Recently rebranded as Meta Platforms, Facebook’s EU headquarters in Ireland was fined a sum of €265 Mln. in late November[i] by the Irish Data Protection Commission (DPC), the overseeing authority, essentially over questions of compliance with the GDPR obligation for data protection by design and default, pursuant to its Article 25.
In 6 December, the European Data Protection Board (EDPB)[ii] settled in a binding decision the question of “whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising, in the cases of Facebook and Instagram, and for service improvement, in the case of WhatsApp”. In other words, Meta’s reliance on its contractual terms in order to justify its personal data based targeted advertisement may be unlawful, whereby users would instead require to be given a yes or no consent option. Users should thus be able to opt out at any time without Meta necessarily limiting the provision of its services.
Since the entry into force of the EU GDPR in 2018, Meta has posited that ads form part of the service given to users under contractual necessity, by rather broad interpretation of Article 6.1(b)[iii] GDPR on lawfulness of processing – arguably leading to manipulated and forced user consent, hence the grounds for series of complaints filed by the European Center for Digital Rights (noyb) with various data protection authorities, including the DPC.
The EDPB’s decision, precise content of which is yet to be publicly disseminated, requires DPC to issue a final decision on this matter by January 2023.
[i] See here https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-in-facebook-data-scraping-inquiry.
[ii] See here https://edpb.europa.eu/news/news/2022/edpb-adopts-art-65-dispute-resolution-binding-decisions-regarding-facebook-instagram_de; https://noyb.eu/en/noyb-win-personalized-ads-facebook-instagram-and-whatsapp-declared-illegal.
[iii] Article 6.1(b) GDPR: “…processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.
