On the first day of GDPR enforcement, Facebook and Google have been hit with a lawsuits accusing the companies of coercing users into sharing personal data. The lawsuits, which seek to fine Facebook 3.9 billion and Google 3.7 billion euro (roughly $8.8 billion in dollars), were filed by Austrian privacy activist Max Schrems, a longtime critic of the companies’ data collection practices.
The complaints strike at the heart of the big tech companies’ business model: providing “free” online services in exchange for user profiling based on collecting of user data.
Three complaints worth €3.9 billion were filed in the early hours of Friday morning against Facebook and two subsidiaries, WhatsApp and Instagram via data regulators in Austria, Belgium and Hamburg. Another complaint worth €3.7 billion was filed with French data protection authority France CNIL in the case of Google’s Android operating system for smartphones.
GDPR requires clear consent and justification for any personal data collected from users, and these guidelines have pushed companies across the internet to revise their privacy policies and collection practices. But there is still widespread uncertainty over how European regulators will treat the requirements, and many companies are still unprepared for enforcement.
They are the first legal tests of Europe’s new data protection rulebook, the General Data Protection Regulation (GDPR), which came into effect at midnight on Friday. It harmonises privacy rules across the bloc and foresees fines of up to four percent of group turnover for breaches. The new lawsuits mark a fresh round of legal tug-of-war between the Austrian campaigner, Facebook and the Irish data protection commission (DPC), which began in 2011 and are ongoing.