An Coimisiún um Chosaint Sonraí
Data Protection
Commission
DPC Complaint Ref:
Date: 29 March 2023
Complainant:
Data Controller: Meta Platforms Ireland Limited
RE: / Meta Platforms Ireland Limited
# DECISION
This document is a decision of the Data Protection Commission of Ireland ("DPC") in relation to DPC complaint reference, (hereinafter referred to as the ("Complaint"), submitted by ("Complainant") against Meta Platforms Ireland Limited ("Meta") directly to the DPC.
This decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General Data Protection Regulation ("GDPR").
# Communication of draft decision to "supervisory authorities concerned"
1. In accordance with Article 60(3) of the GDPR, the DPC was obliged to communicate the relevant information and submit a draft decision, in relation to a complaint regarding cross border processing, to the supervisory authorities concerned for their opinion and to take due account of their views.
2. In accordance with its obligation, the DPC transmitted a draft decision in relation to the matter to the "supervisory authorities concerned". As Meta offers services across the EU, and therefore the processing is likely to substantially affect data subjects in every EU member state, the DPC in its role as lead supervisory authority identified that each supervisory authority is a supervisory authority concerned as defined in Article 4(22) of the GDPR. On this basis, the draft decision of the DPC in relation to this complaint was transmitted to each supervisory authority in the EU and EEA for their opinion.
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
# Complaint Handling by the DPC – Timeline and Summary
3. On 4 and 17 September 2019, the Complainant wrote to the DPC outlining how they wished to access personal data, in particular their pictures, related to a disabled Facebook account ("Requested Data"):
"Hi I have a facebook account since more then 10 years, they decide to close my account because they decide I m in violation of facebook rules according to what I read I dont break any rule I claim to get my personnal picture back and this is the answer from facebook For security reasons, we're unable to provide more information on why your account has been disabled. Please note that we can't reinstate your account, and we can't give you access to the Download Your Information tool. In certain limited cases, where an account has been disabled for serious violations of our terms, and where disclosure of account information may create a security risk for other people on Facebook, we reserve the right not to provide users with access to their data. We are entitled to do so under the exemption to section 4 of the Irish Data Protection Acts provided by section 5(1)(a)¹. can you help me to get my personnal file back best regards.."
4. The Complainant stated that they did not know why their Facebook account had been disabled. The Complainant explained how they had contacted Meta in an effort to access the Requested Data. The Complainant made an access request on 13 August 2019. In this request and subsequent messages, the Complainant requested their data and pictures associated with their Facebook account. Meta engaged with the Complainant's request outlining how the Complainant's Facebook account had been disabled due to a violation of Meta's terms of service, that it was unable to provide the reasons for the disablement or access to Meta's "Download Your Information Tool". On 31 August 2019, Meta informed the Complainant that it was entitled to refuse to disclose certain information to Meta users where the disclosure of such information would pose a security risk to others:
"Hi,
Thanks for contacting us.
¹ This appears to be an erroneous reference to an earlier piece of legislation.
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
It appears your Facebook account was permanently disabled for violating Facebook's Terms of Service. You can read our Terms of Service at https://www.facebook.com/terms
For security reasons, we're unable to provide more details about your account at this time. Since the account is disabled, you can't access our self-serve tools to download or access information related to this account.
In certain limited cases, where an account has been disabled for serious violations of our Terms, and where disclosure of account information may create a security risk for other people on Facebook, we reserve the right not to provide users with access to their data. If you wish to contact Facebook about your account being disabled, you can learn how in the Help Center: https://www.facebook.com/help/103873106370583
Please note, we will not take any further action on this request and can't provide any assistance with a request to appeal or reinstate the account.
Thanks"
5. On 23 September 2019, the DPC notified Meta of the Complaint. In an effort to reach an amicable resolution of the Complaint, the DPC asked Meta to provide the Complainant with personal data which would not pose a threat to the rights and freedoms of others:
"Mr [REDACTED] is complaining about Facebook's denial to his Subject Access Request. He supplied 2 pieces of correspondence where his request was denied, quoting the violation of terms of use, where the disclosure may lead to a security risk to others.
It is unclear at this point, if all of the data relating to Mr [REDACTED] carry this risk, or is it possible to provide Mr [REDACTED] with the risk free portion of the data.
If so, would you please inform this office of the reason to deny Mr [REDACTED] the entirety of his data".
6. Meta responded to the DPC on 8 October 2019. Meta confirmed it had disabled the Complainant's account for a serious breach of its terms of service and informed the DPC of its reliance on Article 15(4) of the GDPR in refusing to provide the Complainant with the Requested Data. Meta also provided the DPC with a burner link which the Complainant could use to access "non-sensitive" data related to their Facebook account:
"As noted in previous correspondence with the complainant, our specialist team has confirmed that the complainant's account was disabled for a serious breach of our Terms of Service. (https://www.facebook.com/terms.php). We reserve the right not to
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
provide users with access to data relating to disablements. We are not always able to provide this information to users as such provision could adversely affect the rights and freedoms of others, as set out in Article 15 (4) GDPR. This would include the rights and freedoms of the members of other users...
Furthermore, where an account has been disabled for serious breaches of our Terms of Service, and where disclosure of account information may create a security risk for other users of the Facebook service or the data was being kept for the prevention, detection or investigation of offences, or disclosure would be likely to prejudice the same, we reserve the right not to provide users with access to any of their data.
However, in order to try to resolve this case, if the complainant can provide us with a secure email address, we can send them a burner link with access to the "non-sensitive" data (i.e. data not related to the reason for account disablement nor would it infringe on anyone's rights and freedoms)."
7. On 7 November 2019, Meta wrote to the DPC to confirm it had provided the Complainant with a burner link to access personal data related to their Facebook account which did not pose a security risk to others. The DPC wrote to the Complainant on the same date to ask whether this resolved the Complaint. The Complainant replied on the same date saying that it did not.
8. On 14 November 2019, the DPC received a telephone call from Meta during which Meta revealed the nature of the Complainant's violation (the "Complainant's Violation") of its terms of service. Meta also detailed how the disclosure of the Requested Data sought by the Complainant would infringe on the rights and freedoms of others.
9. On 19 December 2019, the DPC wrote to the Complainant to inform them that the Complaint had been transferred to the DPC's Cross Border Unit for further complaint handling.
10. On 6 February 2020, the DPC wrote to Meta to enquire about the investigatory steps taken by Meta which led to the Complainant's Facebook account being disabled and whether the Complainant had triggered any appeal mechanism in relation to the account disablement:
"In order to progress this complaint, the DPC requests that you take the following steps by 16 February 2020:
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
1. Provide evidence of the investigatory steps taken by Facebook to reach its conclusion that the account should be suspended. Please note, the DPC requires evidence of Facebook's investigation into the account (i.e. a description of the investigatory steps taken), but does not require a copy of any inappropriate conduct, messages or otherwise associated with Mr. [REDACTED]'s account. If Facebook requires any clarification on this point, please do not hesitate to contact us.
2. Confirm whether any appeal mechanism for the decision to deactivate the account was triggered by the Data Subject, and if so, provide further information in relation to a) the appeal process and b) the results of any such appeal."
The deadline for response was subsequently extended.
11. On 24 April 2020, Meta wrote to the DPC and gave a comprehensive explanation of the investigation which led to the Complainant's account disablement. Meta confirmed that the Complainant had unsuccessfully appealed the disablement of their Facebook account. Meta stated that it was relying on Article 15(4) of the GDPR in refusing to provide the Complainant with any additional personal data as it would adversely affect the rights and freedoms of others.
"We note from the outset that, from previous correspondence with the DPC (Case ref: C-19-5-163; Letter dated 23 December 2019) that your office has confirmed that the issue of account disablement for a violation of our terms and policies is outside the scope of the GDPR and will not be considered via the amicable resolution channel.
However, in so far as this assessment is relevant to our reliance conclusion that providing Mr. [G] with access to certain data could endanger the rights and freedoms of others, under Art. 15 (4) GDPR, please find below a general description of the steps taken to disable an account due to this type of activity.
Consistent with our core values, in particular our commitment to giving people a voice, we seek where possible to enable users to remain on the platform. However, we do not allow profiles that persistently or egregiously violate our policies to remain on the platform. We want to educate people who violate other policies and we disable accounts that repeatedly or severely violate our Community Standards. Disabling an account is a serious step, only undertaken in particularly egregious circumstances.
Facebook disables accounts that are found to violate its Community Standards (or other policies). For most types of violations in relation to content, a user will be informed that the relevant piece of content violates our policies and they will have the option to appeal the decision by requesting another review. However, there is a time
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
at which repeated violating behaviour or a very serious type of violating behaviour may warrant an entire profile to be disabled. We continue to evaluate, gather data and iterate upon the policies and thresholds which determine disablement.
Flagged content or behaviour is reviewed by internal Facebook teams against our Community Standards and other applicable Facebook policies.
If the content or action is found to violate our Policies, an action will be taken - be it to remove the content, add a warning screen to the content and to inform the person or, in egregious cases, to disable the account itself.
[...]
Mr. [G]'s account was disabled for a serious breach of our Terms of Service on 22 July, 2019. On the same day, Mr. [REDACTED] appealed against this decision and our specialist team responded that they would begin the review process for his account and requested his ID to confirm that he was the correct account owner. On 23 July, 2019 Mr. [REDACTED]'s provided his ID. In conclusion, on 24 July, 2019 our specialist team finalized their assessment and informed Mr. [REDACTED] that the decision made was that he would not be able to recover his Facebook account and, for security reasons, they would not be able to share additional information on the reasons that led to the deactivation of his account. Please note that we generally do not reinstate accounts which have committed such severe violations in the past.
Please also note that under Section 3.1. of our Facebook Terms of Service, we explain that "you cannot use Facebook if ... we've previously disabled your account for breaches of our Terms or Policies." Pursuant to this section, we reserve the right not to allow Mr. [REDACTED] back on the Facebook service, once Mr. [REDACTED]'s account has been disabled for a serious breach of our policies.
We are satisfied, following a thorough investigation, that we may rely on Article 15(4) GDPR. Given the reason for the disablement of Mr [REDACTED]'s Facebook account, we feel that the disclosure of any additional personal data could adversely affect, and indeed harm, the rights and freedoms of others. This would include the rights and freedoms of the members of our Community Operations team but more importantly, the rights and freedoms of users who may have reported the breach related behaviour and/or have been a victim of it.
We trust the above explanation demonstrates that we have taken appropriate steps to ensure that Mr [REDACTED]'s Facebook account was correctly disabled and the rights and freedoms of others were protected."
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
12. On 3 July 2020, the DPC wrote to the Complainant. The DPC informed the Complainant that it considered Meta's reliance on Article 15(4) in refusing to provide them with the Requested Data was justified. The DPC outlined to the Complainant that, given the thoroughness of the investigation demonstrated by Meta, there was no further action the DPC could take in relation to Meta's decision to disable their account.
13. On 3 July 2020, the Complainant replied to the DPC. The Complainant maintained that they wished to access the Requested Data.
14. On 18 September 2020, the DPC wrote to the Complainant to confirm that they had understood the DPC's position that, given the thoroughness of the review demonstrated by Meta, the DPC considered the Complaint to be fully investigated as this was not apparent from the Complainant's email of 3 July 2020.
15. The DPC did not receive a response from the Complainant to its email of 18 September 2020 until 20 April 2021 after contacting the Complainant to indicate it would be closing the Complaint if no response was received. On 20 April 2021, the Complainant responded to the DPC rejecting the proposed closure of their complaint:
"Hi
once again I m not agree with the decision of facebook
once again I want my picture back
but once again i guess facebook will win
best regards"
16. On 27 September 2021, the DPC provided an update to the Complainant.
17. The DPC prepared a preliminary draft decision which it shared with the Complainant and Meta on 16 December 2021. No substantive comments were received.
18. On 5 January 2022, the DPC wrote to Meta noting that it had additional queries in relation to the Complaint which it wished to include in its preliminary draft decision. The queries related to Meta's investigation and detection process, Meta's appeal process and Meta's identification and balancing of the risks to the rights and freedoms of others pursuant to Article 15(4) GDPR:
"Meta's investigation and detection process
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
1. Please describe each step in the process followed by Meta from initial detection/reporting of behaviour potentially in breach of Meta's Terms of Service (ToS) to the decision to suspend an account. Please provide examples of the information and correspondence provided to data subjects at each stage of the process.
2. In relation to this complaint, please provide a detailed description of each step of the process which led to the suspension of the account of Mr. [REDACTED] (the Data Subject), together with a copy of all correspondence exchanged between the Data Subject and Meta.
# Meta's appeal process
3. Please provide a detailed explanation of the appeal mechanisms available to users that have been suspended from their Meta account.
4. In relation to this complaint, please provide a detailed description of any appeal process engaged in by the Data Subject.
# Meta's identification and balancing of the risks to the rights and freedoms of others pursuant to Article 15(4) GDPR
5. Please provide a description of the personal data that Meta holds in relation to the Data Subject that would form its response if it was not relying on Article 15(4).
6. Please provide a description (to the extent it is different from your response to question 5) of the personal data which is being withheld by Meta on the basis of 15(4) (Withheld Data).
7. Please explain how Meta conducted a balancing test of the rights and freedoms of individuals that may be impacted by the provision of the Withheld Data to the Data Subject.
a. Please identify the individuals Meta considered in making its decision to restrict the right of access of the Data Subject pursuant to Article 15(4) GDPR
b. Please identify the rights, and freedoms of both the Data Subject and the individuals identified in response to (a)
c. Please identify the adverse effects to the identified rights and freedoms of the individuals which would have occurred had the Withheld Data been provided to the Data Subject
d. Please outline how Meta came to the conclusion that in this case the balance rested in favour of those individuals so that it should not share the Withheld Data with the Data Subject
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
8. Please explain how Meta concluded that there was no other means of effectively protecting the rights and freedoms of those individuals identified in its response to question 7 above other than refusing to provide all of the Withheld Data to the Data Subject."
19. On 7 February 2022, Meta wrote to the DPC with a lengthy and substantive response to the DPC's letter of 5 January 2022. The new information provided by Meta is summarised below:
(a) Meta provided a detailed description of the process followed in the detection of violations and enforcement action.
(b) Meta provided a detailed explanation of the review and appeal mechanisms available to users.
(c) Meta provided a detailed description of the process which led to the disablement of the Complainant's account on 22 July 2019 together with a copy of correspondence exchanged between the Complainant and Meta:
"The Complainant's account was disabled on 22 July 2019. The Complainant appealed the account disablement on the same day (that is, 22 July 2019) using the form which is accessible through the Help Center article noted above. The Complainant was notified that his account would be reviewed and a copy of his identification documentation was requested. The Complainant provided this documentation on 23 July 2019. The Complainant's appeal (which was subject to human review) was denied on 24 July 2019. The Complainant was informed on 24 July 2019 that their appeal was denied and that this decision was final.
Please note, at all times, in accordance with Article 15 GDPR, individuals are able to submit a request to access their personal data to Meta Ireland; however, the extent of personal data made available in response to such requests from individuals whose accounts have been disabled will vary subject to the proper application of Article 15(4) GDPR."
(d) The Complainant appealed the decision by Meta to disable their account. The Complainant's appeal (which was subject to human review) was denied on 24 July 2019 and that decision was final.
(e) Meta is withholding, to the extent this information in fact constitutes personal data of the Complainant, the following information:
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
"Notwithstanding its view that its approach has been fully compliant with its obligations under Article 15 GDPR to-date, Meta Ireland has conducted an extensive internal review of this matter, taking into account the recent draft guidance issued by the European Data Protection Board on the right of access, and in an effort to resolve this matter on an exceptional basis. As part of this review, Meta Ireland's specialist teams have undertaken a further detailed analysis of the Complainant's personal data associated with his account to determine the categories of data that are disclosable without adversely affecting the rights and freedoms of others (as explained below).
Following the detailed and exceptional analysis undertaken by Meta Ireland's specialist teams, given the serious nature of the Complainant's violation, Meta Ireland will, to the extent this information in fact constitutes his personal data, withhold from the Complainant on the basis of Article 15(4) GDPR information that would adversely affect the rights and freedoms of others (including [..the person or persons ...] affected by the Complainant's violation of Meta Ireland's Policies) should it be disclosed, including: (i) the precise reasons for the Complainant's account being disabled; (ii) the [...content...] flagged and found to be in violation of Meta Ireland's Policies; (iii) images and videos uploaded by the Complainant to the Facebook service and saved by the Complainant on the Facebook service and his interactions with other content and individuals across the Facebook service; (iv) contact information uploaded by the Complainant to the Facebook service; (v) the Complainant's Facebook friends and followers information; (vi) the Complainant's Facebook group and pages memberships; (vii) information on how the [...offending content was...] flagged for review against Meta Ireland's Policies; and (viii) certain details relating to the assessment by the personnel within Meta Ireland who were responsible for reviewing and sanctioning the disablement of the Complainant's Facebook account (the "Withheld Data")."
(f) In conducting a balancing test of the rights and freedoms of individuals that may be impacted by the provision of the Withheld Data to the Complainant, Meta considered the rights of the following individuals: the Complainant, their victim or victims, Meta, its personnel and affiliated companies including those personnel involved in the investigation of the matter and their ultimate account disablement, other users of the platform and the wider public:
"Meta Ireland has genuine concerns with respect to the adversarial risks associated with disclosing data such as that included within the Withheld Data (for instance, information with greater specificity regarding the reasons for account disablement and other information associated with the Complainant's account). These concerns are particularly acute in circumstances such as those at-issue in the present matter where disclosure of the offending content and/or information
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection Commission
associated with the disablement of the Complainant's account could: (i) prejudice any on-going law enforcement investigations; (ii) amount to a criminal offence; and (iii) create a risk for, and adversely affect the rights and freedoms of,[...the victim or victims of the Complainant...]
The provision of the Withheld Data may also enable the identification of others including [...any person...] affected by their behaviour which places such individuals at potential risk of retaliation. With respect to the type of violation of its Policies at-issue in this matter, Meta Ireland considers it entirely reasonable not to disclose the Withheld Data, including specific details of the reasons for account disablement, to the Complainant as part of its efforts to mitigate the risk of the Complainant seeking to retaliate against [...the victim or victims of the Complainant...] on or outside of the Facebook service, and/or seeking to regain access to the Facebook service and engaging in similar behaviour in the future but in a manner that may not be detected or flagged by Meta Ireland's systems. This approach is essential to protect [...the victim or victims of the Complainant...] and others from similar behaviour...
In reviewing the Complainant's request for additional information following the disablement of his account for such a severe violation of Meta Ireland's Policies, Meta Ireland considered the risks to the rights and freedoms of others, including the real risk of retaliation against [...the victim or victims of the Complainant...] and the risk of exposing [...the victim or victims of the Complainant...] to continued abuse both online and in real-world scenarios. The risk of retaliation by the Complainant against personnel within Meta Ireland who were responsible for investigating the Complainant's violations and sanctioning the disablement of his account is also recognised."
(g) In conducting a balancing test of the rights and freedoms of individuals that may be impacted by the provision of the Withheld Data to the Complainant, Meta's consideration included the following rights:
1. The rights of the victim or victims of the Complainant: the victim or victims of the Complainant "have a right to a good and safe experience on the Facebook service, not being subject to behaviour and/or content from other users in violation of Meta Ireland's Policies. [...The victim or victims of the Complainant have...] the right to feel safe from reprisal and retaliation from the Complainant and/or the Complainant's associates following Meta Ireland's enforcement action against the Complainant [...]."
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
II. The rights of other users of the Facebook service: “other users of the Facebook service have a right to a good and safe experience on the Facebook service, not being subject to behaviour and/or content from other users in violation of Meta’s policies”.
III. The rights of Meta and Meta’s personnel: “Meta Ireland’s rights and interests to enforce its Policies and provide a safe and secure experience to all users, and limit the impact that violating behaviour has on its platforms [...]. Meta “has a right to enforce its Policies and disable accounts that violate its Policies so as to safeguard the reputation of its business and the products and services it offers to the public at large and also to protect users and the public from being exposed to such content online. Meta Ireland’s personnel also have a right to perform their roles without fear of reprisal or retaliation from users aggrieved at the decisions taken for violations of Meta Ireland’s policies”.
(h) In identifying the adverse effects to the identified rights and freedoms of the individuals which would have occurred had the Withheld Data been provided to the Complainant, Meta’s consideration was as follows:
a. with respect to the victim or victims of the Complainant:
“disclosure of the Withheld Data would adversely affect the rights and freedoms of [...the victim or victims of the Complainant...] by placing them at risk of retaliation and/or reprisal from the Complainant and undermining their confidence in accessing the Facebook service free from receipt of correspondence that violates Meta Ireland’s Policies. In particular, providing the Complainant with access to [... the offending content...] and details of the Complainant’s friends and followers, creates a real risk of the Complainant seeking to make further contact with his [..victim or victims...] and/or direct others to do so, thereby placing the safety and wellbeing of [...the victim or victims of the Complainant...] at risk. Indeed, such a risk was apparent when the Complainant created a new account on the day following the disablement of his account in question for the reasons described above. It is also not possible for Meta Ireland to know whether information such as the contact details uploaded by the Complainant, and the list of his friends and followers includes details of other victims and/or potential victims of the Complainant. The [...confidence of the victim or victims of the Complainant...] in safe access to, and use of, the Facebook service would be undermined should the Withheld Data be provided to the Complainant. For instance, providing the Complainant with access to
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
information regarding the precise reasons for disablement of his account could cause the Complainant to incorrectly conclude that his behaviour was reported by his [...victim or victims...], which creates a risk of retaliation and reprisal for [...the victim or victims of the Complainant...]. The [...victim or victims of the Complainant have ...] a right to feel safe from reprisal and retaliation following the action taken by Meta Ireland against the Complainant's account. Disclosure of the Withheld Data to the Complainant could also facilitate continued abuse of [...the victim or victims of the Complainant...] (both online and in real-world scenarios).
Furthermore, based on context and information known to the Complainant and that could not be known to Meta Ireland, and in light of the severity of the Complainant's violation of Meta Ireland's Policies, there is a risk that disclosure of the Withheld Data used in combination with this context and information that is known to the Complainant and not known to Meta Ireland, could result in [...the victim or victims of the Complainant...] being subject to further exploitation. For instance, information such as the Complainant's friends and followers, the pages and/or groups in respect of which he was associated, uploaded contact information, saved and uploaded images and videos, and his interactions with content on the Facebook service, could be used by the Complainant to commit and/or support the commission by others of further acts that would endanger the safety and wellbeing of [...the victim or victims of the Complainant...].
As such, and to mitigate against these risks and adverse effects on the rights and freedoms of [...the victim or victims of the Complainant...], it is Meta Ireland's position that it may withhold disclosure of information in accordance with Article 15(4) GDPR.";
b. similar arguments to those set out in paragraph a. above were made with respect to "other users of the Facebook service";
c. with respect to Meta's personnel, Meta contended that its personnel have a right to perform their roles without fear of reprisal or retaliation from users aggrieved at the decisions taken for violations of Meta's policies:
"Therefore, disclosure of Withheld Data which includes information on the Meta Ireland personnel who reviewed and/or sanctioned action against the Complainant's account would adversely affect the rights and freedoms of such individuals as it would create a risk of retaliation and/or reprisal by the Complainant and/or the Complainant's associates."
d. with respect to Meta and its affiliate companies, "disclosure of the specific reasons for the disablement of the Complainant's account would adversely affect Meta Ireland's right [...] to enforce its Policies. Disclosure [of the Withheld Data] would also adversely affect Meta Ireland's efforts to provide
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
a safe and secure service to all [Facebook users ...] and to limit the impact of violating behaviour[...]. Disclosure of the Withheld Data [...] may [...] prejudice the effective application of Meta Ireland's Policies [..] by allowing the Complainant to understand how Meta Ireland determines violations and therefore how to adjust their behaviour slightly so as to avoid their account being actioned and share such information with others."
(i) In conducting a balancing test of the rights and freedoms of individuals that may be impacted by the provision of the Withheld Data to the Complainant, Meta is concerned that "disclosure of the offending content and/or information associated with the disablement of the Complainant's account could [...] create a risk for, and adversely affect the rights and freedoms of others". Meta also fears that should it provide greater detail on the account disablement that it would enable the Complainant to adjust their behaviour, should they ever regain access to the platform, to avoid enforcement action in the future - and share such information with others. Indeed, on the day following the disablement of the Complainant's account, the Complainant created a new account on the Facebook service which was disabled once discovered. Meta also fears retaliation against [...the victim or victims of the Complainant...], its personnel as well as other users of its platform from similar behaviour. Considering the nature and severity of the Complainant's Violation, Meta contends it reasonable to conclude that the balance in this matter rests in favour of others whose rights and freedoms would be adversely affected should the Complainant be granted access to the Withheld Data.
(j) In concluding that there was no means of effectively protecting the rights and freedoms of others other than by withholding the Withheld Data, given the nature of the Withheld Data and the nature and severity of the Complainant's Violation, Meta contends that there would be no practical way to share redacted and/or summary versions of the Withheld Data that would not adversely affect the rights and freedoms of others. Meta states that "providing the Complainant with details of the precise reasons for the Complainant's account being disabled, and/or information associated with the Complainant's account being disabled (without any information concerning [...the victim or victims of the Complainant...]), could lead to retaliation against [the victim or victims of the Complainant] outside the Facebook service. To adequately protect the rights and freedoms of [...the victim or victims of the Complainant...], other users of the Facebook service and the wider public, Meta Ireland considers that it would only be possible to disclose entirely redacted information, and as such, it is reasonable for Meta Ireland not to disclose information in such a format to the Complainant... Meta Ireland cannot know the wider context and body of information known to the Complainant relating to his violation of Meta Ireland's Policies, beyond that which is contained within the Withheld Data. As the Complainant's account was disabled for a severe violation
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
of Meta Ireland's Policies and placed the safety and wellbeing of [...others...] at risk, Meta Ireland considers it reasonable not to disclose the Withheld Data on the basis that such information, in combination with other information known to the Complainant, could lead to the perpetuation of harm against [...the victim or victims of the Complainant...] outside of the Facebook service and put others at risk. Meta Ireland considers the risks associated with disclosure of the Withheld Data to be particularly acute in the context of this matter. [...] Meta Ireland does not consider that there would be a manner in which it could provide the Complainant with access to the Withheld Data (including information such as the Complainant's friends and followers, his correspondence with other users, the pages and/or groups in respect of which he was associated, the Meta Ireland personnel responsible for sanctioning the disablement of his account, uploaded contact information, saved and uploaded images and videos, his interactions with content on and off the Facebook service, and whether it was a user who reported the Complainant's content) without adversely affecting the rights and freedoms of others [...]. Meta Ireland cannot know the wider context and body of information known to the Complainant relating to his violation of Meta Ireland's Policies, beyond that which is contained within the Withheld Data. As the Complainant's account was disabled for a severe violation of Meta Ireland's Policies and placed the safety and wellbeing of [...others...] at risk, Meta Ireland considers it reasonable not to disclose the Withheld Data on the basis that such information, in combination with other information known to the Complainant, could lead to the perpetuation of harm against [...the victim or victims of the Complainant...] outside of the Facebook service and put others at risk. Meta Ireland considers the risks associated with disclosure of the Withheld Data to be particularly acute in the context of this matter."
20. On 10 February 2022, the DPC informed the Complainant that a revised preliminary draft decision would be issued with additional new information received by the DPC in the course of its investigation of the Complaint.
21. On 5 May 2022, Meta again made available to the Complainant by download link all personal data other than the Withheld Data. On 16 May 2022, the Complainant again indicated that they were not satisfied with the data provided.
# Notification of the Revised Preliminary Draft Decision to Meta
22. The DPC prepared a revised preliminary draft decision which it provided to Meta on 11 December 2022. The DPC requested that Meta provide submissions in relation to the content of the revised preliminary draft decision by close of business on 26 December
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
2022. On 27 December 2022, Meta stated that it would not be making submissions on the revised preliminary draft decision. However it did raise a concern on some sections of the revised preliminary draft decision on confidentiality grounds. The DPC considered the concern raised by Meta and addressed it by making some minor amendments to the sections concerned. The DPC circulated the amended revised preliminary draft decision to Meta on 12 January 2023.
# Notification of the Revised Preliminary Draft Decision to the Complainant
23. The DPC provided the revised preliminary draft decision to the Complainant on 19 January 2023. The DPC requested that the Complainant provide submissions in relation to the content of the revised preliminary draft decision by close of business on 2 February 2023. The Complainant offered the following response on 31 January 2023:
"Once again facebook says that I have violated some rules but they dont say witch one and dont provide any proof of this violation
If the police stop me and say that I m guildy they have to prove it , so why it sdifferent with facebook , are they above the law ????
Anyway i dont ask to reopen my account , i just want to get back the personnal pictures that I have on my account , why is it so difficult for them to understand that?"
24. The DPC carefully considered the Complainant's submission in making the draft decision.
25. Having transmitted the draft decision on 14 February 2023 to the "supervisory authorities concerned" in accordance with Article 60(3) of the GDPR, the DPC received no relevant and reasoned objections in relation to the draft decision.
# Applicable Law
26. For the purposes of its examination and assessment of this complaint, the DPC has considered the following Articles of the GDPR:
a. Article 15 provides for an individual's right of access. Article 15(3) states that "The controller shall provide a copy of the personal data undergoing processing". Article 15(4) states that "the right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others".
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
b. Article 4(2) defines processing as "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment of combination, restriction, erasure or destruction".
c. Article 12(3) states that "The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request."
d. Recital (63) outlines how "A data subject should have the right of access to personal data...that right should not adversely affect the rights or freedoms of others".
# Findings
# Issue A: Was Meta correct to rely on Article 15(4) in refusing to provide the Complainant with Withheld Data?
27. Article 15 of the GDPR provides for an individual's right of access to personal data which has been collected concerning him or her and also outlines the information that should be provided to a data subject who makes an access request. The provision of such personal data is subject to the limitation in Article 15(4) of the GDPR, which outlines how this right should not "adversely affect the rights and freedoms of others".
28. According to Meta, the Complainant had their Facebook account disabled due to behaviour which constituted an egregious violation of Meta's terms of service. The Complainant made an access request for the Requested Data. Having initially withheld all data, on the intervention of the DPC, Meta provided the Complainant with a copy of the data related to their disabled Facebook account excluding the Withheld Data. Meta relied on Article 15(4) of the GDPR in refusing to provide the Complainant with the Withheld Data.
29. Meta:
a. provided to the DPC details of the nature of the Complainant's Violation;
b. detailed the nature of the Withheld Data;
c. identified the other parties whose rights and freedoms would be adversely affected by the provision of the Withheld Data;
d. identified the rights and freedoms of those other parties which would be adversely affected; and
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection Commission
e. detailed the balancing test carried out in reaching its decision to withhold the Withheld Data.
30. Having been provided with a, b, c, and d above, the DPC is satisfied that if the Complainant is provided with access to, or a copy of, the Withheld Data in response to their access request, the rights and freedoms of others will be adversely affected:
a. There is a real risk that the provision of the Withheld Data could enable the Complainant to identify the victim or victims of the Complainant and put them at risk of being subjected to further potential engagements in violation of Meta's terms of service.
b. There is a real risk that the provision of the Withheld Data to the Complainant would adversely affect the rights and freedoms of all other Meta users as it would enable the Complainant to alter their behaviour to avoid detection of any future violations of Meta's terms of service. Such risk is particularly acute in this case in light of the nature of the Complainant's Violation and the fact the Complainant sought to regain access to the platform shortly after their account was disabled.
c. The provision of the Withheld Data to the Complainant would adversely affect Meta's personnel as it could put them at risk of retaliation for the decisions taken for violations by the Complainant of Meta's policies.
31. The DPC is of the opinion that there was no practical way in which the Withheld Data could be provided to the Complainant in a redacted form. All of the Withheld Data would have to be redacted in order to protect the rights and freedoms of others pursuant to Article 15(4). As explained by Meta:
"[I]n the context of this matter and considering the nature and severity of the Complainant's violation of Meta Ireland's Policies, Meta Ireland is satisfied that there would be no practical way to share redacted and/or summary versions of the Withheld Data that would not adversely affect the rights and freedoms of others. For instance, with respect to each aspect of the Withheld Data (and to the extent that such information comprises the Complainant's personal data):
Meta Ireland does not consider that there would be a manner in which it could provide details of the precise reasons for the Complainant's account being disabled, and/or information associated with the Complainant's account being disabled which does not prejudice the effective application of Meta Ireland's Policies and protocols. Any additional information, including in the form of a summary, would potentially allow the Complainant to understand precisely how Meta Ireland determines violations that
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection Commission
merit disablement and therefore how to adjust his behaviour in the future so as to avoid any new account that he attempts to create from being actioned (the Complainant may also seek to share such information with others, which increases the risk of harm to users of the Facebook service). Meta Ireland considered there to be a real risk of such an outcome (i.e., attempted circumvention of enforcement action) in this instance, particularly given the Complainant created a new account the day following his disablement from the Facebook service (which account was suspended and ultimately deleted from the Facebook service). Furthermore, providing the Complainant with details of the precise reasons for the Complainant's account being disabled, and/or information associated with the Complainant's account being disabled (without any information concerning the Complainant's victim/s), could lead to retaliation against the Complainant's victim/s outside the Facebook service. To adequately protect the rights and freedoms of the Complainant's victim/s, other users of the Facebook service and the wider public, Meta Ireland considers that it would only be possible to disclose entirely redacted information, and as such, it is reasonable for Meta Ireland not to disclose information in such a format to the Complainant...
Meta Ireland does not consider that there would be a manner in which it could provide information regarding the Meta Ireland personnel responsible for taking action against the Complainant's account without adversely affecting the rights and freedoms of those individuals, particularly the right to perform their roles without fear of reprisal or retaliation from users aggrieved at the decisions taken for violations of Meta Ireland's Policies. To adequately protect the rights and freedoms of such individuals, Meta Ireland considers that it would only be possible to disclose entirely redacted information, and as such, it is reasonable for Meta Ireland not to disclose information in such a format to the Complainant.
Considering the severity of the Complainant's violation of Meta Ireland's Policies, and the risks to [...the victim or victims of the Complainant...] and others which have been detailed above, Meta Ireland does not consider that there would be a manner in which it could provide the Complainant with access to the Withheld Data (including information such as the Complainant's friends and followers, his correspondence with other users, the pages and/or groups in respect of which he was associated, the Meta Ireland personnel responsible for sanctioning the disablement of his account, uploaded contact information, saved and uploaded images and videos, his interactions with content on and off the Facebook service, and whether it was a user who reported the Complainant's content) without adversely affecting the rights and freedoms of others[...]. Meta Ireland cannot know the wider context and body of information known to the Complainant relating to his violation of Meta Ireland's Policies, beyond that which is contained within the Withheld Data. As the Complainant's account was disabled for a severe violation of Meta Ireland's Policies and placed the safety and wellbeing of [...others...] at risk, Meta Ireland considers it
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection Commission
reasonable not to disclose the Withheld Data on the basis that such information, in combination with other information known to the Complainant, could lead to the perpetuation of harm against [...the victim or victims of the Complainant...] outside of the Facebook service and put others at risk. Meta Ireland considers the risks associated with disclosure of the Withheld Data to be particularly acute in the context of this [violation]. As such, and in an effort to safeguard the [...the victim or victims of the Complainant...] and others from being exposed to behaviour and/or content similar to that for which the Complainant's account was disabled, Meta Ireland considers that it would only be possible to disclose entirely redacted information, and as such, it is reasonable for Meta Ireland not to disclose information in such a format to the Complainant."
32. Taking into account the likelihood and severity of possible risks to the rights and freedoms of others, in particular the victim or victims of the Complainant's Violation, which would arise in disclosing the Withheld Data to the Complainant, the DPC finds that Meta was correct to conclude that it may rely on Article 15(4) to withhold the Withheld Data in these circumstances.
# Issue B: Was Meta's decision to withhold the Withheld Data from the Complainant in its response to the Complainant's access request the result of a comprehensive investigation?
33. Meta has the sole ability to determine who can and cannot use its service on the basis of a defined set of terms and policies which it determined the Complainant breached. Although outside the scope of the applicability of Article 15(4) to the Complainant's access request, based on the information provided by Meta, the DPC notes the following:
a. Meta has a comprehensive set of terms and policies governing the use of its service. These outline how decisions to place restrictions on accounts in violation of its terms of service are made.
b. Data subjects are informed of and agree to these terms and policies when joining the Facebook platform.
c. Data subjects are informed if they post content in violation of these terms and policies. The process which Meta engages in to detect violations, inform data subjects of such violations and restrict accounts accordingly was detailed to the DPC by Meta and is robust:
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
"Potentially violating content can be reported by other users or detected by technology deployed by Meta Ireland.
Meta Ireland's technology detects and removes a significant proportion of violating content before anyone reports it. In addition to automatic removal of violating content, Meta Ireland's technology may also send potentially violating content to review teams to manually check and take action, as appropriate.
Flagged and detected content or behaviour is reviewed against Meta Ireland's Policies. If the content or action is found to violate Meta Ireland's Policies, an action will be taken and the user will be informed - be it to remove the content, add a warning screen to the content, impose restrictions on the user's access to and use of features on the Facebook service or, in egregious cases, to disable the account itself.
Meta Ireland informs users when something they post violates its Policies... and that it's been removed from the Facebook service. Users are typically notified by a notice appearing in their News Feed when they log in to the Facebook app. Users can also find this notice in their "Support Inbox" on the Facebook service.
Meta Ireland endeavors to reference which part of its Policies a user has violated when content is removed, and provide a brief description of why it did not allow the content, so that the user can avoid having other content removed in the future. Meta Ireland also typically provides an appeal option at this stage...
In some cases - and as is applicable to the Complainant in the context of this matter – a violation may be severe enough that the relevant account is disabled after one occurrence... The possibility of disablement in such circumstances is clearly explained to users in the Transparency Center and Meta Ireland's Terms of Service"
d. Meta provided the DPC with a comprehensive summary of its appeals process:
"If a user's Facebook account has been disabled, the user will see a message notifying them that their account is disabled when they try to log in ... Meta Ireland also informs the user whether they can request another review of the disablement, if the user believes the account was disabled by mistake...
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um Chosaint Sonraí
Data Protection Commission
The Complainant's account was disabled on 22 July 2019. The Complainant appealed the account disablement on the same day (that is, 22 July 2019) using the form which is accessible through the Help Center... The Complainant was notified that his account would be reviewed and a copy of his identification documentation was requested. The Complainant provided this documentation on 23 July 2019. The Complainant's appeal (which was subject to human review) was denied on 24 July 2019. The Complainant was informed on 24 July 2019 that their appeal was denied and that this decision was final."
34. The DPC is satisfied that Meta's investigation and subsequent disablement of the Complainant's Facebook account was conducted in a proper manner. Meta engaged in a robust investigatory process in line with fair procedures. The decision to disable the Complainant's account was not automated. Meta has the sole ability to determine who can and cannot use its service on the basis of a defined set of terms and policies, including its terms of service which it determined the Complainant breached.
35. The DPC determines that Meta's refusal to provide the Complainant with the Withheld Data was the result of a comprehensive investigation which included an appeal mechanism. Therefore, the DPC considers Meta's decision to be the result of a fair process.
# Decision on Infringement of GDPR
36. The DPC considers Meta's reliance on Article 15(4) was correct. Therefore, the DPC is of the opinion that Meta did not infringe the GDPR by withholding from the Complainant the Withheld Data in its response to the Complainant's access request made pursuant to Article 15(1) of the GDPR.
37. The DPC therefore dismisses this complaint, pursuant to Section 113(2)(a) of the Act and Article 57(1)(f) of the GDPR.
# Decision on Corrective Powers
38. In light of the above finding of no infringement, the DPC considers that no corrective powers need to be exercised against Meta in respect of this case.
# Judicial Remedies With Respect to Decision of the DPC
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
39. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court may be taken by a data subject or any other person (this includes a data controller) affected by a legally binding decision of the DPC within 28 days of receipt of notification of such decision. An appeal may also be taken by a data controller within 28 days of notification; under Section 150(1) against the issuing of an enforcement notice and/or information notice by the DPC against the data controller; and under Section 142, against any imposition upon it of an administrative fine by the DPC.
Deputy Commissioner
On behalf of the Data Protection Commission
An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100
1
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]
[Non-Text]