A busy start to the year for the Irish Data Protection Commission

The Data Protection Commission (DPC), the Irish supervisory authority for the EU GDPR, has concluded two of its investigations into the data processing operations of Meta’s Facebook and Instagram services. The final decision delivers two fines totalling €390m, of which €210m relates to Facebook and €180m to Instagram.

In anticipation of the EU GDPR coming into operation (back in 25 May 2018), Meta changed its terms and conditions to permit its processing of users’ personal data and sought to rely on this as a “contract” basis for the processing. Complaints levelled at both Facebook and Instagram, made on the date the EU GDPR came into force, asserted that Meta was forcing users to consent to its processing of their data by otherwise blocking access to the platforms. The DPC’s final decision found that (i) Meta’s processing contravened the transparency and fairness principles under Article 5 EU GDPR, and (ii) following a referral to the European Data Protection Board (“EDPB”) which disagreed with the DPC’s initial draft decision, that Meta could not rely on the above “contract” basis for the lawful processing of data.

Interestingly, the EDPB attempted to direct the DPC to conduct a new investigation across all of the data processing operations of Facebook and Instagram, considering special categories of personal data. The DPC’s statement of 4 January 2023 set out their views that the EDPB does not have a general supervision role akin to national courts and as such is not able to instruct an authority to engage in a speculative investigation. The DPC states that a decision to annul the EDPB’s decision may be appropriate, given what it views as a possible overreach by the EDPB. Meta has also stated that it intends to appeal the DPC ruling, it is likely that this decision will be the subject of further judicial scrutiny.

This fine follows a $725m settlement agreed by Meta in relation to US litigation focusing on its data sharing practices after Cambridge Analytica obtained data for a large number of users.