The Norwegian Data Protection Authority ('NDPA') has taken action to ban Meta from processing personal data for the purposes of behavioural advertising, after the latter purported to change the legal basis for that processing.

After complaints in Ireland from the privacy organisation noyb ('none of your business'), the Irish data protection authority ('DPC') found that Meta could not rely on the contractual basis (Art. 6(1)(b) GDPR) for the processing of personal data for behavioural advertising, and ordered Meta to make its processing compliant with the GDPR.

Meta then purported to rely on legitimate interest (Art. 6(1)(f) GDPR) as the legal basis for its processing. However, in Germany, the Court of Justice found that attempting to rely on Art. 6(1)(f) was also not compliant with the requirements of the GDPR.

Following these two findings, the NDPA raised concerns with the DPC and requested mutual assistance from the DPC under Art. 61(1) GDPR as the lead supervisory authority in Europe for Meta. The NDPA requested that the DPC:

1. Issue a temporary ban on Meta regarding certain processing operations until Meta provided adequate and sufficient commitments to ensure its compliance with Art. 6(1) GDPR; and

2. Share information on how the DPC would ensure and monitor Meta's compliance with Art. 6(1).

The DPC refused to comply with the first request, and, in the opinion of the NDPA, did not provide a sufficient response to the second request, nor any reason for why it was unwilling to provide the requested information.

Accordingly, the NDPA instigated an urgency procedure under Art. 66 GDPR, which allowed the NDPA to issue a temporary ban on Meta and Facebook Norway AS processing personal data for behavioural advertising. This order only applied in Norway and would have lasted for three months, unless Meta demonstrated remedial measures prior to that date. Non-compliance could have led to a fine of NOK 1,000,000 (c. EUR 90,000) per day.

Meta has since capitulated, and will no longer seek to rely on legitimate interest in this context. Rather, throughout the EU, Meta will rely on consent for the purposes of processing personal data for targeted advertising.

Originally published 21 August 2023

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.