The second round in the confrontation between the AGCM and Facebook also came to an end with the imposition of a new overall fine of € 7 million against Facebook Ireland Ltd. and Facebook Inc. jointly and severally.
The story shows how the current business model of apparently free social networks is struggling to fall within the regulatory standards of consumer and data protection law.
Previous steps
Why the two Facebook
In the AGCM decision it is pointed out that Facebook Inc. “is the 100% parent company of Facebook Ireland Ltd. and a subject that benefits from the conduct in question“. On this circumstance, “according to the principle affirmed by the jurisprudence “in antitrust matters […] in the presence of a company that holds 100% of the share capital of another company, it is assumed that the parent company exercises a decisive influence in the performance of the subsidiary’s business, such as to make it held responsible for the offenses materially committed by the latter“.
The reason for the applicability of this principle to sanctions for unfair commercial practices must be identified, according to case law, in the fact that “the diversity of the two regulatory domains (antitrust and consumer protection) does not eliminate the common matrix and ratio of the same which, when ‘even from different angles, they both concern the protection of the market and the freedom of competition”.
In conclusion, the status of 100% parent company, the decisive influence exercised by Facebook Inc. over Facebook Ireland Ltd., the failure of the parent company to supervise the subsidiary, renders the parent company jointly and severally liable for the offenses committed by the subsidiary.
In the data protection domain, similar conclusions are reached according to the principles of the strict connection of personal data processing activities between the two entities (CJEU C-131/12, Google Spain, EDPB 3/2018 guidelines on the territorial scope).
Incorrect and aggressive practices
The first decision of the AGCM held both Facebook Inc. and Facebook Ireland Ltd. responsible for unfair and aggressive practices.
The unfair practice, considered “misleading“, consisted in having adopted, in the phase of the user’s first registration on the Facebook Platform (“website” and “app”), an information notice deemed by AGCM lacking clarity and completeness, with reference to the collection and use of user data for commercial purposes.
The second practice, qualified as “aggressive“, took the form of the application, in relation to users registered on the platform, of a mechanism which, according to the Authority’s reconstruction, involved the transmission of user data from the social network platform to the sites “Web / app” of third parties and vice versa, for the use of the same for profiling and commercial purposes without the prior express consent of the consumer.
