Yesterday on 17 July 2023, the Norwegian Data Protection Authority announced its ban of 3 months from 4 August to 4 November 2023 on Facebook and Instagram behavioural advertising using the surveillance and profiling of users.
Image by Reinhard-Karl Üblacker from Pixabay
Confirmation of illegal behavioural advertising
In the announcement, the Norwegian DPA referred to the Irish Data Protection Commission’s decisions of 31 December 2022 and to the Judgement of the Court of Justice of the EU (CJEU) in case C-252/21 Meta Platforms and others of 4 July 2023. In detail, the Irish DPA concluded that Meta could not rely on Art. 6(1)(b) GDPR to process personal data for the purpose of behavioural advertising in the context of its services.
According to the Court, “the personalised advertising by which the online social network Facebook finances its activity, cannot justify, as a legitimate interest pursued by Meta Platforms Ireland, the processing of the data at issue, in the absence of the data subject’s consent”. Furthermore, although the dominant position of these platforms “on the social network market does not prevent its users from validly giving their consent” under the GDPR, to the processing of their personal data by Meta, it causes a clear imbalance between the data subjects and controllers which is “an important factor in determining whether the consent was in fact validly and, in particular, freely given”.
https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-07/cp230113en.pdf
Datatilsynet Urgent and Provisional Measures
Despite the response of the Irish DPA that there is no potential course of action suggested if its final assessment finds that Meta failed to comply with Irish DPA’s previous decision. Based on Art. 58(2)(f) and 66(1) of the GDPR, the Norwegian DPA adopted provisional measures towards Meta since it considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects. Accordingly, the order applied with respect to data subjects in Norway and remains valid provisionally for 3 months (4 August – 3 November 2023). Nonetheless, the ban will be lifted if the platforms’ remedial measures are adequate and sufficient to ensure compliance with Article 6(1) and 21 GDPR can be provided.
More news on AstraIA Gear: https://www.astraiagear.com/category/news
Further discussion or weekly newsletter – follow me on Linkedin. For more short news, follow our LinkedIn Page, cheers!