EDPB's Urgent Binding Decision on the Processing of Personal Data for Behavioral Advertising by Meta

On 1st November 2023, the European Data Protection Board (EDPB) announced an urgent binding decision regarding the processing of personal data for behavioral advertising by Meta.

Key Highlights:

✅ The EDPB has instructed the Irish Data Protection Authority (IE DPA) to take final measures within two weeks regarding Meta Ireland Limited (Meta IE). ✅ A ban on the processing of personal data for behavioral advertising on the legal bases of contract and legitimate interest has been imposed across the entire European Economic Area (EEA). ✅ This decision follows a request from the Norwegian Data Protection Authority (NO DPA) for measures that would have an effect in the entire EEA.

Effective Date: 📅 The ban on processing will become effective one week after the notification of the final measures by the IE SA to the controller.

Meta’s Response: 🔗 Meta was notified of the EDPB’s Urgent Binding Decision on 31/10. They have proposed a consent-based approach as a legal basis, which is currently under evaluation by the Irish DPC and Concerned Supervisory Authorities (CSAs).

Statement from EDPB Chair Anu Talus: 🗣️ “After careful consideration, the EDPB has deemed it necessary to impose an EEA-wide processing ban on Meta IE. The EDPB’s Binding Decisions in December 2022 clarified that contract is not a suitable legal basis for Meta’s behavioral advertising processing. Furthermore, Meta has been found to be non-compliant with orders from the IE SA issued last year. It is imperative for Meta to bring its processing into compliance and cease unlawful processing.”