DPC Fines Meta (Facebook, Instagram & WhatsApp) nearly €400 Million for incorrect legal basis relied upon to justify data collection under GDPR
January 2023On 4th January 2023, the Data Protection Commissioner (the ‘DPC’) announced that it had concluded two inquiries into Meta Platforms Ireland Limited’s (‘Meta’) data processing operations in respect of its Instagram and Facebook services.
Final decisions have now been made by the DPC where it has fined Meta Ireland €210 million and €180 million for breaches of the GDPR relating to its Facebook and Instagram services, respectively. Meta has also been directed to bring its data processing operations into compliance within a period of 3 months.
Background
Prior to the introduction of the General Data Protection Regulation (‘GDPR’) on 25th May 2018, Meta changed the legal basis on which it was processing users’ data in its Terms of Services for its Facebook and Instagram users. Previously Meta relied on the consent of its users, but they now sought to rely upon contractual as the legal basis for the majority of its processing operations. All users were asked to select ‘I accept’ to indicate their acceptance of the updated Terms of Service however if users declined, they would no longer be able to access the services.
According to Meta, by selecting ‘I accept’ this created a contract between it and the user. Meta thereby contended that the processing of users’ data for the delivery of its Facebook and Instagram services was necessary for the performance of the contract and this included the provision of personalised services and behavioural advertising. However, objections by an Austrian data subject and a Belgian data subject were raised arguing that by restricting the accessibility to the services resulted in ‘forcing’ the user to consent to the processing of their personal data for behavioural advertising and other personalised services and that this was in breach of the GDPR.
Findings
Draft decisions were prepared by the DPC in which it found against Meta on a lack of transparency, however, the DPC also noted that Meta was not required to rely on consent and in principle, the GDPR did not preclude Meta’s reliance on the contract as a legal basis for processing.
When this draft decision was circulated with other EU privacy regulators, several of them objected to the Irish DPC’s “contract” position.
The matter was referred to the European Data Protection Board (‘EDPB’), which agreed that “contract” could not be relied on as means of personal data procession legitimacy in this case.
Accordingly, the DPC’s final decisions include findings that Meta is not entitled to rely on the “contract” legal basis in connection with the delivery of behavioural advertising as part of its Facebook and Instagram services, and that its processing of users’ data to date, in purported reliance on the “contract” legal basis, amounts to a contravention of Article 6 of the GDPR.