Clifford Chance

European Court of Justice in Facebook Ruling Clarifies Interplay Between EU Competition Law and Data Protection Enforcement and Challenges Reliance on Legitimate Interests for Disclosures to Law Enforcement Authorities

27 July 2023

In Case C‑252/21 Meta Platforms Inc. and Ors v Bundeskartellamt, handed down on 4 July 2023, the European Court of Justice (“ECJ”) clarified that an EU Member State competition authority may find a violation of the EU General Data Protection Regulation (“GDPR”), even where a data protection supervisory authority is investigating the same conduct, in the course of investigating an abuse of a dominant position under Article 102 of the Treaty on the Functioning of the European Union (“TFEU”). The Member State competition authority must cooperate closely with the competent EU Member State data protection supervisory authorities and is bound by their prior decisions.

The ECJ also provided clarification on several important points of data protection law, including: (i) reinforcing the high bar required for reliance on the GDPR legal bases of consent, contractual necessity or the legitimate interests of the data controller; and (ii) ruling out reliance on the legitimate interests of the data controller for disclosures of personal data to law enforcement agencies for prevention, detection and prosecution of criminal offences.

Download PDF