Following the 6th of December 2022 binding decision of the European Data Protection Board (EDPB) regarding the question of whether Meta’s reliance on its contractual terms in order to justify its personal data – based targeted advertisement would be deemed unlawful, further clarity has now been gained by the 4th of January 2023 final decision[i] of the Irish Data Protection Commission (DPC), Meta Platforms Ireland’s overseeing authority.
Meta is now given three months to establish an alternative legal basis for its personal data – based targeted advertisement model. In other words, “by making the accessibility of its services conditional on users accepting the updated terms of service, Meta was in fact “forcing” … [users] to consent to the processing of their personal data for behavioural advertising and other personalised services”. A stance found to be in clear breach of the EU GDPR, in particular a contravention of its Article 6.
Simply put, the decision renders that Meta must within three months allow users to have a version of all applications that does not utilise personal data for advertisement. Users must also be able to withdraw consent at any time, in which case Meta may not limit the services.
This clearly excludes Meta’s use of non-personal data for targeted advertisement.
Furthermore, the imposed administrative fines have now seen an almost ten-fold increase to reach €210 mm in the case of Facebook services, and €180 mm in the case of Instagram.
Meta Platforms Ireland still retains the option to appeal against the decision before the Irish courts, albeit with very limited chance to win given the circumstances and the involvement of the EDPB.
[i] See here https://www.dataprotection.ie/en/news-media/data-protection-commission-announces-conclusion-two-inquiries-meta-ireland; https://noyb.eu/en/breaking-meta-prohibited-use-personal-data-advertising.
