Judgment;Abstract — ECLI:EU:C:2021:483
Date: 2021-06-15
Language of the case: Dutch
Court formation: Grand Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Fundamental rights;Data protection;Charter of Fundamental Rights
Procedure: Reference for a preliminary ruling;Reference for a preliminary ruling - inadmissible
Origin: Belgium

Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged:  
30 August 2019 
Referring court:  
Hof van beroep te Brussel (Court of Appeal, Brussels, Belgium) 
Date of the decision to refer:  
8 May 2019 
Appellants:  
Facebook Ireland Limited 
Facebook Inc. 
Facebook Belgium bvba 
Respondent:  
Gegevensbeschermingsautoriteit (Belgian Data Protection 
Authority) 
  
Subject of the action in the main proceedings 
The appeal in the main proceedings is directed against the judgment of the 
Nederlandstalige rechtbank van eerste aanleg Brussel (Court of First Instance 
(Dutch-speaking), Brussels) of 16 February 2018 in which, at the request of the 
Commissie ter bescherming van de Persoonlijke Levenssfeer (Belgian 
Commission on the Protection of Privacy; ‘Privacy Commission’, since replaced 
by the Gegevensbeschermingsautoriteit (Belgian Data Protection Authority; 
‘DPA’), a number of measures were imposed on Facebook Inc., Facebook Ltd and 
Facebook bvba. In particular, these required Facebook to stop placing and 
collecting cookies when Internet users visit a web page forming part of the 
facebook.com domain or a third-party website, unless those users have clearly 
given their consent and been sufficiently informed. The personal data that 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-645/19 
 
2  
Facebook had already obtained through the use of the technologies at issue in this 
case were to be destroyed.  
Subject matter and legal basis of the request for a preliminary ruling 
Request under Article 267 TFEU. 
The six questions referred concern the interpretation of Articles 55(1), 56 to 58 
and 60 to 66 of Regulation (EU) 2016/679 (‘GDPR’), which relate to the powers 
of the supervisory authorities in the Member States in the event of cross-border 
data processing within the European Union.  
Questions referred  
1. Should Articles [55(1)], 56 to 58 and 60 to 66 of Regulation (EU) 2016/679 
of the European Parliament and of the Council of 27 April 2016 on the 
protection of natural persons with regard to the processing of personal data 
and on the free movement of such data, and repealing Directive 95/46/EC, 
read in conjunction with Articles 7, 8 and 47 of the Charter of Fundamental 
Rights of the European Union, be interpreted as meaning that a supervisory 
authority which, pursuant to national law adopted in implementation of 
Article [58(5)] of that regulation, has the power to commence legal 
proceedings before a court in its Member State against infringements of that 
regulation cannot exercise that power in connection with cross-border 
processing if it is not the lead supervisory authority for that cross-border 
processing? 
2. Does it make a difference if the controller of that cross-border processing 
does not have its main establishment in that Member State but does have 
another establishment there? 
3. Does it make a difference whether the national supervisory authority 
commences the legal proceedings against the controller’s main 
establishment or against the establishment in its own Member State? 
4. Does it make a difference if the national supervisory authority had already 
commenced the legal proceedings before the date on which the regulation 
entered into force (25 May 2018)? 
5. If the first question is answered in the affirmative, does Article [58(5)] of the 
GDPR have direct effect, such that a national supervisory authority can rely 
on the aforementioned article to commence or continue legal proceedings 
against private parties even if Article [58(5)] of the GDPR has not been 
specifically transposed into the legislation of the Member States, 
notwithstanding the requirement to do so? 
FACEBOOK IRELAND AND OTHERS 
 
3 
6. If the previous questions are answered in the affirmative, could the outcome 
of such proceedings prevent the lead supervisory authority from reaching a 
conclusion to the contrary, in the event that the lead supervisory authority 
investigates the same or similar cross-border processing activities in 
accordance with the mechanism laid down in Articles 56 and 60 of the 
GDPR? 
Provisions of EU law cited 
Directive 95/46/EC of the European Parliament and of the Council of 24 October 
1995 on the protection of individuals with regard to the processing of personal 
data and on the free movement of such data 
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 
2002 concerning the processing of personal data and the protection of privacy in 
the electronic communications sector 
Directive 2009/136/EC of the European Parliament and of the Council of 
25 November 2009 amending Directive 2002/22/EC on universal service and 
users’ rights relating to electronic communications networks and services, 
Directive 2002/58/EC concerning the processing of personal data and the 
protection of privacy in the electronic communications sector and Regulation (EC) 
No 2006/2004 on cooperation between national authorities responsible for the 
enforcement of consumer protection laws 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (GDPR) 
Charter of Fundamental Rights of the European Union 
Provisions of national law cited 
Wet van 8 december 1992 tot bescherming van de persoonlijke levenssfeer ten 
opzichte van de verwerking van persoonsgegevens (Law of 8 December 1992 on 
the protection of privacy with regard to the processing of personal data; ‘WVP’) 
Wet van 13 juni 2005 betreffende de elektronische communicatie (Law of 13 June 
2005 on electronic communication)  
Wet van 3 december 2017 tot oprichting van de Gegevensbeschermingsautoriteit 
(Law of 3 December 2017 establishing the Belgian Data Protection Authority; 
‘DPA Law’) 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-645/19 
 
4  
Wet van 30 juli 2018 betreffende de bescherming van natuurlijke personen met 
betrekking tot de verwerking van persoonsgegevens (Law of 30 July 2018 on the 
protection of individuals with regard to the processing of personal data) 
Brief summary of the facts and the procedure in the main proceedings 
1 The dispute is based on the legal actions brought successively by the Privacy 
Commission and the DPA (its legal successor), which are aimed at putting an end 
to alleged serious and large-scale infringements of privacy law by Facebook, 
consisting, inter alia, of the unlawful collection and use on a daily basis of 
information on the private browsing behaviour of millions of internet users in 
Belgium (both Facebook account holders and unregistered users of the Facebook 
service) by means of technologies such as ‘cookies’, ‘social plugins’ and ‘pixels’.  
2 In summary, the Privacy Commission – now the DPA – submits that Facebook:  
- uses certain technologies to look over persons’ shoulders while they 
are browsing from one website to another and then uses the 
information collected to profile their browsing behaviour and, on the 
basis of this, to show them targeted advertising, without sufficiently 
informing the persons concerned and obtaining their valid consent; 
- carries out these practices regardless of whether or not the person 
concerned has signed up to Facebook’s social network.  
3 On 11 September 2015 the Privacy Commission commenced proceedings against 
Facebook Inc., Facebook Ireland Ltd and Facebook bvba before the 
Nederlandstalige rechtbank van eerste aanleg Brussel (Court of First Instance 
(Dutch-speaking), Brussels). The rechtbank ruled on the substance of the case in a 
judgment of 16 February 2018. On 2 March 2018 Facebook Inc., Facebook 
Ireland Ltd and Facebook bvba filed a notice of appeal against that judgment with 
the referring court. On 25 May 2018 the DPA Law entered into force, as a result 
of which the DPA became the legal successor of the Privacy Commission.  
Main arguments of the parties in the main proceedings 
4 The dispute between the parties in the main proceedings concerned whether the 
Belgian courts and tribunals had international jurisdiction in respect of the three 
defendants, Facebook Inc., Facebook Ireland Ltd and Facebook bvba (the Belgian 
company). The referring court settled the question, ruling that it has no 
international jurisdiction with regard to the actions against Facebook Inc. and 
Facebook Ireland Ltd, whereas it does have international jurisdiction in respect of 
the actions against Facebook bvba. The main proceedings were therefore 
restricted to the actions against this latter company.  
FACEBOOK IRELAND AND OTHERS 
 
5 
5 Regarding the facts dating from prior to 25 May 2018, the referring court also 
held that the actions brought by the DPA were in any case devoid of purpose if the 
urgency requirement was not met. Consequently, the main proceedings are 
restricted to the acts dating from after 25 May 2018, the date on which the GDPR 
and the DPA Law entered into force and the DPA succeeded the Privacy 
Commission.  
6 The questions referred arise from the dispute between the parties concerning the 
consequences of the entry into force of the GDPR and the associated new Belgian 
legislation, the DPA Law, with regard to the powers of the newly established 
supervisory authority, the DPA, which replaced the Privacy Commission, the 
latter having commenced, at first instance, legal proceedings against Facebook in 
2015.  
7 According to Facebook, the DPA does not have the power to investigate and take 
decisions in respect of the processing activities at issue. The GDPR has 
superseded the national privacy legislation in all Member States, including the 
WVP in Belgium, and has created a new substantive and procedural framework 
with which supervisory authorities in the EU must comply.  
8 In Facebook’s view, the new rules (GDPR and DPA Law), which have applied 
since 25 May 2018, provide for a ‘one-stop shop’ mechanism (Articles 56 and 60 
of the GDPR) whereby enforcement is carried out by the lead supervisory 
authority of the Member State in which the controller of the data processing has 
its main establishment. In this case the lead authority would be the Irish authority 
(Data Protection Commission, DPC), since the main establishment of the 
controller in the EU is located in Ireland (Facebook Ireland Ltd). According to 
Facebook, parallel investigations have also been initiated by the Irish supervisory 
authority.  
9 The DPA disputes the proposition that it cannot engage in legal proceedings as the 
legal successor of the Privacy Commission due to not being the lead supervisory 
authority for the purposes of the GDPR. In its opinion, the ‘one-stop shop’ 
mechanism entails that a controller with one or more establishments in the EU has 
a specific supervisory authority as its sole interlocutor for cross-border processing. 
This is the supervisory authority of the Member State in which the controller has 
its main establishment in the EU, which then becomes the ‘lead’ supervisory 
authority.  
10 In the DPA’s view, the ‘one-stop shop’ mechanism, as laid down in Article 56(1) 
of the GDPR, however, remains an exception. The basic rule is that every 
supervisory authority is competent to exercise the powers conferred on it under 
the GDPR in its territory, as is explicitly stated in Article 55(1) of the GDPR. The 
‘one-stop shop’ mechanism does not affect a supervisory authority’s power to 
engage in legal proceedings. With regard to a supervisory authority’s enforcement 
powers, the GDPR draws a clear distinction between an administrative procedure 
(as provided for in Article 58 of the GDPR) and a legal procedure. The latter does 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-645/19 
 
6  
not fall under the ‘one-stop shop’ mechanism, which is also apparent from the 
purpose of that mechanism, the text of Article 58 of the GDPR, the legislative 
history of the GDPR and its implementation in Belgium. If the DPA were unable 
to engage in legal proceedings in cases where it is not the lead supervisory 
authority, it would result in a situation where infringements committed on Belgian 
territory could not be brought to the attention of the authorities, even if they are 
subject to criminal sanctions.  
11 Last, the DPA submits that, even if a supervisory authority’s power to commence 
legal proceedings in its territory does fall under the ‘one-stop shop’ mechanism, 
there is no provision stating that, as a consequence of the GDPR, all legal 
proceedings already before the courts on 25 May 2018 are terminated.  
Brief summary of the reasons for the referral 
12 The referring court points out that, with regard to acts dating from after 25 May 
2018, an entirely new procedure does indeed apply to the supervision of privacy 
rules.  
13 Complaints may give rise to an investigation by the DPA’s inspection services. 
Once an investigation has been completed, the case may be brought before the 
litigation chamber. This chamber may decide, inter alia, to transfer the file to the 
authorities responsible for criminal enforcement. Appeals can be brought against 
any decision of the litigation chamber before the Marktenhof (Market Court – a 
specialist chamber within the Hof van beroep (Court of Appeal) in Brussels).  
14 The possibility of engaging in legal proceedings against a party – as in the case of 
the legal action brought by the Privacy Commission against Facebook in this 
matter – is generally no longer available. According to the referring court, a new 
rule (the ‘one-stop shop’) applies to the monitoring and combating of 
infringements of privacy rules at European level. 
15 The question that now arises, in the referring court’s view, is whether the DPA 
can bring a legal action against Facebook bvba in respect of the facts dating from 
after 25 May 2018 given that Facebook Ireland Ltd is the data-processing entity. It 
could be inferred from Article 56 of the GDPR that, as from the aforementioned 
date, in accordance with the ‘one-stop shop’ principle, it is only possible for an 
action to be brought in Ireland by the supervisory authority in that country, and 
that only the courts and tribunals in that country have jurisdiction.  
16 In the judgment of the Court of Justice of 5 June 2018 (case C-210/16, 
Wirtschaftsakademie), the Court ruled that the German supervisory authority was 
competent in respect of data processing where the controller was established in 
another Member State (Ireland) and the establishment in Germany was 
responsible solely for the sale of advertising space and other marketing activities 
in the territory of that Member State (Facebook Germany).  
FACEBOOK IRELAND AND OTHERS 
 
7 
17 The Court was ruling in that case on Directive 95/46/EC of the European 
Parliament and of the Council of 24 October 1995, which was superseded by the 
GDPR. The referring court questions to what extent the above interpretation by 
the Court of Justice in the judgment of 5 June 2018 is still relevant to interpreting 
the new legislation. It also notes that the DPA does not prove that Facebook 
Belgium bvba has been involved in any way in the actual data processing.  
18 The referring court also refers to a recent decision by the German 
Bundeskartellamt (Federal Cartel Office) of 6 February 2019 (the ‘Facebook 
decision’), in which that authority took the view that Facebook was abusing its 
position of power by merging data from different sources, which is now permitted 
only if users have given their explicit consent, with the proviso that anyone who 
does not give their consent may not be excluded from Facebook’s services. The 
referring court notes that the Bundeskartellamt evidently considered itself 
competent, in spite of the aforementioned ‘one-stop shop’ mechanism.  
19 The referring court is of the opinion that Article 6 of the DPA Law, which 
stipulates that the DPA has general access to the courts, including the European 
courts, is in itself an insufficient legal basis for the DPA to bring an action in this 
case. That article provides: ‘The Data Protection Authority shall be authorised to 
bring infringements of the fundamental principles of the protection of privacy, 
under this law and laws laying down provisions protecting the processing of 
personal data, to the attention of the judicial authorities and, where appropriate, to 
commence legal proceedings to enforce these fundamental principles.’ 
20 The fact that, in principle, the DPA can commence legal proceedings, where 
appropriate, does not mean that such proceedings can always be brought before 
the Belgian courts and tribunals, given that the general ‘one-stop shop’ rule seems 
to entail that the proceedings are brought before the court in the place where the 
data processing is carried out.  
21 The referring court points out that Article 58(5) of the GDPR provides: ‘Each 
Member State shall provide by law that its supervisory authority shall have the 
power to bring infringements of this Regulation to the attention of the judicial 
authorities and where appropriate, to commence or engage otherwise in legal 
proceedings, in order to enforce the provisions of this Regulation.’ 
22 In its view, that provision requires Member States to specify, by means of an 
explicit provision, the specific circumstances in which the national supervisory 
authority of a Member State can commence legal proceedings before the courts 
and tribunals of the Member State itself, if that possibility exists ‘on top of’ the 
‘one-stop-shop’ principle laid down in Articles 55 and 56 of the GDPR.  
23 It seems to the referring court that each supervisory authority (other than the 
supervisory authority responsible for the main establishment or single 
establishment of the controller) is competent to handle a complaint lodged with it 
or a possible infringement of the regulation, if the subject matter relates only to an 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-645/19 
 
8  
establishment in its Member State or substantially affects data subjects only in its 
Member State.