Rb. Amsterdam - C/13/682421 / KG ZA 20-336
From GDPRhub
| Rb. Amsterdam - C/13/663563 / HA RK 19-97 | |
|---|---|
 | |
| Court: | Rb. Amsterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 6(1) GDPR |
| Decided: | 15.05.2020 |
| Published: | 15.05.2020 |
| Parties: | AVROTROS vs Facebook Netherlands B.V., Facebook Ireland Limited |
| National Case Number: | C/13/663563 / HA RK 19-97 |
| European Case Law Identifier: | ECLI:NL:RBAMS:2020:2602 |
| Appeal from: | n/a |
| Language: | Dutch |
| Original Source: | de Rechtspraak (in NL) |
The Amsterdam Court of First Instance ruled that Facebook was taking enough measures to block fake/fraudulent ads on its platform and that Facebook must share information identifying the advertisers behind these ads.
English Summary
Facts
Fraudulent ads using names and pictures of Dutch celebrities are shown on Facebook and Instagram since October 2018. The Claimant, who is a presenter of the news and current affairs programme broadcasted by AVROTROS, is one of the celebrities affected. In November 2019 a similar lawsuit was won by another celebrity, forcing Facebook to implement strict controls and take down fraudulent bitcoin ads. However, in March and April 2020 the Claimant saw similar fraudulent ads with his picture and name: this time the ads referred to the Corona crisis.
Dispute
The Claimant and AVROTROS asked the Court to order Facebook to: 1. To find and take down fraudulent ads within 5 days from this judgement; 2. Share information, identifying the advertisers behind these ads within 7 days from the judgement. Information should include name, email, phone number, date and time of registration, IP addresses and other user and payment data Facebook has in its possession.
Facebook claims that the measures they already have in place are good enough and that it is not possible to filter out all fraudulent ads. On the second point, Facebook did not have specific objections, however the company believed that only Facebook Ireland could share this data and only on a Court’s order.
Holding
The Court ruled that the measures Facebook has put in place to detect and remove fake/fraudulent ads were enough. On the second point, the Court considered the existing case law in the Netherlands. In 2004 the Amsterdam Court of Appeal ruled that an obligation for the service provider to provide data to a third party may be justified if the following conditions are met: a. the possibility that the information is unlawful and harmful to the third party is sufficiently established; b. the third party has a real interest in obtaining the data; c. there is no less drastic way to retrieve the data; d. the balance of the interests of the third party and the internet service provider is in favor of the third party.
The Court ruled, that all these conditions were met in a present case and article 6(1) of the GDPR gives room for such data sharing.
Comment
Share your comment here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the original. Please refer to the Dutch original for more details.
This statement is anonymized according to the anonymization guidelines.
Search result - view document
ECLI:NL:RBAMS:2020:2602
Authority
Court of Amsterdam
Date of pronunciation
15-05-2020
Date of publication
15-05-2020
Case number
C/13/682421 / KG ZA 20-336
Jurisdictions
Civil Justice
Special features
Interim injunction
Content indication
Interlocutory proceedings. For the time being, the Internet platform Facebook has taken sufficient measures to prevent fake bitcoin advertisements with Dutch celebrities. Only a claim for the provision of identifying data of advertisers has been granted.
Locations
Rechtspraak.nl
Enriched pronunciation
Ruling
judgment
COURT IN AMSTERDAM
Private law division, civil judge in preliminary relief proceedings
Case number / reel number: C/13/682421 / KG ZA 20-336 AB/MB
Judgment in preliminary relief proceedings of 15 May 2020
in the matter of
1 [plaintiff sub 1] ,
living at [residence] ,
2. the association
AVROTROS,
located in Hilversum,
plaintiffs by summons in abridged term of 16 April 2020,
Lawyers H.A.J.M. van Kaam and J.G.J. van Groenendaal in Amsterdam,
by
1. the private limited liability company
FACEBOOK NETHERLANDS B.V.,
based in Amsterdam,
2. the company under foreign law
FACEBOOK IRELAND LIMITED,
based in Dublin,
defendants,
Lawyers Mr. J.P. van den Brink and Mr. J.R. Spauwen in Amsterdam.
1 The proceedings
At the hearing on 1 May 2020, plaintiffs, hereinafter [plaintiff sub 1] and AVROTROS, explained the claims as described in the writ of summons. The defendants, hereinafter jointly Facebook and separately Facebook Netherlands and Facebook Ireland, put forward a defence. In future, the name Facebook will also be used to refer to the platform itself.
Both parties have submitted written documents and/or a written pleading.
Judgment has been pronounced at this time.
Due to the corona crisis, only the lawyers of the parties were present at the hearing, in addition to the judge in preliminary relief proceedings and the clerk of the court. For [plaintiff sub 1] and AVROTROS: mrs. Van Kaam and Van Groenendaal, for Facebook: mrs. Van den Brink and Spauwen.
2 The facts
2.1.
[plaintiff sub 1] is presenter of the news and current affairs program EenVandaag. AVROTROS is the broadcaster that broadcasts that programme and the employer of [plaintiff sub 1].
2.2.
Facebook is an internet platform that is part of the 'social media', intended for posting messages, photos and videos ('content') by users. Facebook also operates 'Instagram', which is used in particular for posting visual material. More than 2.8 billion people worldwide use this platform.
2.3.
Facebook's revenue model is mainly based on revenue from advertisements. Advertisers can place advertisements on Facebook and Instagram for a fee. An advertisement is always linked to a Facebook account.
Facebook has an advertising policy to ensure that advertisements comply with all applicable laws, regulations and guidelines, including those of Facebook itself. Crypt currency advertisements are subject to Facebook's prior approval under that policy.
2.4.
Since October 2018, advertisements have appeared on Facebook and Instagram associating Dutch celebrities, including media entrepreneur [name of media entrepreneur] and, since August 2019, also [plaintiff sub 1], with Bitcoin and Bitcoin investments. In the advertisements, in which these Dutch celebrities are portrayed as successful Bitcoin investors, their photo and name are used without their consent. Users who respond to the advertisements and pay amounts in return do not receive Bitcoins, but lose their money. A characteristic of such advertisements is that only after clicking on the message that appears first (by clicking on the 'More information' block) does one land at the passages about 'Bitcoin investments'.
2.5.
According to a publication in the Volkskrant newspaper on 12 April 2019, a damage of 1.7 million had been reported to the National Government's Fraud Helpdesk as a result of the fake advertisements. According to NRC Handelsblad, this had risen to 2.9 million euros on 15 January 2020.
2.6.
In a letter dated 11 September 2019, [plaintiff sub 1] summoned Facebook to take measures to counter and prevent such fake advertisements. The injunction letter includes an example of an advertisement with the name and photo of [plaintiff sub 1] dated 20 August 2019.
2.7.
By letter of 4 October 2019 Facebook rejected liability for the fake advertisements. The letter also stated that the ad in question had been removed, that Facebook Ireland had blocked access to Facebook from the account associated with the ad, and that it was taking steps to prevent those associated with this type of ad from continuing to use Facebook in the future.
2.8.
By judgment of 11 November 2019, the Interim Injunction Judge of this court ordered Facebook to cease and desist from unlawful acts against [name of media entrepreneur] - consisting of allowing bogus advertisements containing the name or portrait of [name of media entrepreneur] to appear in the ad and/or the website to which the ad is linked to Bitcoin or other crypto currency on Facebook.
2.9.
In December 2019, Facebook Inc. in California filed lawsuits against companies offering 'Cloaking services' that allow advertisers to circumvent Facebook's guidelines.
2.10.
plaintiff sub 1] challenged screenshots taken on
31 March and 5 April 2020, similar advertisement(s) were shown on Facebook, with his name and image and also referring to the Corona crisis.
2.11.
In a letter dated 6 April 2020, [plaintiff sub 1] again summoned Facebook to take measures to prevent these advertisements and to provide the data by which these 'advertisers' can be identified to him.
2.12.
By letter of 14 April 2020 Facebook again rejected liability. This letter also states that Facebook Ireland had already blocked the 'advertiser' in question before the summons of 6 April 2020 and installed a 'banhammer' for this account, i.e. Facebook can no longer be used via this account.
The letter also discusses the measures taken by Facebook to prevent the reappearance of such advertisements.
2.13.
On 28 April 2020, [name manager] , TPM (Technical Program Manager of Facebook 'within the Anti-Cloaking Team') made a statement (Affidavit) about the measures that Facebook takes to prevent the so-called 'cloaking'. It says about cloaking and cloakers:
"Cloaking is when a web page used in an ad contains different content when shown to Facebook's review system compared to when the same web page is viewed by Facebook's users. (...) Cloakers actively try to determine when someone accessing the page is a real person vs when it's a automates scan".
This statement goes on to say the rest:
"When Facebook encounters these policy-violating ads, it takes them down as well as disables the relevant account. Facebook is investing heavily to prevent cloaking on its system, and is examining additional ways where Facebook can more quickly detect the types of ads and advertisers that use this technique. Facebook utilizes a combination of factors to detect this behaviour, including proactive analysis and user reports. (…)
While Facebook is constantly improving its methods to detect cloaking, it is not possible to prevent all malicious ads from appearing on Facebook, oftentimes because the malicious actors behind these acts are reacting to every enforcement action taken".
2.14.
As production 21, [claimant sub 1] challenged a screenshot of an advertisement that was supposed to have appeared on 1 April 2020.
2.15.
Production 5 of Facebook is a statement (Affidavit) by [name director] , director of Facebook Netherlands, which states, inter alia, the following:
"Because Facebook Netherlands B.V. does not operate, control, or host content available om the Facebook Service and is not the entity with which any Facebook users contract for the provision of the Facebook Service, Facebook Netherlands has no ability to block ads, remove ads, or produce user data.
3 The dispute
3.1.
Plaintiff sub 1] and AVROTROS claim that Facebook should be ordered to pay a penalty:
I. to cease and desist any unlawful actions against them, consisting of allowing ads on its forums Facebook and Instagram where the name and portrait of [plaintiff sub 1] in the ad and/or the website to which this ad is linked to (investments in) Bitcoin or other crypto currency, within five days after service of this judgment;
II. provide all identifying data of the parties responsible for the advertisements mentioned under I. within seven days after service of this judgment, including but not limited to name, email address, telephone number, date and time of registration and IP addresses and other usage and payment data to the extent Facebook has such identifying data.
Finally, they claim an order from Facebook to pay the legal costs and follow-up costs.
3.2.
Facebook argues, among other things, that it is already doing everything in its reasonable power to counteract these advertisements. According to Facebook, however, it is impracticable and technically impossible to guarantee that such advertisements will no longer appear.
3.3.
The arguments of the parties will be discussed in more detail below, insofar as they are relevant.
4 The assessment
Jurisdiction
4.1.
Facebook Netherlands has its registered office in Amsterdam, so that (the interim injunction judge of) the District Court of Amsterdam has jurisdiction. By virtue of Article 7 paragraph 1 of the Dutch Code of Civil Procedure (Rv), this court also has jurisdiction in respect of the other defendant, Facebook Ireland.
4.2.
Apart from the above, the following applies. The Dutch court has jurisdiction in cases involving obligations in tort if the harmful event has occurred or may occur in the Netherlands (Article 6, opening words and under e, Rv, and Article 7(2) of Regulation (EU) 1215/2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (the recast EEX Regulation)).
Now that the centre of interests of [plaintiff sub 1] and AVROTROS is located in the Netherlands and, moreover, the advertisements in question are accessible in the Netherlands and are aimed at the Dutch public, the jurisdiction of this court can already be assumed on that ground as well, i.e. apart from Article 7(1) of the Rv. The circumstance that Facebook Netherlands may not be able to comply with the requested provisions relates to the enforceability of the judgment and not to jurisdiction. Facebook's defence of jurisdiction therefore does not apply.
Applicable law
4.3.
The basis of the claims of [plaintiff sub 1] and AVROTROS is unlawful conduct by Facebook. The alleged damage also occurs in the Netherlands, since it concerns in particular reputational damage, the centre of interests of [plaintiff sub 1] and AVROTROS is located in the Netherlands and the advertisements are aimed at the Dutch public. On the basis of Article 4(1) of Regulation (EC) 864/2007 on the law applicable to non-contractual obligations (Rome II), Dutch law is therefore applicable.
Choice of court and choice of law clause?
4.4.
To the extent that Facebook with its reliance on 4.4 of the Facebook Terms of Service is of the opinion that a choice of forum and a choice of law have been agreed, since [plaintiff sub 1] and AVROTROS are not consumers, that is wrong. The clause reads as follows:
"If you are a consumer and reside in a member state of the EU, the laws of that member state shall apply to any claims, causes of action or disputes you may have against us arising out of or related to these Terms or the Facebook products ("Claim"). You may bring this claim before any court having jurisdiction in that Member State that has jurisdiction over the claim. In all other cases, you agree that the claim must be heard in a court of competent jurisdiction in Ireland and that Irish law governs these Terms and all claims regardless of the conflict of laws rules".
This article relates to disputes arising from the use of a Facebook account and not to alleged unlawful actions in relation to advertisements placed by third parties that have nothing to do with the accounts of [plaintiff sub 1] and AVROTROS, as in this case. This is irrespective of whether a reference in these terms and conditions is a legally agreed forum and choice of law clause and irrespective of the question why [plaintiff sub 1], in his capacity as a Facebook user with whom he would be bound by these terms and conditions of service, could not be regarded as a consumer.
(Urgent) interest
4.5.
Claimant sub 1] has a reasonable interest as referred to in Section 21 of the Copyright Act to oppose the distribution of his portrait if it is used for scams and misleading messages. Facebook has not disputed that in itself either.
Contrary to what Facebook argues, AVROTROS also has a sufficient interest in the claims, on the sole ground that, as the employer of [plaintiff sub 1], it has an interest in one of its 'faces' being protected as much as possible from connection with fraudulent practices that could be harmful to the reputation of both [plaintiff sub 1] and AVROTROS. Insofar as, as [plaintiff sub 1] and AVROTROS claim, there is still a concrete threat that the fake advertisements with the portrait and/or the name of [plaintiff sub 1] will continue to appear, which cannot be ruled out at the moment, their interest is also urgent.
The advertisements
4.6.
The parties agree that the advertisements described under 2.4 and 2.10 are fraudulent "fake advertisements", in that they use the name of [plaintiff under 1] without his consent, to commend fake investments in Bitcoins. Similar advertisements use the names of other Dutch celebrities, without their consent, which are completely inconsistent with Facebook's own Advertising Policy. The parties also agree to the extent that they both believe that these practices, which they describe as 'scams', should be stopped. Placing these advertisements is not only detrimental to the honor and good name of [plaintiff sub 1], but also to the reputation of Facebook.
Safeguard clause
4.7.
The parties do not agree on whether Facebook can invoke Article 6:196c of the Dutch Civil Code, which stipulates that a 'service provider of the information society' to which category Facebook could be counted, depending on the services it provides, is under certain conditions not liable for information disseminated by third parties via its platform.
In so far as this would be the case, this can only be invoked if the internet service provider:
(paragraph 4):
"a. is unaware of the activity or information of an unlawful nature (...) or:
b. as soon as it knows, or ought reasonably to know, promptly removes or disables access to the information.
Incidentally, this indemnification does not stand in the way of obtaining a court order or injunction (Section 6:196c (5) of the Dutch Civil Code). Such an injunction may also include a forward-looking measure, as can be deduced from recital 45 of the preamble to the Directive on which this article is based:
(Directive on electronic commerce (Directive 2000/31/EC))
"The limitation of (...) liability of service providers acting as intermediaries does not affect the possibility of taking different types of injunctions. Such measures consist in particular of judicial or administrative decisions ordering the cessation or prevention of an infringement, including the removal or rendering inaccessible of illegal information".
General Filter Commandment
4.8.
Facebook has also invoked the provisions of Article 15 of the Directive, which prohibits a general monitoring obligation. Recital 47 of the preamble to the Directive states that 'Member States may not impose monitoring obligations of a general nature on service providers'. However, it has been added: 'This does not apply to surveillance obligations in special cases and, in particular, does not affect measures taken by national authorities in accordance with national law'.
The starting point is therefore, on the one hand, that a general filtering ban is not allowed and, on the other hand, that no excessive obligations should be imposed on the Internet service provider. On the other hand, there is room for the imposition of a sufficiently specific injunction to take action - also preventively - against acts that must be deemed unlawful on the basis of Section 6:162 of the Dutch Civil Code.
Interim conclusion
4.9.
The above means that Facebook's general defences against the claimed provisions do not serve any purpose.
The claim under (3.1) I. Is Facebook acting unlawfully because it does not take sufficient measures?
4.10.
These preliminary relief proceedings therefore focus on the questions: what can be demanded of Facebook in the context of countering the fake advertisements and what can it be obliged to do vis-à-vis [plaintiff sub 1] and AVROTROS, in the context of the social care it must observe, on pain of a penalty. More specifically on the question whether Facebook is doing everything that can reasonably be asked of it in this specific case to keep the advertisements out, namely by (a.) removing them and (b.) preventing them from popping up again and again.
a. Removal
4.11.
Concretely, these preliminary relief proceedings concern four advertisements that were visible on Facebook, one in August 2019, the other between 31 March and 5 April 2020. Facebook argues that these advertisements were all detected by its control system ('ads review system') and that in any event three of the four advertisements had already been removed before [plaintiff sub 1] had summoned it to do so and/or reported the advertisements. Furthermore, the accounts of these advertisers are 'banned', which means that access to Facebook is no longer possible via those accounts. Facebook further pointed out in this respect that it also uses a technology that makes use of the so-called 'Sparse model'. This model analyses the characteristics of advertisements in order to trace advertising accounts that may be linked to previously identified malicious practices. In addition, after the previous summary proceedings (with [name of media entrepreneur] as plaintiff) Facebook has introduced a new option since 10 December 2019 with which misleading advertisements, such as the 'celeb-bait' advertisements at issue here, can be reported, of which [plaintiff sub 1] and AVROTROS - as denied by Facebook - incidentally did not make use for the reporting of the fake advertisements.
For the time being there is insufficient reason to doubt the correctness of what Facebook has stated on this point. Facebook has therefore made it sufficiently plausible that it took timely action to promptly remove the unlawful advertisements and that it has expanded the possibilities for the public to report these advertisements. Plaintiff sub 1] and AVROTROS also argued that the possibility to block advertisements would not exist for advertisements that appear on the side of the screen. Facebook has objected that this is the case, only then must be clicked on 'hide', which according to Facebook has the same effect.
b. Preventive measures
4.12.
The main bone of contention is whether Facebook can be required to do more than it is doing now to prevent advertisements like this from appearing on Facebook. Facebook has pointed out that for these advertisements use is made of so-called 'cloaking' technique, as a result of which the landing page on which the public ends up is different from the innocent-looking page that is presented to (the systems of) Facebook. In all four advertisements in question, 'cloaking' appeared to be in play.
4.13.
Facebook Ireland has pointed out that even after the verdict in the case of [name of media entrepreneur], it has taken and continues to take numerous measures to prevent advertisers from using cloaking to place bogus advertisements. It has promised to continue to do so. In addition to her ad control systems, she apparently has an 'anti-cloaking team', she has installed a separate 'tool' to make it easier to report this type of advertisements, after which they are immediately blocked, and she has instituted proceedings against companies that focus on bypassing the systems via cloaking. It is plausible that these measures will have (some) effect, given the fact that - apparently - the celeb-bait advertisements did not or hardly show up in the period from September 2019 to March 2020. Facebook has rightly argued that it must have sufficiently substantiated in what respect it fell short before a conviction against it, issued with penalty payments, would be appropriate. The mere circumstance that it was recently possible to place three more advertisements, apparently circumventing its control systems, is not sufficient for this purpose, all the less now that it is plausible that Facebook promptly removed them. Plaintiff sub 1] and AVROTROS do still argue that 'cloaking' is not their problem, but that of Facebook, and that the case [name of media entrepreneur] teaches that the fake advertisements are finished as long as they are banned with a penalty payment, but that is all too easily argued. Moreover, it would go too far to oblige Facebook to completely prevent advertisements with the name and/or photo of [plaintiff sub 1] from ending up on Facebook. After all, this would also prevent lawful advertisements, such as the announcement by AVROTROS of the programme 'Wie is de Mol' (Who is the mole), in which [plaintiff sub 1] appeared, mentioned by Facebook.
4.14.
The conclusion is that in the given circumstances, in which the fake adverts do not systematically appear on its platforms, but occasionally appear to circumvent its measures, Facebook has for the time being done what is reasonable in its power to prevent the fake adverts. For the time being, therefore, her conduct is not considered unlawful vis-à-vis [plaintiff sub 1] and AVROTROS, because it has not been sufficiently specified what additional measures Facebook could and should take at this time. The assertion of [plaintiff sub 1] that the provisions in the General Data Protection Regulation (AVG) can carry the measures desired by him is not valid, as these do not relate to preventive measures.
Conclusion with regard to the claimed under I
4.15.
It is concluded that the claim under I above is rejected. In this outcome, the question of whether (in addition to Facebook Ireland) Facebook Netherlands should be deemed able to satisfy the claim under I, which Facebook disputes, does not need to be answered.
The claim under II
4.16.
Facebook has no objection of its own to the provision of the claimed Identifying Information, except that, in its view, only Facebook Ireland is in a position to do so and that it considers that it is not for it but for the court to decide whether such a decision should be taken. Nor, in her opinion, is there any basis for granting this claim against AVROTROS. However, as the employer of [plaintiff sub 1], AVROTROS has, in the context of being a good employer, an independent interest in being able to dispose of those data.
4.17.
For the time being, with reference to a statement of [name of director] (cited in 2.15), Facebook has made it sufficiently plausible that Facebook Netherlands cannot comply with an order to provide identifying data, because it is not authorised to do so and does not enter into a contract with users.
4.18.
The criteria formulated by the Court of Appeal of Amsterdam in its judgment of 24 June 2004 (ECLI:NL:HR:2005: AU4019 ([name of party])) (ratified by the Supreme Court) can (still today) be taken as a starting point in the considerations to be made by the court. In that judgment, the Court of Appeal ruled that an obligation for the service provider to provide such data to a third party may be justified if the following conditions are met:
a. the possibility that the information, viewed in isolation, is unlawful and harmful vis-à-vis the third party is sufficiently plausible;
b. the third party has a real interest in obtaining the data;
c. it is plausible that, in the specific case, there is no less far-reaching possibility of retrieving the data;
d. balancing the interests of the third party and the internet service provider involved means that the interests of the third party should prevail.
As follows from the above, these conditions are met in this case. Article 6.1 of the AVG also provides scope for the provision of such information and for the rest, in this specific case there are no grounds on the basis of which that claim should be rejected.
4.19.
The claim under II will therefore be allowed, albeit only against Facebook Ireland, as mentioned below in the judgment, with moderation and maximisation of the penalty payments claimed.
4.20.
Contrary to what [plaintiff sub 1] and AVROTROS have argued, Facebook has not had to understand that the claim is also aimed at future advertisements. After all, Facebook has rightly argued that this interpretation is at odds with the claim to comply with the judgment 'within seven days'. This conviction therefore only relates to advertisements that have already appeared.
Final conclusion
4.21.
In conclusion, the claim under I is rejected, and the claim under II is allowed, as indicated below. Since this means that both parties are partially (dis)successful, the costs of the proceedings are settled, as stated below in the operative part of the judgment.
5 The decision
The judge in preliminary relief proceedings
5.1.
Condemns Facebook Ireland to provide, within seven days of service of this judgment, all identifying information of the parties responsible for the advertisements referred to in points 2.4 and 2.10, including name,
email address, telephone number, date and time of registration, IP addresses and other usage and payment data, if available to Facebook Ireland,
5.2.
provides that Facebook Ireland shall be liable to periodic penalty payments of €1,000 for each day (of each day) that it fails to comply with the judgment referred to in point 5.1, up to a maximum of €50,000,
5.3.
declares this judgment provisionally enforceable,
5.4.
set off the costs of the proceedings in such a way that each party bears its own costs,
5.5.
rejects the more or otherwise advanced.
This judgment has been rendered by A.J. Beukenhorst, judge in preliminary relief proceedings, assisted by M. Balk, registrar, and publicly pronounced on 15 May 2020.
