An exciting case was decided in Oslo at the beginning of September. In July, the Norwegian Data Protection Authority Datatilsynet had banned Meta Ireland and Facebook Norway (hereinafter referred to as Meta) from displaying personalised advertising via its platforms in Norway. Meta had appealed against this and as a result lost before an Oslo district court.
What had happened?
Meta had failed to comply with the previous order of the Norwegian Data Protection Authority not to display behaviour-based advertising on the basis of a „contract“ or „legitimate interest“ (Art. 6 para. 1 b) or Art. 6 para. 1 f) GDPR). The GDPR also applies in Norway, as we have already explained here. Meta was given a deadline in this regard until the beginning of August 2023. As the data processing processes were not changed within the set deadline, the Norwegian Data Protection Authority imposed a joint penalty on Meta Ireland and Facebook Norway on 7 August 2023 on the grounds of joint liability in the amount of 1 million Norwegian kroner (equivalent to approx. 90,000 euros) for each day that the official order was not complied with.
On 10 August 2023, Meta asked the court to review the preliminary injunction.
Background of the dispute
As the Norwegian court summarises in its decision, complaints from the data protection organisation NOYB to the Austrian Data Protection Authority led to the Norwegian Data Protection Authority’s decision in May 2018 (see previous source). The reason for the complaints was data processing for behaviour-based advertising by the Meta services Facebook and Instagram. The complaints were handled by the Irish Data Protection Authority due to Meta’s headquarters in Ireland.
The Irish National Data Protection Commissioner (DPC) processed the complaints as part of the cooperation mechanism pursuant to Art. 60 GDPR and sent draft decisions to the Data Protection Authorities involved. Ultimately, the complaints ended up before the European Data Protection Board (EDPB) as no agreement could be reached, see Art. 65 GDPR.
The EDPB issued a decision on 5 December 2022, summarising that the complaint concerned the question of whether the processing of personal data by Meta Ireland on the basis of „forced consent“ was in breach of the specific provisions of the GDPR and the EU Charter of Fundamental Rights. As a result, the EDPB confirmed the infringement by ruling that behaviour-based advertising could not be based on Art. 6 para. 1 b) GDPR.
This decision was then confirmed by the DPC on 31 December 2022, stating that Meta could not justify behavioural advertising under Art. 6 para. 1 b) GDPR. The Irish Data Protection Authority, which is responsible for the data company’s activities in the European Economic Area (EEA), determined this at the turn of the year and retroactively imposed a fine for the activities via Facebook and Instagram.
This was followed by detailed written arguments, which the Norwegian court summarised in its decision. As Meta subsequently based its data processing on legitimate interest, the ECJ ruled on 4 July 2023 that Art. 6 para. 1 f) GDPR was also not a sufficient legal basis for behaviour-based marketing (see decision C-252/21, para. 116 and 117).
Advertising Ban for Meta in Norway
The Norwegian Data Protection Authority then informed the Irish Data Protection Authority on 14 July 2023, after corresponding communication, that it would take provisional measures in summary proceedings against Meta in the form of a ban on behaviour-based advertising based on Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. Meta was thus provisionally prohibited from continuing to place adverts based on user tracking without their effective consent in Norway. Meta was further informed that the ban would be lifted as soon as the orders had been implemented. Following the court’s summary, Meta then announced its intention to switch the legal basis for its data processing to user consent in future. Please see the Oslo court’s summary for further details.
Among other things, Meta argued in court that the Data Protection Authority’s decision was invalid due to a lack of prior notification and that there was no reason for the authority to make an emergency decision.
The Oslo District Court disagreed and upheld the Norwegian Data Protection Authority’s decision of 14 July 2023 in its entirety.
As a result, this means: No behaviour-based marketing without valid consent!
Here´s what happens next
The Norwegian Data Protection Authority announced in its press release that, in addition to the court proceedings, Meta had filed several administrative complaints against the Norwegian Data Protection Authority’s decision and brought the matter before the European Data Protection Board.
On 3 November 2023, the Norwegian Data Protection Authority announced in a further press release that the European Data Protection Board (EDPB) had decided that the Norwegian ban on behavioural advertising would be permanently extended to the entire EU/EEA.
In its decision, the EDPB instructs the Irish Data Protection Authority to issue a permanent ban within 2 weeks. The Irish authority informed Meta of the EDPB’s urgent binding decision on 31 October.
In its aforementioned press release, the EDPB quotes EDPB Chair Anu Talus as saying:
“After careful consideration, the EDPB considered it necessary to instruct the IE SA to impose an EEA-wide processing ban, addressed to Meta IE. Already in December 2022, the EDPB Binding Decisions clarified that contract is not a suitable legal basis for the processing of personal data carried out by Meta for behavioural advertising. In addition, Meta has been found by the IE SA to not have demonstrated compliance with the orders imposed at the end of last year. It is high time for Meta to bring its processing into compliance and to stop unlawful processing.”
Meta is now faced with the task of establishing an effective legal basis for its data processing. This could take the form of obtaining effective consent from users.
The matter therefore remains exciting and we will report on further progress.
16. November 2023 @ 12:07
I was a regular user of Instagram by Meta and loved all the informational posts by public and private news offices as well as keeping in touch with friends etc.
Last week Meta told me that Consent would be used now and I need to consent or pay a monthly subscription of 12 €.
Apart from the fact that 12 € is very expensive another interesting fact is that Meta also told me that my Consent is already used before I accept to the conditions.
Of what I understand from changing terms & conditions as well as getting consent is that you cannot just take it for granted and give someone the option to pay instead.
The questions I ask myself are:
1. Is 12 € an amount that makes the consent for processing of data freely?
2. Can Meta ask me for Consent or Pay but already process under consent?
I would answer both questions with a no.