The Irish Data Protection Commission has announced that its inquiry into Meta Platforms Ireland Limited (Instagram) has concluded. The DPC has imposed a fine of €405 million and a range of corrective measures.
The inquiry concerned the processing of personal data relating to child users of the Instagram social networking service. It was initiated by the DPC on 21 September 2020 in response to information provided by David Stier (a US data scientist). It also considered issues identified by the DPC itself, following examination of the Instagram user registration process. The inquiry examined, in particular, the public disclosure of email addresses and/or phone numbers of children using the Instagram business account feature and a public-by-default setting for personal Instagram accounts of children.
Following a comprehensive investigation, the DPC submitted a draft decision to other data protection regulators in the EU under Article 60 of the GDPR in December 2021. Six of the other national regulators raised objections to the DPC’s draft decision. The DPC was unable to reach consensus with them about the objections and so referred the case to the European Data Protection Board in accordance with the Article 65 dispute resolution process of the GDPR.
On 28 July 2022, the EDPB adopted its binding decision, which rejected some of the other regulators’ objections. However, it did require the DPC to amend its draft decision to include a finding of infringement of Article 6(1) GDPR and to reassess its proposed administrative fines because of this additional infringement.
Having incorporated these amendments, the DPC’s decision was adopted on 2 September, 2022. The decision records findings of infringement of Articles 5(1)(a), 5(1)(c), 6(1), 12(1), 24, 25(1), 25(2) and 35(1) of the GDPR.
The DPC’s original draft decision had recommended a fine of up to €405 million and, having taken account of the EDPB’s binding decision, the fine imposed on Meta Platforms Ireland Limited (Instagram) totals €405 million, including a fine of €20 million for the infringement of Article 6(1).>/p>
In addition to these administrative fines, the DPC has also imposed a reprimand and an order requiring Meta Platforms Ireland Limited to bring its processing into compliance by taking a range of specified remedial actions.
The EDPB has also published its decision.
