The event
The Administrative Court ruled on the appeal filed by Facebook Inc. appealing a decision of the Italian Competition Authority which, in December 2018, had jointly fined the companies Facebook Ireland Ltd. and its holding company Facebook Inc. for violation of the Consumer Code, imposing two fines of five million of euros each for the two censured behaviours.
The Authority’s decision concerned two conducts deemed, respectively, to be deceptive and aggressive towards consumers.
The first condemned conduct concerned the famous slogan „Sign up. It’s free and always will be“ contained in the Facebook login and registration page, which emphasized the free nature of the service without however adequately informing users of the collection and use, for commercial purposes, of personal data provided by them. This practice was therefore considered misleading, as it did not allow an informed choice of the consumer, who was not made aware with sufficient immediacy and accuracy of the remunerative purposes underlying the provision of the social network service.
The second conduct condemned by the Competition Authority concerned the mechanism of transmission of personal data generated by users from the platform to third-party apps and websites and vice-versa. According to the Authority, Facebook was implementing an aggressive practice aimed at improperly conditioning the users of the service to the transmission of their data from Facebook to third party websites or apps, and vice-versa, for commercial purposes, through the adoption of a mechanism of preselection of the widest consent to data sharing. Users, in this way, would be inadvertently influenced to maintain the pre-selected choice made by Facebook.

The Court’s decision
The Regional Administrative Court, preliminarily examining Facebook’s claim on the inapplicability of the „parental liability“ institution to the present case, rejects this ground of appeal, deeming the imputation of the holding company Facebook Inc. to be legitimate – jointly with its subsidiary Facebook Ireland Ltd. – for the unfair commercial practices pursued by the latter, not basing the holding company’s liability exclusively on the concept of ‚parental liability‘, but finding that it has omitted to supervise the conduct of the subsidiary and that it has shared the benefit of the effects produced by the unfair commercial practices.
Moreover, the jurisdiction of the Antitrust Authority in matters of personal data has been confirmed by the rejection of the appellant’s defence, which alleged the lack of power of the Antitrust Authority for intruding in a field of exclusive jurisdiction of the Italian Data Protection Authority, due to the alleged pertinence of the censored conducts to the matter of personal data treatment, with consequent sole applicability of the „Privacy Regulation“ on the basis of the specialty principle.
The Administrative Court, arguing the reasons grounding the jurisdiction of the Antitrust Authority, has the opportunity to affirm the potential commercial value of personal data, no longer merely the expression of a fundamental right of the individual’s personality, but a parameter of investigation inherent to the trading relationship between consumer and service provider.
Therefore, considering the existence of two distinct aspects of personal data to be evaluated, there is no incompatibility between the provisions for the protection of privacy and the one for the consumer protection, which, on the contrary, are complementary, since they relate to different conducts: the two provisions, in fact, in relation to their respective aims of protection, impose different information duties, functional, on one side, to the correct treatment of personal data for the usage of the platform and, on the other, to the transparency of information about the economic value of personal data and the lucrative purposes pursued through their exploitation. With this specification, the Court also excludes the danger raised by Facebook regarding the risk of multiple penalties that may be inflicted for the same conduct.
With regard to the second conduct examined by the Antitrust Authority, concerning the mechanism for the transmission of users‘ personal data to third parties, the Administrative Court has revoked the penalty of 5 million of euros, deeming the Authority’s measure illegitimate given the lack of evidence on the existence of a conduct capable of influencing the consumers’ choices.

The capitalization of personal data
The decision of the Italian Administrative Court has a significant importance as it explores in a new light the extent of consumers‘ economic interests with regard to the disclosure and use of their personal data.
While the protection of personal data has historically been developed in consideration of their quality as an expression of a fundamental right of the individual’s personality, with the consequent provision of forms of protection that cannot be waived, such as the right to revoke consent, the Administrative Court now analyses personal data in their quality as assets available for negotiation, susceptible of economic exploitation, potential object of trade between economic operators and consumers: the content of personal data provided by the consumer and the consequent profiling would represent the punctual remuneration provided by the user for the provision of the service.
Consequently, the estimation of personal data from a financial point of view requires economic operators to comply with the obligations of transparency, completeness and non-deception of information required by consumer protection legislation. The user must therefore be made aware of the exchange of transactions underlying the subscription to a synallagmatic contract, as it turns out to be the one for the usage of the social network.

Alessia Asaro and Tankred Thiem