On 16 February 2018, the Dutch Chamber of the Court of First Instance in Brussels (the Court) found Facebook guilty for violations of Belgian data protection law. Facebook has announced that it will appeal the decision.

The case has been ongoing since 2015 (read an earlier newsletter on this subject here) and after initial trials in summary judgment proceedings, it reached a first judgement on the merits earlier this month.

On the merits of the case, Facebook was found to be lacking with regard to its transparency obligations as it insufficiently informs users about (inter alia) the data that it collects, for what purposes, how long it is kept for, and who has access to it. The Court also found Facebook to be lacking a legal basis for the processing. Furthermore, its methods of tracking online behavior of people, for instance on third party websites, and specifically when it concerns people who are not Facebook users, were found to be excessive.

Facebook has been sanctioned to delete all the data concerning Belgian citizens which it obtained illegitimately through its cookies and social plug-ins, also with regard to the Belgian citizens who were not Facebook users.  In addition, Facebook will be fined EUR 250.000 a day (or up to EUR 100.000.000) in the event that it does not comply with the court’s judgement.