The EDPB has held its July plenary sessions. It adopted two letters in response to Access Now and BEUC concerning TikTok. It highlighted the swift action taken by the Irish, Italian and Spanish supervisory authorities following TikTok’s announcement that it would no longer seek users’ consent to send personalised advertisements, but that the legal basis for this would be the legitimate interest of TikTok and its partners. As a result of these actions, TikTok announced that it would pause the change in the legal basis used for personalised ads.
In addition, the EDPB adopted a dispute resolution decision under Article 65 GDPR. The binding decision sought to address the lack of consensus on certain aspects of a draft decision issued by the Irish supervisory authority as lead supervisory authority regarding Instagram (Meta Platforms Ireland Limited) and the subsequent objections expressed by some of the concerned supervisory authorities.
The Irish DPC issued the draft decision following an own-volition inquiry into the processing activities of Meta Ireland. Its draft decision concerned Meta Ireland’s compliance with Articles 5(1)(a) and (c), 6(1), 12(1), 13, 24, 25 and 35 of the GDPR regarding certain processing of children’s personal data in the context of Instagram. It especially concerns the public disclosure of email addresses and phone numbers of children using the Instagram business account feature and a public-by-default setting for personal accounts of children on Instagram during a period falling within the temporary scope of the DPC’s inquiry. On 3 December 2021, the DPC shared its draft decision with other supervisory authorities under Article 60(3) GDPR. Several supervisory authorities issued objections under Article 60(4) GDPR concerning, among others, the legal basis for processing and the determination of the fine.
The supervisory authorities were unable to reach consensus on some of the objections, which were then referred to the EDPB by the DPC for determination under Article 65(1)(a) GDPR, thereby initiating the dispute resolution procedure.
The EDPB has now adopted its binding decision. The DPC will adopt its final decision, addressed to the controller, based on the EDPB decision, without undue delay and at the latest one month after the EDPB has notified its decision. The EDPB will publish its decision on its website without undue delay after the DPC has notified their national decision to the controller.
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPBS) have also adopted a Joint Opinion on the Proposal for a Regulation to prevent and combat child sexual abuse.
