EDPB Urgent Binding Decision on processing of personal data for behavioural advertising by Meta
The European Data Protection Board (EDPB) has recently made a significant decision that affects Meta Ireland Limited (Meta IE). On October 27, the EDPB adopted an urgent binding decision that instructs the Irish Data Protection Authority (IE DPA) to take final measures against Meta IE within two weeks. This decision was made after a request from the Norwegian Data Protection Authority (NO DPA) to take measures that would have effect throughout the entire European Economic Area (EEA).
The EDPB’s decision includes a ban on the processing of personal data for behavioural advertising across the EEA. This ban, which is based on the legal foundations of contract and legitimate interest, will become effective a week after the IE DPA notifies Meta IE of the final measures. The Irish DPC has already notified Meta about the EDPB’s decision on October 31.
Meta has proposed a consent-based approach as a legal basis for processing data, which was reported on October 30. The Irish DPC, along with the Concerned Supervisory Authorities (CSAs), is currently evaluating this proposal. This is an important development considering the EDPB’s stand on Meta’s data processing for behavioural advertising.
Anu Talus, the EDPB Chair, expressed the board’s position in clear terms. She stated that the EDPB, after careful consideration, found it necessary to instruct the IE DPA to impose an EEA-wide processing ban on Meta IE. She also reminded that the EDPB had clarified in December 2022 that contract is not a suitable legal basis for Meta’s data processing for behavioural advertising. She concluded by urging Meta to comply with the orders and stop unlawful data processing.
