The European Data Protection Board (EDPB) has adopted an urgent binding decision on Meta Ireland Ltd’s (Meta’s) processing for behavioural advertising. The decision instructs the Irish Data Protection Commission (IDPC) to impose a ban on Meta in relation to the processing of personal data for behavioural advertising on the legal basis of contract and legitimate interest across the entire European Economic Area (EEA).
For context, EU data protection law requires controllers of personal data (Meta in this case) to identify an appropriate lawful basis in relation to each processing activity. Here, the EDPB determined that the lawful bases of contract and legitimate interest, each of which Meta relied on, were inappropriate in relation to processing for behavioural advertising. Practically, this will mean that Meta will be required to rely on the legal basis of unequivocal and freely given consent in order to undertake behavioural advertising on users going forward.
The decision will become effective one week following notification to Meta, which it is understood took place on 31 October.
The ban follows an earlier similar request from the Norwegian Data Protection Authority.
Ahead of the decision, Meta has announced it will offer users the option of continuing to use Meta’s services for free with ads, or subscribing to stop seeing ads. Where users are subscribed, Meta has confirmed that user information will not be used for advertising. Meta’s announcement can be found here.
Whether the EDPB will regard Meta’s new approach as compliant with EU data protection laws remains to be seen and this is currently being evaluated by the IDPC and other relevant authorities.
The full EDPB press release can be found here.
Beverley Flynn
Guy Cartwright