In January 2023, after a significant and turbulent investigation, the Irish Data Protection Commission (Irish DPC) fined Meta Platforms Ireland Ltd. (Meta Ireland) €390m (£340m) for its activities in relation to Facebook and Instagram.
In advance of GDPR, Meta Ireland changed the legal basis for most of its processing operations from consent to contractual necessity, including those relating to the “provision of personalised services and behavioural advertising”.
Platform users were invited to accept the terms and conditions in order to use the service.
When the Irish DPC’s draft decision was submitted for review by peer regulators, there were disagreements, in relation to the amount of the fine and the use of contractual necessity as the legal basis for processing. As such, the matter was referred to the EDPB.
The Irish DPC considers that contractual necessity could form the legal basis for processing stating that “Facebook and Instagram services include, and indeed appear to be premised on, the provision of a personalised service that includes personalised or behavioural advertising” and as such the processing is central to the contract itself.
On the EDPB’s review of the decision by the Irish DPC, the fines for transparency failures were increased substantially and the Irish DPC’s decision that Meta Ireland could use contractual necessity as a basis for processing was overturned.
The Irish DPC is challenging the EDPB’s “order” that the Irish DPC should conduct a new investigation into the entirety of Facebook and Instagram’s processing activities.
The Irish DPC considers the EDPB has gone beyond its remit in making the order and has issued claims in the Court of Justice of the European Union to challenge the order. The Irish DPC has made the same point in respect of a similar order relating to WhatsApp.
Meta plans to appeal the Irish DPC’s ruling.
Meta is also facing a challenge in the Competition Appeal Tribunal in relation to its use of personal data, which the claimant representative (in collective proceedings) alleges was obtained and used in abuse of its dominant position in the market and contrary to competition law.
If you are currently contemplating targeted advertising, we would be happy to help you find your way to a workable and compliant solution. Simply get in touch with your usual contact, or email hello@hellodpo.com for help.
