Irish Data Protection Commission ("DPC") has imposed fines against Meta owned social networking sites Facebook and Instagram. The complaint was made on 25th May,2018 by Austrian data subject (against facebook) and one Belgian data subject against Instagram. The decision on such complaints was pending since long.
While facebook was slapped with penalty of $223 million, penalty of $180 million was levied on Instagram. The said fines were imposed on Meta for forcing European users to give consent to processing of their personal data for behavioral advertising and other personalized services.
Meta Ireland argued that on accepting the updated Terms of Service, a contract was entered into between Meta Ireland and the user. It also took the position that the processing of users’ data in connection with the delivery of its Facebook and Instagram services was necessary for the performance of that contract, to include the provision of personalized services and behavioral advertising, so that such processing operations were lawful by reference to Article 6(1)(b) of the GDPR (the “contract” legal basis for processing). However, DPC found that contractual necessity is not an appropriate basis for processing personal data for behavioral ads.
It means meta can no longer rely on the ground of contractual necessity to run behavioral ads — and will instead have to ask users for their consent. (And cannot profile and target users who do refuse its surveillance ads.). Meta has been directed to bring its processing in compliance with GDPR within 3 months.
