Rb. Amsterdam - ECLI:NL:RBAMS:2323:6530
| Rb. Amsterdam - ECLI:NL:RBAMS:2323:6530 | |
|---|---|
 | |
| Court: | Rb. Amsterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 6(1)(a) GDPR Article 11.7a of the Telecommunications Act |
| Decided: | 18.10.2023 |
| Published: | 20.10.2023 |
| Parties: | Criteo |
| National Case Number/Name: | ECLI:NL:RBAMS:2323:6530 |
| European Case Law Identifier: | ECLI:NL:RBAMS:2323:6530 |
| Appeal from: | |
| Appeal to: | Not appealed |
| Original Language(s): | Dutch |
| Original Source: | Rb Amsterdam (in Dutch) |
| Initial Contributor: | n/a |
The Amsterdam District Court ruled that digital advertising platform, Criteo, was in violation of Article 6(1) GDPR for failing to obtain users’ consent prior to placing tracking cookies on their devices. Moreover, it held that Criteo and its third-party partner companies, were joint controllers for the purpose of Article 26 GDPR, and thus both Criteo and its partner companies were responsible for ensuring that valid consent had been obtained prior to the placement of cookies.
English Summary
Facts
On 15 June 2023, the CNIL (the French DPA) fined Criteo S.A. € 40,000,000 for their unlawful cookie practices. Criteo is a digital advertising platform that enables businesses to target customers through personalised advertising. As part of their business model, Criteo places tracking cookies on user devices through their partner websites. The CNIL fined Criteo because it collected cookies without having obtained prior user consent, and even in cases where users had refused consent, their websites still collected cookies. On 8 August 2023 in response to the CNIL decision against Criteo, the data subject, a Dutch resident wrote to both Criteo’s Dutch establishment (Criteo B.V.) and their French establishment (Criteo S.A.) requesting them to cease unlawfully processing their data, to provide them with a copy of their data (Article 15 GDPR access request), and to delete all data related to them (Article 17 GDPR erasure request). Included in the letter, was a report by an independent technical expert that the data subject had contracted, which demonstrated that cookies had been placed on the data subject’s devices without their consent and that their data had been processed without their consent by websites belonging to the Criteo group. On 7 September 2023, Criteo’s legal representatives responded. Criteo refused the data subject’s requests on the grounds that Criteo was not the controller. They argued that the operators of the websites were responsible for the non-compliant cookie practices and not Criteo. On 21 September 2023, the data subject instigated summary proceedings against Criteo’s Dutch and French establishments in the Amsterdam District Court (Rechtbank Amsterdam). In their submissions to the Court, the data subject made three requests: (i) that the Court order Criteo to stop placing cookies on user devices without consent, (ii) that Criteo respond to their access request, and (iii) that Criteo fulfil their erasure request.
Holding
Before considering the merits of the case, the Court considered issue of jurisdiction. The Court held that it was competent to hear the case on the basis of Article 79(2) GDPR, as the data subject’s habitual residence was in the Netherlands. On the merits of the case, the Court held that Criteo B.V., Criteo S.A., and their partner websites were joint controllers for the purposes of Article 26 GDPR. It held that their cookie practices were (i) in violation of Article 6(1)(a) GDPR, and (ii) Article 11.7a of the Dutch Telecommunications Act. (i) Firstly, the Court held that Criteo and its partner websites were in violation of Article 6(1)(a) GDPR because they purported to rely on consent for their processing, however, consent was not valid. The expert report submitted by the data subject (claimant) proved that out of 39 of the 40 websites visited, tracking cookies from Criteo were placed on the data subject’s devices without their prior consent. Moreover, in instances where the data subject had refused consent, the websites placed cookies regardless. As joint-controllers, Criteo was responsible for ensuring that consent was validly obtained. (ii) Secondly, the Court held that Criteo and its partner websites were in violation of Article 11.7a of the Dutch Telecommunication Act. This provision states that storing cookies on a user’s device is only lawful if the user has consented to it. As a result, the Court granted the three requests made in the data subject’s submissions, and ordered Criteo to (i) stop placing cookies on user devices without consent, (ii) to respond to the data subject’s access request, and (iii) to fulfil the data subject’s erasure request. The Court gave Criteo 7 days from the date of the judgment to comply with its orders. In the instance of non-compliance, Criteo would face a daily fine of €250 per violation, and up to a maximum of €25,000 cumulatively per violation.
Comment
The complete version of Article 11.7a of the Telecommunications Act states that: 1. Without prejudice to the General Data Protection Regulation, storing or accessing information in a user's peripheral equipment via an electronic communications network is only permitted on condition that the user concerned: a. has been provided with clear and complete information in accordance with the General Data Protection Regulation, at least about the purposes for which such information is used, and b. has consented to it.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
