The Court of Justice of the European Union (CJEU) ruled on 4 July 2023 that a national competition authority can assess whether data processing operations comply with the General Data Protection Regulation (GDPR). The ruling concerned the case of Meta Platforms vs German Federal Cartel Office (Bundeskartellamt). The Bundeskartellamt banned Meta from processing Facebook users’ data from outside the platform without their consent, deeming this an abuse of the company’s dominant position.
The CJEU emphasised that the assessment of compliance with the RODO is only to determine the abuse of a dominant position and impose appropriate measures. In addition, the CJEU noted that the dominant position does not implicitly prevent users from giving valid consent, but is a relevant factor in assessing whether consent was in fact valid and freely given.Source