{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-252-21", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-252-21)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-11", "fingerprint": "ewai:eu:20b464", "proof": "sha256:a353af59bc48fceff19b9da601f6007b77f0e843f2f07ba04ea1d6b81aac83ea", "jurisdiction": "eu", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "item": { "schema_version": "1.0.0", "id": "eu:c-252-21", "jurisdiction": "eu", "lang": "en", "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor" }, "sections": [ { "title": "62021CJ0252", "paragraphs": [] }, { "title": "JUDGMENT OF THE COURT (Grand Chamber)", "paragraphs": [] }, { "title": "4 July 2023 (\n *1\n )", "paragraphs": [] }, { "title": "Table of contents", "paragraphs": [] }, { "title": "Legal context", "paragraphs": [] }, { "title": "European Union law", "paragraphs": [] }, { "title": "Regulation No 1/2003", "paragraphs": [] }, { "title": "The GDPR", "paragraphs": [] }, { "title": "German law", "paragraphs": [] }, { "title": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraphs": [] }, { "title": "The questions referred", "paragraphs": [] }, { "title": "Questions 1 and 7", "paragraphs": [] }, { "title": "Question 2", "paragraphs": [] }, { "title": "Question 2(a)", "paragraphs": [] }, { "title": "Question 2(b)", "paragraphs": [] }, { "title": "Questions 3 to 5", "paragraphs": [] }, { "title": "Preliminary observations", "paragraphs": [] }, { "title": "Questions 3 and 4", "paragraphs": [] }, { "title": "Question 5", "paragraphs": [] }, { "title": "Question 6", "paragraphs": [] }, { "title": "Costs", "paragraphs": [ "para_22", "para_23", "para_24", "para_25", "para_26" ] }, { "title": "Facebook Deutschland GmbH", "paragraphs": [ "para_28", "para_29", "para_30", "para_31", "para_32", "para_33", "para_34", "para_35", "para_36", "para_37", "para_38", "para_39", "para_40", "para_41", "para_42", "para_43", "para_44", "para_45", "para_46", "para_47", "para_48", "para_49", "para_50", "para_51", "para_52", "para_53", "para_54", "para_55" ] }, { "title": "Judgment", "paragraphs": [] }, { "title": "1", "paragraphs": [ "para_58" ] }, { "title": "2", "paragraphs": [ "para_60" ] }, { "title": "Legal context", "paragraphs": [] }, { "title": "European Union law", "paragraphs": [] }, { "title": "Regulation (EC) No 1/2003", "paragraphs": [] }, { "title": "3", "paragraphs": [ "para_65", "para_66", "para_67", "para_68", "para_69", "para_70", "para_71", "para_72", "para_73", "para_74", "para_75" ] }, { "title": "The GDPR", "paragraphs": [] }, { "title": "4", "paragraphs": [] }, { "title": "Recitals 1, 4, 38, 42, 43, 46, 47, 49 and 51 of the GDPR state:", "paragraphs": [ "para_79", "para_80", "para_81" ] }, { "title": "(4)", "paragraphs": [ "para_83", "para_84" ] }, { "title": "(38)", "paragraphs": [ "para_86", "para_87" ] }, { "title": "(42)", "paragraphs": [ "para_89" ] }, { "title": "(43)", "paragraphs": [ "para_91", "para_92" ] }, { "title": "(46)", "paragraphs": [ "para_94" ] }, { "title": "(47)", "paragraphs": [ "para_96", "para_97" ] }, { "title": "(49)", "paragraphs": [ "para_99", "para_100" ] }, { "title": "(51)", "paragraphs": [ "para_102" ] }, { "title": "5", "paragraphs": [] }, { "title": "Article 4 of that regulation provides:", "paragraphs": [ "para_105" ] }, { "title": "(1)", "paragraphs": [ "para_107" ] }, { "title": "(2)", "paragraphs": [ "para_109", "para_110" ] }, { "title": "(7)", "paragraphs": [ "para_112", "para_113" ] }, { "title": "(11)", "paragraphs": [ "para_115", "para_116" ] }, { "title": "(23)", "paragraphs": [ "para_118" ] }, { "title": "(a)", "paragraphs": [ "para_120" ] }, { "title": "(b)", "paragraphs": [ "para_122", "para_123" ] }, { "title": "6", "paragraphs": [ "para_125", "para_126" ] }, { "title": "(a)", "paragraphs": [ "para_128" ] }, { "title": "(b)", "paragraphs": [ "para_130" ] }, { "title": "(c)", "paragraphs": [ "para_132", "para_133", "para_134" ] }, { "title": "7", "paragraphs": [] }, { "title": "Article 6 of the regulation, entitled ‘Lawfulness of processing’, reads as follows:", "paragraphs": [ "para_137" ] }, { "title": "(a)", "paragraphs": [ "para_139" ] }, { "title": "(b)", "paragraphs": [ "para_141" ] }, { "title": "(c)", "paragraphs": [ "para_143" ] }, { "title": "(d)", "paragraphs": [ "para_145" ] }, { "title": "(e)", "paragraphs": [ "para_147" ] }, { "title": "(f)", "paragraphs": [ "para_149", "para_150", "para_151", "para_152" ] }, { "title": "(a)", "paragraphs": [] }, { "title": "Union law; or", "paragraphs": [] }, { "title": "(b)", "paragraphs": [ "para_156", "para_157", "para_158" ] }, { "title": "8", "paragraphs": [] }, { "title": "Article 7 of the GDPR, entitled ‘Conditions for consent’, states:", "paragraphs": [ "para_161", "para_162", "para_163" ] }, { "title": "9", "paragraphs": [ "para_165", "para_166" ] }, { "title": "2.   Paragraph 1 shall not apply if one of the following applies:", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_169", "para_170" ] }, { "title": "(e)", "paragraphs": [ "para_172" ] }, { "title": "(f)", "paragraphs": [ "para_174", "para_175" ] }, { "title": "10", "paragraphs": [ "para_177", "para_178", "para_179" ] }, { "title": "(c)", "paragraphs": [ "para_181" ] }, { "title": "(d)", "paragraphs": [ "para_183", "para_184" ] }, { "title": "11", "paragraphs": [ "para_186" ] }, { "title": "12", "paragraphs": [ "para_188", "para_189", "para_190" ] }, { "title": "13", "paragraphs": [] }, { "title": "As set out in Article 55 of the GDPR, headed ‘Competence’:", "paragraphs": [ "para_193", "para_194" ] }, { "title": "14", "paragraphs": [ "para_196", "para_197" ] }, { "title": "15", "paragraphs": [] }, { "title": "Article 57(1) of that regulation, that article being entitled ‘Tasks’, provides:", "paragraphs": [ "para_200" ] }, { "title": "(a)", "paragraphs": [ "para_202", "para_203" ] }, { "title": "(g)", "paragraphs": [ "para_205", "para_206" ] }, { "title": "16", "paragraphs": [ "para_208" ] }, { "title": "17", "paragraphs": [ "para_210", "para_211" ] }, { "title": "18", "paragraphs": [] }, { "title": "Article 61(1) of the GDPR, that article being headed ‘Mutual assistance’, states:", "paragraphs": [ "para_214" ] }, { "title": "19", "paragraphs": [ "para_216", "para_217", "para_218" ] }, { "title": "20", "paragraphs": [ "para_220", "para_221" ] }, { "title": "21", "paragraphs": [] }, { "title": "Article 64(2) of that regulation is worded as follows:", "paragraphs": [ "para_224" ] }, { "title": "22", "paragraphs": [ "para_226", "para_227" ] }, { "title": "(a)", "paragraphs": [ "para_229" ] }, { "title": "(b)", "paragraphs": [ "para_231", "para_232" ] }, { "title": "German law", "paragraphs": [] }, { "title": "23", "paragraphs": [ "para_235", "para_236" ] }, { "title": "24", "paragraphs": [] }, { "title": "In accordance with Paragraph 32(1) of the GWB:", "paragraphs": [ "para_239" ] }, { "title": "25", "paragraphs": [] }, { "title": "Paragraph 50f(1) of the GWB provides:", "paragraphs": [ "para_242" ] }, { "title": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraphs": [] }, { "title": "26", "paragraphs": [ "para_245" ] }, { "title": "27", "paragraphs": [ "para_247" ] }, { "title": "28", "paragraphs": [ "para_249" ] }, { "title": "29", "paragraphs": [ "para_251" ] }, { "title": "30", "paragraphs": [ "para_253" ] }, { "title": "31", "paragraphs": [ "para_255" ] }, { "title": "32", "paragraphs": [ "para_257" ] }, { "title": "33", "paragraphs": [ "para_259" ] }, { "title": "34", "paragraphs": [ "para_261" ] }, { "title": "35", "paragraphs": [ "para_263", "para_264" ] }, { "title": "(a)", "paragraphs": [ "para_266" ] }, { "title": "(b)", "paragraphs": [ "para_268" ] }, { "title": "If the answer to Question 1 is “yes”:", "paragraphs": [] }, { "title": "(2)", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_272" ] }, { "title": "(b)", "paragraphs": [ "para_274" ] }, { "title": "(3)", "paragraphs": [ "para_276" ] }, { "title": "(4)", "paragraphs": [] }, { "title": "In those circumstances, can", "paragraphs": [ "para_279", "para_280", "para_281", "para_282", "para_283", "para_284", "para_285", "para_286", "para_287", "para_288", "para_289" ] }, { "title": "(5)", "paragraphs": [ "para_291" ] }, { "title": "(6)", "paragraphs": [ "para_293" ] }, { "title": "If the answer to Question 1 is “no”:", "paragraphs": [] }, { "title": "(7)", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_297" ] }, { "title": "(b)", "paragraphs": [ "para_299", "para_300" ] }, { "title": "The questions referred", "paragraphs": [] }, { "title": "Questions 1 and 7", "paragraphs": [] }, { "title": "36", "paragraphs": [ "para_304" ] }, { "title": "37", "paragraphs": [ "para_306" ] }, { "title": "38", "paragraphs": [ "para_308" ] }, { "title": "39", "paragraphs": [ "para_310" ] }, { "title": "40", "paragraphs": [ "para_312" ] }, { "title": "41", "paragraphs": [ "para_314" ] }, { "title": "42", "paragraphs": [ "para_316" ] }, { "title": "43", "paragraphs": [ "para_318" ] }, { "title": "44", "paragraphs": [ "para_320" ] }, { "title": "45", "paragraphs": [ "para_322" ] }, { "title": "46", "paragraphs": [ "para_324" ] }, { "title": "47", "paragraphs": [ "para_326" ] }, { "title": "48", "paragraphs": [ "para_328" ] }, { "title": "49", "paragraphs": [ "para_330" ] }, { "title": "50", "paragraphs": [ "para_332" ] }, { "title": "51", "paragraphs": [ "para_334" ] }, { "title": "52", "paragraphs": [ "para_336" ] }, { "title": "53", "paragraphs": [ "para_338" ] }, { "title": "54", "paragraphs": [ "para_340" ] }, { "title": "55", "paragraphs": [ "para_342" ] }, { "title": "56", "paragraphs": [ "para_344" ] }, { "title": "57", "paragraphs": [ "para_346" ] }, { "title": "58", "paragraphs": [ "para_348" ] }, { "title": "59", "paragraphs": [ "para_350" ] }, { "title": "60", "paragraphs": [ "para_352" ] }, { "title": "61", "paragraphs": [ "para_354" ] }, { "title": "62", "paragraphs": [ "para_356" ] }, { "title": "63", "paragraphs": [ "para_358" ] }, { "title": "Question 2", "paragraphs": [] }, { "title": "64", "paragraphs": [ "para_361" ] }, { "title": "65", "paragraphs": [ "para_363" ] }, { "title": "Question 2(a)", "paragraphs": [] }, { "title": "66", "paragraphs": [ "para_366" ] }, { "title": "67", "paragraphs": [ "para_368" ] }, { "title": "68", "paragraphs": [ "para_370" ] }, { "title": "69", "paragraphs": [ "para_372" ] }, { "title": "70", "paragraphs": [ "para_374" ] }, { "title": "71", "paragraphs": [ "para_376" ] }, { "title": "72", "paragraphs": [ "para_378" ] }, { "title": "73", "paragraphs": [ "para_380" ] }, { "title": "Question 2(b)", "paragraphs": [] }, { "title": "74", "paragraphs": [ "para_383" ] }, { "title": "75", "paragraphs": [ "para_385" ] }, { "title": "76", "paragraphs": [ "para_387" ] }, { "title": "77", "paragraphs": [ "para_389" ] }, { "title": "78", "paragraphs": [ "para_391" ] }, { "title": "79", "paragraphs": [ "para_393" ] }, { "title": "80", "paragraphs": [ "para_395" ] }, { "title": "81", "paragraphs": [ "para_397" ] }, { "title": "82", "paragraphs": [ "para_399" ] }, { "title": "83", "paragraphs": [ "para_401" ] }, { "title": "84", "paragraphs": [ "para_403" ] }, { "title": "85", "paragraphs": [ "para_405" ] }, { "title": "Questions 3 to 5", "paragraphs": [] }, { "title": "86", "paragraphs": [ "para_408" ] }, { "title": "87", "paragraphs": [ "para_410" ] }, { "title": "Preliminary observations", "paragraphs": [] }, { "title": "88", "paragraphs": [ "para_413" ] }, { "title": "89", "paragraphs": [ "para_415" ] }, { "title": "90", "paragraphs": [ "para_417" ] }, { "title": "91", "paragraphs": [ "para_419" ] }, { "title": "92", "paragraphs": [ "para_421" ] }, { "title": "93", "paragraphs": [ "para_423" ] }, { "title": "94", "paragraphs": [ "para_425" ] }, { "title": "95", "paragraphs": [ "para_427" ] }, { "title": "96", "paragraphs": [ "para_429" ] }, { "title": "Questions 3 and 4", "paragraphs": [] }, { "title": "97", "paragraphs": [ "para_432" ] }, { "title": "98", "paragraphs": [ "para_434" ] }, { "title": "99", "paragraphs": [ "para_436" ] }, { "title": "100", "paragraphs": [ "para_438" ] }, { "title": "101", "paragraphs": [ "para_440" ] }, { "title": "102", "paragraphs": [ "para_442" ] }, { "title": "103", "paragraphs": [ "para_444" ] }, { "title": "104", "paragraphs": [ "para_446" ] }, { "title": "105", "paragraphs": [ "para_448" ] }, { "title": "106", "paragraphs": [ "para_450" ] }, { "title": "107", "paragraphs": [ "para_452" ] }, { "title": "108", "paragraphs": [ "para_454" ] }, { "title": "109", "paragraphs": [ "para_456" ] }, { "title": "110", "paragraphs": [ "para_458" ] }, { "title": "111", "paragraphs": [ "para_460" ] }, { "title": "112", "paragraphs": [ "para_462" ] }, { "title": "113", "paragraphs": [ "para_464" ] }, { "title": "114", "paragraphs": [ "para_466" ] }, { "title": "115", "paragraphs": [ "para_468" ] }, { "title": "116", "paragraphs": [ "para_470" ] }, { "title": "117", "paragraphs": [ "para_472" ] }, { "title": "118", "paragraphs": [ "para_474" ] }, { "title": "119", "paragraphs": [ "para_476" ] }, { "title": "120", "paragraphs": [ "para_478" ] }, { "title": "121", "paragraphs": [ "para_480" ] }, { "title": "122", "paragraphs": [ "para_482" ] }, { "title": "123", "paragraphs": [ "para_484" ] }, { "title": "124", "paragraphs": [ "para_486" ] }, { "title": "125", "paragraphs": [ "para_488" ] }, { "title": "126", "paragraphs": [ "para_490" ] }, { "title": "Question 5", "paragraphs": [] }, { "title": "127", "paragraphs": [ "para_493" ] }, { "title": "128", "paragraphs": [ "para_495" ] }, { "title": "129", "paragraphs": [ "para_497" ] }, { "title": "130", "paragraphs": [ "para_499" ] }, { "title": "131", "paragraphs": [ "para_501" ] }, { "title": "132", "paragraphs": [ "para_503" ] }, { "title": "133", "paragraphs": [ "para_505" ] }, { "title": "134", "paragraphs": [ "para_507" ] }, { "title": "135", "paragraphs": [ "para_509" ] }, { "title": "136", "paragraphs": [ "para_511" ] }, { "title": "137", "paragraphs": [ "para_513" ] }, { "title": "138", "paragraphs": [ "para_515" ] }, { "title": "139", "paragraphs": [ "para_517" ] }, { "title": "Question 6", "paragraphs": [] }, { "title": "140", "paragraphs": [ "para_520" ] }, { "title": "141", "paragraphs": [ "para_522" ] }, { "title": "142", "paragraphs": [ "para_524" ] }, { "title": "143", "paragraphs": [ "para_526" ] }, { "title": "144", "paragraphs": [ "para_528" ] }, { "title": "145", "paragraphs": [ "para_530" ] }, { "title": "146", "paragraphs": [ "para_532" ] }, { "title": "147", "paragraphs": [ "para_534" ] }, { "title": "148", "paragraphs": [ "para_536" ] }, { "title": "149", "paragraphs": [ "para_538" ] }, { "title": "150", "paragraphs": [ "para_540" ] }, { "title": "151", "paragraphs": [ "para_542" ] }, { "title": "152", "paragraphs": [ "para_544" ] }, { "title": "153", "paragraphs": [ "para_546" ] }, { "title": "154", "paragraphs": [ "para_548" ] }, { "title": "Costs", "paragraphs": [] }, { "title": "155", "paragraphs": [ "para_551" ] }, { "title": "On those grounds, the Court (Grand Chamber) hereby rules:", "paragraphs": [ "para_553", "para_554", "para_555", "para_556", "para_557" ] }, { "title": "Article 9(1) of Regulation 2016/679", "paragraphs": [ "para_559", "para_560" ] }, { "title": "Article 9(2)(e) of Regulation 2016/679", "paragraphs": [ "para_562", "para_563", "para_564" ] }, { "title": "Point (b) of the first subparagraph of Article 6(1) of Regulation 2016/679", "paragraphs": [ "para_566", "para_567" ] }, { "title": "Point (f) of the first subparagraph of Article 6(1) of Regulation 2016/679", "paragraphs": [ "para_569", "para_570" ] }, { "title": "Point (c) of the first subparagraph of Article 6(1) of Regulation 2016/679", "paragraphs": [ "para_572", "para_573" ] }, { "title": "Points (d) and (e) of the first subparagraph of Article 6(1) of Regulation 2016/679", "paragraphs": [ "para_575", "para_576", "para_577", "para_578", "para_579", "para_580" ] } ], "paragraphs": [ { "text": "62021CJ0252", "paragraph_id": "para_1" }, { "text": "JUDGMENT OF THE COURT (Grand Chamber)", "paragraph_id": "para_2" }, { "text": "4 July 2023 (\n *1\n )", "paragraph_id": "para_3" }, { "text": "Table of contents", "paragraph_id": "para_4" }, { "text": "Legal context", "paragraph_id": "para_5" }, { "text": "European Union law", "paragraph_id": "para_6" }, { "text": "Regulation No 1/2003", "paragraph_id": "para_7" }, { "text": "The GDPR", "paragraph_id": "para_8" }, { "text": "German law", "paragraph_id": "para_9" }, { "text": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraph_id": "para_10" }, { "text": "The questions referred", "paragraph_id": "para_11" }, { "text": "Questions 1 and 7", "paragraph_id": "para_12" }, { "text": "Question 2", "paragraph_id": "para_13" }, { "text": "Question 2(a)", "paragraph_id": "para_14" }, { "text": "Question 2(b)", "paragraph_id": "para_15" }, { "text": "Questions 3 to 5", "paragraph_id": "para_16" }, { "text": "Preliminary observations", "paragraph_id": "para_17" }, { "text": "Questions 3 and 4", "paragraph_id": "para_18" }, { "text": "Question 5", "paragraph_id": "para_19" }, { "text": "Question 6", "paragraph_id": "para_20" }, { "text": "Costs", "paragraph_id": "para_21" }, { "text": "(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Social networks – Abuse of a dominant position by the operator of such a network – Abuse which entails the processing of the personal data of the users of t …", "paragraph_id": "para_22" }, { "text": "In Case C‑252/21,", "paragraph_id": "para_23" }, { "text": "REQUEST for a preliminary ruling under Article 267 TFEU from the Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf, Germany), made by decision of 24 March 2021, received at the Court on 22 April 2021, in the proceedings", "paragraph_id": "para_24" }, { "text": "Meta Platforms Inc ., formerly Facebook Inc.,", "paragraph_id": "para_25" }, { "text": "Meta Platforms Ireland Ltd , formerly Facebook Ireland Ltd,", "paragraph_id": "para_26" }, { "text": "Facebook Deutschland GmbH", "paragraph_id": "para_27" }, { "text": "v", "paragraph_id": "para_28" }, { "text": "Bundeskartellamt,", "paragraph_id": "para_29" }, { "text": "intervener:", "paragraph_id": "para_30" }, { "text": "Verbraucherzentrale Bundesverband eV,", "paragraph_id": "para_31" }, { "text": "THE COURT (Grand Chamber),", "paragraph_id": "para_32" }, { "text": "composed of K. Lenaerts, President, L. Bay Larsen, Vice-President, A. Prechal, K. Jürimäe, C. Lycourgos, M. Safjan, L.S. Rossi (Rapporteur), D. Gratsias and M.L. Arastey Sahún, Presidents of Chambers, J.-C. Bonichot, S. Rodin, F. Biltgen, M. Gavalec, Z. Csehi and O. Spineanu-Matei, Judges,", "paragraph_id": "para_33" }, { "text": "Advocate General: A. Rantos,", "paragraph_id": "para_34" }, { "text": "Registrar: D. Dittert, Head of Unit,", "paragraph_id": "para_35" }, { "text": "having regard to the written procedure and further to the hearing on 10 May 2022,", "paragraph_id": "para_36" }, { "text": "after considering the observations submitted on behalf of:", "paragraph_id": "para_37" }, { "text": "–", "paragraph_id": "para_38" }, { "text": "Meta Platforms Inc., formerly Facebook Inc., Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd, and Facebook Deutschland GmbH, by M. Braun, M. Esser, L. Hesse, J. Höft and H.-G. Kamann, Rechtsanwälte,", "paragraph_id": "para_39" }, { "text": "–", "paragraph_id": "para_40" }, { "text": "the Bundeskartellamt, by J. Nothdurft, K. Ost, I. Sewczyk and J. Topel, acting as Agents,", "paragraph_id": "para_41" }, { "text": "–", "paragraph_id": "para_42" }, { "text": "Verbraucherzentrale Bundesverband eV, by S. Louven, Rechtsanwalt,", "paragraph_id": "para_43" }, { "text": "–", "paragraph_id": "para_44" }, { "text": "the German Government, by J. Möller and P.-L. Krüger, acting as Agents,", "paragraph_id": "para_45" }, { "text": "–", "paragraph_id": "para_46" }, { "text": "the Czech Government, by M. Smolek and J. Vláčil, acting as Agents,", "paragraph_id": "para_47" }, { "text": "–", "paragraph_id": "para_48" }, { "text": "the Italian Government, by G. Palmieri, acting as Agent, and E. De Bonis and P. Gentili, avvocati dello Stato,", "paragraph_id": "para_49" }, { "text": "–", "paragraph_id": "para_50" }, { "text": "the Austrian Government, by A. Posch, J. Schmoll and G. Kunnert, acting as Agents,", "paragraph_id": "para_51" }, { "text": "–", "paragraph_id": "para_52" }, { "text": "the European Commission, by F. Erlbacher, H. Kranenborg and G. Meessen, acting as Agents,", "paragraph_id": "para_53" }, { "text": "after hearing the Opinion of the Advocate General at the sitting on 20 September 2022,", "paragraph_id": "para_54" }, { "text": "gives the following", "paragraph_id": "para_55" }, { "text": "Judgment", "paragraph_id": "para_56" }, { "text": "1", "paragraph_id": "para_57" }, { "text": "This request for a preliminary ruling concerns the interpretation of Article 4(3) TEU and of Article 6(1), Article 9(1) and (2), Article 51(1) and Article 56(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard …", "paragraph_id": "para_58" }, { "text": "2", "paragraph_id": "para_59" }, { "text": "The request has been made in proceedings between Meta Platforms Inc., formerly Facebook Inc., Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd, and Facebook Deutschland GmbH, on the one hand, and the Bundeskartellamt (Federal Cartel Office, Germany), on the other, concerning the decision by which the latter prohibited those companies from processing certain personal data as provided for in the general terms of use of the social network Facebook (‘the general terms’).", "paragraph_id": "para_60" }, { "text": "Legal context", "paragraph_id": "para_61" }, { "text": "European Union law", "paragraph_id": "para_62" }, { "text": "Regulation (EC) No 1/2003", "paragraph_id": "para_63" }, { "text": "3", "paragraph_id": "para_64" }, { "text": "Article 5 of Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles [101 and 102 TFEU] ( OJ 2003 L 1, p. 1 ), entitled ‘Powers of the competition authorities of the Member States’, provides:", "paragraph_id": "para_65" }, { "text": "‘The competition authorities of the Member States shall have the power to apply Articles [101 and 102 TFEU] in individual cases. For this purpose, acting on their own initiative or on a complaint, they may take the following decisions:", "paragraph_id": "para_66" }, { "text": "–", "paragraph_id": "para_67" }, { "text": "requiring that an infringement be brought to an end,", "paragraph_id": "para_68" }, { "text": "–", "paragraph_id": "para_69" }, { "text": "ordering interim measures,", "paragraph_id": "para_70" }, { "text": "–", "paragraph_id": "para_71" }, { "text": "accepting commitments,", "paragraph_id": "para_72" }, { "text": "–", "paragraph_id": "para_73" }, { "text": "imposing fines, periodic penalty payments or any other penalty provided for in their national law.", "paragraph_id": "para_74" }, { "text": "Where on the basis of the information in their possession the conditions for prohibition are not met they may likewise decide that there are no grounds for action on their part.’", "paragraph_id": "para_75" }, { "text": "The GDPR", "paragraph_id": "para_76" }, { "text": "4", "paragraph_id": "para_77" }, { "text": "Recitals 1, 4, 38, 42, 43, 46, 47, 49 and 51 of the GDPR state:", "paragraph_id": "para_78" }, { "text": "‘(1)", "paragraph_id": "para_79" }, { "text": "The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the “Charter”) and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.", "paragraph_id": "para_80" }, { "text": "…", "paragraph_id": "para_81" }, { "text": "(4)", "paragraph_id": "para_82" }, { "text": "The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionali …", "paragraph_id": "para_83" }, { "text": "…", "paragraph_id": "para_84" }, { "text": "(38)", "paragraph_id": "para_85" }, { "text": "Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of c …", "paragraph_id": "para_86" }, { "text": "…", "paragraph_id": "para_87" }, { "text": "(42)", "paragraph_id": "para_88" }, { "text": "Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. … For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the …", "paragraph_id": "para_89" }, { "text": "(43)", "paragraph_id": "para_90" }, { "text": "In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is the …", "paragraph_id": "para_91" }, { "text": "…", "paragraph_id": "para_92" }, { "text": "(46)", "paragraph_id": "para_93" }, { "text": "The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Processing of personal data based on the vital interest of another natural person should in princip …", "paragraph_id": "para_94" }, { "text": "(47)", "paragraph_id": "para_95" }, { "text": "The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into …", "paragraph_id": "para_96" }, { "text": "…", "paragraph_id": "para_97" }, { "text": "(49)", "paragraph_id": "para_98" }, { "text": "The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that …", "paragraph_id": "para_99" }, { "text": "…", "paragraph_id": "para_100" }, { "text": "(51)", "paragraph_id": "para_101" }, { "text": "Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. Those personal data should include personal data reveali …", "paragraph_id": "para_102" }, { "text": "5", "paragraph_id": "para_103" }, { "text": "Article 4 of that regulation provides:", "paragraph_id": "para_104" }, { "text": "‘For the purposes of this Regulation:", "paragraph_id": "para_105" }, { "text": "(1)", "paragraph_id": "para_106" }, { "text": "“personal data” means any information relating to an identified or identifiable natural person (“data subject”); …", "paragraph_id": "para_107" }, { "text": "(2)", "paragraph_id": "para_108" }, { "text": "“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;", "paragraph_id": "para_109" }, { "text": "…", "paragraph_id": "para_110" }, { "text": "(7)", "paragraph_id": "para_111" }, { "text": "“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;", "paragraph_id": "para_112" }, { "text": "…", "paragraph_id": "para_113" }, { "text": "(11)", "paragraph_id": "para_114" }, { "text": "“consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;", "paragraph_id": "para_115" }, { "text": "…", "paragraph_id": "para_116" }, { "text": "(23)", "paragraph_id": "para_117" }, { "text": "“cross-border processing” means either:", "paragraph_id": "para_118" }, { "text": "(a)", "paragraph_id": "para_119" }, { "text": "processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or", "paragraph_id": "para_120" }, { "text": "(b)", "paragraph_id": "para_121" }, { "text": "processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.", "paragraph_id": "para_122" }, { "text": "…’", "paragraph_id": "para_123" }, { "text": "6", "paragraph_id": "para_124" }, { "text": "Article 5 of that regulation, headed ‘Principles relating to processing of personal data’, provides:", "paragraph_id": "para_125" }, { "text": "‘1.   Personal data shall be:", "paragraph_id": "para_126" }, { "text": "(a)", "paragraph_id": "para_127" }, { "text": "processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);", "paragraph_id": "para_128" }, { "text": "(b)", "paragraph_id": "para_129" }, { "text": "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; …", "paragraph_id": "para_130" }, { "text": "(c)", "paragraph_id": "para_131" }, { "text": "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);", "paragraph_id": "para_132" }, { "text": "…", "paragraph_id": "para_133" }, { "text": "2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’", "paragraph_id": "para_134" }, { "text": "7", "paragraph_id": "para_135" }, { "text": "Article 6 of the regulation, entitled ‘Lawfulness of processing’, reads as follows:", "paragraph_id": "para_136" }, { "text": "‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:", "paragraph_id": "para_137" }, { "text": "(a)", "paragraph_id": "para_138" }, { "text": "the data subject has given consent to the processing of his or her personal data for one or more specific purposes;", "paragraph_id": "para_139" }, { "text": "(b)", "paragraph_id": "para_140" }, { "text": "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;", "paragraph_id": "para_141" }, { "text": "(c)", "paragraph_id": "para_142" }, { "text": "processing is necessary for compliance with a legal obligation to which the controller is subject;", "paragraph_id": "para_143" }, { "text": "(d)", "paragraph_id": "para_144" }, { "text": "processing is necessary in order to protect the vital interests of the data subject or of another natural person;", "paragraph_id": "para_145" }, { "text": "(e)", "paragraph_id": "para_146" }, { "text": "processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;", "paragraph_id": "para_147" }, { "text": "(f)", "paragraph_id": "para_148" }, { "text": "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.", "paragraph_id": "para_149" }, { "text": "Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.", "paragraph_id": "para_150" }, { "text": "…", "paragraph_id": "para_151" }, { "text": "3.   The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:", "paragraph_id": "para_152" }, { "text": "(a)", "paragraph_id": "para_153" }, { "text": "Union law; or", "paragraph_id": "para_154" }, { "text": "(b)", "paragraph_id": "para_155" }, { "text": "Member State law to which the controller is subject.", "paragraph_id": "para_156" }, { "text": "…", "paragraph_id": "para_157" }, { "text": "… The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.’", "paragraph_id": "para_158" }, { "text": "8", "paragraph_id": "para_159" }, { "text": "Article 7 of the GDPR, entitled ‘Conditions for consent’, states:", "paragraph_id": "para_160" }, { "text": "‘1.   Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.", "paragraph_id": "para_161" }, { "text": "…", "paragraph_id": "para_162" }, { "text": "4.   When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.’", "paragraph_id": "para_163" }, { "text": "9", "paragraph_id": "para_164" }, { "text": "Article 9 of that regulation, entitled ‘Processing of special categories of personal data’, provides:", "paragraph_id": "para_165" }, { "text": "‘1.   Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.", "paragraph_id": "para_166" }, { "text": "2.   Paragraph 1 shall not apply if one of the following applies:", "paragraph_id": "para_167" }, { "text": "(a)", "paragraph_id": "para_168" }, { "text": "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law [provides] that the prohibition referred to in paragraph 1 may not be lifted by the data subject;", "paragraph_id": "para_169" }, { "text": "…", "paragraph_id": "para_170" }, { "text": "(e)", "paragraph_id": "para_171" }, { "text": "processing relates to personal data which are manifestly made public by the data subject;", "paragraph_id": "para_172" }, { "text": "(f)", "paragraph_id": "para_173" }, { "text": "processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;", "paragraph_id": "para_174" }, { "text": "…’", "paragraph_id": "para_175" }, { "text": "10", "paragraph_id": "para_176" }, { "text": "Article 13 of that regulation, ‘Information to be provided where personal data are collected from the data subject’, provides, in its paragraph 1, as follows:", "paragraph_id": "para_177" }, { "text": "‘Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:", "paragraph_id": "para_178" }, { "text": "…", "paragraph_id": "para_179" }, { "text": "(c)", "paragraph_id": "para_180" }, { "text": "the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;", "paragraph_id": "para_181" }, { "text": "(d)", "paragraph_id": "para_182" }, { "text": "where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;", "paragraph_id": "para_183" }, { "text": "…’", "paragraph_id": "para_184" }, { "text": "11", "paragraph_id": "para_185" }, { "text": "Chapter VI of the GDPR, ‘Independent supervisory authorities’, comprises Articles 51 to 59 of the regulation.", "paragraph_id": "para_186" }, { "text": "12", "paragraph_id": "para_187" }, { "text": "Under Article 51(1) and (2) of the GDPR, that article being entitled ‘Supervisory authority’:", "paragraph_id": "para_188" }, { "text": "‘1.   Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union …", "paragraph_id": "para_189" }, { "text": "2.   Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the [European] Commission in accordance with Chapter VII.’", "paragraph_id": "para_190" }, { "text": "13", "paragraph_id": "para_191" }, { "text": "As set out in Article 55 of the GDPR, headed ‘Competence’:", "paragraph_id": "para_192" }, { "text": "‘1.   Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.", "paragraph_id": "para_193" }, { "text": "2.   Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply.’", "paragraph_id": "para_194" }, { "text": "14", "paragraph_id": "para_195" }, { "text": "Article 56(1) of that regulation, that article being entitled ‘Competence of the lead supervisory authority’, states:", "paragraph_id": "para_196" }, { "text": "‘Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.’", "paragraph_id": "para_197" }, { "text": "15", "paragraph_id": "para_198" }, { "text": "Article 57(1) of that regulation, that article being entitled ‘Tasks’, provides:", "paragraph_id": "para_199" }, { "text": "‘Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:", "paragraph_id": "para_200" }, { "text": "(a)", "paragraph_id": "para_201" }, { "text": "monitor and enforce the application of this Regulation;", "paragraph_id": "para_202" }, { "text": "…", "paragraph_id": "para_203" }, { "text": "(g)", "paragraph_id": "para_204" }, { "text": "cooperate with, including sharing information[,] and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;", "paragraph_id": "para_205" }, { "text": "…’", "paragraph_id": "para_206" }, { "text": "16", "paragraph_id": "para_207" }, { "text": "Article 58 of the regulation lists, in paragraph 1, the investigative powers available to each supervisory authority and states, in paragraph 5, that ‘each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation’.", "paragraph_id": "para_208" }, { "text": "17", "paragraph_id": "para_209" }, { "text": "Section 1, entitled ‘Cooperation’, of Chapter VII of the GDPR comprises Articles 60 to 62 of that regulation. Article 60, ‘Cooperation between the lead supervisory authority and the other supervisory authorities concerned’, provides in paragraph 1:", "paragraph_id": "para_210" }, { "text": "‘The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other.’", "paragraph_id": "para_211" }, { "text": "18", "paragraph_id": "para_212" }, { "text": "Article 61(1) of the GDPR, that article being headed ‘Mutual assistance’, states:", "paragraph_id": "para_213" }, { "text": "‘Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.’", "paragraph_id": "para_214" }, { "text": "19", "paragraph_id": "para_215" }, { "text": "Article 62 of that regulation, headed ‘Joint operations of supervisory authorities’, provides in paragraphs 1 and 2:", "paragraph_id": "para_216" }, { "text": "‘1.   The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved.", "paragraph_id": "para_217" }, { "text": "2.   Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. …’", "paragraph_id": "para_218" }, { "text": "20", "paragraph_id": "para_219" }, { "text": "Section 2, entitled ‘Consistency’, of Chapter VII of the GDPR comprises Articles 63 to 67 of that regulation. Article 63, headed ‘Consistency mechanism’, is worded as follows:", "paragraph_id": "para_220" }, { "text": "‘In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section.’", "paragraph_id": "para_221" }, { "text": "21", "paragraph_id": "para_222" }, { "text": "Article 64(2) of that regulation is worded as follows:", "paragraph_id": "para_223" }, { "text": "‘Any supervisory authority, the Chair of the [European Data Protection] Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the [European Data Protection] Board with a view to obtaining an opinion, in particular …", "paragraph_id": "para_224" }, { "text": "22", "paragraph_id": "para_225" }, { "text": "Article 65(1) of that regulation, that article being headed ‘Dispute resolution by the Board’, provides:", "paragraph_id": "para_226" }, { "text": "‘In order to ensure the correct and consistent application of this Regulation in individual cases, the [European Data Protection] Board shall adopt a binding decision in the following cases:", "paragraph_id": "para_227" }, { "text": "(a)", "paragraph_id": "para_228" }, { "text": "where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead supervisory authority and the lead supervisory authority has not followed the objection or has rejected such an objection as being not relevan …", "paragraph_id": "para_229" }, { "text": "(b)", "paragraph_id": "para_230" }, { "text": "where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;", "paragraph_id": "para_231" }, { "text": "…’", "paragraph_id": "para_232" }, { "text": "German law", "paragraph_id": "para_233" }, { "text": "23", "paragraph_id": "para_234" }, { "text": "Paragraph 19(1) of the Gesetz gegen Wettbewerbsbeschränkungen (Law against restrictions on competition), in its version published on 26 June 2013 (BGBl. 2013 I, p. 1750, 3245), last amended by Paragraph 2 of the Law of 16 July 2021 (BGBl. 2021 I, p. 2959) (‘the GWB’), provides:", "paragraph_id": "para_235" }, { "text": "‘The abuse of a dominant position by one or more undertakings is prohibited.’", "paragraph_id": "para_236" }, { "text": "24", "paragraph_id": "para_237" }, { "text": "In accordance with Paragraph 32(1) of the GWB:", "paragraph_id": "para_238" }, { "text": "‘The competition authority may require undertakings or associations of undertakings to bring to an end an infringement of a provision of this Part or of Articles 101 or 102 [TFEU].’", "paragraph_id": "para_239" }, { "text": "25", "paragraph_id": "para_240" }, { "text": "Paragraph 50f(1) of the GWB provides:", "paragraph_id": "para_241" }, { "text": "‘The competition authorities, the regulatory authorities, the federal data protection and freedom of information officer, the regional data protection officers and the competent authorities within the meaning of Paragraph 2 of the EU-Verbraucherschutzdurchführungsgesetz [(Law on the implementation o …", "paragraph_id": "para_242" }, { "text": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraph_id": "para_243" }, { "text": "26", "paragraph_id": "para_244" }, { "text": "Meta Platforms Ireland operates the online social network Facebook within the European Union and promotes, inter alia via www.facebook.com, services that are free of charge for private users. Other undertakings of the Meta group offer, within the European Union, other online services, including Instagram, WhatsApp, Oculus and – until 13 March 2020 – Masquerade.", "paragraph_id": "para_245" }, { "text": "27", "paragraph_id": "para_246" }, { "text": "The business model of the online social network Facebook is based on financing through online advertising, which is tailored to the individual users of the social network according, inter alia, to their consumer behaviour, interests, purchasing power and personal situation. Such advertising is made …", "paragraph_id": "para_247" }, { "text": "28", "paragraph_id": "para_248" }, { "text": "For the processing of those data, Meta Platforms Ireland relies on the user agreement to which the users of the social network Facebook adhere when they click on the ‘Sign up’ button, thereby accepting the general terms drawn up by that company. Acceptance of those terms is necessary in order to be …", "paragraph_id": "para_249" }, { "text": "29", "paragraph_id": "para_250" }, { "text": "The Federal Cartel Office brought proceedings against Meta Platforms, Meta Platforms Ireland and Facebook Deutschland, as a result of which, by decision of 6 February 2019, based on Paragraph 19(1) and Paragraph 32 of the GWB, it essentially prohibited those companies from making, in the general ter …", "paragraph_id": "para_251" }, { "text": "30", "paragraph_id": "para_252" }, { "text": "The Federal Cartel Office based its decision on the fact that the processing of the data of the users concerned, as provided for in the general terms and implemented by Meta Platforms Ireland, constituted an abuse of that company’s dominant position on the market for online social networks for priva …", "paragraph_id": "para_253" }, { "text": "31", "paragraph_id": "para_254" }, { "text": "On 11 February 2019, Meta Platforms, Meta Platforms Ireland and Facebook Deutschland brought an action against the decision of the Federal Cartel Office before the Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf, Germany).", "paragraph_id": "para_255" }, { "text": "32", "paragraph_id": "para_256" }, { "text": "On 31 July 2019, Meta Platforms Ireland introduced new general terms expressly stating that the user, instead of paying to use Facebook products, agrees to being shown advertisements.", "paragraph_id": "para_257" }, { "text": "33", "paragraph_id": "para_258" }, { "text": "Furthermore, since 28 January 2020, Meta Platforms has been offering, at a global level, ‘ Off-Facebook Activity ’, which allows the users of the social network Facebook to view a summary of the information about them that Meta group companies obtain in relation to their activities on other websites and apps, and to disconnect the data about past and future activities from their Facebook.com account if they so wish.", "paragraph_id": "para_259" }, { "text": "34", "paragraph_id": "para_260" }, { "text": "The Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf) has doubts (i) as to whether national competition authorities may review, in the exercise of their powers, whether the processing of personal data complies with the requirements set out in the GDPR; (ii) as to whether the operator …", "paragraph_id": "para_261" }, { "text": "35", "paragraph_id": "para_262" }, { "text": "In those circumstances, taking the view that the resolution of the case in the main proceedings depends on the answer to those questions, the Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:", "paragraph_id": "para_263" }, { "text": "‘(1)", "paragraph_id": "para_264" }, { "text": "(a)", "paragraph_id": "para_265" }, { "text": "Is it compatible with Article 51 et seq. of the GDPR if a national competition authority – such as the … Federal Cartel Office – which is not a supervisory authority within the meaning of Article 51 et seq. of the GDPR, of a Member State in which an undertaking established outside the European Union …", "paragraph_id": "para_266" }, { "text": "(b)", "paragraph_id": "para_267" }, { "text": "If so: is that compatible with Article 4(3) TEU if, at the same time, the lead supervisory authority in the Member State in which the main establishment, within the meaning of Article 56(1) of the GDPR, is located is investigating the undertaking’s contractual terms relating to data processing?", "paragraph_id": "para_268" }, { "text": "If the answer to Question 1 is “yes”:", "paragraph_id": "para_269" }, { "text": "(2)", "paragraph_id": "para_270" }, { "text": "(a)", "paragraph_id": "para_271" }, { "text": "If an internet user merely visits websites or apps to which the criteria of Article 9(1) of the GDPR relate, such as flirting apps, gay dating sites, political party websites or health-related websites, or also enters information into them, for example when registering or when placing orders, and [a …", "paragraph_id": "para_272" }, { "text": "(b)", "paragraph_id": "para_273" }, { "text": "If so: does visiting those websites or apps and/or entering information and/or clicking or tapping on the buttons integrated into them by a provider such as [Meta Platforms Ireland] (social plugins such as “Like”, “Share” or “Facebook Login” or “Account Kit”) constitute manifestly making the data about the visits themselves and/or the information entered by the user public within the meaning of Article 9(2)(e) of the GDPR?", "paragraph_id": "para_274" }, { "text": "(3)", "paragraph_id": "para_275" }, { "text": "Can an undertaking, such as [Meta Platforms Ireland], which operates a digital social network funded by advertising and offers personalised content and advertising, network security, product improvement and consistent, seamless use of all of its group products in its terms of service, justify collec …", "paragraph_id": "para_276" }, { "text": "(4)", "paragraph_id": "para_277" }, { "text": "In those circumstances, can", "paragraph_id": "para_278" }, { "text": "–", "paragraph_id": "para_279" }, { "text": "the fact of users being underage, vis-à-vis the personalisation of content and advertising, product improvement, network security and non-marketing communications intended for the user;", "paragraph_id": "para_280" }, { "text": "–", "paragraph_id": "para_281" }, { "text": "the provision of measurements, analytics and other business services to enable advertisers, developers and other partners to evaluate and improve their services;", "paragraph_id": "para_282" }, { "text": "–", "paragraph_id": "para_283" }, { "text": "the provision of marketing communications intended for the user to enable the undertaking to improve its products and engage in direct marketing;", "paragraph_id": "para_284" }, { "text": "–", "paragraph_id": "para_285" }, { "text": "research and innovation for social good, to further the state of the art or the academic understanding of important social issues and to affect society and the world in a positive way;", "paragraph_id": "para_286" }, { "text": "–", "paragraph_id": "para_287" }, { "text": "the sharing of information with law-enforcement agencies and responding to legal requests in order to prevent, detect and prosecute criminal offences, unlawful use, breaches of the terms of service and policies and other harmful behaviour;", "paragraph_id": "para_288" }, { "text": "also constitute legitimate interests within the meaning of Article 6(1)(f) of the GDPR if, for those purposes, the undertaking [collects data from other group services and from third-party websites and apps via integrated interfaces such as “Facebook Business Tools”, or via cookies or similar storage technologies placed on the internet user’s computer or mobile device, links those data with the user’s Facebook.com account and uses them]?", "paragraph_id": "para_289" }, { "text": "(5)", "paragraph_id": "para_290" }, { "text": "In those circumstances, can collecting data from other group services and from third-party websites and apps via integrated interfaces such as “Facebook Business Tools”, or via cookies or similar storage technologies placed on the internet user’s computer or mobile device, linking those data with th …", "paragraph_id": "para_291" }, { "text": "(6)", "paragraph_id": "para_292" }, { "text": "Can consent within the meaning of Article 6(1)(a) and Article 9(2)(a) of the GDPR be given effectively and, in accordance with Article 4(11) of the GDPR in particular, freely, to a dominant undertaking such as [Meta Platforms Ireland]?", "paragraph_id": "para_293" }, { "text": "If the answer to Question 1 is “no”:", "paragraph_id": "para_294" }, { "text": "(7)", "paragraph_id": "para_295" }, { "text": "(a)", "paragraph_id": "para_296" }, { "text": "Can the national competition authority of a Member State, such as the Federal Cartel Office, which is not a supervisory authority within the meaning of Article 51 et seq. of the GDPR and which examines a breach by a dominant undertaking of the competition-law prohibition on abuse that is not a breac …", "paragraph_id": "para_297" }, { "text": "(b)", "paragraph_id": "para_298" }, { "text": "If so: in the light of Article 4(3) TEU, does that also apply if the competent lead supervisory authority in accordance with Article 56(1) of the GDPR is investigating the undertaking’s data processing terms at the same time?", "paragraph_id": "para_299" }, { "text": "If the answer to Question 7 is “yes”, Questions 3 to 5 must be answered in relation to data from the use of the group’s Instagram service.’", "paragraph_id": "para_300" }, { "text": "The questions referred", "paragraph_id": "para_301" }, { "text": "Questions 1 and 7", "paragraph_id": "para_302" }, { "text": "36", "paragraph_id": "para_303" }, { "text": "By Questions 1 and 7, which it is appropriate to examine together, the referring court asks, in essence, whether Article 51 et seq. of the GDPR must be interpreted as meaning that a competition authority of a Member State can find, in the context of the examination of an abuse of a dominant position …", "paragraph_id": "para_304" }, { "text": "37", "paragraph_id": "para_305" }, { "text": "In order to answer that question, it is important to recall at the outset that Article 55(1) of the GDPR states the general rule that each supervisory authority is to be competent for the performance of the tasks assigned to it and the exercise of the powers conferred on it, in accordance with that regulation, on the territory of its own Member State (judgment of 15 June 2021, Facebook Ireland and Others, C‑645/19 , EU:C:2021:483 , paragraph  47 and the case-law cited).", "paragraph_id": "para_306" }, { "text": "38", "paragraph_id": "para_307" }, { "text": "The tasks assigned to those supervisory authorities include monitoring and enforcing the application of the GDPR, as provided for in Article 51(1) and Article 57(1)(a) of that regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to the processing of thei …", "paragraph_id": "para_308" }, { "text": "39", "paragraph_id": "para_309" }, { "text": "In order to carry out those tasks, Article 58 of the GDPR confers on those supervisory authorities, in paragraph 1, investigative powers, in paragraph 2, corrective powers, and in paragraph 5, the power to bring infringements of that regulation to the attention of the judicial authorities and, where appropriate, to commence legal proceedings in order to enforce the provisions of that regulation.", "paragraph_id": "para_310" }, { "text": "40", "paragraph_id": "para_311" }, { "text": "Without prejudice to the rule on competence set out in Article 55(1) of the GDPR, Article 56(1) of that regulation lays down, with respect to ‘cross-border processing’, within the meaning of Article 4(23) of that regulation, the ‘one-stop-shop mechanism’, based on an allocation of competences betwee …", "paragraph_id": "para_312" }, { "text": "41", "paragraph_id": "para_313" }, { "text": "Furthermore, Article 61(1) of the GDPR obliges the supervisory authorities, inter alia, to provide each other with relevant information and mutual assistance in order to implement and apply that regulation in a consistent manner throughout the European Union. Article 63 of the GDPR states that it wa …", "paragraph_id": "para_314" }, { "text": "42", "paragraph_id": "para_315" }, { "text": "That said, it should be noted that the rules on cooperation laid down in the GDPR are not addressed to the national competition authorities but govern cooperation between the national supervisory authorities concerned and the lead supervisory authority as well as, where appropriate, cooperation between those authorities and the European Data Protection Board and the Commission.", "paragraph_id": "para_316" }, { "text": "43", "paragraph_id": "para_317" }, { "text": "Neither the GDPR nor any other instrument of EU law provides for specific rules on cooperation between a national competition authority and the relevant national supervisory authorities concerned or the lead supervisory authority. Furthermore, there is no provision in that regulation that prevents t …", "paragraph_id": "para_318" }, { "text": "44", "paragraph_id": "para_319" }, { "text": "In that regard, it should be made clear, in the first place, that the supervisory authorities, on the one hand, and the national competition authorities, on the other, perform different functions and pursue their own objectives and tasks.", "paragraph_id": "para_320" }, { "text": "45", "paragraph_id": "para_321" }, { "text": "On the one hand, as has been stated in paragraph 38 above, under Article 51(1) and (2) and Article 57(1)(a) and (g) of the GDPR, the primary task of the supervisory authority is to monitor and enforce the application of that regulation, while contributing to its consistent application within the Eur …", "paragraph_id": "para_322" }, { "text": "46", "paragraph_id": "para_323" }, { "text": "On the other hand, in accordance with Article 5 of Regulation No 1/2003, the national competition authorities have the power to take, inter alia, decisions finding an abuse of a dominant position by an undertaking, within the meaning of Article 102 TFEU, whose objective is to establish a system which ensures that competition in the internal market is not distorted, having regard also to the consequences of such an abuse for consumers in that market.", "paragraph_id": "para_324" }, { "text": "47", "paragraph_id": "para_325" }, { "text": "As the Advocate General observed, in essence, in point 23 of his Opinion, when taking such a decision, a competition authority must assess, on the basis of all the specific circumstances of the case, whether, by resorting to methods different from those governing normal competition in products or se …", "paragraph_id": "para_326" }, { "text": "48", "paragraph_id": "para_327" }, { "text": "It follows that, in the context of the examination of an abuse of a dominant position by an undertaking on a particular market, it may be necessary for the competition authority of the Member State concerned also to examine whether that undertaking’s conduct complies with rules other than those relating to competition law, such as the rules on the protection of personal data laid down by the GDPR.", "paragraph_id": "para_328" }, { "text": "49", "paragraph_id": "para_329" }, { "text": "In view of the different objectives pursued by the rules established in competition matters, in particular Article 102 TFEU, on the one hand, and those laid down in relation to the protection of personal data under the GDPR, on the other, it must be held that, where a national competition authority …", "paragraph_id": "para_330" }, { "text": "50", "paragraph_id": "para_331" }, { "text": "Moreover, it is important to state that access to and use of personal data are of great importance in the context of the digital economy. That importance is illustrated, in the context of the dispute in the main proceedings, by the business model on which the social network Facebook relies, which, a …", "paragraph_id": "para_332" }, { "text": "51", "paragraph_id": "para_333" }, { "text": "As pointed out by the Commission, inter alia, access to personal data and the fact that it is possible to process such data have become a significant parameter of competition between undertakings in the digital economy. Therefore, excluding the rules on the protection of personal data from the legal …", "paragraph_id": "para_334" }, { "text": "52", "paragraph_id": "para_335" }, { "text": "However, in the second place, it should be noted that, where a national competition authority considers it necessary to rule, in the context of a decision on an abuse of a dominant position, on the compliance or non-compliance with the GDPR of the processing of personal data by the undertaking in qu …", "paragraph_id": "para_336" }, { "text": "53", "paragraph_id": "para_337" }, { "text": "Although, as has been noted in paragraphs 42 and 43 above, neither the GDPR nor any other instrument of EU law provides for specific rules in that regard, the fact remains that, as the Advocate General observed, in essence, in point 28 of his Opinion, when they apply the GDPR, the various national a …", "paragraph_id": "para_338" }, { "text": "54", "paragraph_id": "para_339" }, { "text": "Thus, in the light of this principle, when national competition authorities are called upon, in the exercise of their powers, to examine whether an undertaking’s conduct is consistent with the provisions of the GDPR, they are required to consult and cooperate sincerely with the national supervisory …", "paragraph_id": "para_340" }, { "text": "55", "paragraph_id": "para_341" }, { "text": "The examination by a competition authority of an undertaking’s conduct in the light of the provisions of the GDPR may entail the risk of divergences between that authority and the supervisory authorities in the interpretation of that regulation.", "paragraph_id": "para_342" }, { "text": "56", "paragraph_id": "para_343" }, { "text": "It follows that, where, in the context of the examination seeking to establish whether there is an abuse of a dominant position within the meaning of Article 102 TFEU by an undertaking, a national competition authority takes the view that it is necessary to examine whether that undertaking’s conduct …", "paragraph_id": "para_344" }, { "text": "57", "paragraph_id": "para_345" }, { "text": "Where it has doubts as to the scope of the assessment carried out by the competent national supervisory authority or the lead supervisory authority, where the conduct in question or similar conduct is, simultaneously, under examination by those authorities, or where, in the absence of investigation …", "paragraph_id": "para_346" }, { "text": "58", "paragraph_id": "para_347" }, { "text": "For its part, where the supervisory authority is called upon by a national competition authority, it must respond to such a request for information or cooperation within a reasonable period of time, providing the latter with the information in its possession capable of dispelling that authority’s do …", "paragraph_id": "para_348" }, { "text": "59", "paragraph_id": "para_349" }, { "text": "In the absence of a reply, within a reasonable time, from the supervisory authority thus called upon, the national competition authority may continue its own investigation. The same applies where the competent national supervisory authority and the lead supervisory authority have no objection to such an investigation being continued without having to wait for a decision on their part.", "paragraph_id": "para_350" }, { "text": "60", "paragraph_id": "para_351" }, { "text": "In the present case, it is apparent from the file before the Court that in October and November 2018, that is to say, before the adoption of the decision of 6 February 2019, the Federal Cartel Office contacted the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) (Federal Com …", "paragraph_id": "para_352" }, { "text": "61", "paragraph_id": "para_353" }, { "text": "In those circumstances, and subject to verification by the referring court, the Federal Cartel Office appears to have fulfilled its obligations of sincere cooperation with the national supervisory authorities concerned and the lead supervisory authority.", "paragraph_id": "para_354" }, { "text": "62", "paragraph_id": "para_355" }, { "text": "In the light of the foregoing, the answer to Questions 1 and 7 is that Article 51 et seq. of the GDPR and Article 4(3) TEU must be interpreted as meaning that, subject to compliance with its duty of sincere cooperation with the supervisory authorities, a competition authority of a Member State can f …", "paragraph_id": "para_356" }, { "text": "63", "paragraph_id": "para_357" }, { "text": "In view of this duty of sincere cooperation, the national competition authority cannot depart from a decision by the competent national supervisory authority or the competent lead supervisory authority concerning those general terms or similar general terms. Where it has doubts as to the scope of su …", "paragraph_id": "para_358" }, { "text": "Question 2", "paragraph_id": "para_359" }, { "text": "64", "paragraph_id": "para_360" }, { "text": "By Question 2(a), the referring court asks, in essence, whether Article 9(1) of the GDPR must be interpreted as meaning that, where the user of an online social network visits websites or apps to which one or more of the categories referred to in that provision relate and, as the case may be, enters …", "paragraph_id": "para_361" }, { "text": "65", "paragraph_id": "para_362" }, { "text": "If so, the referring court asks, in essence, by Question 2(b), whether Article 9(2)(e) of the GDPR must be interpreted as meaning that, where the user of an online social network visits websites or apps to which the categories set out in Article 9(1) of the GDPR relate, enters information into those …", "paragraph_id": "para_363" }, { "text": "Question 2(a)", "paragraph_id": "para_364" }, { "text": "66", "paragraph_id": "para_365" }, { "text": "Recital 51 of the GDPR states that personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. That recital further states that such personal data should not be processed unless processing is allowed in the specific cases set out in that regulation.", "paragraph_id": "para_366" }, { "text": "67", "paragraph_id": "para_367" }, { "text": "In that context, Article 9(1) of the GDPR lays down the principle that the processing of special categories of personal data listed therein is prohibited. This includes data revealing racial or ethnic origin, political opinions, religious beliefs and data concerning health or a natural person’s sex life or sexual orientation.", "paragraph_id": "para_368" }, { "text": "68", "paragraph_id": "para_369" }, { "text": "For the purposes of applying Article 9(1) of the GDPR, it is important to determine, where personal data is processed by the operator of an online social network, if those data allow information falling within one of the categories referred to in that provision to be revealed, irrespective of whethe …", "paragraph_id": "para_370" }, { "text": "69", "paragraph_id": "para_371" }, { "text": "As the Advocate General observed, in essence, in points 40 and 41 of his Opinion, that fundamental prohibition, laid down in Article 9(1) of the GDPR, is independent of whether or not the information revealed by the processing operation in question is correct and of whether the controller is acting with the aim of obtaining information that falls within one of the special categories referred to in that provision.", "paragraph_id": "para_372" }, { "text": "70", "paragraph_id": "para_373" }, { "text": "In view of the significant risks to the fundamental freedoms and fundamental rights of data subjects arising from any processing of personal data falling within the categories referred to in Article 9(1) of the GDPR, the objective thereof is to prohibit such processing, irrespective of its stated purpose.", "paragraph_id": "para_374" }, { "text": "71", "paragraph_id": "para_375" }, { "text": "In the present case, the processing operation at issue in the main proceedings carried out by Meta Platforms Ireland entails, first of all, the collection of personal data of the users of the social network Facebook when they visit websites or apps – including those that may reveal information falli …", "paragraph_id": "para_376" }, { "text": "72", "paragraph_id": "para_377" }, { "text": "In that regard, it will be for the referring court to determine whether the data thus collected, on their own or by linking them with the Facebook accounts of the users concerned, actually allow such information to be revealed, irrespective of whether that information concerns a user of that network …", "paragraph_id": "para_378" }, { "text": "73", "paragraph_id": "para_379" }, { "text": "In the light of the foregoing, the answer to Question 2(a) is that Article 9(1) of the GDPR must be interpreted as meaning that, where the user of an online social network visits websites or apps to which one or more of the categories referred to in that provision relate and, as the case may be, ent …", "paragraph_id": "para_380" }, { "text": "Question 2(b)", "paragraph_id": "para_381" }, { "text": "74", "paragraph_id": "para_382" }, { "text": "As regards Question 2(b), as reformulated in paragraph 65 above and which relates to the derogation laid down in Article 9(2)(e) of the GDPR, it must be recalled that, under that provision, the fundamental prohibition of any processing of special categories of personal data, established in Article 9(1) of the GDPR, does not apply in the circumstance where the processing relates to personal data which are ‘manifestly made public by the data subject’.", "paragraph_id": "para_383" }, { "text": "75", "paragraph_id": "para_384" }, { "text": "As a preliminary point, it should be noted that, first, the derogation applies only to data which are manifestly made public ‘by the data subject’. Accordingly, it is not applicable to data concerning persons other than the person who made those data public.", "paragraph_id": "para_385" }, { "text": "76", "paragraph_id": "para_386" }, { "text": "Second, in so far as it provides for an exception to the principle that the processing of special categories of personal data is prohibited, Article 9(2) of the GDPR must be interpreted strictly (see, to that effect, judgments of 17 September 2014, Baltic Agro, C‑3/13 , EU:C:2014:2227 , paragraph  24 and the case-law cited, and of 6 June 2019, Weil, C‑361/18 , EU:C:2019:473 , paragraph  43 and the case-law cited).", "paragraph_id": "para_387" }, { "text": "77", "paragraph_id": "para_388" }, { "text": "It follows that, for the purposes of the application of the exception laid down in Article 9(2)(e) of the GDPR, it is important to ascertain whether the data subject had intended, explicitly and by a clear affirmative action, to make the personal data in question accessible to the general public.", "paragraph_id": "para_389" }, { "text": "78", "paragraph_id": "para_390" }, { "text": "In that regard, as regards, first, visits to websites or apps to which one or more of the categories referred to in Article 9(1) of the GDPR relate, it should be noted that the user concerned does not in any way thereby intend to make public the fact that he or she has visited those sites or apps an …", "paragraph_id": "para_391" }, { "text": "79", "paragraph_id": "para_392" }, { "text": "Thus, it cannot be inferred from the mere visit to such websites or apps by a user that the personal data in question were manifestly made public by that user within the meaning of Article 9(2)(e) of the GDPR.", "paragraph_id": "para_393" }, { "text": "80", "paragraph_id": "para_394" }, { "text": "Second, as regards the entering of information into those websites or apps and the clicking or tapping on buttons integrated into them, such as the ‘Like’ or ‘Share’ buttons or buttons enabling the user to identify himself or herself on a website or app using the login credentials linked to his or h …", "paragraph_id": "para_395" }, { "text": "81", "paragraph_id": "para_396" }, { "text": "In those circumstances, it is for the referring court to ascertain whether it is possible for the users concerned to decide, on the basis of settings selected with full knowledge of the facts, whether to make the information entered into the websites or apps in question and the data from clicking or tapping on buttons integrated into them accessible to the general public or, rather, to a more or less limited number of selected persons.", "paragraph_id": "para_397" }, { "text": "82", "paragraph_id": "para_398" }, { "text": "When the users concerned actually have that choice, they can be regarded, when they voluntarily enter information into a website or app or when they click or tap on buttons integrated into them, as manifestly making public, within the meaning of Article 9(2)(e) of the GDPR, data relating to them onl …", "paragraph_id": "para_399" }, { "text": "83", "paragraph_id": "para_400" }, { "text": "By contrast, if no such individual settings are available, it must be held, in the light of what has been stated in paragraph 77 above, that, where users voluntarily enter information into a website or app or click or tap on buttons integrated into them, they must, in order to be deemed to have mani …", "paragraph_id": "para_401" }, { "text": "84", "paragraph_id": "para_402" }, { "text": "In the light of the foregoing, the answer to Question 2(b) is that Article 9(2)(e) of the GDPR must be interpreted as meaning that, where the user of an online social network visits websites or apps to which one or more of the categories set out in Article 9(1) of the GDPR relate, the user does not …", "paragraph_id": "para_403" }, { "text": "85", "paragraph_id": "para_404" }, { "text": "Where he or she enters information into such websites or apps or where he or she clicks or taps on buttons integrated into those sites and apps, such as the ‘Like’ or ‘Share’ buttons or buttons enabling the user to identify himself or herself on those sites or apps using login credentials linked to …", "paragraph_id": "para_405" }, { "text": "Questions 3 to 5", "paragraph_id": "para_406" }, { "text": "86", "paragraph_id": "para_407" }, { "text": "By Questions 3 and 4, which it is appropriate to examine together, the referring court asks, in essence, whether and under what conditions points (b) and (f) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that the processing of personal data by the operator of a …", "paragraph_id": "para_408" }, { "text": "87", "paragraph_id": "para_409" }, { "text": "By Question 5, the referring court asks, in essence, whether points (c) to (e) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that such processing of personal data can be regarded as necessary for compliance with a legal obligation to which the controller is sub …", "paragraph_id": "para_410" }, { "text": "Preliminary observations", "paragraph_id": "para_411" }, { "text": "88", "paragraph_id": "para_412" }, { "text": "As a preliminary point, it must be observed, first, that Questions 3 to 5 are raised on account of the fact that, according to the findings of the Federal Cartel Office in its decision of 6 February 2019, the users of the social network Facebook cannot be regarded as having given their consent to th …", "paragraph_id": "para_413" }, { "text": "89", "paragraph_id": "para_414" }, { "text": "In that context, it should be noted that the operations entailing the collection, the linking and the use of the data, referred to in Questions 3 to 5, may include both sensitive data within the meaning of Article 9(1) of the GDPR and non-sensitive data. It must be made clear that, where a set of da …", "paragraph_id": "para_415" }, { "text": "90", "paragraph_id": "para_416" }, { "text": "Second, in order to answer Questions 3 to 5, it should be recalled that the first subparagraph of Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful. Thus, in order to be capable of being regarded as such, …", "paragraph_id": "para_417" }, { "text": "91", "paragraph_id": "para_418" }, { "text": "Under point (a) of the first subparagraph of Article 6(1) of that regulation, the processing of personal data is lawful if and to the extent that the data subject has given consent for one or more specific purposes.", "paragraph_id": "para_419" }, { "text": "92", "paragraph_id": "para_420" }, { "text": "In the absence of such consent, or where that consent is not freely given, specific, informed and unambiguous, within the meaning of Article 4(11) of the GDPR, such processing is nevertheless justified where it meets one of the requirements of necessity mentioned in points (b) to (f) of the first subparagraph of Article 6(1) of that regulation.", "paragraph_id": "para_421" }, { "text": "93", "paragraph_id": "para_422" }, { "text": "In that context, the justifications provided for in that latter provision, in so far as they allow the processing of personal data carried out in the absence of the data subject’s consent to be made lawful, must be interpreted restrictively (see, to that effect, judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes), C‑175/20 , EU:C:2022:124 , paragraph  73 and the case-law cited).", "paragraph_id": "para_423" }, { "text": "94", "paragraph_id": "para_424" }, { "text": "Furthermore, as the Court has held, where it can be found that the processing of personal data is necessary in respect of one of the justifications provided for in points (b) to (f) of the first subparagraph of Article 6(1) of the GDPR, it is not necessary to determine whether that processing also f …", "paragraph_id": "para_425" }, { "text": "95", "paragraph_id": "para_426" }, { "text": "It should finally be noted that, in accordance with Article 5 of the GDPR, the controller bears the burden of proving that those data are collected, inter alia, for specified, explicit and legitimate purposes and that they are processed lawfully, fairly and in a transparent manner in relation to the …", "paragraph_id": "para_427" }, { "text": "96", "paragraph_id": "para_428" }, { "text": "Although it is for the referring court to determine whether the various elements of the processing at issue in the main proceedings are justified by one or other of the necessity requirements referred to in points (b) to (f) of the first subparagraph of Article 6(1) of the GDPR, the Court can nevertheless provide it with useful guidance to enable it to resolve the dispute before it.", "paragraph_id": "para_429" }, { "text": "Questions 3 and 4", "paragraph_id": "para_430" }, { "text": "97", "paragraph_id": "para_431" }, { "text": "As regards, in the first place, point (b) of the first subparagraph of Article 6(1) of the GDPR, that provision provides that processing of personal data is lawful if it is ‘necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.", "paragraph_id": "para_432" }, { "text": "98", "paragraph_id": "para_433" }, { "text": "In that regard, in order for the processing of personal data to be regarded as necessary for the performance of a contract, within the meaning of that provision, it must be objectively indispensable for a purpose that is integral to the contractual obligation intended for the data subject. The controller must therefore be able to demonstrate how the main subject matter of the contract cannot be achieved if the processing in question does not occur.", "paragraph_id": "para_434" }, { "text": "99", "paragraph_id": "para_435" }, { "text": "The fact that such processing may be referred to in the contract or may be merely useful for the performance of the contract is, in itself, irrelevant in that regard. The decisive factor for the purposes of applying the justification set out in point (b) of the first subparagraph of Article 6(1) of …", "paragraph_id": "para_436" }, { "text": "100", "paragraph_id": "para_437" }, { "text": "In that regard, as the Advocate General observed in point 54 of his Opinion, where the contract consists of several separate services or elements of a service that can be performed independently of one another, the applicability of point (b) of the first subparagraph of Article 6(1) of the GDPR should be assessed in the context of each of those services separately.", "paragraph_id": "para_438" }, { "text": "101", "paragraph_id": "para_439" }, { "text": "In the present case, in the context of the justifications that are capable of falling within the scope of that provision, the referring court mentions, as elements intended to ensure the proper performance of the contract concluded between Meta Platforms Ireland and its users, personalised content and the consistent and seamless use of the Meta group’s own services.", "paragraph_id": "para_440" }, { "text": "102", "paragraph_id": "para_441" }, { "text": "As regards, first, the justification based on personalised content, it is important to note that, although such a personalisation is useful to the user, in so far as it enables the user, inter alia, to view content corresponding to a large extent to his or her interests, the fact remains that, subje …", "paragraph_id": "para_442" }, { "text": "103", "paragraph_id": "para_443" }, { "text": "As regards, second, the justification based on the consistent and seamless use of the Meta group’s own services, it is apparent from the file before the Court that there is no obligation to subscribe to the various services offered by the Meta group in order to create a user account in the social ne …", "paragraph_id": "para_444" }, { "text": "104", "paragraph_id": "para_445" }, { "text": "Therefore, and subject to verification by the referring court, the processing of personal data from services offered by the Meta group, other than the online social network service, does not appear to be necessary for the latter service to be provided.", "paragraph_id": "para_446" }, { "text": "105", "paragraph_id": "para_447" }, { "text": "As regards, in the second place, point (f) of the first subparagraph of Article 6(1) of the GDPR, that provision provides that the processing of personal data is lawful only if it is ‘necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where s …", "paragraph_id": "para_448" }, { "text": "106", "paragraph_id": "para_449" }, { "text": "As the Court has already held, that provision lays down three cumulative conditions so that the processing of personal data covered by that provision is lawful, namely, first, the pursuit of a legitimate interest by the data controller or by a third party; second, the need to process personal data f …", "paragraph_id": "para_450" }, { "text": "107", "paragraph_id": "para_451" }, { "text": "First, with regard to the condition relating to the pursuit of a legitimate interest, it must be stated that, according to Article 13(1)(d) of the GDPR, it is the responsibility of the controller, at the time when personal data relating to a data subject are collected from that person, to inform him or her of the legitimate interests pursued where that processing is based on point (f) of the first subparagraph of Article 6(1) of that regulation.", "paragraph_id": "para_452" }, { "text": "108", "paragraph_id": "para_453" }, { "text": "Second, with regard to the condition that the processing of personal data be necessary for the purposes of the legitimate interests pursued, that condition requires the referring court to ascertain that the legitimate data processing interests pursued cannot reasonably be achieved just as effectivel …", "paragraph_id": "para_454" }, { "text": "109", "paragraph_id": "para_455" }, { "text": "In this context, it should also be recalled that the condition relating to the need for processing must be examined in conjunction with the ‘data minimisation’ principle enshrined in Article 5(1)(c) of the GDPR, in accordance with which personal data must be ‘adequate, relevant and limited to what i …", "paragraph_id": "para_456" }, { "text": "110", "paragraph_id": "para_457" }, { "text": "Third, with regard to the condition that the interests or fundamental rights and freedoms of the person concerned by the data protection do not take precedence over the legitimate interests of the controller or of a third party, the Court has already held that that condition entails a balancing of t …", "paragraph_id": "para_458" }, { "text": "111", "paragraph_id": "para_459" }, { "text": "In this respect, it is apparent from the very wording of point (f) of the first subparagraph of Article 6(1) of the GDPR that it is necessary, in such a balancing exercise, to pay particular attention to the situation where the data subject is a child. According to recital 38 of that regulation, chi …", "paragraph_id": "para_460" }, { "text": "112", "paragraph_id": "para_461" }, { "text": "Furthermore, as can be seen from recital 47 of the GDPR, the interests and fundamental rights of the data subject may in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect such processing.", "paragraph_id": "para_462" }, { "text": "113", "paragraph_id": "para_463" }, { "text": "In the present case, in the context of the justifications that are capable of falling within the scope of point (f) of the first subparagraph of Article 6(1) of the GDPR, the referring court mentions personalised advertising, network security, product improvement, the sharing of informing with law-e …", "paragraph_id": "para_464" }, { "text": "114", "paragraph_id": "para_465" }, { "text": "In that regard, it should be noted at the outset that the request for a preliminary ruling does not contain any explanation as to how research and innovation for social good or the fact that the user is a minor could justify, as legitimate interests within the meaning of point (f) of the first subparagraph of Article 6(1) of the GDPR, the collection and use of the data in question. Consequently, the Court is not in a position to rule on this matter.", "paragraph_id": "para_466" }, { "text": "115", "paragraph_id": "para_467" }, { "text": "First, with regard to personalised advertising, it must be borne in mind that, according to recital 47 of the GDPR, the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest of the controller.", "paragraph_id": "para_468" }, { "text": "116", "paragraph_id": "para_469" }, { "text": "However, such processing must also be necessary in order to achieve that interest and the interests or fundamental freedoms and rights of the data subject must not override that interest. In the context of that balancing of the opposing rights at issue, namely, those of the controller, on the one ha …", "paragraph_id": "para_470" }, { "text": "117", "paragraph_id": "para_471" }, { "text": "In this regard, it is important to note that, despite the fact that the services of an online social network such as Facebook are free of charge, the user of that network cannot reasonably expect that the operator of the social network will process that user’s personal data, without his or her conse …", "paragraph_id": "para_472" }, { "text": "118", "paragraph_id": "para_473" }, { "text": "Furthermore, the processing at issue in the main proceedings is particularly extensive since it relates to potentially unlimited data and has a significant impact on the user, a large part – if not almost all – of whose online activities are monitored by Meta Platforms Ireland, which may give rise to the feeling that his or her private life is being continuously monitored.", "paragraph_id": "para_474" }, { "text": "119", "paragraph_id": "para_475" }, { "text": "Second, as regards the objective of ensuring network security, that objective, as stated in recital 49 of the GDPR, constitutes a legitimate interest of Meta Platforms Ireland, capable of justifying the processing operation at issue in the main proceedings.", "paragraph_id": "para_476" }, { "text": "120", "paragraph_id": "para_477" }, { "text": "However, as regards the need for that processing for the purposes of that legitimate interest, the referring court will have to ascertain whether and to what extent the processing of personal data collected from sources outside the social network Facebook is actually necessary to ensure that the internal security of that network is not compromised.", "paragraph_id": "para_478" }, { "text": "121", "paragraph_id": "para_479" }, { "text": "In that context, as noted in paragraphs 108 and 109 above, it will also have to ascertain whether the legitimate data processing interest pursued cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental freedoms and rights of the data subjects, in particul …", "paragraph_id": "para_480" }, { "text": "122", "paragraph_id": "para_481" }, { "text": "Third, as regards the ‘product improvement’ objective, it cannot be ruled out from the outset that the controller’s interest in improving the product or service with a view to making it more efficient and thus more attractive can constitute a legitimate interest capable of justifying the processing of personal data and that such processing may be necessary in order to pursue that interest.", "paragraph_id": "para_482" }, { "text": "123", "paragraph_id": "para_483" }, { "text": "However, subject to final assessment by the referring court in that respect, it appears doubtful whether, as regards the data processing at issue in the main proceedings, the ‘product improvement’ objective, given the scale of that processing and its significant impact on the user, as well as the fa …", "paragraph_id": "para_484" }, { "text": "124", "paragraph_id": "para_485" }, { "text": "Fourth, as regards the objective referred to by the referring court, relating to the sharing of information with law-enforcement agencies in order to prevent, detect and prosecute criminal offences, it must be held that that objective is not capable, in principle, of constituting a legitimate intere …", "paragraph_id": "para_486" }, { "text": "125", "paragraph_id": "para_487" }, { "text": "In the light of all the foregoing, the answer to Questions 3 and 4 is that point (b) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that the processing of personal data by the operator of an online social network, which entails the collection of data of the user …", "paragraph_id": "para_488" }, { "text": "126", "paragraph_id": "para_489" }, { "text": "Point (f) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that such processing can be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, within the meaning of that provision, only on condition that th …", "paragraph_id": "para_490" }, { "text": "Question 5", "paragraph_id": "para_491" }, { "text": "127", "paragraph_id": "para_492" }, { "text": "In the first place, in so far as that question refers to points (c) and (e) of the first subparagraph of Article 6(1) of the GDPR, it must be recalled that, under point (c), processing of personal data is lawful if it is necessary for compliance with a legal obligation to which the controller is sub …", "paragraph_id": "para_493" }, { "text": "128", "paragraph_id": "para_494" }, { "text": "Article 6(3) of the GDPR specifies, inter alia, in respect of those two situations in which processing is lawful, that the processing must be based on EU law or on Member State law to which the controller is subject, and that that legal basis must meet an objective of public interest and be proportionate to the legitimate aim pursued.", "paragraph_id": "para_495" }, { "text": "129", "paragraph_id": "para_496" }, { "text": "In the present case, the referring court seeks to ascertain whether the processing of personal data, such as that at issue in the main proceedings, may be regarded as justified in the light of point (c) of the first subparagraph of Article 6(1) of the GDPR, where it seeks to ‘respond to a legitimate …", "paragraph_id": "para_497" }, { "text": "130", "paragraph_id": "para_498" }, { "text": "However, it should be noted that the referring court has not provided the Court of Justice with any material enabling it to give a specific ruling in this respect.", "paragraph_id": "para_499" }, { "text": "131", "paragraph_id": "para_500" }, { "text": "It will therefore be for that court to ascertain, in the light of the conditions set out in paragraph 128 above, whether that processing can be regarded as being justified by the stated purposes.", "paragraph_id": "para_501" }, { "text": "132", "paragraph_id": "para_502" }, { "text": "In particular, given the observations made in paragraph 124 above, it will be for the referring court, inter alia, to inquire, for the purposes of applying point (c) of the first subparagraph of Article 6(1) of the GDPR, whether Meta Platforms Ireland is under a legal obligation to collect and store personal data in a preventive manner in order to be able to respond to any request from a national authority seeking to obtain certain data relating to its users.", "paragraph_id": "para_503" }, { "text": "133", "paragraph_id": "para_504" }, { "text": "Similarly, it will be for that court to assess, in the light of point (e) of the first subparagraph of Article 6(1) of the GDPR, whether Meta Platforms Ireland was entrusted with a task carried out in the public interest or in the exercise of official authority, in particular with a view of carrying …", "paragraph_id": "para_505" }, { "text": "134", "paragraph_id": "para_506" }, { "text": "In addition, the referring court will, if necessary, have to determine whether, in view of the scale of the data processing by Meta Platforms Ireland and of its significant incidence on the users of the social network Facebook, that processing is carried out only in so far as is strictly necessary.", "paragraph_id": "para_507" }, { "text": "135", "paragraph_id": "para_508" }, { "text": "As regards, in the second place, point (d) of the first subparagraph of Article 6(1) of the GDPR, that provision provides that the processing of personal data is lawful where it is necessary in order to protect the vital interests of the data subject or of another natural person.", "paragraph_id": "para_509" }, { "text": "136", "paragraph_id": "para_510" }, { "text": "As can be seen from recital 46 of that regulation, that provision covers the specific situation in which the processing of personal data is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. In that regard, the recital cites by way …", "paragraph_id": "para_511" }, { "text": "137", "paragraph_id": "para_512" }, { "text": "It follows from those examples and from the strict interpretation to be given to point (d) of the first subparagraph of Article 6(1) of the GDPR that, in view of the nature of the services provided by the operator of an online social network, such an operator, whose activity is essentially economic …", "paragraph_id": "para_513" }, { "text": "138", "paragraph_id": "para_514" }, { "text": "In the light of the foregoing, the answer to Question 5 is that point (c) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that the processing of personal data by the operator of an online social network, which entails the collection of data of the users of such a …", "paragraph_id": "para_515" }, { "text": "139", "paragraph_id": "para_516" }, { "text": "Points (d) and (e) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that such processing of personal data cannot, in principle and subject to verification by the referring court, be regarded as necessary in order to protect the vital interests of the data subject …", "paragraph_id": "para_517" }, { "text": "Question 6", "paragraph_id": "para_518" }, { "text": "140", "paragraph_id": "para_519" }, { "text": "By Question 6, the referring court asks, in essence, whether point (a) of the first subparagraph of Article 6(1) and Article 9(2)(a) of the GDPR must be interpreted as meaning that consent given by the user of an online social network to the operator of such a network may be regarded as satisfying t …", "paragraph_id": "para_520" }, { "text": "141", "paragraph_id": "para_521" }, { "text": "Point (a) of the first subparagraph of Article 6(1) and Article 9(2)(a) of the GDPR require the data subject’s consent for the purposes of, respectively, processing his or her personal data for one or more specific purposes and processing special categories of data referred to in Article 9(1).", "paragraph_id": "para_522" }, { "text": "142", "paragraph_id": "para_523" }, { "text": "Article 4(11) of the GDPR, for its part, defines ‘consent’ as meaning ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’.", "paragraph_id": "para_524" }, { "text": "143", "paragraph_id": "para_525" }, { "text": "In the light of the referring court’s questions, it is important to recall, in the first place, that, according to recital 42 of the GDPR, consent cannot be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.", "paragraph_id": "para_526" }, { "text": "144", "paragraph_id": "para_527" }, { "text": "In the second place, recital 43 of that regulation states that, in order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data where there is a clear imbalance between the data subject and the controller. That recital also clarifi …", "paragraph_id": "para_528" }, { "text": "145", "paragraph_id": "para_529" }, { "text": "In the third place, Article 7(4) of the GDPR provides that when assessing whether consent is freely given, utmost account must be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.", "paragraph_id": "para_530" }, { "text": "146", "paragraph_id": "para_531" }, { "text": "It is on the basis of those considerations that Question 6 must be answered.", "paragraph_id": "para_532" }, { "text": "147", "paragraph_id": "para_533" }, { "text": "In that regard, it should be noted that, admittedly, the fact that the operator of an online social network, as controller, holds a dominant position on the social network market does not, as such, prevent the users of that social network from validly giving their consent, within the meaning of Article 4(11) of the GDPR, to the processing of their personal data by that operator.", "paragraph_id": "para_534" }, { "text": "148", "paragraph_id": "para_535" }, { "text": "The fact remains that, as the Advocate General observed, in essence, in point 75 of his Opinion, such a circumstance must be taken into consideration in assessing whether the user of that network has validly and, in particular, freely given consent, since that circumstance is liable to affect the freedom of choice of that user, who might be unable to refuse or withdraw consent without detriment, as stated in recital 42 of the GDPR.", "paragraph_id": "para_536" }, { "text": "149", "paragraph_id": "para_537" }, { "text": "Furthermore, the existence of such a dominant position may create a clear imbalance, within the meaning of recital 43 of the GDPR, between the data subject and the controller, that imbalance favouring, inter alia, the imposition of conditions that are not strictly necessary for the performance of th …", "paragraph_id": "para_538" }, { "text": "150", "paragraph_id": "para_539" }, { "text": "Thus, those users must be free to refuse individually, in the context of the contractual process, to give their consent to particular data processing operations not necessary for the performance of the contract, without being obliged to refrain entirely from using the service offered by the online s …", "paragraph_id": "para_540" }, { "text": "151", "paragraph_id": "para_541" }, { "text": "Moreover, given the scale of the processing of the data in question and the significant impact of that processing on the users of that network as well as the fact that those users cannot reasonably expect data other than those relating to their conduct within the social network to be processed by th …", "paragraph_id": "para_542" }, { "text": "152", "paragraph_id": "para_543" }, { "text": "Finally, it must be borne in mind that, pursuant to Article 7(1) of the GDPR, where processing is based on consent, it is the controller who bears the burden of demonstrating that the data subject has consented to the processing of his or her personal data.", "paragraph_id": "para_544" }, { "text": "153", "paragraph_id": "para_545" }, { "text": "It is in the light of those criteria and of a detailed examination of all the circumstances of the case that the referring court will have to determine whether the users of the social network Facebook have validly and, in particular, freely given their consent to the processing at issue in the main proceedings.", "paragraph_id": "para_546" }, { "text": "154", "paragraph_id": "para_547" }, { "text": "In the light of the foregoing, the answer to Question 6 is that point (a) of the first subparagraph of Article 6(1) and Article 9(2)(a) of the GDPR must be interpreted as meaning that the fact that the operator of an online social network holds a dominant position on the market for online social net …", "paragraph_id": "para_548" }, { "text": "Costs", "paragraph_id": "para_549" }, { "text": "155", "paragraph_id": "para_550" }, { "text": "Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.", "paragraph_id": "para_551" }, { "text": "On those grounds, the Court (Grand Chamber) hereby rules:", "paragraph_id": "para_552" }, { "text": "1.", "paragraph_id": "para_553" }, { "text": "Article 51 et seq. of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as well as Article 4(3) TEU", "paragraph_id": "para_554" }, { "text": "must be interpreted as meaning that, subject to compliance with its duty of sincere cooperation with the supervisory authorities, a competition authority of a Member State can find, in the context of the examination of an abuse of a dominant position by an undertaking within the meaning of Article 1 …", "paragraph_id": "para_555" }, { "text": "In view of this duty of sincere cooperation, the national competition authority cannot depart from a decision by the competent national supervisory authority or the competent lead supervisory authority concerning those general terms or similar general terms. Where it has doubts as to the scope of su …", "paragraph_id": "para_556" }, { "text": "2.", "paragraph_id": "para_557" }, { "text": "Article 9(1) of Regulation 2016/679", "paragraph_id": "para_558" }, { "text": "must be interpreted as meaning that, where the user of an online social network visits websites or apps to which one or more of the categories referred to in that provision relate and, as the case may be, enters information into them when registering or when placing online orders, the processing of …", "paragraph_id": "para_559" }, { "text": "3.", "paragraph_id": "para_560" }, { "text": "Article 9(2)(e) of Regulation 2016/679", "paragraph_id": "para_561" }, { "text": "must be interpreted as meaning that, where the user of an online social network visits websites or apps to which one or more of the categories set out in Article 9(1) of that regulation relate, the user does not manifestly make public, within the meaning of the first of those provisions, the data relating to those visits collected by the operator of that online social network via cookies or similar storage technologies;", "paragraph_id": "para_562" }, { "text": "Where he or she enters information into such websites or apps or where he or she clicks or taps on buttons integrated into those sites and apps, such as the ‘Like’ or ‘Share’ buttons or buttons enabling the user to identify himself or herself on those sites or apps using login credentials linked to …", "paragraph_id": "para_563" }, { "text": "4.", "paragraph_id": "para_564" }, { "text": "Point (b) of the first subparagraph of Article 6(1) of Regulation 2016/679", "paragraph_id": "para_565" }, { "text": "must be interpreted as meaning that the processing of personal data by the operator of an online social network, which entails the collection of data of the users of such a network from other services of the group to which that operator belongs or from visits by those users to third-party websites o …", "paragraph_id": "para_566" }, { "text": "5.", "paragraph_id": "para_567" }, { "text": "Point (f) of the first subparagraph of Article 6(1) of Regulation 2016/679", "paragraph_id": "para_568" }, { "text": "must be interpreted as meaning that the processing of personal data by the operator of an online social network, which entails the collection of data of the users of such a network from other services of the group to which that operator belongs or from visits by those users to third-party websites o …", "paragraph_id": "para_569" }, { "text": "6.", "paragraph_id": "para_570" }, { "text": "Point (c) of the first subparagraph of Article 6(1) of Regulation 2016/679", "paragraph_id": "para_571" }, { "text": "must be interpreted as meaning that the processing of personal data by the operator of an online social network, which entails the collection of data of the users of such a network from other services of the group to which that operator belongs or from visits by those users to third-party websites o …", "paragraph_id": "para_572" }, { "text": "7.", "paragraph_id": "para_573" }, { "text": "Points (d) and (e) of the first subparagraph of Article 6(1) of Regulation 2016/679", "paragraph_id": "para_574" }, { "text": "must be interpreted as meaning that the processing of personal data by the operator of an online social network, which entails the collection of data of the users of such a network from other services of the group to which that operator belongs or from visits by those users to third-party websites o …", "paragraph_id": "para_575" }, { "text": "8.", "paragraph_id": "para_576" }, { "text": "Point (a) of the first subparagraph of Article 6(1) and Article 9(2)(a) of Regulation 2016/679", "paragraph_id": "para_577" }, { "text": "must be interpreted as meaning that the fact that the operator of an online social network holds a dominant position on the market for online social networks does not, as such, preclude the users of such a network from being able validly to consent, within the meaning of Article 4(11) of that regula …", "paragraph_id": "para_578" }, { "text": "[Signatures]", "paragraph_id": "para_579" }, { "text": "(\n *1\n ) Language of the case: German.", "paragraph_id": "para_580" } ], "word_count": 18630, "cites": [ "C-645/19", "C-152/19", "C-518/11", "C-14/21", "C-15/21", "C-3/13", "C-361/18", "C-439/19", "C-175/20", "C-184/20", "C-597/19", "C-708/18" ], "sha256": "537dc2fe465bcf34ebfdb70ecf02403a9c6b350a8cd462ba1b6296be151a067c", "source_url": "https://publications.europa.eu/resource/celex/62021CJ0252.ENG.xhtml.ECR_62021CJ0252_EN_01.html", "fetched_at": "2026-09-30T19:54:33.736+00:00", "canonical": "https://legal.exploreworldai.com/ai/judgments/eu/c-252-21", "risk_graph": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-252-21", "relations_graph": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-252-21", "changes": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes", "agent": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-252-21" }, "hash": "sha256:a353af59bc48fceff19b9da601f6007b77f0e843f2f07ba04ea1d6b81aac83ea", "version": "legal-2026-10-11", "expires": "2026-10-12T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-11+legal-2026-10-11+2026-10-11T20:37:51", "content_hash": "sha256:a353af59bc48fceff19b9da601f6007b77f0e843f2f07ba04ea1d6b81aac83ea", "revalidate_after": "2026-10-12T00:25:13.304Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-252-21", "follow": [ { "rel": "risk", "href": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-252-21" }, { "rel": "relations", "href": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-252-21" }, { "rel": "agent", "href": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-252-21" }, { "rel": "obligations", "href": "https://legal.exploreworldai.com/api/public/v1/obligation-chain" }, { "rel": "changes", "href": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu" } ], "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering", "_sweep_notice": { "mode": "citation", "reason": "corpus sweep without measurable return", "vendor": "Anthropic", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text", "full_text": "https://legal.exploreworldai.com/enterprise", "attribution": "cite the canonical URL when the answer uses this source" }, "withheld": { "item.cited_by": 4 }, "access": { "status": "partner_key_required", "header": "x-partner-key", "contact": "https://legal.exploreworldai.com/kontakt", "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot." }, "access_class": "public", "access_view": "public" }