NOTE: Compare the DPC's summaries of the submissions by the complainant against the relevant documents, as arguments are partly missing, not accurately reflected or taken out of context.
2.21 The Complainant’s submissions on the Preliminary Draft Decision further argue that there has been a failure to investigate the relevant facts. It is argued that there is a fundamental disagreement as to whether the agreement the Complainant has accepted is “a contract” or “a consent”.12 This issue was dealt with extensively in the Preliminary Draft Decision and is determined below in this Draft Decision. 2.22 While the Complainant’s submissions on the Preliminary Draft Decision call for the Commission to engage in a thorough investigation as to the nature of this agreement, having regard to the scope of the Complaint, this is, in my view, entirely unnecessary and would not divulge any new Information or serve a useful purpose at this stage. As is set out in Section 3 below, there is no dispute in relation to the fact that there is a contract between Facebook and the Complainant or the fact no consent within the meaning of the GDPR has been provided by the Complainant in concluding the “agreement” in dispute. What is in dispute, as set out in detail in this Draft Decision and in the Schedule, is the lawfulness of the personal data processing and the transparency of the information provided. 2.23
3
On this basis, the issues that I will address in this Draft Decision are as follows:
Issue 1 – Whether clicking on the “accept” button constitutes or must be considered consent for the purposes of the GDPR
Issue 2 – Reliance on Article 6(1)(b) as a lawful basis for personal data processing
Issue 3 – Whether Facebook provided the requisite information on the legal basis for processing on foot of Article 6(1)(b) GDPR and whether it did so in a transparent manner.
ISSUE 1 – WHETHER CLICKING ON THE “ACCEPT” BUTTON CONSTITUTES OR MUST BE CONSENT FOR THE PURPOSES OF THE GDPR
WHETHER THE ACCEPTANCE IS CONSENT 3.1 As I have outlined in Section 2, the Complainant alleges that clicking on the “accept” button of the engagement flow presented to existing users in respect of Facebook’s updated Terms of Service in April 2018 constituted an act of consent by the data subject for the purposes of Article 6(1)(a) GDPR. The first question to be considered is whether Facebook, via the updated Terms of Service, sought to obtain the Complainant’s “consent” for the purposes of processing of personal data under those Terms of Service. Facebook’s position, as noted above, is that it did not.
12
Ibid, paragraph 4.3.1.
