wp-plugin-hostgator domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114ol-scrapes domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114Source:https:\/\/techcrunch.com\/2023\/07\/04\/cjeu-meta-superprofiling-decision\/<\/a><\/br> Mark your calendar European friends: July 4th could soon be celebrated as independence-from-Meta\u2019s-surveillance-capitalism-day\u2026 A long-anticipated judgement handed down today by the Court of Justice of the European Union (CJEU) looks to have comprehensively crushed the social media giant\u2019s ability to keep flouting EU privacy law by denying users a free choice over its tracking and profiling.<\/p>\n The ruling tracks back to a pioneering order by Germany\u2019s antitrust watchdog, the Federal Cartel Office (FCO), which spent years investigating Facebook\u2019s business \u2014 making the case that privacy harm should be treated as an exploitative competition abuse too.<\/p>\n In its February 2019 order<\/a>, the FCO told Facebook (as Meta still was back then) to stop combining data on users across its own suite of social platforms without their consent. Meta sought to block the order in the German courts \u2014 eventually sparking the referral on Meta\u2019s so-called \u201csuperprofiling\u201d to the CJEU in March 2021<\/a>.<\/p>\n Now we have the top court\u2019s take and, well, it\u2019s not going to spark any celebrations at Meta HQ, that\u2019s for sure.<\/p>\n The CJEU has not only agreed competition authorities can factor data protection into their antitrust assessments (which sounds wonky but really is vital because joint-working rather than regulatory silos is the path to effective oversight of platform power) \u2014 but has signalled that consent is the only appropriate legal basis for the tracking-and-profiling-driven \u2018personalized\u2019 content and behavioral advertising that Meta monetizes.<\/p>\n Here\u2019s the relevant chunk from the press release:<\/p>\n As regards more generally the processing operation carried out by Meta Platforms Ireland, including the processing of \u2018non-sensitive\u2019 data, the Court examines next whether this is covered by the justifications, set out in the GDPR, allowing the processing of data carried out in the absence of the data subject\u2019s consent to be made lawful. In that context, it finds that the need for the performance of the contract to which the data subject is party may justify the practice at issue only on condition that the data processing is objectively indispensable such that the main subject matter of the contract cannot be achieved if the processing in question does not occur. Subject to verification by the national court, the Court of Justice expresses doubts as to whether personalised content or the consistent and seamless use of the Meta group\u2019s own services are capable of fulfilling those criteria.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/blockquote>\n<\/div>\n<\/div>\n<\/div>\n Consent under EU data protection law means users must be offered a choice to deny this kind of tracking without having to forgo access to the core service. And this is exactly the choice Meta has historically denied its users. (Although \u2014 surprise, surprise! \u2014 just a few short weeks ahead of the CJEU judgement, doubtless anticipating what was coming, it announced new controls<\/a> to let users limit its cross-site tracking, albeit with some reduction in functionality if they do deny the tracking so it remains to be seen whether Meta\u2019s attempt to pre-empt the decision has gone far enough.)<\/p>\n Last year<\/a> an advisor to the CJEU took a similar view on the substance of the Meta superprofiling referral. But while the advocate general\u2019s opinion to the Court was non-legally binding, today\u2019s ruling is bona fide<\/em> hard law. And that means neither Meta nor EU data protection authorities can ignore it.<\/p>\n The latter is important because reluctance by certain DPAs to vigorously enforce the bloc\u2019s General Data Protection Regulation (GDPR) on rule-flouting tech giants they\u2019re supposed to oversee has led to cries that the regulation has failed \u2014 or at least been hopelessly stymied by forum shopping.<\/p>\n There\u2019s no doubt GDPR enforcement on Big Tech has been a very painstaking process indeed. A major decision out of Ireland\u2019s DPA in January<\/a> finally found against Meta\u2019s claim to rely on contractual necessity to run its behavioral advertising. But it took over four years since the original complaint was filed to get to that order (which Meta is also now appealing, so the process is still not concluded yet either).<\/p>\n Then, in March<\/a>, responding to a compliance deadline in the Irish Data Protection Commission\u2019s (DPC) order, Meta announced it would switch the legal basis it claims for the data-for-ads processing to another, non-consent-based basis \u2014 known as legitimate interest.<\/p>\n So, after years of privacy abuse complaints, regulatory inquiry and (eventual) enforcement Meta still opted against<\/em> offering users a clear yes\/no choice over its tracking \u2014 presumably anticipating being able to spin out the oversight process of its LI claim (and avoid having to reform its privacy-hostile business model) for another four years or so.<\/p>\n However the CJEU looks to have tossed a spanner in that latest GDPR evasion tactic since EU DPAs can\u2019t ignore the Court\u2019s direction. So Ireland shouldn\u2019t just sit on its hands and let Meta do so by claiming a legitimate interest legal basis the CJEU has signalled is inappropriate in this context. And, well, when users are empowered to deny surveillance capitalism they do so in droves. (See, for e.g.: Apple\u2019s App Tracking Transparency impact on Meta\u2019s ads business<\/a>.)<\/p>\n Clarity from the CJEU on how the GDPR must be applied on ad-funded business models like Meta\u2019s may finally close this chapter on surveillance capitalism.<\/p>\n In its press release on the judgement, the Court writes (with emphasis): \u201c[T]<\/strong>he personalised advertising by which the online social network Facebook finances its activity, cannot justify, as a legitimate interest pursued by Meta Platforms Ireland, the processing of the data at issue, in the absence of the data subject\u2019s consent.\u201d<\/strong><\/span><\/p>\n We\u2019ve reached out to the Irish DPC for a response to the CJEU ruling and will update this report if we get one.<\/p>\n The CJEU has also opted to highlight the need to ensure that the quality of consent is valid \u2014 i.e. that the choice offered it truly free (not manipulated, such as by the use of dark patterns or through otherwise penalizing the user, such as with a sub-par service for denying access to their data) \u2014 given the imbalance between the market power of a dominant social network and its users, noting in its press release that \u201cthis is for the operator to prove\u201d.<\/p>\n Furthermore, the Court has confirmed that Meta cannot simply dodge the legal requirement to obtain explicit consent from users to process so-called sensitive categories of personal data (such as political beliefs, sexual orientation, racial or ethnic origin etc) \u2014 with the Court finding the fact of users visiting or interacting with web services does not mean they have manifestly made public their sensitive data (which would lift the requirement to obtain explicit consent).<\/p>\n This element of the judgement could fuel a new wave of litigation against Meta for processing users\u2019 sensitive data without obtaining their explicit consent since Facebook clearly process oodles of such stuff \u2014 always without explicitly asking permission.<\/p>\n Again from the CJEU press release:<\/p>\n Furthermore, the Court observes that the data processing operation carried out by Meta Platforms Ireland appears also to concern special categories of data that may reveal, inter alia, racial or ethnic origin, political opinions, religious beliefs or sexual orientation, and the processing of which is in principle prohibited by the GDPR. It will be for the national court to determine whether some of the data collected may actually allow such information to be revealed, irrespective of whether that information concerns a user of that social network or any other natural person.<\/p>\n<\/blockquote>\n Max Schrems, the lawyer and privacy rights campaigner who was behind the original complaint against Meta\u2019s \u201cforced consent\u201d, has dubbed today \u201cGDPR meltdown day for Meta\u201d \u2014 arguing the court has shut the door on all the \u201cloopholes\u201d the company\u2019s lawyers have sought to press over the last five years.<\/p>\n In a fuller statement, noyb<\/a> \u2014 Schrem\u2019s privacy rights not-for-profit \u2014 said the CJEU has declared Meta\u2019s GDPR approach \u201cillegal\u201d.<\/p>\n \u201cnoyb still has to study the details of this massive judgment. From the live reading of the holding, it seems that Meta\/Facebook was barred from using anything but consent for crucial operations that it relies on to make profits in Europe,\u201d it also wrote, with Schrems arguing Meta will now have to \u201cseek proper consent and cannot use its dominant position to force people to agree to things they don\u2019t want\u201d.<\/p>\n \u201cThis will also have a positive impact on pending litigation between noyb and Meta in Ireland,\u201d he added \u2014 referring to the aforementioned decision out of Ireland on Meta\u2019s legal basis for ads.<\/p>\n BEUC, the European consumer organization, also welcomed the CJEU ruling \u2014 suggesting it \u201cpaves the way for more effective enforcement against dominant digital platforms\u201d.<\/p>\n While in a statement the FCO\u2019s president, Andreas Mundt, said the judgement \u201csends a strong signal for competition law enforcement in the digital economy, a field where data are decisive for market power\u201d.<\/p>\n \u201cWhen large internet companies use the very personal data of consumers, this usage can also be deemed abusive under competition law. In their application of competition law, competition authorities must also take data protection rules into consideration. The judgment will have far-reaching effects on the business models used in the data economy. When enforcing competition law, it is important that we continue to cooperate closely with the data protection authorities,\u201d he added.<\/p>\n For its part, Meta didn\u2019t offer much of a response to offer as yet. \u201cWe are evaluating the Court\u2019s decision and will have more to say in due course,\u201d a company spokesperson said.<\/p>\n
\nCJEU ruling on Meta referral could close the chapter on surveillance capitalism<\/br>
\n2023-07-04 21:42:20<\/br><\/p>\n\n
\n