Meta fined in €390 million because of behavioural advertising on contractual basis

The Irish Data Protection Commission (DPC) yesterday announced it has fined Meta in €390 million, for GDPR breaches. DPC says it has directed Meta to bring its data processing operations into compliance within a period of 3 months.

DPC’s Decision was supported by European Data Protection Board (EDPB) determinations. The European Data Protection Board ruled Meta Ireland is not entitled to rely on the “contract” legal basis as providing a lawful basis for its processing of personal data for the purpose of behavioural advertising. By doing this, Meta processes users’ data to date in contravention of Article 6 of the GDPR.

DPC says Meta is processing users’ data to date in a contravention of Article 6 of the GDPR. Users use Meta do not have the option to disable behavioural advertising.

“Instead of having a ‘yes/no’ option for personalized ads, they just moved the consent clause in the terms and conditions. This is not just unfair but clearly illegal. We are not aware of any other company that has tried to ignore the GDPR in such an arrogant way,” said Max Schrems, founder of noyb, commenting on DPC’s decision.

“This is a huge blow to Meta’s profits in the EU. People now need to be asked if they want their data to be used for ads or not. They must have a ‘yes or no’ option and can change their mind at any time. The decision also ensures a level playing field with other advertisers that also need to get opt-in consent,” he said.

Although noyb was one of the two parties in the procedure, DPC Ireland informed it will not release the decision to noyb. noyb is a non-profit organization based in Vienna, Austri for digital rights that is pushing Ireland to act. This investigation started in 2018, and Europe was asking already if Ireland was enforcing GDPR?

DPC Ireland did not publish the full decision online.

Meta reacted, stating it is intends to appeal the ruling and the fine. Meta says the decisions do not prevent personalised advertising on Facebook and on Instagram, as decisions relate only to which legal basis Meta uses when offering certain advertising.

Meta is now assessing options to continue offering a personalised service to users, and it states “the suggestion that personalised ads can no longer be offered by Meta across Europe unless each user’s agreement has first been sought is incorrect.”