The EU’s second-highest court has ruled that Facebook can’t be forced to turn over sensitive information without a review.
A new EU court decision could delay an ongoing European Commission antitrust investigation into Facebook, after ruling that the company does not have to hand over vast amounts of data without a review.
It follows severe pushback from Facebook earlier this year, when the tech giant filed a legal challenge claiming that many of the documents requested as part of the antitrust investigation were “irrelevant” and would reveal highly sensitive personal information.
While this week’s ruling may be seen as a small victory for the social media giant, the General Court of the EU also said Facebook should identify potentially sensitive information and store it in a “virtual data room”, according to Bloomberg.
“The members of the team responsible for the investigation shall examine and select the documents in question,” said judge Marc van der Woude in the court order.
He went on to say that the team should also give Facebook lawyers “the opportunity to comment on them before the documents considered relevant are placed on the file”.
In a statement, Facebook said that it welcomed the court’s assessment “that highly personal and irrelevant information enjoy strong legal protections which need to be respected in the commission’s ongoing investigation”.
“In the meantime, we continue to cooperate with the commission and have already provided it with over a million documents,” it added.
Challenging the DPC
Elsewhere, Ireland’s Data Protection Commission (DPC) sent Facebook a preliminary order to change its data-sharing practices between the EU and the US in September of this year.
However, Facebook Ireland is now challenging the DPC’s draft decision and, according to The Irish Times, this legal challenge will be heard in December. A separate challenge by data rights activist Max Schrems will be heard in January.
When dealing with pre-trial applications in both cases at the commercial court, the judge also made orders, on terms agreed between the sides, providing for Schrems to be joined as a notice party to the Facebook case and for Facebook to be joined as a notice party to his case.
The DPC’s preliminary order to Facebook followed a landmark ruling in July from the Court of Justice of the European Union, which invalidated the Privacy Shield agreement for EU-US data transfers.
Facebook is challenging the order because it claims the DPC failed to conduct an inquiry before it reached its draft decision and has not afforded the company fair procedures. The DPC’s probe has been stayed pending the outcome of the proceedings.