On December 7, 2023, the European Data Protection Board (EDPB) announced the Data Protection Commission's (DPC) decision dated November 10, 2023, imposing a ban on Meta Ireland Limited (Meta) for the unlawful processing of personal data for behavioral advertising purposes on the bases of performance of the contract and legitimate interest. In particular, the DPC issued its enforcement notice further to the EDPB's Urgent Binding Decision 1/2023 (Urgency Decision), as adopted by the EDPB on October 27, 2023, under Article 66 of the General Data Protection Regulation (GDPR).

Background to the decision

On December 31, 2022, the DPC issued two decisions in which it fined Meta a total of €390 million for breaches of the GDPR relating to its Facebook (€210 million) and Instagram (€180 million) services. Further to this, the EDPB in its Urgency Decision found that:

• Meta did not achieve compliance with the DPC's decision within the deadline for compliance and is therefore currently in breach of its duty to comply with decisions by supervisory authorities;
• Meta is inappropriately relying on Article 6(1)(b) of the GDPR to process location data and advertisement interaction data collected on its products for the purpose of behavioral advertising;
• Meta did not provide sufficient information to explain why other categories of data processed by itself do not amount to behavioral data, such as device data and advertisements shown. In this respect, the EDPB found that, if Meta would use device data to identify different market segments, this would constitute processing for behavioral advertising for which it would rely inappropriately on Article 6(1)(b) and Article 6(1)(f) of the GDPR, infringing Article 6(1) of the GDPR;
• failing to put an end to the processing activities at stake and to enforce the DPC's decision exposes data subjects to a risk of serious and irreparable harm;
• the regular cooperation or consistency mechanisms cannot be applied in their usual manner, and due to the risk of serious and irreparable harm without urgent final measures, there is a need to derogate from the regular cooperation and consistency mechanisms to order final measures due to the urgency of the situation;
• there is urgency for the DPC to order final measures in this case in circumstances where further enforcement measures are necessary;
• the presumption set by Article 61(8) of the GDPR is applicable in this specific case. Consequently, the EDPB found that urgency may be presumed on the basis of Article 61(8) of the GDPR, which further corroborates the need to derogate from the regular cooperation and consistency mechanisms;
• it is appropriate, necessary, and proportionate to order final measures consisting of a ban on processing, to be adopted based on Article 58(1)(f) of the GDPR;
• in this particular case, it is proportionate for the ban on processing to be effective one week after notifying the final measures to the controller;
• the appropriate territorial scope is for the final measures to be applicable throughout the entire EEA;
• the addressee of the final measures consisting of a ban on processing should be Meta, which shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the EEA; and
• the national decision needs to be adopted by the DPC without undue delay and at the latest by two weeks after the EDPB has notified its urgent binding decision to itself and to all the concerned supervisory authorities.

Findings of the DPC

Following the EDPB's Urgency Decision and its instructions to the DPC, the DPC adopted the national decision consisting of a ban on processing, to be adopted on the basis of Article 58(1)(f) of the GDPR and referring to Meta's processing of personal data collected on Meta's products for behavioral advertising purposes based on Articles 6(1)(b) and 6(1)(f) of the GDPR. The processing activities to which the ban is to refer are:

• the processing of personal data, including location data and advertisement interaction data, collected on Meta's products for behavioral advertising purposes, having established in this respect the infringement of Article 6(1) of the GDPR arising from inappropriate reliance on Article 6(1)(b) of the GDPR; and
• processing of personal data collected on Meta's products for behavioral advertising purposes, having ascertained in this respect the infringement of Article 6(1) of the GDPR arising from inappropriate reliance on Article 6(1)(f) of the GDPR.

Outcomes

The DPC imposed and required Meta to implement and give effect to a ban on processing by Meta of personal data collected on Meta's products for behavioral advertising purposes based on Article 6(1)(b) and 6(1)(f) of the GDPR, noting that such ban must become effective one week after the notification of same to Meta. Furthermore, having complied with the requirements contained in the notice, and in accordance with Sections 133(7)(a)(i) and 133(7)(a)(ii) of the Data Protection Act 2018 (the Act), Meta must, as soon as may be, and in any event not more than 28 days after such compliance, notify the DPC and any data subject concerned of the steps taken to comply with the notice.

Meta's attention was drawn to Sections 133(9) and 133(1) of the Act for consequences arising from any failure to comply with the decision. Finally, the DPC noted that Meta may, within 28 days from the date on which the notice is served, appeal against a requirement specified in the notice.

You can read the EDPB's press release here, the DPC's decision here, and the Urgency Decision here.