{"id":594993,"date":"2023-01-07T05:49:29","date_gmt":"2023-01-07T11:49:29","guid":{"rendered":"https:\/\/news.sellorbuyhomefast.com\/index.php\/2023\/01\/07\/meta-to-appeal-345m-fine-for-facebook-and-instagram-privacy-breaches\/"},"modified":"2023-01-07T05:49:29","modified_gmt":"2023-01-07T11:49:29","slug":"meta-to-appeal-345m-fine-for-facebook-and-instagram-privacy-breaches","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2023\/01\/07\/meta-to-appeal-345m-fine-for-facebook-and-instagram-privacy-breaches\/","title":{"rendered":"Meta to appeal \u00a3345m fine for Facebook and Instagram privacy breaches"},"content":{"rendered":"
\n

Facebook parent firm Meta faces fines totalling \u20ac390m (\u00a3345m), after European regulators found it had been unlawfully processing customers\u2019 personal data to deliver targeted advertising on its Facebook and Instagram social media sites since 2018.<\/p>\n

Ireland\u2019s Data Protection Commission has given the company three months to comply with Europe\u2019s data protection laws after regulators found that Meta\u2019s reliance on a \u201ccontract\u201d with its users to deliver personalised advertising breached Europe\u2019s General Data Protection Regulation (GDPR).<\/p>\n

The decision follows complaints from Noyb, the campaigning group run by Austrian lawyer Max Schrems, which argued Meta had tried to \u201cbypass\u201d the consent requirements of GDPR by making consent a part of its terms and conditions.<\/p>\n

\u201cThis is a huge blow to Meta\u2019s profits in the EU,\u201d he said.<\/p>\n

Meta faces fines of \u20ac210m for breaches by Facebook and \u20ac180m for breaches by Instagram. A third complaint against WhatsApp is expected to lead to further fines this month.<\/p>\n

Facebook said in a statement that it \u201cstrongly disagreed\u201d with the DPC\u2019s decision, and planned to appeal the contents of the rulings and the fines.<\/p>\n

\u201cWe believe we are fully compliant with GDPR by relying on Contractual Necessity\u00a0for behaviour ads given the nature of our services,\u201d it said.<\/p>\n

\n

<\/i>European Data Protection Board intervened<\/h3>\n

Ireland\u2019s DPC was forced to take action against Meta after the European Data Protection Board (EDPB) overturned the DPC\u2019s finding that Meta\u2019s reliance on Contractual Necessity\u00a0to process personal data in Europe is compatible with GDPR.<\/p>\n

In a binding decision on 5 December 2022, the EDPB found that Meta\u2019s use of a contract as a legal basis for processing data was in breach of Article 6 of the GDPR<\/a>, which requires data to be lawfully processed.<\/p>\n

The DPC was required to substantially increase its proposed fines against Facebook and Meta to reflect the more serious nature of the breaches identified by the EDPB.<\/p>\n

Meta Ireland changed its terms of service when the GDPR came into force on 25 May 2018, to allow it to rely on a contract with its users to deliver personalised services and advertising as a legal basis for processing their data under GDPR.<\/p>\n

Facebook and Instagram were required to press \u201cI accept\u201d to agree to the new terms if they wanted to access Facebook and Instagram, according to a statement by the DPC.<\/p>\n<\/section>\n

\n

<\/i>Schrems complaints<\/h3>\n

Noyb filed complaints on the same day, accusing Facebook and Instagram of trying to \u201cbypass\u201d the consent requirements of GDPR.<\/p>\n

According to the complaints, Meta argued that targeted advertisements were part of the service it contractually owes users.<\/p>\n

This went beyond the narrow way that Contractual Necessity\u00a0is normally understood, as well as what was strictly necessary to provide services to users, according to the complaints.<\/p>\n

The complaints argued that Meta was \u201cforcing\u201d users to consent to the processing of their data by making accessibility of its services conditional on accepting Facebook and Instagram\u2019s terms.<\/p>\n

\u201cInstead of having a \u2018yes\/no\u2019 option for personalised ads, they just moved the consent clause into the terms and conditions. This is not just unfair but clearly illegal,\u201d said Schrems in a statement.<\/p>\n

\u201cWe are not aware of any other company that has tried to ignore the GDPR in such an arrogant way,\u201d he added.<\/p>\n<\/section>\n

\n

<\/i>Meta failed obligation to be transparent<\/h3>\n

A draft decision by the DPC found that Meta had failed its obligation to be transparent with its customers about how it processed their data, the purpose of processing their data, and what the legal basis for processing data was.<\/p>\n

The DPC concluded, however, that GDPR did not preclude Meta Ireland\u2019s reliance on a contract as a legal basis for processing users\u2019 data, and did not require Meta to rely on users\u2019 consent.<\/p>\n

Facebook and Instagram services include providing personalised services and personalised advertising to users, Meta said.<\/p>\n

\u201cIn the view of the DPC, this reality is central to the bargain struck between users and their chosen service provider, and forms part of the contract concluded at the point at which users accept the Terms of Service,\u201d it said in a statement.<\/p>\n

Other EU regulators, known as Concerned Supervisory Authorities (CSA), reviewed the DPC\u2019s draft decision as part of the adjudication process.<\/p>\n

They agreed with the DPC that Meta had failed to meet its obligations of transparency, but were unable to reach an agreement with the DPC on the validity of Meta\u2019s contract.<\/p>\n

A total of 10 CSAs argued that Meta should not be allowed to use a contract as a legal basis for processing data on the grounds that the delivery of personalised advertising could not be \u201csaid to be necessary\u201d to fulfil Facebook\u2019s contract with its users.<\/p>\n

Following the consultation process, the DPC referred the disputed points to the EDPB for a final decision.<\/p>\n

The board found that as a matter of principle, Meta Ireland was not entitled to rely on its contract with users as a lawful legal basis for processing personal data for behaviour advertising.<\/p>\n

In its decision on 5 December 2022, the EDPB agreed that Meta Ireland had failed its transparency obligations, and found that in addition it had breached the principle of fairness in processing its customers\u2019 data.<\/p>\n<\/section>\n

\n

<\/i>DPC disputes EDPB order to investigate Facebook and Instagram<\/h3>\n

The DPC said it would challenge a further direction from the EDPB to require it to conduct a fresh investigation into Facebook and Instagram\u2019s data processing operations, focusing on special categories of data.<\/p>\n

The DPC argues that the EDPB does not have the authority to direct national data protection regulators to engage in what it calls an \u201copen-ended and speculative\u201d investigation.<\/p>\n

\u201cThe direction is \u2026 problematic in jurisdictional terms, and does not appear consistent with the structure of the cooperation and consistency arrangements laid down by GDPR,\u201d it said.<\/p>\n

The DPC said it would bring an action for annulment of the EDPB\u2019s direction to launch further investigations into Meta at the European Court of Justice.<\/p>\n<\/section>\n

\n

<\/i>DPC \u2018cooperated\u2019 with Meta<\/h3>\n

Schrems said the DPC and Meta had cooperated with Meta, through a series of 10 confidential meetings, to allow it to use a contract with its users to \u201cbypass\u201d GDPR.<\/p>\n

Documents obtained by Noyb\u00a0under Freedom of Information show that the DPC also attempted to introduce the use of \u201cfreedom to contract<\/a>\u201d provisions in proposed EDPB guidelines that would have benefited Facebook.<\/p>\n

These proposals, made by the DPC, after receiving the complaint from Noyb\u00a0against Meta, were rejected by other data protection authorities.<\/p>\n

Following the DPC\u2019s decision, Meta must now allow users to have versions of Facebook and Instagram that do not use personal data within three months, said Schrems.<\/p>\n

The decision will still allow Meta to use non-personal data, such as the content of a story read by a user to personalise ads, or to give users a \u201cyes\/no\u201d option to consent to advertising, he said.<\/p>\n<\/section>\n

\n

<\/i>Meta to appeal<\/h3>\n

Meta said in a statement that it intends to appeal the DPC\u2019s rulings and the fines.<\/p>\n

The company said it would be assessing a variety of options that would allow it to continue to offer fully personalised services to users.<\/p>\n

It added that suggestions by Schrems and others that personalised ads can no longer be offered by Meta across Europe unless each user\u2019s agreement had first been sought were incorrect.<\/p>\n

A Meta spokesman said: \u201cThese decisions do not prevent targeted or personalised advertising on our platform. The decisions relate only to which legal basis Meta uses when offering certain advertising.\u201d<\/p>\n

The company said in a statement that there had been a lack of regulatory clarity and debate among regulators and policy makers over the legal basis for sharing data for some time, and that cases underway in the EU courts may reach different verdicts.<\/p>\n

\u201cGiven that regulators themselves disagreed with each other on the issue up until the final stages of these processes in December, it is hard to understand how we can be criticised for the approach we have taken to date,\u201d it said.<\/p>\n

\u201cWe believe we fully comply with GDPR by relying on Contractual Necessity for behaviour ads given the nature of our services. As a result, we will appeal the substance of the decision,\u201d it added.<\/p>\n<\/section>\n

\n

<\/i>Legal questions<\/h3>\n

Data protection lawyer Dai Davis said it was not certain that Meta would win an appeal.<\/p>\n

The first question for a court is whether Meta can show it has a contract with users. \u201cThey either have a contractual agreement which says, \u2018We obligate ourselves to send you advertising that we believe from an analysis on your activity on Facebook will be of interest to you\u2019, or they don\u2019t,\u201d he said.<\/p>\n

The contract must also be fair and transparent. \u201cYou have to make clear what the obligations are that you are processing the data for, and that it\u2019s transparent to the user that you are collecting data to comply with the contract,\u201d said Davis.<\/p>\n

If Meta is giving itself the freedom to change its contract with users whenever it wants, that also raises questions about whether the contract is legally binding.<\/p>\n

Eddie Powell, partner and regulatory lawyer at law firm Fladgate, said that decision was \u201cvery bad news for Meta\u201d. \u201cThe DPC was overruled by the EU, which determined that Meta\u2019s practice of forcing users to accept personalised ads as part of the Facebook or Instagram service contract was an additional breach of GDPR,\u201d he said. \u201cAs a result, the DPC has increased its fine against Meta to \u20ac390m.\u201d<\/p>\n

\u201cThe order that Facebook and Instagram users cannot be forced to accept their data being used to serve personalised ads must massively reduce the platforms\u2019 attractiveness to advertisers,\u201d he said. \u201cToo many users are likely, if given a choice, to decline personalised ads.\u201d<\/p>\n

Meta, however, said in a statement that it had a variety of options to lawfully process users\u2019 data other than asking for consent. \u201cThese decisions do not prevent targeted or personalised advertising on our platform,\u201d it said.<\/p>\n<\/section>\n<\/section>\n

Read More<\/a>
\n Marquis Paris<\/p>\n","protected":false},"excerpt":{"rendered":"

Facebook parent firm Meta faces fines totalling \u20ac390m (\u00a3345m), after European regulators found it had been unlawfully processing customers\u2019 personal data to deliver targeted advertising on its Facebook and Instagram social media sites since 2018. Ireland\u2019s Data Protection Commission has given the company three months to comply with Europe\u2019s data protection laws after regulators found<\/p>\n","protected":false},"author":1,"featured_media":594994,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26136,90,46],"tags":[],"class_list":{"0":"post-594993","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-appeal","8":"category-facebook","9":"category-technology"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/594993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/comments?post=594993"}],"version-history":[{"count":0,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/594993\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media\/594994"}],"wp:attachment":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media?parent=594993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/categories?post=594993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/tags?post=594993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}