Authority (Irish DPA) has adopted its final decisions regarding Facebook and Instagram (Meta Platforms Ireland Ltd). These decisions are the result of complaint-based inquiries into Facebook’s and Instagram’s activities concerning the lawfulness and transparency of processing for behavioural advertising. Meta was fined €210 million in the Facebook decision and €180 million in the Instagram decision by the Irish DPA.

The Irish DPA’s final decisions of 31 December 2022 incorporate the legal assessment expressed by the EDPB in its binding decisions of 5 December 2022. These binding decisions were adopted on the basis of Article 65(1)(a) of the GDPR after the Irish DPA, as lead supervisory authority (LSA), had triggered two sets of dispute resolution proceedings concerning objections raised by the other relevant supervisory authorities (RSAs) from ten countries in each case. The RSAs’ objections concerned the legal basis for processing (Article 6 GDPR), data protection principles (Article 5 GDPR) and the use of corrective measures, including fines.

EDPB Chair Andrea Jelinek said: “The EDPB binding decisions clarify that Meta unlawfully processed personal data for behavioural advertising. Such advertising is not necessary for the performance of an alleged contract with Facebook and Instagram users. These decisions may also have an important impact on other platforms that have behavioural ads at the centre of their business model.”

The EDPB decided that Meta had wrongly relied on contract as a legal basis to process personal data in the context of Facebook’s Terms of Service and Instagram’s Terms of Use for the purpose of behavioural advertising as this was not a core element of the services. The EDPB found in both cases that Meta lacked a legal basis for this processing and had therefore unlawfully processed the data. Accordingly, the EDPB instructed the Irish DPA to amend the findings in its draft decisions and to include infringement of Article 6(1) of the GDPR.

The EDPB instructed the Irish DPA to include, in its final decisions, an order that Meta bring its processing of personal data for behavioural advertising in relation to its Facebook and Instagram services into compliance with Article 6(1) within three months.

The EDPB also considered whether the complaints had been properly addressed. The complainant had raised the fact that sensitive data is processed by Meta. However, the Irish DPA did not assess the processing of sensitive data, meaning that the EDPB did not have sufficient factual evidence to make findings on any possible infringement of the controller’s obligations under Article 9 of the GDPR. As a result, the EDPB disagreed with the Irish DPA’s proposed conclusion that Meta was not legally obliged to rely on consent to carry out its processing activities; it was not possible to conclude this categorically without further investigations. Therefore, the EDPB decided that the Irish DPA must carry out further investigations.

In addition, the EDPB instructed the Irish DPA to include in both final decisions a finding of infringement of the principle of fairness and to adopt appropriate corrective measures. The EDPB noted that the grave breaches of transparency obligations impacted the reasonable expectations of users, that Meta had presented its services to users in a misleading manner, and that the relationship between Meta and users was imbalanced.

As for fines, the EDPB directed the Irish DPA to impose an administrative fine for the additional infringements of Article 6(1) GDPR (lack of legal basis for the processing of personal data) and to issue significantly higher fines for the transparency infringements identified, as the fines proposed did not fulfil the requirement of being effective, proportionate and dissuasive. This led to the Irish DPA increasing the fines in its final decisions (from a maximum of €36 and €23 million for the Facebook and Instagram draft decisions, to €210 million and €180 million respectively). To read the EDPB’s press release in full, click here.