The European Data Protection Board has adopted three dispute resolution decisions under Article 65 of the GDPR concerning Meta Platforms Ireland Limited. The EDPB’s binding decisions consider important legal issues arising from the draft decisions of the Irish supervisory authority (DPC) as lead supervisory authority regarding Facebook, Instagram and WhatsApp. The EDPB’s binding decisions play a key role in ensuring the correct and consistent application of the GDPR by the national data protection regulators.
The DPC carried out investigations into the processing activities of the three platforms following complaints. As a result of its investigations, it issued the draft decisions.
The Facebook and Instagram draft decisions relate to the lawfulness and transparency of processing for behavioural advertising. The WhatsApp draft decision involves the lawfulness of processing for the purpose of improving services. Several EU supervisory authorities issued objections about the DPC’s draft decisions concerning, among other matters, the legal basis for processing (Article 6 GDPR), data protection principles (Article 5 GDPR), and the use of corrective measures including fines.
As no consensus was reached on these objections, the EDPB was called upon to settle the issues.
In its binding decisions, the EDPB has addressed the question of whether the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising, for Facebook and Instagram, and for service improvement, for WhatsApp.
The DPC will now adapt its three final decisions, addressed to the controller, to take into account the EDPB binding decisions and its legal assessment. This should happen within one month. Following the DPC announcement, the EDPB will publish its decisions.
