OPINION OF ADVOCATE GENERAL
RANTOS
delivered on 20 September 2022 (1)
Case C‑252/21
Meta Platforms Inc., formerly Facebook Inc.,
Meta Platforms Ireland Limited, formerly Facebook Ireland Ltd.,
Facebook Deutschland GmbH
v
Bundeskartellamt,
intervener:
Verbraucherzentrale Bundesverband e.V.
(Request for a preliminary ruling
from the Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf, Germany))
(Reference for a preliminary ruling – Regulation (EU) 2016/679 – Protection of natural persons with regard to the processing of personal data – Social networks – Article 4(11) – Notion of ‘consent’ of the data subject – Consent given to a dominant undertaking responsible for processing – Article 6(1)(b) to (f) – Lawfulness of processing – Processing necessary for the performance of a contract to which the data subject is party or for the purposes of the legitimate interests pursued by the controller or by a third party – Processing necessary for compliance with a legal obligation to which the controller is subject, the protection of the vital interests of the data subject or of another natural person or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller – Article 9(1) and (2)(e) – Special categories of personal data – Personal data which are manifestly made public by the data subject – Articles 51 to 66 – Powers of the national competition authority – Reconciliation with the powers of data protection supervisory authorities – Adoption of measures under competition law by an authority located in a Member State other than that of the lead authority for the supervision of data protection)
Introduction
1. This request for a preliminary ruling was made by the Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf, Germany) in proceedings between companies in the Meta Platforms group (2) and the Bundeskartellamt (Federal Cartel Office, Germany) concerning the decision by which the Federal Cartel Office prohibited the applicant in the main proceedings from processing data as provided for in the terms of service of its Facebook social network and from implementing those terms of service, and imposed measures to stop it from doing so. (3)
2. The questions referred for a preliminary ruling essentially concern, on the one hand, the competence of a national competition authority such as the Federal Cartel Office to examine, as a principal issue or as an incidental question, the conduct of an undertaking in the light of certain provisions of Regulation (EU) 2016/679 (4) and, on the other hand, the interpretation of those provisions with regard to the processing of sensitive personal data, the relevant conditions for the lawfulness of personal data processing and the consent given freely to an undertaking in a dominant position.
Legal framework
European Union law
3. Article 4 of the GDPR provides:
‘For the purposes of this Regulation:
…
(11) “consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
…’
4. Article 6(1) of the regulation, entitled ‘Lawfulness of processing’, reads as follows:
‘Processing shall be lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.’
5. Article 9(1) and (2) of the regulation, entitled ‘Processing of special categories of personal data’, provides:
‘1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:
(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
…
(e) processing relates to personal data which are manifestly made public by the data subject;
…’
6. Article 51 of the regulation, entitled ‘Supervisory authority’, which forms part of Chapter VI, entitled ‘Independent supervisory authorities’, states:
‘1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union …
2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.
…’
German law
7. Paragraph 19(1) of the Gesetz gegen Wettbewerbsbeschränkungen (Law against restrictions on competition; ‘the GWB’) provides:
‘The abusive exploitation of a dominant position on the market by one or more undertakings is prohibited.’ (5)
8. Paragraph 50f of the GWB provides:
‘(1) The competition authorities, the regulatory authorities, the federal data protection and freedom of information officer, the regional data protection officers and the competent authorities within the meaning of Article 2 of the EU-Verbraucherschutzdurchführungsgesetz [Law on the implementation of EU consumer protection law] may, irrespective of the procedure chosen, exchange information, including personal data and trade and business secrets, to the extent necessary for the performance of their respective tasks and may use that information in the course of their proceedings. …’
The dispute in the main proceedings, the questions referred for a preliminary ruling and the procedure before the Court
9. Meta Platforms operates the online social network ‘Facebook’ in the European Union (www.facebook.com), as well as other online services, including Instagram and WhatsApp. The business model of the social networks operated by Meta Platforms essentially consists of offering social network services free of charge for private users and selling online advertising. The advertising is tailored to individual users and aims to show them products and services that might interest them on the basis of, inter alia, their consumer behaviour, interests, purchasing power and personal situation. The technical basis for this type of advertising is the automated production of detailed profiles of users of Facebook and the online services offered at group level. (6)
10. In order to collect and process user data, Meta Platforms relies on the contract for the use of the services entered into with its users when they click on the ‘Sign up’ button, thereby accepting Facebook’s terms of service. Acceptance of those terms of service is an essential requirement for using the Facebook social network. (7) The central element of this case is the practice of collecting data from other group services, as well as from third-party websites and apps via integrated interfaces or via cookies placed on the user’s computer or mobile device, linking those data with the user’s Facebook account and then using them (‘the practice at issue’).
11. The Federal Cartel Office initiated proceedings against Meta Platforms as a result of which, by the decision at issue, it prohibited Meta Platforms from processing data as provided for in Facebook’s terms of service and from implementing those terms, and imposed measures to stop it from doing so. The Federal Cartel Office based its decision, inter alia, on the fact that under Paragraph 19 of the GWB, the processing in question constituted an abuse of the company’s dominant position in the social media market for private users in Germany. (8)
12. On 11 February 2019, Meta Platforms brought an action against the decision at issue before the Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf), (9) which is the referring court. In essence, the referring court has doubts as to the ability of national competition authorities to monitor the compliance of data processing with the requirements laid down in the GDPR and to determine and penalise breaches of the GDPR. It also has doubts as to the interpretation and application of certain provisions of that regulation.
13. In those circumstances, the Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1)(a) Is it compatible with Article 51 et seq. of the GDPR if a national competition authority – such as the Federal Cartel Office – which is not a supervisory authority within the meaning of Article 51 et seq. of the GDPR, of a Member State in which an undertaking established outside the European Union has an establishment that provides the main establishment of that undertaking – which is located in another Member State and has sole responsibility for processing personal data for the entire territory of the European Union – with advertising, communication and public relations support, finds, for the purposes of monitoring abuses of competition law, that the main establishment’s contractual terms relating to data processing and their implementation breach the GDPR and issues an order to end that breach?
(b) If so: is that compatible with Article 4(3) TEU if, at the same time, the lead supervisory authority in the Member State in which the main establishment, within the meaning of Article 56(1) of the GDPR, is located is investigating the undertaking’s contractual terms relating to data processing?
If the answer to Question 1 is yes:
(2)(a) If an internet user merely visits websites or apps to which the criteria of Article 9(1) of the GDPR relate, such as flirting apps, gay dating sites, political party websites or health-related websites, or also enters information into them, for example when registering or when placing orders, and another undertaking, such as Facebook Ireland, uses interfaces integrated into those websites and apps, such as ‘Facebook Business Tools’, or cookies or similar storage technologies placed on the internet user’s computer or mobile device, to collect data about those visits to the websites and apps and the information entered by the user, and links those data with the data from the user’s [Facebook] account and uses them, does this collection and/or linking and/or use involve the processing of sensitive [personal] data for the purpose of that provision?
(b) If so: does visiting those websites or apps and/or entering information and/or clicking or tapping on the buttons integrated into them by a provider such as Facebook Ireland (social plugins such as ‘Like’, ‘Share’ or ‘Facebook Login’ or ‘Account Kit’) constitute manifestly making the data about the visits themselves and/or the information entered by the user public within the meaning of Article 9(2)(e) of the GDPR?
(3) Can an undertaking, such as Facebook Ireland, which operates a digital social network funded by advertising and offers personalised content and advertising, network security, product improvement and continuous, seamless use of all of its group products in its terms of service, justify collecting data for these purposes from other group services and third-party websites and apps via integrated interfaces such as Facebook Business Tools, or via cookies or similar storage technologies placed on the internet user’s computer or mobile device, linking those data with the user’s [Facebook] account and using them, on the ground of necessity for the performance of the contract under Article 6(1)(b) of the GDPR or on the ground of the pursuit of legitimate interests under Article 6(1)(f) of the GDPR?
(4) In those circumstances, can
– the fact of users being underage, vis-à-vis the personalisation of content and advertising, product improvement, network security and non-marketing communications with the user;
– the provision of measurements, analytics and other business services to enable advertisers, developers and other partners to evaluate and improve their services;
– the provision of marketing communications to the user to enable the undertaking to improve its products and engage in direct marketing;
– research and innovation [in the public interest], to further the state of the art or the academic understanding of important social issues and to affect society and the world in a positive way;
– the sharing of information with law enforcement agencies and responding to legal requests in order to prevent, detect and prosecute criminal offences, unlawful use, breaches of the terms of service and policies and other harmful behaviour;
also constitute legitimate interests within the meaning of Article 6(1)(f) of the GDPR if, for those purposes, the undertaking links data from other group services and from third-party websites and apps with the user’s [Facebook] account via integrated interfaces such as Facebook Business Tools or via cookies or similar storage technologies placed on the internet user’s computer or mobile device and uses those data?
(5) In those circumstances, can collecting data from other group services and from third-party websites and apps via integrated interfaces such as Facebook Business Tools, or via cookies or similar storage technologies placed on the internet user’s computer or mobile device, linking those data with the user’s [Facebook] account and using them, or using data already collected and linked by other lawful means, also be justified under Article 6(1)(c), (d) and (e) of the GDPR in individual cases, for example to respond to a legitimate request for certain data (point (c)), to combat harmful behaviour and promote security (point (d)), to [conduct] research [in the public interest] and to promote safety, integrity and security (point (e))?
(6) Can consent within the meaning of Article 6(1)(a) and Article 9(2)(a) of the GDPR be given effectively and, in accordance with Article 4(11) of the GDPR in particular, freely, to a dominant undertaking such as Facebook Ireland?
If the answer to Question 1 is no:
(7)(a) Can the national competition authority of a Member State, such as the Federal Cartel Office, which is not a supervisory authority within the meaning of Article 51 et seq. of the GDPR and which examines a breach by a dominant undertaking of the competition-law prohibition on abuse that is not a breach of the GDPR by that undertaking’s data processing terms and their implementation, determine, when assessing the balance of interests, whether those data processing terms and their implementation comply with the GDPR?
(b) If so: in the light of Article 4(3) TEU, does that also apply if the competent lead supervisory authority in accordance with Article 56(1) of the GDPR is investigating the undertaking’s data processing terms at the same time?
If the answer to Question 7 is yes, Questions 3 to 5 must be answered in relation to data from the use of the group’s Instagram service.’
14. Written observations were received from Meta Platforms, the German, Czech, Italian and Austrian Governments, the Federal Cartel Office, the Verbraucherzentrale Bundesverband e V. (consumers’ association, Germany) and the European Commission. Those parties also presented oral observations at the hearing held on 10 May 2022.
Analysis
15. The questions referred for a preliminary ruling that are the subject of this case, relating to the interpretation of several provisions of the GDPR, mainly concern: (i) the competence of a competition authority to determine and penalise a breach of the rules on the processing of personal data and its obligations to cooperate with the lead authority within the meaning of the GDPR (first and seventh questions); (ii) the prohibition on processing sensitive personal data and the conditions applicable to consenting to their use (second question); (iii) the lawfulness of the processing of personal data in the light of certain justification (third to fifth questions); (iv) the validity of consent to the processing of personal data given to an undertaking in a dominant position (sixth question).
16. In the points that follow, I will deal with the first and seventh questions first, before examining the other questions in the order in which they were raised, grouping together the third to fifth questions.
The first question
17. By its first question referred for a preliminary ruling, the referring court is asking, in essence, whether a competition authority, when prosecuting a breach of the competition rules, may rule primarily (10) on the infringement of GDPR data processing rules by an undertaking whose main establishment with sole responsibility for processing personal data for the entire territory of the European Union is in another Member State, and, furthermore, issue an order to end that breach (Question 1(a)), and if so, whether the competent lead supervisory authority under Article 56(1) of the GDPR may still investigate that undertaking’s contractual terms relating to data processing (Question 1(b)).
18. Subject to verification by the referring court, it seems to me that the Federal Cartel Office, in the decision at issue, did not penalise a breach of the GDPR by Meta Platforms, but proceeded, for the sole purpose of applying competition rules, to review an alleged abuse of its dominant position while taking account, inter alia, of that undertaking’s non-compliance with the provisions of the GDPR.
19. Accordingly, in my opinion, Question 1(a), in so far as it concerns a competition authority’s ability to decide, as the main issue, on a breach of the GDPR and to issue an order to end that breach within the meaning of that regulation, is irrelevant. (11)
20. It follows that Question 1(b), which is contingent on an affirmative answer to Question 1(a), is also irrelevant. (12)
The seventh question
21. By its seventh question referred for a preliminary ruling, the referring court is asking, in essence, whether a competition authority is entitled, when prosecuting infringements of the competition rules, to establish, (13) as an incidental question, whether the data processing terms and their implementation comply with the GDPR (Question 7(a)) and, if so, whether the competition authority’s analysis is also possible where those terms are, at the same time, under investigation by the competent lead supervisory authority (Question 7(b)).
22. First, with regard to Question 7(a), it seems to me that although a competition authority is not competent to establish a breach of the GDPR, (14) that regulation does not, in principle, preclude authorities other than the supervisory authorities, when exercising their own powers, from being able to take account, as an incidental question, of the compatibility of conduct with the provisions of the GDPR. This is especially true, in my opinion, where a competition authority exercises the powers conferred on it by Article 102 TFEU and by the first paragraph of Article 5 of Regulation (EC) No 1/2003, (15) or by any other equivalent national provision. (16)
23. In exercising its powers, a competition authority must assess, inter alia, whether the conduct in question entails resorting to methods other than those prevailing under merit-based competition, taking into account the legal and economic context in which that conduct takes place. (17) In that respect, the compliance or non-compliance of that conduct with the provisions of the GDPR, not taken in isolation but considering all the circumstances of the case, may be a vital clue as to whether that conduct entails resorting to methods prevailing under merit-based competition, it being stated that the lawful or unlawful nature of conduct under Article 102 TFEU is not apparent from its compliance or lack of compliance with the GDPR or other legal rules. (18)
24. Therefore, I consider that the examination of an abuse of a dominant position on the market may justify the interpretation, by a competition authority, of rules other than those relating to competition law, such as those of the GDPR, (19) while specifying that such an examination is carried out in an incidental manner (20) and is without prejudice to the application of that regulation by the competent supervisory authorities. (21)
25. Second, with regard to Question 7(b), the referring court is asking what obligations, in the context of the application of the principle of sincere cooperation enshrined in Article 4(3) TEU, a competition authority has, when interpreting the provisions of the GDPR, in respect of the competent lead supervisory authority within the meaning of that regulation, particularly when the conduct under investigation by the competition authority is also being investigated by the competent lead supervisory authority.
26. In the present case, the investigation, albeit incidental, by a competition authority of an undertaking’s conduct in the light of the GDPR carries the risk of differing interpretations of that regulation by the competition authority and the supervisory authorities, which could in principle undermine the uniform interpretation of the GDPR. (22)
27. EU law does not provide detailed rules on cooperation between a competition authority and supervisory authorities within the meaning of the GDPR in such a situation. More specifically, neither the mechanism for cooperation among competent authorities within the meaning of the GDPR when applying that regulation, (23) nor other specific rules on cooperation among administrative authorities, such as those on cooperation among competition authorities, and between competition authorities and the Commission when applying competition rules, (24) are applicable in the present case.
28. Nevertheless, a competition authority, when interpreting the GDPR, is bound by the duty to cooperate in good faith enshrined in Article 4(3) TEU, according to which the European Union and the Member States, including their administrative authorities, (25) must, in full mutual respect, assist each other in carrying out tasks which flow from the Treaties. In particular, the third paragraph of that article provides that the Member States must facilitate the achievement of the European Union’s tasks and refrain from any measure which could jeopardise the attainment of the European Union’s objectives. (26) In addition, like any administrative authority responsible for enforcing EU law, a competition authority is bound by the principle of sound administration as a general principle of EU law, which includes, inter alia, an extensive duty of diligence and care on the part of national authorities. (27)
29. Thus, in the absence of clear rules on cooperation mechanisms, which it may fall to the EU legislature to adopt, a competition authority, when interpreting the provisions of the GDPR, is subject, at the very least, to a duty to inform and cooperate with the competent authorities within the meaning of that regulation, in accordance with the national provisions that govern its powers (principle of procedural autonomy of the Member States) and in compliance with the principles of equivalence and effectiveness. (28)
30. It follows, in my view, that where the competent lead supervisory authority has ruled on the application of certain provisions of the GDPR in respect of the same practice or similar practices, the competition authority cannot, in principle, deviate from the interpretation of that authority, which is the sole competent authority for the application of that regulation, (29) and must, as far as possible and with due regard, in particular, for the rights of the defence of the data subjects, comply with any decisions adopted by that authority concerning the same conduct, (30) and, in the event of doubts in the case at hand as to the interpretation given by the competent authority, consult it or, where that authority is in another Member State, the national supervisory authority. (31)
31. Even without a decision by the competent supervisory authority, it is still the competition authority’s duty to inform (32) and cooperate with the competent supervisory authority where that authority has begun an investigation of the same practice or has indicated its intention to do so, and possibly to await the outcome of that authority’s investigation before commencing its own assessment, in so far as that is appropriate and is without prejudice to the competition authority abiding by a reasonable investigation period and the rights of defence of the data subjects. (33)
32. In the present case, it seems to me that the fact that the Federal Cartel Office entered into cooperation with the supervisory authorities responsible at national level (34) and that the lead supervisory authority in Ireland has also been contacted informally – circumstances alluded to by the Federal Cartel Office and which it is for the referring court to verify – may be sufficient evidence that the authority has fulfilled its duties of diligence and sincere cooperation. (35)
33. In conclusion, I propose that the answer to the seventh question referred for a preliminary ruling should be that Articles 51 to 66 of the GDPR must be interpreted as meaning that a competition authority, within the framework of its powers under the competition rules, may examine, as an incidental question, the compliance of the practices under investigation with the GDPR rules, while taking account of any decision or investigation of the competent supervisory authority on the basis of the GDPR, informing and, where appropriate, consulting the national supervisory authority.
The second question
34. By its second question referred for a preliminary ruling, the referring court is asking, in essence, whether Article 9(1) of the GDPR must be interpreted as meaning that the practice at issue, when it concerns visits to third-party websites and apps, (36) involves processing the types of sensitive personal data mentioned, (37) which is prohibited (38) (Question 2(a)), and if so, whether Article 9(2)(e) of that regulation must be interpreted as meaning that a user manifestly makes public within the meaning of that provision the data revealed by visiting those websites and apps, or entered into those websites or apps, or resulting from clicking on buttons integrated into those websites or apps (39) (Question 2(b)).
35. First, with regard to Question 2(a), I would point out that the processing of sensitive personal data is prohibited under Article 9(1) of the GDPR. The specific protection of such data is justified – as is apparent from recital 51 of that regulation – by the fact that they are, by their nature, particularly sensitive in relation to fundamental rights and freedoms and their processing could create significant risks to those fundamental rights and freedoms. Furthermore, despite the somewhat obscure wording of that provision, (40) it does not seem to me that, as the referring court assumes, it introduces a substantial difference between personal data that are sensitive because they ‘reveal’ a certain situation and data that are inherently sensitive. (41)
36. In the present case, it is clear, in my view, that the practice at issue entails the processing of personal data which is, in principle, liable to fall within the scope of that provision and to be prohibited where the data processed ‘reveal’ one of the sensitive situations referred to therein. It is necessary therefore to establish whether and to what extent visiting websites and apps or entering data into them may be ‘indicative’ of one of the sensitive situations listed in the provision in question.
37. In that respect, I doubt whether it is relevant (or always possible) to distinguish between the data subject merely being interested in certain information and the data subject belonging to one of the categories covered by the provision in question. (42) Although the parties to the main proceedings have opposing views in that regard, (43) I believe the answer to that question must be sought on a case-by-case basis and with regard to each of the activities comprising the practice at issue.
38. Although, as the German Government points out, simply collecting sensitive personal data about the visit to a website or an app is not, in itself, necessarily the same as processing sensitive personal data within the meaning of that provision, (44) linking the data to the relevant user’s Facebook account or using the data could, on the other hand, both easily amount to such processing. The decisive factor for the purpose of applying Article 9(1) of the GDPR is, in my view, whether the data processed allow user profiling based on the categories that emerge from the types of sensitive personal data mentioned in that article. (45)
39. In that context, to be able to determine whether data processing falls within the scope of that provision, it might be worth distinguishing, where appropriate, between the processing of data which prima facie may be categorised as sensitive personal data, which alone allow profiling of the data subject, and the processing of data that are not inherently sensitive but require subsequent aggregation in order to draw plausible conclusions for profiling purposes.
40. However, it should be clarified that the existence of categorisation within the meaning of that provision is independent of whether that categorisation is accurate or correct. (46) What counts is the possibility that such categorisation could create a significant risk to the fundamental rights and freedoms of the data subject, as stated in recital 51 of the GDPR, regardless of whether or not that possibility materialises.
41. Lastly, as to the referring court’s question whether the purpose for which the data are used is relevant to the assessment in question, (47) I find – contrary to the argument put forward by the applicant in the main proceedings – that in principle, the controller is not required to process those data knowing and intending to derive particular categories of information directly from them. The aim of the provision in question is, in essence, objectively to prevent significant risks to the fundamental rights and freedoms of data subjects arising from the processing of sensitive personal data, irrespective of any subjective element such as the controller’s intention.
42. Second, as regards Question 2(b), it should be recalled that, pursuant to Article 9(2)(e) of the GDPR, the prohibition on processing sensitive personal data does not apply if the processing relates to personal data which are manifestly made public by the data subject. Moreover, the inclusion in the wording of that provision of the adverb ‘manifestly’ and the fact that the provision constitutes an exemption to the prohibition on processing sensitive personal data (48) require a particularly stringent application of that exemption, on account of the significant risks to the fundamental rights and freedoms of data subjects. (49) In order for that exemption to apply, the user must, in my opinion, be fully aware that, by an explicit act, (50) he or she is making personal data public. (51)
43. In the present case, it seems to me that conduct consisting in visiting websites and apps, entering data into those websites and apps and clicking on buttons integrated into them cannot, in principle, be regarded in the same way as conduct that manifestly makes public the user’s sensitive personal data within the meaning of Article 9(2)(e) of the GDPR.
44. In principle, the browsing data from visits to websites and apps is only visible to the administrator of the website or app in question and to the third parties to whom the administrator transmits such information, such as the applicant in the main proceedings. (52) Similarly, although by entering data into websites and apps, the data subject could disclose, directly and voluntarily, information about certain sensitive personal data, that information is only visible to the administrator of the website or app in question and to third parties to whom the administrator transmits that information. I would say therefore that those actions cannot constitute evidence of the user’s wish to make the data publicly available. (53) Furthermore, while it is clear that, by clicking on buttons integrated into websites or apps, (54) the data subject is clearly expressing a wish to share certain information with the public outside the website or app in question, I am of the opinion that, as the Federal Cartel Office points out, by doing so, the person in question is conscious that he or she is sharing information with a specific group of people, often defined by the user himself or herself, (55) and not with the general public. (56)
45. Lastly, with regard to the relevance of any consent given by the user within the meaning of Article 5(3) of Directive 2002/58 so that personal data may be collected by cookies or similar technologies, as described by the referring court, I do not consider such consent, in view of its specific purpose, to be sufficient to justify the processing of sensitive personal data collected by such methods. (57) Indeed, such consent, which is necessary to install the technical means to capture certain user activities, (58) does not involve the processing of sensitive personal data and cannot be regarded as a wish to make such data manifestly public within the meaning of Article 9(2)(e) of the GDPR. (59)
46. In conclusion, I propose that the answer to the second question referred for a preliminary ruling should be that Article 9(1) of the GDPR must be interpreted as meaning that the prohibition on processing sensitive personal data may include the processing of data carried out by an operator of an online social network consisting in the collection of a user’s data when he or she visits other websites or apps or enters such data into them, the linking of such data to the user account on the social network and the use of such data, provided that the information processed, considered in isolation or aggregated, make it possible to profile users on the basis of the categories that emerge from the listing in that provision of types of sensitive personal data. In addition, Article 9(2)(e) of the GDPR must be interpreted as meaning that a user does not manifestly make public data revealed by visiting websites and apps or entered into those websites or apps or resulting from clicking on buttons integrated into those websites or apps.
The third to fifth questions
47. By its third to fifth questions referred for a preliminary ruling, the referring court is asking, in essence, whether Article 6(1)(b), (c), (d), (e) and (f) of the GDPR must be interpreted as meaning that the practice at issue (60) falls within the scope of one of the grounds provided for in those provisions, and in particular:
– the necessity for the performance of the contract (61) or the taking account of legitimate interests, (62) given that Meta Platforms operates a social network funded by advertising and offering, in its terms of service, personalised content and advertising, network security, product improvement and continuous, seamless use of all group products (third question referred for a preliminary ruling);
– the taking account of those legitimate interests (63) in the context of certain situations (64) (fourth question referred for a preliminary ruling);
– the need to respond to a legitimate request for certain data, (65) to combat harmful behaviour and promote security, (66) or to conduct research in the public interest and to promote safety, integrity and security (67) (fifth question referred for a preliminary ruling).
48. As a preliminary point, notwithstanding several questions as to the admissibility of the fourth and fifth questions, (68) I propose to answer the third to fifth questions together, in so far as the information I will provide below, mainly with regard to the third question, may also be useful to the referring court when applying the provisions that are the subject of the fourth and fifth questions.
49. Principally, I note that, in accordance with Article 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’), personal data must be processed fairly for specified purposes and on the basis of a legitimate basis laid down by law. In that respect, Article 6(1) of the GDPR specifies that the processing of such data is lawful only if one of the six conditions set out in that article is met. (69)
50. In the present case, I believe that the third to fifth questions call for a detailed case-by-case analysis of the various clauses of the Facebook terms of service in the context of the practice at issue, since it is impossible to establish whether, in respect of that practice, ‘an undertaking, such as [Meta Platforms]’ can comprehensively rely on all (or some) of the grounds set out in Article 6(1) of the GDPR, even though it is possible that said practice, or some of its component activities, may, in certain cases, fall within the scope of that article. (70)
51. Furthermore, the processing envisaged by the provisions cited is carried out, in the present case, on the basis of the general conditions of contract imposed by the controller, in the absence of the consent of the data subject, (71) or even against his or her will, which, in my opinion, calls for a strict interpretation of the grounds in question, particularly in order to avoid any circumvention of the requirement for consent. (72)
52. Lastly, I would point out that, under Article 5(2) of the GDPR, the controller is responsible for demonstrating that the personal data are processed in accordance with the regulation. Moreover, under Article 13(1)(c) of that regulation, it is for the controller to specify the purposes of the processing for which the personal data are intended, as well as the legal basis for the processing.
The third question
53. First, according to Article 6(1)(b) of the GDPR, the processing of personal data is lawful to the extent that it is necessary for the performance of a contract to which the data subject is party. (73)
54. In that regard, I note that the concept of ‘necessity’ is not defined in EU legislation, but according to the case-law, is still an autonomous concept of EU law. (74) For the processing to be necessary for the performance of the contract, it is not sufficient for it to be carried out at the time of performance of the contract, to be mentioned in the contract, (75) or even merely to be useful for the performance of the contract. (76) According to the case-law of the Court of Justice, the processing must be objectively necessary for the performance of the contract in the sense that there must be no realistic, less intrusive alternatives, (77) taking into account the reasonable expectations of the data subject. (78) It also concerns the fact that, where the contract consists of several separate services or elements of a service that can be performed independently of one another, the applicability of Article 6(1)(b) of the GDPR should be assessed in the context of each of those services separately. (79)
55. As part of that justification, the referring court mentions the personalised content and continuous, seamless use of the group’s products (or rather services).
56. As far as the personalised content is concerned, it seems to me that, although that activity may, to some extent, be in the user’s interest, since it makes it possible to display content, particularly in the ‘newsfeed’, which, on the basis of an automated evaluation, matches the user’s interests, it is not apparent that it is also necessary in order to provide the service of the social network at issue, such that the processing of personal data to that end does not require the user’s consent. (80) For the purpose of that examination, consideration should also be given to the fact that the practice at issue concerns the processing not of data relating to the user’s activities on the Facebook site or app, but data originating from external and therefore potentially unlimited sources. Therefore, I am curious as to what extent the processing might correspond to the expectations of an average user and, more generally, what ‘degree of personalisation’ the user can expect from the service he or she signs up for. (81)
57. With regard to the continuous, seamless use of the group’s services, I note that a link between the various services offered by the applicant in the main proceedings – for example, between Facebook and Instagram – could be useful or even preferable on occasion for the user. However, I doubt that the processing of personal data from other group services (including Instagram) is necessary to provide Facebook services. (82)
58. Second, according to Article 6(1)(f) of the GDPR, the processing of personal data is lawful only if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
59. According to the case-law of the Court of Justice, the provision in question lays down three cumulative conditions so that the processing of personal data is lawful, namely, first, the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the fundamental rights and freedoms of the person concerned by the data protection do not take precedence. (83)
60. First, with regard to the pursuit of a legitimate interest, the GDPR and the case-law recognise a wide range of interests considered legitimate, (84) while specifying that, according to Article 13(1)(d) of the GDPR, it is the responsibility of the controller to indicate the legitimate interests pursued under Article 6(1)(f) of the GDPR. (85)
61. As to the condition relating to the necessity of processing personal data for the purposes of the legitimate interests pursued, according to the case-law of the Court of Justice, derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary. (86) It is necessary therefore for a close link to exist between the processing and the interest pursued, in the absence of alternatives that are more data-protection friendly, since it is not enough for the processing merely to be of use to the controller.
62. Lastly, as regards the balancing of the interests of the controller and the interests or fundamental rights and freedoms of the data subject, according to the case-law of the Court of Justice, it is for the referring court to weigh the interests at stake. (87) To that end, as stated in recital 47 of the GDPR, it is essential to take into consideration the reasonable expectations of data subjects based on their relationship with the controller and to determine whether the data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.
63. As part of that justification, the referring court mentions the personalisation of advertising, network security and product improvement.
64. First, with regard to the personalisation of advertising, it is clear from recital 47 of the GDPR that the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest of the controller. However, when it comes to the necessity of the processing, it is worth noting that the data in question originate from sources outside Facebook. The question therefore arises as to the ‘degree of personalisation’ of the advertising objectively necessary in that respect. As for balancing the interests at stake, consideration should be given to the nature of the legitimate interest in question (in this case, a purely economic interest), as well as the impact of the processing on the user, including his or her reasonable expectations, and to any safeguards put in place by the controller. (88)
65. Similar points can be made in relation to network security. While such a justification may constitute a legitimate interest of the controller, (89) it is less obvious to conclude that the processing is necessary in the present case, given that the data in question originate from sources outside Facebook. (90) At any rate, it is the responsibility of the controller to specify the security purposes on which any processing is based.
66. Lastly, with regard to product improvement, although security-related improvements – which fall under the specific justification examined above – are excluded, it seems to me that such a justification should be in the interest of the user rather than the data controller. From that perspective, it is unclear to what extent it could constitute a legitimate interest of the controller, thus avoiding the need for the user’s consent. With regard to the condition of necessity and the balancing of the rights and interests at stake, I refer to the points made previously.
The fourth and fifth questions
67. By its fourth question referred for a preliminary ruling, which is essentially an extension of the second part of the third question referred, the referring court seeks to ascertain whether the recurrence of some of the situations mentioned implies the existence of a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Conversely, by its fifth question referred for a preliminary ruling, the referring court seeks to ascertain whether the need to respond to a legitimate request to provide certain data, the need to combat harmful behaviour and promote security or to conduct research in the public interest and to promote safety, integrity and security justify the practice at issue. (91)
68. Regardless of whether those questions are admissible, (92) in general, it cannot be excluded, in relation to the fourth question, that certain clauses characterising the practice at issue may be justified by legitimate interests in the circumstances described by the referring court, (93) and in relation to the fifth question, that in certain situations, the practice at issue may be justified on the basis of the provisions cited.
69. Nevertheless, it is unclear from the order for reference whether, and to what extent, Meta Platforms Ireland has explained – for each purpose of processing and type of data processed – the actual legitimate interests pursued or other justification that may be relevant in the present case. (94) It is for the referring court, in the light of the foregoing, to examine to what extent, in the circumstances described by that court, the practice at issue is justified by the existence of legitimate interests of Meta Platforms Ireland in the processing of data within the meaning of Article 6(1)(f) of the GDPR or by any other condition laid down in Article 6(1)(c), (d) and (e) of that regulation.
The answer to the third to fifth questions
70. In conclusion, I propose that the answer to the third to fifth questions referred for a preliminary ruling should be that Article 6(1)(b), (c), (d), (e) and (f) of the GDPR must be interpreted as meaning that the practice at issue, or some of the activities that comprise it, may be covered by the exemptions laid down in those provisions, as long as each data processing method examined fulfils the conditions provided for by the justification specifically put forward by the controller, and that therefore:
– the processing is objectively necessary for the provision of the services relating to the Facebook account;
– the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed and does not have a disproportionate effect on the fundamental rights and freedoms of the data subject;
– the processing is necessary to respond to a legitimate request for certain data, to combat harmful behaviour and promote security, to conduct research in the public interest and to promote safety, integrity and security.
The sixth question
71. By its sixth question referred for a preliminary ruling, the referring court is asking, in essence, whether Article 6(1)(a) and Article 9(2)(a) of the GDPR are to be interpreted as meaning that consent within the meaning of Article 4(11) of that regulation may be given effectively and freely to an undertaking having a dominant position in the national market for online social networks for private users.
72. I would first like to point out that Article 6(1)(a) and Article 9(2)(a) of the GDPR respectively require the consent of the data subject to the processing of personal data in general and to the processing of sensitive personal data. Furthermore, according to Article 4(11) of the GDPR, for the purposes of the regulation, ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which that person, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. (95)
73. With regard, in particular, to the requirement for ‘freedom’ of consent, which is the only requirement challenged in this case, I note that, according to recital 42 of the GDPR, consent should not be regarded as freely given if the data subject has no genuine or free choice (96) or is unable to refuse or withdraw consent without detriment. (97) Furthermore, as provided for in Article 7(1) of the GDPR (and reiterated in recital 42 thereof), where processing is based on consent of the data subject, the controller must be able to demonstrate that that person consented to the processing of his or her personal data.
74. As to relevance in the present case, as stated in the first sentence of recital 43 of the GDPR, consent should not serve as a valid legal ground for the processing of personal data where there is a ‘clear imbalance’ between the data subject and the controller. (98) Furthermore, under Article 7(4) of the GDPR, when assessing whether consent is freely given, utmost account must be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. (99) Lastly, according to the second sentence of recital 43 of the GDPR, consent is also presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case. (100)
75. In the present case, I am of the opinion that any dominant position on the market held by a personal data controller operating a social network is a factor when assessing whether users of that network have given their consent freely. Indeed, the market power of the controller could lead to a clear imbalance in the sense described in point 74 of this Opinion. (101) However, it should be clarified that for such a market power to be relevant from the point of view of enforcing the GDPR, it need not necessarily be regarded as a dominant position within the meaning of Article 102 TFEU. (102) Besides, that circumstance alone cannot, in principle, render the consent invalid. (103)
76. Therefore, the validity of consent should be examined on a case-by-case basis, in the light of the other factors mentioned in points 73 and 74 of this Opinion, taking into account all the circumstances of the case and the controller’s responsibility to demonstrate that the data subject has given his or her consent to the processing of personal data relating to him or her.
77. In conclusion, I propose that the answer to the sixth question referred for a preliminary ruling should be that Article 6(1)(a) and Article 9(2)(a) of the GDPR must be interpreted as meaning that the mere fact that an undertaking that operates a social network enjoys a dominant position in the domestic market for online social networks for private users cannot, on its own, render invalid the consent of the user of that network to the processing of his or her personal data under Article 4(11) of that regulation. However, that fact does play a role in the assessment of the freedom of consent within the meaning of that provision, which it is for the controller to demonstrate, taking into account, where appropriate, the existence of a clear imbalance of power between the data subject and the controller, any requirement for consent to the processing of personal data other than those strictly necessary for the provision of the services in question, the need for consent to be specific for each purpose of processing and the need to prevent the withdrawal of consent from being detrimental to users who withdraw it.
Conclusion
78. In the light of the foregoing, I propose that the Court of Justice reply to the questions referred for a preliminary ruling by the Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf, Germany) as follows:
(1) Articles 51 to 66 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
must be interpreted as meaning that a competition authority, within the framework of its powers under the competition rules, may examine, as an incidental question, the compliance of the practices investigated with the rules of that regulation, while taking into account any decision or investigation of the competent supervisory authority on the basis of said regulation, informing and, where appropriate, consulting that authority.
(2) Article 9(1) of Regulation 2016/679
must be interpreted as meaning that the prohibition on processing sensitive personal data may include the processing of data carried out by an operator of an online social network consisting in the collection of the user’s data when that user visits other websites or apps or enters such data into those websites or apps, linking the data to the user account on the social network and then using the data, provided that the information processed, considered in isolation or aggregated, allows user profiling based on the categories that emerge from the types of sensitive personal data mentioned in that article.
Article 9(2)(e) of that regulation
must be interpreted as meaning that a user does not manifestly make public the data revealed by visiting websites and apps or entered into those websites or apps or resulting from having clicked on buttons integrated into those websites or apps.
(3) Article 6(1)(b), (c), (d), (e) and (f) of Regulation 2016/679
must be interpreted as meaning that the practice consisting in (i) the collection of data from other group services, as well as from third-party websites and apps, by interfaces integrated into the latter or by cookies placed on the user’s computer or mobile terminal, (ii) the linking of such data with the user’s Facebook account and (iii) the use of said data or some of the activities comprising that practice may be covered by the exemptions laid down in those provisions, as long as each data processing method examined fulfils the conditions provided for by the justification specifically put forward by the controller, and that therefore:
– the processing is objectively necessary for the provision of the services relating to the Facebook account;
– the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed and does not have a disproportionate effect on the fundamental rights and freedoms of the data subject;
– the processing is necessary to respond to a legitimate request for certain data, to combat harmful behaviour and promote security, to conduct research in the public interest and to promote safety, integrity and security.
(4) Articles 6(1)(a) and 9(2)(a) of Regulation 2016/679
must be interpreted as meaning that the mere fact that an undertaking providing a social network enjoys a dominant position in the domestic market for online social networks for private users cannot, on its own, render invalid the consent of the user of that network to the processing of his or her personal data under Article 4(11) of that regulation. However, that fact does play a role in the assessment of the freedom of consent within the meaning of that provision, which it is for the controller to demonstrate, taking into account, where appropriate, the existence of a clear imbalance of power between the data subject and the controller, any requirement for consent to the processing of personal data other than those strictly necessary for the provision of the services in question, the need for consent to be specific for each purpose of processing and the need to prevent the withdrawal of consent from being detrimental to users who withdraw it.