Facebook was dealt a setback on Tuesday when an adviser to the top European Union court said any data protection authority in the bloc had the power to take action against it for breaching privacy laws.
Facebook has its European headquarters in Ireland and has argued that only the Irish data protection authority has the power to police it for its processing of Europeans’ data. Nonetheless other European privacy regulators, including the French, Belgian and German authorities, have taken action against the U.S. company.
Yves Bot, advocate general at the Court of Justice of the European Union (ECJ), said in a non-binding opinion that any national authority could take action against a company for breaching data protection laws in the context of its activities in the country, even if the company is established in another member state.
The case stems from a dispute about a German fan page on Facebook, which collected data on visitors to that page by storing a cookie on their hard drive.
A German court asked the ECJ whether a German data protection authority had jurisdiction over Facebook given its Irish subsidiary Facebook Ireland was responsible for its data processing activities in Europe.
Get Data Sheet, Fortune’s technology newsletter
Bot said that since the data processing at issue via the installation of cookies “is specifically intended to enable Facebook better to target the advertisements which it publishes,” it could be considered as being part of the activities undertaken by Facebook Germany, which is responsible for the promotion and sale of advertising space in Germany.
A spokeswoman for Facebook (FB) said: “We respectfully disagree with the Advocate General and await the European Court’s decision.”
Opinions from Advocate Generals tend to be followed by the Court’s judges in a majority of cases. A final ruling should follow in the coming months.
A new EU data protection law will come into force in May next year which seeks to make life easier for multinational businesses like Facebook by introducing a “one stop shop” principle whereby they would only have to deal with the authority in the member state of their main establishment.
But Bot pointed out that the new law was not yet in effect and the current framework enables each member state to apply its own national legislation, thereby making the “application of multiple national legislations possible.”
