Meta Platforms Ireland Ltd. fined for unlawful data processing Summary In 2018, a Belgian Instagram user filed a complaint To continue accessing Facebook and Instagram against Meta, alleging that Instagram’s processing services after the implementation of the GDPR, practices amounted to ‘forced consent’. The complaint existing and new users were required to indicate their was initially filed with the Belgian DPA, which referred acceptance of the updated Terms of Service by clicking the case to the Irish DPA. ”I accept.” Users who declined to accept would not be able to access the services. Similarly, an Austrian Facebook user complained about Meta, arguing that the processing practices on the Meta Ireland considered that by accepting the Facebook platform and the consent required to access updated Terms of Service, a contractual agreement the platform could not be considered ‘freely given’, in was established between Meta Ireland and the user. turn also constituting ‘forced consent’. The complaint It also argued that the processing of users’ data was filed with the Austrian DPA, who also referred the in connection with the provision of Facebook and case to the Irish DPA. Instagram services, including personalized services and behavioral advertising, was necessary for fulfilling that In both cases, the data subjects were represented by contract. Therefore, Meta Ireland maintained that such the Austrian Data Privacy NGO NOYB (None of Your processing operations were lawful under GDPR, Article Business). 6(1)(b), which designates the ”contract” legal basis for Prior to the GDPR entering into force, Meta Ireland processing. modified the Terms of Service governing its Facebook However, the complainants disputed Meta Ireland’s and Instagram services. As part of this change, Meta claims and argued that Meta Ireland was still seeking Ireland informed users that it was altering the legal to rely on user consent as the legal basis for processing basis used to legitimize the processing of their personal their data, contrary to its stated position. The data. Previously, Meta Ireland relied on user consent complainants contended that by making accessibility for processing personal data in relation to the provision to its services conditional upon accepting the of Facebook and Instagram services, including updated Terms of Service, Meta Ireland was effectively behavioral advertising. However, it sought to switch pressuring users to consent to the processing of their to the ”contract” legal basis for most of its processing personal data for behavioral advertising and other activities. personalized services, thereby violating the provisions of the GDPR. In October 2021, the Irish DPA issued a draft decision, which received objections from ten other DPAs. Subsequently, the cases were referred to the European Data Protection Board, which adopted a binding decision on 5 December 2022. The Irish DPA published the final decisions on 11 January 2023. Published: 11.01.2023 Journal number: IN-18-5-5 and IN-18-5-7 Tags: 01 Legal basis and principles of processing, 92