The Commission earlier had recruited researchers from an inter-university group to examine how Facebook processes the data of both those who have signed up to the social network as well as non-users and those who have explicitly opted out of using it.
The Commission described the results of the study as "disconcerting", adding that "Facebook disregards European and Belgian privacy legislation in several ways". The report raised concerns about users' inability to opt out of sharing location data or being featured in Facebook's Sponsored Stories. It also criticised the site for not being explicit enough about how data it collects will be used.
Since Facebook's new data use policy was brought in, the privacy commissions of the Netherlands (the lead authority), Germany, and Belgium have worked together as a group to review the changes, with France and Germany recently joining the group. Each of the countries have opened their own local investigation into the policy, according to their national regulations.
Facebook also disputes that any of the local watchdogs have jurisdiction over it. The Belgian Privacy Commission claims that Facebook does not accept the statement that it is bound by the national privacy legislation of Belgium, the Netherlands, and Germany. "Facebook did not accept that it was bound by the national privacy legislation of Belgium, the Netherlands and Germany. It rejected the competence of those countries' supervisory authorities for privacy. Facebook only accepts supervision by the Irish privacy commission and the application of Irish law," the Commission said.
The Commission said that it has now adopted a first recommendation after "months of unsuccessful correspondence and fruitlessly exchanging ideas" with Facebook.
The recommendation sets out that the regulator is competent to address the privacy concerns regarding Facebook, that Belgian law applies to Facebook "simply because any national supervisory authority is obliged to ensure privacy protection for its citizens". The regulator also says that the Belgian law applies to the company as it has a local presence in the country's capital of Brussels.
Because Facebook is subject to EU - and Belgian - law, the Commission insists that Facebook is required to seek consent from users for any tracking activities such as behavioural ads. Under European law, users must give prior consent before any party is allowed to install a cookie on their browser or to perform tracking activities, except in the event either are necessary for connecting to the service or delivering a service specifically requested by the user. According to the watchdog, neither of these two criteria apply to the way Facebook is currently tracking ads.
Read more on this story