Facebook faces the possibility of mounting data protection regulations after Europe's highest court indicated the social media giant may have to comply with national regulations in the EU's 28 member states.
Facebook, whose European operation is headquartered in Ireland, has long insisted that it must only abide by the data protection laws set in Ireland rather than be policed by all of the EU’s national authorities.
But a case bought by German regulators to the European Court of Justice said the company “may be held liable” for any breaches of Germany’s data protection laws, according to a preliminary opinion from the ECJ’s advocate general.
Although the opinion is not binding on EU judges, it threatens to deliver another blow to Facebook which is already fighting a host of legal challenges on how it handles user information in Europe.
Facebook was fined €1.2 million by Spanish authorities for breaking Spain’s data privacy rules last month.
Europe’s national regulators have tended to take a tougher line on tech giants compared to Brussels. It also comes at a time when the EU is preparing to roll out its landmark data protection law, known as the GDPR (General Data Protection Regulation), from May next year.
Facebook said it “respectfully disagreed” with the opinion from advocate general Yves Bot.
The case centres on a Facebook fan page created by a user in Germany which has the ability to access and process data of users outside the country.
Mr Bot said the handling of the data was subject to German data protection rules: “The German supervisory authority can request Facebook Ireland and Facebook Inc. to take measures to stop data processing in respect of any breaches of German data protection law in Germany since those companies are the controllers of that data.”
A final ECJ ruling on the case is expected in the coming months.
Copyright The Financial Times Limited 2017.
