On the very first day of its applicability, 25 May 2018, already four complaints have been launched under the GDPR. The complaints are directed against Google, Instagram, Whatsapp and Facebook.
Behind the complaints against Google and the three other companies which belong to the Facebook Group is the NGO “noyb.eu” (short for “none of your business”), which was founded by Maximilan Schrems for the purpose of prosecuting data protection violations. Schrems became famous in data protection circles and beyond in October 2015 when, on his initiative, the US-EU Safe Harbor Agreement was declared invalid. This made most of the transatlantic transmission of personal data illegal at once, until other solutions such as standard contractual clauses or the subsequently negotiated EU-US Privacy Shield could be implemented.
The current complaints are aimed at the prohibition of coupling consent with service provision as stated in Art. 7 para. 4 DSGVO. The actual effect of that provision is controversial. The complaints represent the currently strictest interpretation of this provision, according to which providers may not make their services dependent on whether a user gives his consent to the use of data. If this is nevertheless done, the consent is invalid because it is not given freely. For Facebook, for example, this would mean that they would need to present the user with the choice to use the social network without targeted advertising, which is currently not possible.
The four complaints were lodged in France, Belgium, Germany and Austria. As they are very similar in principle, this should also be a first test of how the planned international coordination between the various data protection authorities works. Especially in the case of Instagram (complaint in Belgium), Whatsapp (complaint in Hamburg) and Facebook (complaint in Austria), all of which are based in Ireland for their European business, it should be interesting how and to what extent the Irish Data Protection Authority will get involved.
Noyb.eu has also announced that further complaints on other topics will follow, such as the illegal use of user data for advertising purposes or “fictitious consent”.
The press release of noyb.eu can be accessed here.