Following the binding decisions of the European Data Protection Board (hereinafter also referred to as "EDPB") on dispute resolution dated December 5, 2022, the Irish Data Protection Authority (hereinafter also referred to as "IE DPA") adopted its decisions regarding Facebook and Instagram (Meta Platforms Ireland Limited, hereinafter also referred to as "Meta IE"). What were the consequences? Was Meta fined?
The EDPB’s decisions are the result of an investigation into the activities of Facebook and Instagram based on complaints, particularly regarding the lawfulness and transparency of data processing for behavioral advertising purposes. The IE DPA imposed a fine of €210 million on Meta IE in the decision concerning Facebook and €180 million in the decision concerning Instagram.
The IE DPA’s final decisions of December 31, 2022, incorporate the legal assessment expressed by the EDPB in its decisions of December 5, 2022. These decisions were adopted pursuant to Article 65(1)(a) of the GDPR after the IE DPA initiated two dispute resolution procedures regarding objections raised by the concerned supervisory authorities (DPAs).
The EDPB ruled that Meta IE had unreasonably relied on a contract as the legal basis for processing personal data in the context of the terms of use for Facebook and Instagram for the purposes of behavioral advertising, as this was not a core element of the services. In both cases, the EDPB found that Meta IE lacked a legal basis for this processing and therefore processed the data unlawfully. Consequently, the EDPB instructed the IE DPA to amend the findings in the draft decisions to include a violation of Article 6(1) of the GDPR.
The EDPB instructed the IE DPA to include in its final decisions an order requiring Meta IE to bring its processing of personal data for the purposes of behavioral advertising into compliance with Article 6(1) of the GDPR within three months for the Facebook services and within three months for the Instagram services.
In addition, the EDPB ordered the IE DPA to include in both final decisions a finding of a breach of the principle of fairness and to adopt appropriate remedial measures. The EDPB found that serious breaches of transparency obligations affected users’ legitimate expectations, that Meta IE presented its services to users in a misleading manner, and that the relationship between Meta IE and users was unbalanced.
With regard to fines, the EDPB ordered the IE DPA to impose an administrative fine for further violations of Article 6(1) of the GDPR (lack of a legal basis for the processing of personal data) and to impose significantly higher fines for the identified transparency violations, as it found that the proposed fines did not meet the requirements of effectiveness, proportionality, and deterrence. This led the IE DPA to significantly increase the fines in its final decisions (from a maximum of €36 million in the draft decisions concerning Facebook and €23 million in the case of Instagram to €210 million for Facebook and €180 million for Instagram).
