Following the binding decisions of the European Data Protection Board (hereinafter also referred to as "EDPB") on dispute resolution of December 5, 2022, the Irish Data Protection Authority (hereinafter also referred to as "IE DPA") adopted its decisions concerning Facebook and Instagram (Meta Platforms Ireland Limited, hereinafter also referred to as "Meta IE") in January 2023. What were the consequences? Was Meta fined?
The EDPB's decisions are the result of investigations into the activities of Facebook and Instagram following complaints, in particular regarding the lawfulness and transparency of data processing for behavioral advertising purposes. The IE DPA imposed a fine of €210 million on Meta IE in its decision concerning Facebook and €180 million in its decision concerning Instagram.
The final decisions of the IE DPA of 31 December 2022 incorporate the legal assessment expressed by the EDPB in its decisions of 5 December 2022. These decisions were adopted pursuant to Article 65(1)(a) of the GDPR after the IE DPA initiated two dispute resolution procedures concerning objections raised by the supervisory authorities (DPAs) concerned.
The EDPB decided that Meta IE had relied disproportionately on the contract as the legal basis for processing personal data in the context of Facebook and Instagram's terms of service for the purpose of behavioral advertising, as this was not the main element of the services. In both cases, the EDPB found that Meta IE had no legal basis for this processing and therefore processed the data unlawfully. As a result, the EDPB instructed the IE DPA to amend the findings in its draft decisions to include a violation of Article 6(1) of the GDPR.
The EDPB instructed the IE DPA to include in its final decisions an order for Meta IE to bring its processing of personal data for behavioral advertising purposes in the context of Facebook and Instagram services into compliance with Article 6(1) of the GDPR within three months and Instagram services into compliance with Article 6(1) of the GDPR within three months.
In addition, the EDPB instructed the IE DPA to include in both final decisions a finding of a breach of the principle of fairness and to take appropriate remedial measures. The EDPB found that the serious breaches of transparency obligations had an impact on users' reasonable expectations, that Meta IE presented its services to users in a misleading manner, and that the relationship between Meta IE and users was unbalanced.
As regards the fines, the EDPB ordered the IE DPA to impose an administrative fine for the other infringements of Article 6(1) of the GDPR (lack of legal basis for the processing of personal data) and to impose significantly higher fines for the transparency infringements found, as it found that the IE DPA had failed to take all necessary measures to ensure that the Meta IE was able to comply 1 of the GDPR (lack of legal basis for the processing of personal data) and to impose significantly higher fines for the transparency breaches found, as it found that the proposed fines did not meet the requirements of effectiveness, proportionality and dissuasiveness. This led the IE DPA to significantly increase the fines in its final decisions (from a maximum of EUR 36 million in the draft decisions concerning Facebook and EUR 23 million in the draft decision concerning Instagram to EUR 210 million in the case of Facebook and EUR 180 million in the case of Instagram).
