The Norwegian Data Protection Authority (DPA) has requested a binding decision from the European Data Protection Board (EDPB) in the Meta case. In the request, we ask that the Norwegian temporary ban on behavioural advertising on Facebook and Instagram be made permanent and extended to the entire EU/EEA.
Earlier this year, we found that Meta processes personal data for behavioural advertising unlawfully in the context of the Facebook and Instagram services. For this reason, we imposed a ban on the unlawful processing of personal data.
Nonetheless, Meta continues its illegal activities and has not yet complied with our decision.
The Norwegian DPA is only authorised to make a temporary decision in this case. Our decision expires on 3 November.
Therefore, we have asked the EDPB for a binding decision on the matter. We believe that our temporary ban must be made permanent. Furthermore, we believe that the GDPR must be interpreted consistently throughout the EU/EEA, and we ask for the ban to be extended to the rest of Europe.
– Meta continues to process personal data unlawfully throughout the EEA. Referring the matter to the EDPB is the only way to ensure that Meta respects Facebook and Instagram users’ rights, says head of international department Tobias Judin.
The EDPB has confirmed that a decision will be made by 27 October. However, this decision will not become public until it has been sent to all involved parties. This may take some time, and we will post information as soon as it is ready.
Meta disagrees with the referral to the EDPB. The company believes, among other things, that the decision of the Norwegian DPA is invalid and that the DPA does not have a legal basis to request a binding decision from the EDPB. Furthermore, Meta points out that it will soon ask users for consent before using their personal data for behavioural advertising.
– It is uncertain whether and when a valid consent mechanism may be in place. The Norwegian DPA believes that we cannot tolerate illegal activity in the meantime, Judin says.
Before the formal EDPB procedure can start, the EDPB needs to assess the completeness of the file. After the completeness assessment has been finalised, the procedure will commence and the legal deadlines will start to apply. The discussions of the EDPB are confidential.