Norway’s data protection authority, the Datatilsynet, scored a significant win in favor of user data rights when an Oslo District Court rejected Meta’s bid to lift an injunction on its non-consensual behavioral ad targeting. Meta’s continued defiance of the ban has resulted in accruing daily fines, which, since August 14th, already exceed $2 million. Despite this setback, Meta is yet to confirm whether they will appeal the decision to a higher court.
Following a much-anticipated judgement by the EU’s top court, the CJEU, in July, Meta announced their “intention” to shift towards a consent-based model for their targeted advertising. However, without a clear timeline provided for this transition, the Norwegian DPA asserts that Meta’s unlawful data processing continues unabated. As such, the emergency ban was issued to mitigate ongoing violations of user data protection.
Ireland’s DPC, which leads GDPR oversight for Meta, has been notably slower to respond compared to its Norwegian counterpart. The DPC is currently focused on evaluating Meta’s future “consent process,” seemingly overlooking ongoing instances of unlawful processing that Norway’s ban order targets. The Datatilsynet confirmed that they have been in contact with the DPC regarding these issues.
The Datatilsynet is now “intensely assessing” the possibility of referring the matter to the European Data Protection Board (EDPB) for a binding decision that would apply across the EU. As the spokesman for the Datatilsynet points out, surveillance-based advertising is not just a Norwegian problem – it’s a European one.