- Meta Platforms Inc., formerly Facebook Inc., Meta Platforms Ireland Limited, formerly Facebook Ireland Ltd., Facebook Deutschland GmbH v Bundeskartellamt, intervener: VerbraucherzentraleBundesverbande.V.
In the following CJEU opinion by the AG on 20th September’ 2022, the AG opined that the personalized digital marketing in form of advertisement and personalized content (even with data collected from third-party websites and cookies) may rely on legal basis and/or legitimate interest. There can be no one-size fits all approach in determining this question. Even the AG relied heavily on case-by-case analysis.
Essential elements to watch out for:
- Degree of personalization
- Users’ expectations while giving consent
- Safeguards implemented by the controller
- NorraStokholmBygg AB v Per Nycander AB, joined parties: Entral AB
In the following CJEU opinion by the AG ĆAPETA on 6th October’ 2022, the AG opined that:
- Once national courts orders for disclosure of the processed data, concerned court becomes joint controller with the original controller.
- The GDPR does not exclude the activities of national court in civil proceedings and complements Member States’ procedural rules. Both the articles 6(4) and 6(3) of GDPR which allows repurposed processing and allows processing of data respectively in the exercise of official authority requires existence of national (or EU) law as the legal basis for processing but the safeguards shall be taken in respect of GDPR for the data subjects involved in case if the disclosure of documentary evidence in an individual case.
- While deciding on the order for disclosure in civil proceedings, national courts must do proportionality analysis which is guided by Article 5 of GDPR that takes into account the interests of data subjects whose personal data are to be processed and balance them in relation to the interest of the parties to the procedure to obtain evidence
- UI v Österreichische Post AG
In the following CJEU opinion by the AG CAMPOS SÁNCHEZ-BORDONA on 6th October’ 2022, the AG opined that Article 82 of the GDPR which provides for the Right to compensation and liability which is interpretated for the purpose if the damage is suffered by the person or data subject of an infringement of the regulation, but if the concerned infringement is not supported by the relevant material or non-material damage then it is not sufficient to be said as infringement.
Even in case of non-material damage, mere upset or feeling of displeasure cannot be deemed as infringement of the GDPR. But it can be determined by the interpretation by the national courts, whether a subjective feeling of displeasure may be deemed to be non-material damage which varies from case to case.
- TU, RE v Google LLC
In the following CJEU judgement by the Grand Chamber on 8th December’ 2022, it was held that:
- The case was concerned to thumbnail photographs which were linked to articles, whereas the applicants claimed that the concerned thumbnail was inaccurate.
- The court referred to the Article 17(3)(a) of the GDPR for the purpose of the case and held that freedom of expression and of information includes the publication of photographs, the protection of the right to privacy takes on particular importance in that context since photographs are capable of conveying particularly personal or even intimate information about an individual or his or her family
- CJEU also held that the burden of proving the inaccuracy of the information lies with the person requesting de-referencing. But where the person who has made a request for de-referencing submits relevant and sufficient evidence, the operator of the search engine is required to comply to that request.
- It was also held that while displaying photos in the form of thumbnails, the account must consider the information about those photos which does consider the context of their publication on the internet page from which they are taken.
