Belgium: Facebook Wins Privacy Appeal Before Belgian Court Of Appeal

On 29 June 2016, the Court of Appeal of Brussels (the "Court") overturned the decision of the President of the Court of First Instance of Brussels of 9 November 2015 (the "Decision") which had ordered Facebook to cease the use of a cookie under sanction of a daily penalty (See, VBB on Business Law, Volume 2015, No 11, p. 11-12, available at www.vbb.com).

The Belgian Privacy Commission had initiated summary proceedings against Facebook over the allegedly infringing use of a specific cookie, called the "datr" cookie. During the proceedings, Facebook rejected the territorial competence of Belgian courts on this matter and argued that the cookie was necessary for the security and protection of its services. At first instance, the court sided with the Privacy Commission and issued a cease and desist order against Facebook Inc., Facebook Belgium SPRL and Facebook Ireland Limited ("Facebook"). The Court has now overturned the Decision in its entirety.

First, the Court examined if the Belgian courts have international jurisdiction over Facebook Ireland Limited and Facebook Inc. The Court determined that Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "Data Protection Directive") does not have direct effect in Belgian legislation and that therefore the Belgian courts do not have jurisdiction over Facebook Inc. and Facebook Ireland Limited.

The Court then turned to national legislation.  It determined that Article 32, §3 of the Law of 8 December 1992 on the protection of personal data (Wet tot bescherming van de persoonlijke levenssfeer ten opzichte van de verwerking van persoonsgegevens/Loi relative à la protection de la vie privée à l'égard des traitements de données à caractère personnel) does not govern international jurisdiction and therefore cannot be relied on to allow the Belgian courts to exercise jurisdiction over Facebook Inc. and Facebook Ireland Limited.

Furthermore, neither Regulation 1215/2015/EU on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters nor the Belgian International Private Law (Wet van 16 juli 2004 houdende het Wetboek van internationaal privaatrecht/Loi du 16 juillet 2004 portant le Code de droit international privé) applied to the case at hand. This is because both laws only relate to civil or commercial cases. Conversely, disputes between an individual or commercial company and the government fall outside the scope of these laws when the government acts pursuant to its governmental power. 

The Court also considered recent case law of the Court of Justice of the European Union ("ECJ") interpreting the territorial scope of the Data Protection Directive. First, the Court held that the 2014 Google Spain judgment of the ECJ (See, VBB on Business Law, Volume 2014, No. 5, p. 6, available at www.vbb.com) does not apply, as this case concerned two companies both of which had accepted the international jurisdiction of the Spanish courts voluntarily. Regarding the reference to the 2015 Weltimmo ECJ case (See, VBB on Business Law, Volume 2015, No. 11, p. 10 available at www.vbb.com), the Court held that it does not elaborate on international jurisdiction, but only covers the power of the supervisory authority. Additionally, in this case, Weltimmo had brought the proceedings itself, therefore recognising the international jurisdiction of the court. Therefore, Weltimmo is not applicable either.

Consequently, the Court declared the action against Facebook Inc. and Facebook Ireland Limited to be non-admissible. By contrast, the Court accepted competence over Facebook Belgium. However, the Privacy Commission had initiated summary proceedings, which require urgency. At first instance, the court had considered that urgency is assumed to be present in cases relating to the violation of a fundamental right. The Court now determined that with regard to Facebook Belgium, the urgency requirement had not been met, as the investigation regarding Facebook's use of datr cookies had already been published in 2011, while the summary proceedings case had only been filed in 2015.

The Privacy Commission has announced that it is considering filing an appeal to the Belgian Supreme Court (Hof van Cassatie/Cour de Cassation). It referred to the Yahoo case, in which the Belgian Supreme Court accepted the international jurisdiction of the Belgian courts (See, VBB on Business Law, Volume 2015, No. 12, p. 14 and Volume 2011, No. 1, p. 11, available at www.vbb.com).

The case on the merits between the Privacy Commission and Facebook is scheduled to be heard in the autumn of 2017.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.