Have you ever wondered what's wrong with the relationship between the European Union and Facebook? To uphold citizens' right to privacy, the EU requires all websites that have databases of European users to inform visitors about the use of cookies. It's a process called "informed consent.".
But the informed consent rule is widely open to interpretation by EU privacy regulators, as evidenced by the ongoing problematic relationship between Facebook and Belgium. The cause, of course, is again the use of cookies.
In November, a Belgian court ordered Facebook to stop tracking web users who are not registered with Facebook through social plugins used by third-party websites. Facebook was able to track the online activity of even people who did not have Facebook accounts through a special cookie.
Facebook distributes a cookie called 'datr' from the code of its social plugins as well as Facebook.com itself. The company claims that the datr cookie is necessary to secure its services from data breaches. (Good!)
Thus, according to the European Union, the information-consent policy for cookies does not protect users in the use of datr cookies because, as it considers, it is a method of monitoring and collecting data.
In particular, the EU is looking very carefully at how it can restrict data tracking cookies used in the healthcare sector and government websites.
Van Alsenoy, an independent consultant for the Belgian Data Protection Commission, told ZDNet that the Facebook Like button is now ubiquitous as a social plugin and is used by third-party websites. It is present on more than 13 million websites, covering almost all categories of websites. Health websites as well as government websites.
Most EU member states view health and government websites as essential citizen services, where the user has no choice but to use them. Their content should be open to all users, regardless of their privacy preferences.
Accepting a data tracking cookie via the Like button on healthcare and government websites is illegal under the EU.
“The Belgian judge ruled that Facebook’s monitoring of even non-users, even if done only for security reasons, was excessive and violated their reasonable expectation of privacy,” van Alsenoy said.
Every time someone visits Facebook.com, their browser receives or updates the datr cookie, regardless of whether they have an account on the social network.
The court ruled that Facebook must pay €250,000 for each day it fails to comply with the ruling.
Facebook continues to use the datr cookie outside of Belgium and today filed an appeal against the Belgian court's decision.
Meanwhile, political pressure at the European level could give the EU more leverage against Facebook. A data privacy consortium, made up of regulators from Belgium, the Netherlands, Germany, France and Spain, expects Facebook to comply with the Belgian court order across the EU.
Legislation recently approved by the European Commission will also give national data protection authorities more power to police the privacy policies of internet companies.
This means that privacy regulators from across the EU can legally fine and prosecute any website operator they deem to be violating privacy rules in a country.
