Court rules Facebook violated Dutch law when processing personal data

Facebook acted unlawfully in the processing of Dutch personal data over a period of almost ten years, ruled the Amsterdam district court. The personal data of Facebook users present in the Netherlands was used without permission for advertising purposes, but in this case that was not allowed by law. The case was brought by the Data Privacy Stichting (DPS), a nonprofit organization, and the Dutch consumer group Consumentenbond.

The social media company processed and utilized data, such as the sexual orientation or religion of its users. But this case was not only about information provided by the users themselves. Some data was obtained by Facebook by tracking users' behavior as they surfed the internet beyond Facebook's websites and services.

Facebook also passed on personal data to third parties without informing users. This concerned both information from the users themselves, but also the personal data of their Facebook friends. According to the court, the social media platform acted unlawfully between April 1, 2010 and January 1, 2020.

"For years, Facebook has violated user privacy, misinforming consumers, misleading consumers by withholding information, and not asking for consent. The court's ruling is therefore a major victory for us, truly groundbreaking," said the Consumentenbond.

Facebook has said on Wednesday afternoon that it would respond at a later time.

The case only revolved around the question of whether Facebook acted unlawfully. The court declared that no compensation could be claimed from the social media company.

Facebook claimed two years ago that the case could not be heard in the Netherlands because the company has its European headquarters in Ireland. As such, the social media platform said the situation was governed under Irish law. Facebook also argued that DPS could not press a case against the company because it was not an injured party. The court declared those objections unfounded, at which point the case could be assessed on its merits.

DPS said that it was standing up for Dutch victims of privacy breaches.