The European Data Protection Board (EPDB) has issued what it describes as an “urgent binding decision” on the processing of personal data by social-media giant Meta.
The board said that, on 27 October, it had instructed Ireland’s Data Protection Commission (DPC) to take final measures on the issue within two weeks.
It wants the DPC to impose a ban on the processing of personal data for behavioural advertising on the legal bases of ‘contract’ and legitimate interest across the entire European Economic Area (EEA).
Some tech companies have previously argued that processing users’ data was necessary for the performance of contracts entered into when users accepted revised terms and conditions.
Consent-based approach
The ban on processing will become effective one week after the notification of the final measures by the DPC to Meta, the parent company of Facebook, WhatsApp, and Instagram. It added that the Irish watchdog had notified Meta on 31 October.
“The EDPB takes note of Meta's proposal to rely on a consent-based approach as legal basis,” it stated, adding that the DPC was currently evaluating this, together with other European data regulators.
EDPB chair Anu Talus said that the body had previously clarified that contract was not a suitable legal basis for the processing of personal data carried out by Meta for behavioural advertising.
“In addition, Meta has been found by the IE SA [DPC] to not have demonstrated compliance with the orders imposed at the end of last year. It is high time for Meta to bring its processing into compliance and to stop unlawful processing,” he concluded.
Subscription
Meta on Wednesday said it had already indicated that it would give users in the EU and the EEA the opportunity to consent, and would offer, in November, a subscription model to comply with regulatory requirements.
"EDPB members have been aware of this plan for weeks and we were already fully engaged with them to arrive at a satisfactory outcome for all parties," said a company spokesperson quoted by the Reuters news agency.
"This development unjustifiably ignores that careful and robust regulatory process."