Ireland's data watchdog 'shouldn’t alone regulate Facebook and other big tech for 500m Europeans'

Europe's top court has backed individual national privacy watchdogs to pursue Facebook and other tech giants, meaning they could face scrutiny and sanctions from other member states

Along with Google, Twitter and Apple, Facebook has its EU headquarters here, putting it under the oversight of the Data Protection Commissioner under the GDPR privacy rules. File picture: PA

Facebook and other Silicon Valley giants could face more scrutiny and potential sanctions in the EU after Europe's top court backed individual national privacy watchdogs to pursue them, even when they are not the lead regulators, as is the case for Ireland's Data Protection Commission.

Consumer lobbying group BEUC welcomed the ruling by the EU Court of Justice (CJEU), which backed the right of national agencies to act, citing enforcement bottlenecks.

"Most big tech companies are based in Ireland, and it should not be up to that country's authority alone to protect 500m consumers in the EU," BEUC director general Monique Goyens said after the judgement.

Along with Google, Twitter and Apple, Facebook has its EU headquarters here, putting it under the oversight of the Data Protection Commissioner under the GDPR privacy rules, which allow for fines of up to 4% of a company's global turnover for breaches.

The CJEU got involved after a Belgian court sought guidance on Facebook's challenge to the territorial competence of the Belgian data watchdog. The watchdog was trying to stop Facebook from tracking users through cookies stored in the company's social plug-ins, regardless of whether they have an account or not.

Belgium's data watchdog now needs to analyse the judgment in more detail, the agency said. 

Several national watchdogs in the EU have long complained about their Irish counterpart, saying it takes too long to decide on cases. Ireland has dismissed this, saying it has to be extra meticulous in dealing with powerful and well-funded tech giants.

Ireland's cases in the pipeline include Facebook-owned Instagram and WhatsApp as well as Twitter, Apple, Verizon Media, Microsoft-owned LinkedIn and US digital advertiser Quantcast.

"Under certain conditions, a national supervisory authority may exercise its power to bring any alleged infringement of the GDPR before a court of a member state, even though that authority is not the lead supervisory authority," the CJEU said.

Judges said these conditions include regulators following cooperation and consistency procedures set out in the GDPR and that the violations occurred in the relevant EU country. 

• Reuters