EU bans Meta from processing personal information for behavioural advertising
The Norwegian data protection authority (Datatilsynet) has won the backing of the European Union’s data protection board (EDPB) to urgently ban Meta from further processing personal user data to serve behavioural advertising. This measure will be in force until further notice and was formally adopted on 27 October, although it was not communicated to the company until four days later by the Irish data protection authority (DPC).
Court of Justice of the European Union
A court defeat in Europe puts Facebook’s personalised advertising business in jeopardy
This is a serious blow to Meta’s practices on Instagram and Facebook that make much of its advertising revenue possible. It comes in the wake of the European Court of Justice (CJEU) ruling in July that made it illegal to collect data from individuals to serve them personalised advertising without explicit consent and on the basis of the concept of “legitimate interest”.
Days after that failure, Datatilsynet took the initiative in its application under the General Data Protection Regulation (GDPR), which empowers national agencies to take such decisions for a period of three months in “cases of urgency”. Under this legal umbrella, the Norwegian agency ordered the social web giant to stop displaying targeted ads with information obtained in this way. It also asked the EDPB to extend the measure to all EU countries. Failure to comply with the Norwegian regulator’s order entailed the payment of almost 90,000 euros per day as of 4 August.
The company agreed in principle to comply with these demands, although in September Datatilsynet filed a lawsuit against it for using user activity data such as location and browser history to serve personalised advertising. This followed a separate action by the DPC in May when it fined Meta $1.2 billion for its European user data handling practices. That sanction was accompanied by a landmark decision invalidating the argument that users’ acceptance of terms and conditions was viable as consent to the collection of personal information.
The Irish agency will now have to enforce this EDPB decision as the EU regulator because Meta has its European headquarters in Ireland. In the next two weeks it will have to finalise the measures linked to it and a week later they will come into force. Just to try to avoid this scenario, the technology giant presented a few days ago a subscription plan for Facebook and Instagram, with the intention of taking advantage of the possibility suggested in the CJEU ruling on the possible existence of a payment alternative as a viable endorsement of its current model.
