The European Data Protection Board (EDPB), comprising EU data protection regulators, has enforced a conclusive ruling preventing Meta’s platforms from using personal data for behavioural advertising. Norway implemented a temporary three-month ban on Meta-owned platforms that utilised comprehensive user profiling for behavioural advertising. Despite the restrictions, Facebook and Instagram continued their operations in Norway during this period. The decision was influenced by the EU data protection laws that prohibit certain advertising practices based on user profiling. In response to the lack of action on privacy breaches, Norway started imposing a daily fine of one million Norwegian kroner, equivalent to approximately $98,000. Before facing restrictions, Facebook and Instagram could handle publicly shared personal data such as a user’s bio, location, gender, age, or interests, as long as the user explicitly provided this information. The GDPR’s reach spans all 27 EU countries and three additional European Economic Area nations: Iceland, Liechtenstein, and Norway. Temporary measures, lasting up to three months, can be implemented by national privacy regulators, but they must notify both the EDPB and the European Commission. The relevant authority is anticipated to formally request an urgent prohibition from the EDPB, providing reasons for the necessity of such intervention.
The EDPB’s decision is a response to the plea from the Norwegian Data Protection Authority for a ban across the EEA, replacing the temporary national prohibition.
Additionally, the Board determined that the Irish Data Protection Authority (IE DPA) failed to respond to a mutual assistance request from the Norwegian Data Protection Authority (NO DPA) within the prescribed timeframe of the GDPR. This further emphasises the imperative nature of taking immediate action.
Anu Talus, the Chair of the European Data Protection Board (EDPB), highlighted that the Board’s rulings have unambiguously stated that employing contracts as a legal foundation for processing personal data for behavioural advertising by Meta is unsuitable.
The Board emphasised the need for prompt and conclusive actions instead of temporary national prohibitions to address the significant and potentially irreversible infringement on individuals’ data rights.