Regarding the decision adopted on 27 October 2023 concerning the processing of personal data with the reason of behavioral advertising on the legal grounds of contract and legitimate interest within the European Economic Area (“EEA”), the Irish Data Protection Authority adopted its final decision.
The decision prohibits the processing of personal data with the reason of behavioral advertising on the legal grounds of contract and legitimate interest. Following this decision, the Norwegian Data Protection Authority requested the European Data Protection Board (“EDPB”) to order measures concerning the entire EEA.
The chair of EDPB argued that the decision has been made concerning Irish DPA to prohibit the processing in the entire EEA. He also highlighted that based on the decision in December 2022, the legal basis of contract cannot be justified for the processing carried out by Meta for behavioral advertising. It has been also recalled that Meta did not demonstrate compliance with this decision, which brings out the question of the applicability of Article 66 GDPR, urgency procedure.
In the middle of this year, the Norwegian DPA temporarily prohibited the processing of personal data for Norwegian data subjects by Facebook Norway for behavioral advertising with the basis of contract and legal interest under Article 66 GDPR. This ban was limited both in scope and geographic area; with a duration of three months and being applicable only in Norway. Following this, in September, the Norwegian DPA requested EDPB to publish an urgent binding decision regarding the adaptation of final measures applicable to the entire EEA.
With the continuous concerns regarding the infringement of GDPR, EDBP concluded that there is an urgent need to act since the rights and freedoms of data subjects are at risk. After the examination of the evidence provided, EDPB established that there is an ongoing infringement of Article 6(1), highlighting the inappropriate use of the legal grounds of contract and legitimate interest for behavioral advertising by Meta Ireland.
Since this is a matter of urgency, EDPB concluded that the regular cooperation mechanisms cannot be applied and therefore a final measure needs to be ordered urgently, concerning the possible risks and irreparable harm.
In addition, Irish DPA did not answer the request for mutual assistance from the Norwegian DPA, for which the timeframe is set for in the GDPR. Article 61(8) refers to the presumption to urgency which makes the application of GDPR clear, as well as highlights the need to derogate from regular cooperation mechanisms.
EDPB ordered that the final measures needed to be complied with by the Irish DPA. In conclusion, the EDPB found out that imposing a ban on processing of personal data for behavioral advertising on the grounds of contract and legitimate purpose, by Meta Ireland, is proportionate, necessary and appropriate.
This urgent binding decision was addressed to the Irish DPA, the Norwegian DPA and the other concerned DPAs.
Do you have any questions about developments within privacy and data protection? Contact us, the Experts in Data Privacy, at info@dpoconsultancy.nl for more information.
https://edpb.europa.eu/news/news/2023/edpb-publishes-urgent-binding-decision-regarding-meta_en
Recent Comments