The Court of Justice of the European Union issued a ruling that could lead to an increase in proceedings against companies that do not comply with the General Data Protection Regulation (GDPR). Under certain conditions, i guarantors of privacy of individual countries can bring a lawsuit before the court, even if they are not the lead authority for the cross-border data processing.
More power to the national authorities
The ruling of the Court of Justice of the European Union represents the final step in a case that began in September 2015. The Belgian authority for the protection of personal data had asked the court to block the collection of information carried out by Facebook through various technologies, including cookies and social plugins (Like and Share).
The judge had accepted the request of the guarantor, namely the injunction against Facebook Inc. (United States), Facebook Ireland and Facebook Belgium. Following the appeal presented by the Menlo Park company, the judge had declared his jurisdiction only on the appeal of Facebook Belgium, expressing doubts on the application of the so-called “one stop shop” principle provided for by the General Data Protection Regulation.
Under Article 56, only the lead authority can bring a lawsuit before the court. The lead authority is that of the country where the company has its head office. Therefore, in the present case, only the Irish supervisor could initiate an injunction, as the headquarters of Facebook is located in Ireland.
This constraint has been repeated several times criticized because it represents a “bottleneck”. The Irish supervisor has to investigate numerous complaints and therefore takes too long to complete the proceedings (some on Facebook and Google date back to over three years ago).
The Court of Justice specified that the national authorities they can exercise their power, even if they are not lead authority for cross-border data processing. Privacy guarantors can initiate actions against big techs, but only in urgent cases, as done by the Italian authority against TikTok. However, the ruling does not clearly indicate which are the criteria to be followed to assess the urgency.