US and China.

Mr. Tang is a former Chief Executive of the Intellectual Property Office of Singapore and will serve as WIPO General Director for a mandate of six years.

For more information here.

There is no communication to the public in case of photo disclosed to a court as evidence

The Advocate General of the European Court G. HOGAN has given an opinion in case  C‑637/19 BY v CX. This case concerns the following background:

BY and CX are both natural persons each of whom operates a website. In the course of a prior dispute before the civil courts, CX sent a copy of a page of text, including a photograph, from BY’s website as evidence in the underlying court proceedings. The photograph accordingly forms part of the documentary record in the proceedings.

BY claims to hold the copyright to that photograph and asks that CX be ordered to pay damages, first, for infringement of copyright and, second, for infringement of the special protection conferred on photographs by Article 49a of the Law on Copyright. CX contests any obligation to pay damages and maintains that the disclosure of the material for the purposes of the court proceedings did not amount to a copyright violation.

At first instance, the Patent- och Patent and Commercial Court, Sweden held that the photograph was protected by rights related to copyright, that is to say, by the special protection conferred on photographs. That court found, however, that because the photograph was transmitted to it as a procedural document, any third party may request communication of the photograph in accordance with the applicable provisions of Swedish constitutional law on access to documents. Although the Patent- och Patent and Commercial Court concluded that CX had distributed that photograph to the public within the meaning of the Law on Copyright, it considered that it had not been established that BY had suffered damage and, accordingly, dismissed its application.

BY appealed that judgment to the referring court.

The referring court considers that it must rule in particular on the question of whether the forwarding of a copy of that photograph to a court as a procedural step constitutes an unlawful making available of the work within the meaning of the relevant national copyright legislation, either as a distribution to the public or as a communication to the public.

It is not in dispute that the photograph was sent electronically (by email) to the court hearing the dispute between the parties in the form of an electronic copy. The national court is also seeking to ascertain whether a court may be regarded as falling within the concept of ‘public’ for these purposes.

The referring court points out that there is uncertainty as to the interpretation in Union law of the concepts of ‘communication to the public’ and ‘distribution to the public’ in the case of a transmission to a court in the course of civil proceedings of a copyright-protected work. This raises the question of, first, whether a court may be regarded as falling within the concept of ‘the public’ within the meaning of Directive 2001/29 and, second, whether the term ‘public’ must be given the same meaning in the context of the application of Articles 3(1) and 4(1) of Directive 2001/29.

In that regard, the referring court notes that the Court has held that the concept of ‘public’ refers to an indeterminate number of potential addressees and involves, moreover, a fairly large number of persons. It further emphasised that the aim is to make a work perceptible in any manner appropriate to ‘persons in general’, as opposed to specific persons belonging to a private group. (5)

It is also apparent from the case-law of the Court that the concept of ‘distribution’, within the meaning of Article 4(1) of Directive 2001/29, has the same meaning as the expression ‘making available to the public … by sale’ within the meaning of Article 6(1) of the WCT. It would appear, however, from the judgment of 13 May 2015, Dimensione Direct Sales and Labianca (C‑516/13, EU:C:2015:315), that for there to be ‘distribution to the public’ it is sufficient that the protected work has been delivered to a member of the public.

It is also necessary to ascertain whether, where a procedural document is transmitted to a court, either in the form of a physical (paper) document or as an attachment to an electronic mail, it is a ‘communication to the public’ or a ‘distribution to the public’, since such transmission produces the same effects and has the same purpose in both cases.

The referring court considers that neither that court itself nor the members of its staff could be regarded as constituting the ‘public’ in the general sense of the term. They could not, however, be regarded as belonging to a private group.

Moreover, according to the referring court, while the number of persons who, following transmission, have access to the work is certainly limited to the court’s staff alone, that number would necessarily be variable and should be regarded from the outset as high. Finally, national law provides that anyone has a right of access to documents received by a court.

In those circumstances, the referring court stayed proceedings and referred the following questions to the Court for a preliminary ruling:

‘(1)  Does the term “public” in Articles 3(1) and 4(1) of Directive [2001/29] have a uniform meaning?

(2) If question 1 is answered in the affirmative, is a court to be regarded as falling within the scope of the term “public” within the meaning of those provisions?

(3) If question 1 is answered in the negative:

(a) in the event of communication of a protected work to a court, can that court fall within the scope of the term “public”?

(b)  in the event of distribution of a protected work to a court, can that court fall within the scope of the term “public”?

(4) Does the fact that national legislation lays down a general principle of access to public documents in accordance with which any person who makes a request can access procedural documents transmitted to a court, except where they contain confidential information, affect the assessment of whether transmission to a court of a protected work amounts to a “communication to the public” or a “distribution to the public”?’

The Advocate’s opinion:

‘The electronic transmission by a litigant or a party to proceedings of copyrighted material as evidence to a court does not constitute a “communication to the public” or a “distribution to the public” in accordance with Article 3(1) and Article 4(1) of Directive 2001/29/EC of 22 May 2001. The mere fact that such evidence is considered a public document and that the public may thus, in principle, have access to the copyrighted material in question in accordance with national freedom of information or transparency rules does not entail that it enters the public domain and is free from copyright protection.’