New binding decision of the EDPB on the processing of personal data by META

New binding decision of the EDPB on the processing of personal data by META

The European Data Protection Board (hereinafter “EDPB”) has issued an urgent and binding decision about the processing of personal data by META, stating that the only valid basis of legitimacy for the issuance of behavioral advertising must be the consent of the data subject.

The ECDC is an independent European body, established by the General Data Protection Regulation (GDPR), whose mission is to ensure the consistent application of data protection rules throughout the European Economic Area (EEA).

Personal data: processing of META

In the aforementioned binding resolution, the European Data Protection Board has ordered the Irish Data Protection Authority, in its capacity as lead supervisory authority, to impose, within two (2) weeks, on Meta Ireland Limited (hereinafter “META”), the parent company of Facebook, WhatsApp and Instagram in Europe, a prohibition on the processing of personal data of its users throughout the European Economic Area to send them behavioral advertising, on the lawful bases of contract performance and legitimate interest.

In this sense, META would be justifying the processing of its users’ data for the remission of commercial communications and/or advertisements in accordance with the following bases of legitimacy of Article 6 of the General Data Protection Regulation:

• “(…) b) the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation at the data subject’s request of pre-contractual measures (…)”
• “(…) f) processing is necessary for the fulfilment of legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. (…)”

In this regard it should be noted that already in December 2022 META was warned, through the issuance of other binding decisions of the ECDC, that being party to a contract and legitimate interest are not adequate legal bases for the processing of personal data by META to provide users with behavioral advertising (based on detailed segmentation of the user’s profile, in order to offer products or services that are of interest to the user).

What are the implications of the CEPD’s decision on personal data?

The purpose of this decision is to ensure that META complies once and for all with EU data protection regulations, which have been applicable for five (5) years. However, META has not demonstrated that it has complied with the orders imposed at the end of last year, so we can only hope that it complies with this latest resolution of the ECDC under the premise that, if it does not do so, it will be sanctioned with penalties of up to 4% of its global turnover.

This decision poses a serious problem for META’s practices on Instagram and Facebook insofar as, through behavioral advertising, they make a large part of their advertising turnover possible.