Ireland fines Meta with 390 million for the use of personal data of users in Europe

A Meta sign at their Irish headquarters.Brian Lawless - PA Images (PA Images via Getty Images)

Ireland has imposed two fines on Meta, the parent company of Facebook, for the processing of the personal data of its users in Europe since May 2018: one of 210 million euros for the service it provides through the famous social network and another for 180 million for Instagram.

In addition, the Irish data regulator has given the US tech giant three months to adapt to European regulations.

The Dublin decision comes after the council that brings together all European regulators, both those of the EU and those of Norway and Iceland, set their position on these cases and also on WhatsApp, although this decision has been delayed halfway of month.

The Irish ruling is actually tougher than this same regulator had initially anticipated.

The initial draft proposed a penalty between 26 million and 38 million, which has finally been multiplied by 10 without counting, still, the ruling on WhatsApp, the messaging service.

The rectification has come after the regulator in Ireland, where Meta's European headquarters is located, submitted its decision to the review of its European peers and the body that brings them all together, the European Data Protection Board (EDPB, for its acronym in English) and collided with a claim from Norway in 2021. Just a year later the EDPB took its position and that has led to the change of position in Dublin.

Data Protection Commission announces conclusion of two inquiries into Meta Ireland: https://t.co/KvmD9cBQd6 pic.twitter.com/Csj4z2donq

— Data Protection Commission Ireland (@DPCIreland) January 4, 2023

"We are disappointed by these decisions and we intend to appeal both the judgments and the fines," the company said when the decision was made known.

The resistance of Ireland, the country where all the big US technology companies are located, to being tougher with Meta speaks of the fact that it refuses to apply one of the EDPB resolutions.

“He has sought to direct the DPC [acronym for the Irish regulator] to carry out a new investigation covering all of the data processing operations of Facebook and Instagram and to examine the special categories of personal data that may or may not be processed in the context of such operations.

[...].

The order may imply an overreach by the EDPB, the CPD considers it appropriate to file an annulment appeal before the Court of Justice of the EU to request annulment”.

The EDPB welcomes today's CJEU's General Court ruling stating that the action for annulment brought by WhatsApp Ireland Ltd against EDPB binding decision 01/2021 is inadmissible.

Read more about it in our news item available here: https://t.co/H34JBpWl1M pic.twitter.com/wfu2fEc6LY

— EDPB (@EU_EDPB) December 7, 2022

The investigation that has ended, for now, with these two sanctions and the requirement to adapt to the European regulation on data in three months was activated after the complaint of "an Austrian citizen" and another "Belgian".

The complainant is Max Schrems, activist for the protection of personal data in the digital universe and creator of the NGO Noyb, which this Wednesday issued a statement as soon as the final decision was known.

In it, he stresses that “Meta cannot use personal data for advertisements based on an alleged contract.

Users will have to give their consent, otherwise Meta will not be able to use their data for personal ads”, they explain, clarifying the impact of the ruling.

Noyb's reference to the “alleged contract” is important, as the Irish DPC admits.

This same body explains in its statement that its interpretation of the European data protection regulation was different and, therefore, it agreed with Meta that when users give their consent to the use of data, they sign a kind of contract with the company that allowed you to use them to personalize advertising.

“The EDPB took a different view on the 'legal basis' issue, considering that, as a matter of principle, Meta Ireland was not entitled to invoke the 'contractual' legal basis as a legal ground for processing personal data for the purposes of behavioral advertising,” he explains.

In addition to pointing out that the failures are "disappointing", Meta has been quick to point out that the failures known this Wednesday do not imply a ban on personalized advertising.

“The decisions refer only to the legal basis that Meta uses to offer certain advertising.

Advertisers can continue to use our platforms to reach potential customers, grow their business, and create new markets,” she noted.

The company goes so far as to state that “the decisions also do not require the use of consent - [there is] another legal basis available under the GDPR - for this treatment.

The suggestion that Meta can no longer offer personalized ads across Europe unless consent has been previously sought from each user is incorrect.

If the sanction is applied for the use of data that the North American technology company has made since 2018, it is because on May 25 of that year the new European Union regulation on data protection came into force.

To adapt to it, the company began to demand that the users of its applications accept the updated conditions.

Otherwise, the service would not be provided to them.

From then on, Meta interpreted that this acceptance was similar to the conclusion of a contract between it and the user and that from then on, behavioral advertising could be directed at them.

You can follow