Facebook wins privacy case, can track any Belgian it wants

Doesn't matter if Internet users are logged into Facebook or not.
In a somewhat unexpected twist, Facebook has won a legal battle against Belgium's data protection authority, which had sought to prevent Facebook from tracking non-Facebook (or not-logged-into-Facebook) users, both on the Facebook website itself but also via the company's Like and Share buttons that can be found in even the darkest depths of the known universe.

The Brussels appeals court dismissed the case on Wednesday, saying that the Belgian CPP (Commission for the Protection of Privacy) had no jurisdiction over Facebook, which has its European headquarters in Dublin, Ireland.

"We are pleased with the court's decision and look forward to bringing all our services back online for people in Belgium," a Facebook spokesperson said.

"Today's decision simply and purely means that the Belgian citizen cannot obtain the protection of his private life through the courts and tribunals when it concerns foreign actors," the CPP said in a statement. The CPP also said that it may launch an appeal to the Belgian Court of Cassation—the court of last resort—which in the past had overruled cases that involved foreign company jurisdiction.

Back in November 2015, a lower court ruled in favour of the CPP and ordered Facebook to quit tracking people who don't have a Facebook account or who aren't currently logged into the service. If Facebook didn't comply, it faced fines of up to €250,000 per day. Suffice it to say, the company complied: in December, Facebook said that it had stopped tracking Belgian visitors who were not logged in.

Today's ruling is certainly a win for Facebook, but it's not the end of the story. The initial Belgian court ruling was based on EU privacy law, and so it's safe to assume that other national regulators will bring cases against Facebook in due course. Two likely candidates for following Belgian's example are the Netherlands and Germany, both of whose data protection authorities have been part of a European task force investigating possible violations of EU law by Facebook.

The other option is that users could challenge Facebook's tracking policies, in much the same way that Max Schrems brought a case against the company's EU-US data flows, which eventually ended up with the dissolution of the Safe Harbour agreement. Speaking of which, Schrems also has another Facebook privacy case currently working through the Austrian supreme court, which may eventually get forwarded up the chain to the CJEU (Court of Justice of the European Union) due to the importance of the issues being discussed.