The European Data Protection Board (EDPB) has announced three binding decisions against Meta Platforms Ireland Limited (Meta) under the dispute resolution mechanism contained in Article 65 of the EU General Data Protection Regulation (GDPR). The rulings against Meta's Facebook, Instagram and WhatsApp platforms will now be sent to the company's lead supervisory authority, the Irish Data Protection Commission (DPC), which will hand down final penalties within 30 days.
In its binding decisions, "the EDPB settles, among others, the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising, in the cases of Facebook and Instagram, and for service improvement, in the case of WhatsApp."
The board found that Meta cannot force users to agree to targeted advertising. Even though the GDPR came into force in May 2018, Meta still believed it could ignore its legal obligation to obtain user opt-in consent by adding a provision in the terms and conditions. The decision concludes a complaint submitted by the Austrian privacy campaign group NOYB on 25 May 2018. Noyb posted a summary of the complaint yesterday, including details of contentious revelations about the DPC's approval of Meta's plans to bypass consent and pursue the company's interests.
News of the rulings was leaked to the Wall Street Journal (£), but has since been reported by Reuters, TechCrunch.
Related articles
- Ireland's DPC backs Facebook's data processing plans
- noyb files corruption complaint against Irish Data Protection Commission
- noyb trolls Irish DPC and Facebook with festive Advent Readings
- Irish DPC lobbied for Facebook-friendly GDPR
- Privacy activist Max Schrems Facebook complaint referred to EU court
- Schrems v Facebook explicit consent case moves closer to ECJ
- Irish DPC receives criticism over the handling of Facebook case
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 4,350 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.
