January 24, 2022

European Privacy Ruling Could Mean More Scrutiny of Companies

The European Union’s top court is set to weigh in Tuesday on whether a privacy regulator in one country can sanction a company if its headquarters is in another country. A go-ahead would potentially open firms up to more penalties.

A ruling due in a case between

Facebook Inc.

and the Belgian data protection authority could impact any company that does business in any of the 27 EU countries. If the European Court of Justice rules that the Belgian regulator can pursue a court case against Facebook, whose European headquarters is in Ireland, authorities across the bloc will be able to sanction companies in their own national courts. Facebook has argued against the prospect.

Under a provision known as the one-stop-shop rule in the 2018 General Data Protection Regulation, companies are overseen by the national data regulator in the EU country where their European headquarters is located. That means authorities in the other 26 member countries generally don’t levy fines or orders about data-handling practices against companies outside their jurisdiction, and companies interact with their local regulator, not with all 27. However, some authorities have used methods such as drawing on other laws for privacy fines, or using emergency measures in the GDPR, to go after firms beyond their geographic boundaries.

The Belgian authority took Facebook to court in 2015 over its use of cookies to track individuals’ browsing across websites. The case was referred to the European court after the GDPR took effect.

“The one-stop-shop mechanism doesn’t work as smoothly as it should work,” said Hielke Hijmans, who oversees fines and sanctions for the Belgian data protection authority. The method requires regulators to hand off complaints to their counterparts in other countries, which can involve bureaucratic legwork and take a long time, he added.

Plus, in cases when there may be public concern over a significant data breach, for instance, regulators are under pressure to investigate wrongdoing instead of waiting for another authority to do so, Mr. Hijmans said.

If the EU judges allow regulators to take companies to court, doing so would still be a lengthy and expensive option, he said. European privacy authorities generally issue sanctions through regulatory procedures, not courts.

An adviser to the EU court published a nonbinding opinion in January stating that regulators can bring companies to court in GDPR cases that affect people in their jurisdiction, regardless of the location of their headquarters. Judges at the EU’s top court consider the adviser’s opinion and their final ruling often follows the recommendation.

A Facebook spokesman declined to comment.

Many companies say the provision simplifies their compliance with the GDPR.

Without the one-stop-shop, companies might be subject to conflicting decisions from regulators in different countries, said Lorena Marciano, privacy officer for Europe at Cisco Systems Inc. “As a multinational, what do I do, do I change my approach in each member state? That’s not feasible,” she said.

But tensions have been brewing over some European privacy regulators’ speed in investigating GDPR complaints. Critics say the one-stop-shop funnels a high number of cases to a small group of regulators who take a long time to issue decisions. The Irish regulator’s office, which is responsible for overseeing several large multinationals, has said it didn’t receive appropriate budget increases to investigate the high number of complaints it receives.

“We’re at a turning point. We can’t simply continue as things have been,” said David Martin, senior legal officer at the European Consumer Organisation, a Brussels-based advocacy group representing consumer watchdog bodies from EU countries.

The consumer group has needed to hire a lawyer to navigate local administrative rules when complaints are sent to other countries, Mr. Martin said. “It’s about protecting 500 million consumers. You can’t rely on one single authority,” he said referring to the population of the EU.

Johannes Caspar, the privacy regulator in Hamburg, Germany, used an emergency measure in the GDPR in May to issue a three-month ban on Facebook’s collection of WhatsApp user data from Germany.

The order was issued days before a May 15 deadline set by Facebook for its users to accept new privacy terms about how WhatsApp shares data with the company. Mr. Caspar said in a statement last month that Facebook couldn’t legally draw consent for the new policy because users had to agree to the terms to continue using WhatsApp, and the company could use individuals’ data for marketing purposes.

Mr. Caspar said he has since applied for an extension of the ban with the European Data Protection Board, the umbrella group of EU regulators. The one-stop-shop has “massive deficits” and has “led to two-speed data protection enforcement” between regulators who issue fines after regular investigations and those who drag out bureaucratic procedures for years, Mr. Caspar said in an email.

Barry Cook, group data protection officer for VFS Global, a technology provider for government visa services, said companies might choose to establish their headquarters in a country whose regulator is known to be less rigorous if the court determines that regulators can only pursue companies based in their jurisdiction.

“The downside of this is it leads to a race to the bottom, which really weakens the whole concept of the GDPR,” Mr. Cook said.

VFS, officially called VF Worldwide Holdings Ltd, previously had its European base in the U.K. and is in the process of relocating to another EU country, which Mr. Cook declined to name, since the U.K. left the EU last year.

Write to Catherine Stupp at Catherine.Stupp@wsj.com

Copyright ©2020 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8

Related Posts

Western Drought Reveals Need for Stronger Farm Protections, Agriculture Secretary Says

June 25, 2021

June 25, 2021

A drought gripping the Western U.S. shows the need for stronger protections for farmers navigating growing climate-related risks, U.S. Agriculture...

Ant Wins China’s Approval to Set Up Consumer-Finance Company

June 3, 2021

June 3, 2021

China’s banking and insurance regulator said Thursday that it had approved an application by Ant Group Co. to set up...

North Face Owner Pulled Xinjiang Criticism, Then Reinstated It

June 20, 2021

June 20, 2021

In late March, the maker of North Face jackets and Vans sneakers quietly took down a statement raising concern about...

Supreme Court Declines to Lift National Eviction Moratorium

June 30, 2021

June 30, 2021

WASHINGTON—A divided Supreme Court on Tuesday declined to lift a national moratorium on the eviction of tenants who have fallen...

LinkedIn Accounts of Scholars Blocked in China

June 22, 2021

June 22, 2021

SINGAPORE—Eyck Freymann, an Oxford University doctoral student, was surprised to get a notice from LinkedIn this month telling him his...

China Reconsiders Its Central Role in Bitcoin Mining

June 5, 2021

June 5, 2021

Bitcoin enthusiasts prize the cryptocurrency as beyond the reach of any government. Yet up to three-quarters of the world’s supply...

Subway’s New Tech Chief Eyes Mobile Customer Experience

May 24, 2021

May 24, 2021

Subway is looking to rewire its mobile-ordering technology and processes to improve customer experience amid a surge of digital sales,...

Altria-Juul Deal Goes to Trial

June 2, 2021

June 2, 2021

Altria MO 0.35% Group Inc. and the Federal Trade Commission are squaring off over allegations that the Marlboro maker engaged...

For Ever Given, Ship That Blocked Suez, It Could Soon Be Anchors Aweigh

June 23, 2021

June 23, 2021

The Ever Given blocked the Suez Canal for almost a week. Photo: Mohamed Elshahed/Associated Press The owner and insurers of...

All-or-Nothing Investment Websites Used Wirecard for Card Payments

June 4, 2021

June 4, 2021

More than half a dozen websites that securities regulators alleged stole money from novice investors in the U.S., Canada and...

Saudi Retail Magnate to List 432 Park Penthouse For as Much as $170 Million

June 28, 2021

June 28, 2021

Saudi retail and real-estate magnate Fawaz Al Hokair is planning to list his penthouse at 432 Park Avenue—one of New...

U.S. and EU Near Deal on Boeing-Airbus Trade Fight

June 15, 2021

June 15, 2021

The U.S. and the European Union are near to a deal that would suspend their trade dispute over government subsidies...

PG&E Warns of More Blackouts During California’s Wildfire Season

June 11, 2021

June 11, 2021

PG&E Corp. said it is likely to proactively cut power to customers in Northern California more frequently this fall in...

Amazon Could Use Less Prime Time

June 22, 2021

June 22, 2021

Prime Day has long been about more than Amazon AMZN -0.94% just keeping itself busy over the slow summer. But...

U.S. Plans to Spend Big on Critical Minerals; Choosing Where Isn’t Easy

June 20, 2021

June 20, 2021

As the U.S. and its allies chase China in procuring critical minerals essential for modern technologies, they face a major...