(Reuters) – Facebook and other Silicon Valley giants could face closer scrutiny and potential sanctions in the European Union after the bloc’s highest court backs the national life watchdogs private sector to prosecute them, even though they are not the main regulators.

Consumer lobby group BEUC hailed Tuesday’s ruling by the EU Court of Justice (CJEU), which upheld the right of national agencies to act, citing bottlenecks in the enforcement.

“Most of the big tech companies are based in Ireland, and it shouldn’t be up to that country’s authority alone to protect 500 million consumers in the EU,” BEUC Managing Director Monique Goyens said after the judgment.

Along with Google, Twitter and Apple, Facebook has its European headquarters in Ireland, placing it under the oversight of the Irish data protection regulator under privacy rules known as GDPR, which allows fines of up to $ 4. % of a company’s worldwide revenue for violations. .

The CJEU intervened after a Belgian court asked for advice on Facebook’s challenge to the territorial jurisdiction of the Belgian data watchdog, which tried to prevent it from tracking users via cookies stored in the plug-ins corporate social responsibility, whether or not they have an account. or not.

“The BE DPA (Belgium’s Data Watchdog) must now analyze the judgment in more detail to determine whether one of the situations described … applies to the case it opened against Facebook in 2015”, Hielke Hijmans, president of the Belgian Data Protection Authority. Litigation Chamber, said.

Several EU-27 national watchdogs have long complained about their Irish counterpart, saying it takes too long to decide cases. Ireland rejected this, saying it had to be very meticulous in dealing with powerful and well-funded tech giants.

Ongoing Irish cases include Facebook-owned Instagram and WhatsApp, as well as Twitter, Apple, Verizon Media, Microsoft-owned LinkedIn and US digital advertiser Quantcast.

“Under certain conditions, a national supervisory authority can exercise its power to bring any alleged violation of the GDPR to a court in a member state, even if that authority is not the main supervisory authority,” said the CJEU .

The judges said that these conditions include regulators following the cooperation and consistency procedures set out in the GDPR and that the violations took place in the relevant EU country.

“We are delighted that the CJEU has supported the value and principles of the Single Window Mechanism and underlined its importance in ensuring the effective and consistent application of the GDPR across the EU”, said Jack Gilbert, General Counsel Facebook associate.

Backdoor open

But tech lobby group CCIA said the move could lead to inconsistent and uncertain enforcement and increase costs.

“It has also opened the back door for all national data protection officials to initiate multiple proceedings against companies,” said Alex Roure, policy officer at CCIA Europe.

“Data protection compliance in the EU risks becoming more inconsistent, fragmented and uncertain,” he said.

However, David Stevens, chairman of the Belgian DPA, said the decision was “a good thing for the protection of citizens’ privacy and for the harmonized application of the GDPR”.

“We have always been convinced of the importance of maintaining the ability for authorities to act on behalf of users,” Stevens added in a statement.

Wojciech Wiewiórowski, of the EDPS, the EU’s privacy watchdog for European institutions such as the European Commission and the European Parliament, said the ruling confirms that a lead supervisory authority cannot “do go it alone “and had to cooperate closely with other data protection authorities.

Wiewiórowski said he stressed the need for “sincere and effective cooperation to preserve both a consistent interpretation of the GDPR and the effectiveness of its provisions”.

The case is C-645/19 Facebook Ireland & Others.