Clifford Chance

2020 kicks off in Italy with an important decision on Big Data from the Tribunale Amministrativo Regionale for Lazio (the Administrative Court), the Court tasked with the appeal of the sanctions imposed on Facebook by the Autorità Garante della Concorrenza e del Mercato's (the Italian Antitrust Authority) for the breach of competition and consumer laws.

In its decision no. 261 published on 10 January 2020, the Administrative Court partially confirmed the fine the Italian Antitrust Authority imposed on Facebook on grounds that the social network's claim addressed to users – "Sign in, it's free forever" – qualifies as unfair commercial practice, lacking further disclaimers on the use of personal data by Facebook for commercial purposes.

The Decision concludes that not only data protection laws, but also consumer protection laws apply to the processing of personal data due to data's economic value.

Background: the investigations of the Italian Antitrust Authority

Following several Italian consumer associations' complaints in April 2018, the Italian Antitrust Authority launched investigations against Facebook Inc. and its EU subsidiary Facebook Ireland Limited to ascertain whether Facebook is liable on grounds of unfair and aggressive commercial practices concerning its users.

The investigations resulted in an order dated 29 November 2018 decision, whereby the Italian Antitrust Authority fined Facebook EUR 10 million for two unfair commercial practices carried out against the 31 million Italian users, in breach of Articles 21, 22, 24 and 25 of the Italian Legislative Decree no. 206/2005 (the Italian Consumer Code).

The first was a misleading practice carried out by Facebook during the sign-up process in the social network's platform (website and app), where Facebook did not provide users with adequate information as to the purposes of the processing of their personal data.

Leveraging on the claim "Sign up, it's free and it will be forever", Facebook emphasised the free nature of the social network, without highlighting that the collection of users' personal data was carried out for marketing purposes.

The information provided to users did not clearly make a distinction between the use of data to personalise the service (in order to connect users with each other) and the use of data to carry out advertising campaigns aimed at specific targets.

Therefore, the Italian Antitrust Authority concluded that Facebook had in fact encouraged users to make transactional decisions to register in the social network and to continue using it. - that they would not have taken otherwise, had they been properly informed and conscious of the consequences.

The second practice was qualified as "aggressive" pursuant to Articles 24 and 25 of the Italian Consumer Code.

According to the Italian Antitrust Authority, Facebook forced an "aggressive practice" on registered users whose data were automatically transmitted from the Facebook platform to third party websites / apps – and vice versa – without the data subjects' express and prior consent, for profiling and commercial purposes.

In particular, according to the Italian Antitrust Authority, Facebook pre-selected the "Active Platform" function, which allowed the data sharing; therefore, every time users accessed a third party's web-site (such as game, app), the transfer of personal data to those parties was automatically activated.  Users’ opt-out was unduly discouraged by threatening negative consequences in the use of both Facebook and third-party websites and apps.

Facebook's appeal against the Antitrust Order

Facebook appealed the Antitrust Order before the Administrative Court for Lazio, alleging the unlawfulness of the Antitrust Order on the following main grounds:

• consumer protection laws do not apply to the case: as the access to the social network is "free of charge", there is a lack of any consideration (the "Consideration Argument"); therefore,
• the case falls within the competence of the privacy – rather than competition – regulators. Therefore, only GDPR's rules apply (the "Privacy Argument").

The Decision of the Administrative Court for Lazio

The Administrative Court confirmed the sanction relating to Facebook's misleading practice against the users during the sign-up process, but rejected the second sanction finding that the transfer of personal data to third parties does not constitute an aggressive practice, because the pre-selection of the "Active Platform" function did not allow any automatic transfer of users' personal data to third parties.

Following the publication of the Decision, Euroconsumers, a member of the Organization of Consumers and Users (OCU), described the Decision as "very important" and pointed out that "for the first time it is recognized by a court that consumers' data has an economic value for companies".

The major issues the Decision addressed.

Personal data has an economic value (the rejection of the Consideration Argument)

According to the Decision, the economic value of personal data requires traders to comply with consumers laws, meaning that they have a duty to properly inform consumers and users about the commercial purposes for which their personal data are collected and used.[1]

When users sign-up to a social network, like Facebook, they enter into a contract that binds the parties to mutual obligations: Facebook undertakes to allow users to use the social network's services, while the user joins the Facebook's community by inputting certain personal data that is required for the registration.

On this basis, the Administrative Court concludes that, from a legal standpoint, the collection of users' personal data by Facebook qualifies as a performance of a contractual obligation on the user's side.

The Decision embraced the view expressed in the Euroconsumers' manifesto "#MyDataIsMine".

Protection of personal data is not only a privacy affair… (the rejection of the Privacy Argument)

According to the Decision, the processing of personal data for commercial purposes is not exclusively covered by privacy laws and regulations.  

Indeed, privacy laws do not conflict with consumer and competition laws, as they are closely intertwined with each other.

They both protect users and consumers' rights in relation to the usage of their personal data, one protecting personal data as a fundamental right of individuals and the other ensuring that users are properly informed before making everyday decisions.  

Additionally, the legislator has ensured coordination between privacy and consumers laws, preventing any risks of consumer related fines overlapping with privacy related fines.

The use of personal data continues to create challenges at EU level

The Decision addresses the delicate issue of the exploitation for commercial purposes of personal data in the digitalisation era.

Social networks and ISP in general make huge investments in data mining and reuse: Data is collected and analysed, then shared with third parties which, based on the profiling of the user, results in advertising being targeted at the user

The Italian Antitrust Authority and the Administrative Court took many commentators' view that while social networks, search engines and gaming platforms (so-called freemiums) (just to mention a few) are, free of [monetary] charge, this by no means implies that they are cost-free. Data is the consideration.

So, while users can impact the web by inputting content (user generated content), Authorities such as the Italian Antitrust Authority are progressively coming to the conclusion that they cannot entirely leave it to the terms and conditions of the social network to govern the relationship between the web and the user. Hence, the Authority's call for greater transparency over the use of personal data.

Key Take-Away Points

• the Administrative Court for Lazio states that personal data has an economic value
•  the economic value of personal data requires traders to comply with consumers laws, meaning that they have a duty to properly inform consumers and users about the commercial purposes for which their personal data are collected and used
• the processing of personal data for commercial purposes is not exclusively covered by privacy laws and regulations: privacy laws do not conflict with consumer and competition laws, as they are closely intertwined with each other
• the Italian Antitrust Authority and the Administrative Court took many commentators' view that while social networks, search engines and gaming platforms are, free of [monetary] charge, this by no means implies that they are cost-free: data is the consideration.

Vittoria Pontecchiani contributed to the writing of this article.