Earlier this year, the French consumer association UFC-Que Choisir initiated proceedings before the Paris District Court against Google Inc., Facebook Inc. and Twitter Inc., accusing these companies of using confusing and unlawful online privacy policies and terms of use agreements in the French versions of their social media platforms; in particular, the consumer association argued that these online policies and agreements provide the companies with too much leeway to collect and share user data.
In a press release published (in French) on its website, UFC-Que Choisir explains that the three Internet companies ignored a letter that the group had delivered to them in June 2013, containing recommendations on how to modify their online policies and agreements. The group sought to press the companies to modify their practices as part of a consumer campaign entitled “Je garde la main sur mes données” (or, in English, “I keep my hand on my data”).
According to the press release, the companies’ refusal to address UFC-Que Choisir’s concerns prompted it to initiate court proceedings. The group has requested that the court suppress or modify a “myriad of contentious clauses,” and alleged that one company had included 180 such “contentious clauses” in its user agreement.
The group has also invited French consumers to sign a petition calling for rapid adoption of the EU Data Protection Reform that will replace the current Directive on data protection with a Regulation with direct effects on the 28 EU Member States. UFC-Que Choisir published two possibly NSFW videos depicting a man and a woman being stripped bare while posting to their Google Plus, Facebook and Twitter accounts. A message associated with each video states: “Sur les réseaux sociaux, vous êtes vite à poil” (or, in English, “On social networks, you will be quickly stripped bare”).
The campaign is obviously aimed at catching the attention of the French public, and its timing is not coincidental. In April 2013, the French data protection authority (DPA) started coordinating a joint action among France, Germany, Italy, the Netherlands, Spain and the United Kingdom to investigate and launch penalty proceedings against Google’s new privacy policy. That policy, issued in March 2012, permitted the company to merge data from different Google services and to use that data across different platforms. So far, the French, Spanish and Italian DPAs have issued record fines and the Dutch DPA has condemned the policy.
The DPAs observed that any processing of personal information is covered by the national laws of the country where the user resides; this assertion was contested by Google. The DPAs found that Google does not sufficiently inform its users of the conditions under which their personal information is processed, or of the purposes for the processing; as a consequence, users are not able to correctly exercise their rights of access, correction or deletion. Further, the DPAs held that Google doesn’t comply with the obligation to obtain user consent prior to the storage of cookies on their terminal devices, and that it fails to define retention periods applicable to the different data sets it processes, as required under applicable national laws.
UFC-Que Choisir also alleges that the three Internet companies provide insufficient information regarding their practices to users. For example, the group argues that the contractual terms displayed on the three companies’ web pages are “inaccessible, unreadable, and full of hyperlinks—between 40 and 100 hyperlinks—sometimes sending back to pages in English.” The group argues in its press release that this allows for the “widespread collection, modification, retention and exploitation of data related to users and their contacts.” The group contrasts Twitter and Facebook policies, which are allegedly “very long and fragmented,” with the Google Plus policy and its “laconic wording.” The group wants the companies to shorten their contractual terms and notify users when they change their conditions, in order to obtain new and valid consent. According to the group, the three companies afford a “worldwide, unlimited and unremunerated license” to share information with their commercial partners without obtaining valid consent. The group warns consumers: “In short, you are not only being targeted with advertising, but your data may also be commercially exploited without your express consent and without receiving compensation.” UFC-Que Choisir released to the press some examples of allegedly unfair clauses that are currently accessible online.
Consumer associations everywhere in Europe want to gain influence over data protection issues. In November 2013, the Berlin District Court upheld similar arguments by the German Federation of Consumer Organisations (VZBV) in proceedings against Google. Germany is expected to pass a bill in the near future that will allow consumer associations to initiate summary proceedings to defend individual rights against infringement of data protection laws. So far, they can only rely on the German Unfair Competition Act where data protection breaches create an economic disadvantage.
Consumer associations also think their role will be strengthened by rapid adoption of the EU reform. In its petition (in French), UFC-Que Choisir states that consumers’ control over their own personal information will be put in place as a general principle under the new Regulation. In the provision adopted on March 12, 2014, Parliament increased the fines for companies that violate privacy rules up to EUR 100 million (approximately USD 138 million) or 5 percent of their annual worldwide turnover. Further, the provision reinforces the application of national laws to activities of global companies operating from the U.S. More specifically, the bill clarifies that not only data controllers established outside the EU but also data processors established outside of the EU are subject to EU laws whenever they offer goods or services, regardless of whether payment is required.
However, it is questionable whether these developments will be upheld by the Council, as many Member States have stated that they want to remove administrative burdens from companies. While Parliament has expressed the need to rapidly adopt reforms, the Council has not yet started official negotiations to reach a common position. The likelihood of having the proposed Reform adopted by the end of the year is uncertain.
As for the case at hand, it may be months before the judge makes a ruling. Paradoxically, the UFC-Que Choisir publicly criticized the much-debated May 13 ruling of the European Court of Justice stating that individuals may compel Google to remove links to contested information based on their right to be forgotten. The association said that publishers are responsible for the personal data on their web pages, and not Google. Neutrality goes along with transparency, free movement and freedom of expression on the Internet, all principles that the association says it wants to promote.