Davranışsal Reklamda Sözleşmeye Dayalı Veri İşleme

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

In the matter of the General Data Protection Regulation

DPC Inquiry Reference: IN-18-5-5

In the matter of LB, a complainant, concerning a complaint directed against Meta Platforms Ireland
Limited (formerly Facebook Ireland Limited) in respect of the Facebook Service

Decision of the Data Protection Commission made pursuant to Section 113 of the Data Protection Act,
2018 and Articles 60 and 65 of the General Data Protection Regulation

Further to a complaint-based inquiry commenced pursuant to Section 110 of the Data Protection Act,
2018

DECISION

Decision-Maker for the Commission:

Helen Dixon
________________________________

Commissioner for Data Protection

Dated the 31st day of December 2022

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland
1. INTRODUCTION AND PROCEDURAL BACKGROUND

PURPOSE OF THIS DOCUMENT

1.1 This document is the Decision (“the Decision”) of the Data Protection Commission (“the Commission”),
made in accordance with Section 113 of the Data Protection Act, 2018 (“the 2018 Act”), arising
from an inquiry conducted by the Commission, pursuant to Section 110 of the 2018 Act (“the
Inquiry”).

1.2 The Inquiry, which commenced on 20 August 2018, examined whether Meta Platforms Ireland Limited
(formerly Facebook Ireland Limited) (“Facebook”) complied with its obligations under the EU
General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of
the Council) (“the GDPR”) in respect of the subject matter of a complaint made by Ms. L.B. (“the
Complainant”). While Facebook Ireland Limited has since changed its name to Meta Platforms
Ireland Limited, with effect from 5 January 2022, the relevant events, for the purpose of the
Inquiry, occurred prior to this name change. In the circumstances, the term “Facebook” is used
throughout this Decision to denote Meta Platforms Ireland Limited, the company formerly known
as Facebook Ireland Limited. Similarly, Facebook, Inc. changed its name to Meta Platforms, Inc.
on 28 October 2021 and any references, within this Decision, to “Facebook, Inc.” should be
understood as meaning Meta Platforms, Inc., the company formerly known as Facebook, Inc.

1.3 The complaint was referred to the Commission by the Austrian Data Protection Authority, Die
Österreichische Datenschutzbehörde (“the Austrian DPA“) on 30 May 2018 (“the Complaint“). In
advance of the preparation of this Decision, a preliminary draft of this document (“the Preliminary
Draft Decision”) was circulated to Facebook and the Complainant’s representative so as to enable
them to make submissions on my provisional findings. The submissions of these parties have been
taken into account in finalising this Decision.

1.4 This Decision further reflects the binding decision that was made by the European Data Protection
Board (the “Board” or, otherwise, the “EDPB”) pursuant to Article 65(2) of the GDPR 1 (the “Article
65 Decision”), which directed changes to certain of the positions reflected in the draft decision
that was presented by the Commission for the purposes of Article 60 of the GDPR (the “Draft
Decision”), as detailed further below. The Article 65 Decision will be published on the website of
the Board, in accordance with Article 65(5) of the GDPR, and a copy of same is attached at Schedule
2 to this Decision.

1
Binding Decision 3/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its
Facebook service (Art. 65 GDPR), adopted on 5 December 2022
2

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

1.5 Further details of procedural matters and a chronology pertaining to the Inquiry are set out in Schedule
1 to this Decision.

2. FACTUAL BACKGROUND AND THE COMPLAINT

FACTUAL BACKGROUND

2.1 Facebook is an online social network and social media platform. In order to access the Facebook
platform, a prospective user must create a Facebook account. To create a Facebook account, a
prospective user is required to accept a series of terms and conditions, referred to by Facebook as
their Terms of Service (the “Terms of Service”). When a prospective user accepts the Terms of
Service, the terms contained therein constitute a contract between the (new) user and Facebook.
It is only on acceptance of the Terms of Service that the individual becomes a registered Facebook
user.

2.2 In April 2018, Facebook updated the Terms of Service to give effect to changes it sought to implement
to comply with the obligations which would arise when the GDPR became applicable from 25 May
2018. Among the obligations under the GDPR, as under Directive 95/46/EC, was the fundamental
requirement that data controllers have a lawful basis for any processing of personal data they
undertake. Legal bases provided for in the GDPR include consent of the data subject, necessity for
the purposes of the performance of a contract with the data subject or processing necessary for
the purposes of the legitimate interests of the data controller. In addition, under the GDPR,
controllers are required to provide detailed information to users at the time personal data is
obtained in relation to the purposes of any data processing and the legal basis for any such
processing. In essence, there must be a legal basis for each processing operation (of personal data)
and there must be transparency in the communication of such information to individual users.
Prior to the GDPR taking legal effect, no detailed requirement existed for a controller to explicitly
state what legal basis they relied on in processing particular categories of personal data.

2.3 To continue to access the Facebook platform, all users were required to accept the updated Terms of
Service prior to 25 May 2018. The updated Terms of Service were brought to the attention of
existing Facebook users by way of a series of information notices and options on the Facebook
platform, referred to as an “engagement flow” or “user flow”. The engagement flow was designed
to guide users through the processing of deciding whether to accept the updated Terms of Service.
The option to accept the updated “terms” was presented to users at the final stage of the
engagement flow. The final stage of the engagement flow also contained embedded hyperlinks to
the full text of the Terms of Service, the Data Policy and the Cookies Policy. As referenced in the
full text of the Terms of Service, the Data Policy provides information to users on Facebook’s
processing of personal data in respect of the Facebook platform.

2.4 Existing users who were not willing to accept the new terms were advised of the option to delete their
Facebook account. Such users were informed that they could no longer use the Facebook platform
3

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

without accepting the new terms. Prior to deletion of the account, the users were also informed
of the option to download a copy of their personal data which had undergone processing by
Facebook.

2.5 Users who did continue through the new “engagement flow” were given the opportunity to consent
or not to consent to a number of specific data processing activities, including the use of facial
recognition. Provision of consent for such processing was not presented as a prerequisite for
continuing to use the service. In other words, these were choices the user could make above and
beyond the decision to sign up to the service, and users are free to use the service without
providing consent to this processing.

2.6 Figures 2.1 and 2.2, below, are screenshots of the final stage of the “engagement flow” which brought
an existing user, the Complainant, through the process of accepting the updated Terms of Service.
The screenshots are in German; an English translation can be found below.

Figure 2.1

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Figure: 2.2

2.7 An English translation (via machine-translation) of the text is as follows:

Figure 2.1: “Please accept our updated Terms of Service to continue using Facebook. We have
updated our Terms of Service to explain in more detail how our service works and what we expect
from all Facebook uses. You can now more easily control your data as well as your privacy and
security settings in the settings. We have also updated our Data Policy and our Cookie Policy. These
now also take into account new features that we are working on and explaining. By clicking "I
agree", you accept the updated Terms of Service. If you do not want to accept the terms of use,
you can find your options under this link.”

Figure 2.2: “If you do not agree, you can no longer use Facebook. You can delete your account and
have the option to download a copy of your information beforehand. Close/Delete Account”.

OVERVIEW OF THE COMPLAINT

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

2.8 The Complaint was made in the context of Facebook’s updated Terms of Service and the requirement
for existing users to accept the new terms to continue to access the Facebook platform.

2.9 In respect of the updated Terms of Service, the Complainant alleges that she was given a binary choice:
either accept the Terms of Service and the associated Data Policy by selecting the “accept”
button, 2 or delete her Facebook account. The Complainant’s argument is predicated on the Data
Policy being incorporated into the Terms of Service. This claim is disputed by Facebook. 3 The
Complainant further alleges that Facebook relied on “forced consent” to process personal data on
the basis that “the controller required the data subject to agree to the entire privacy policy and the
new terms”4 and did not give users a genuine choice to decline the updated terms without
suffering detriment.

2.10 In addition, the Complainant alleges that it is unclear which specific legal basis is being relied on by
the controller for each processing operation. Indeed, she argues that “[i]t remains, nevertheless,
unclear which exact processing operations the controller chooses to base on each specific legal
basis” 4 as “[t]he controller simply lists all six bases for lawful processing under Article 6 of the GDPR
in its privacy policy without stating exactly which legal basis the controller relies upon for each
specific processing operation.” 5 In connection with this, the Complainant expresses particular
concern with reliance on Article 6(1)(b) GDPR as a legal basis for the processing operations detailed
in the Terms of Services; extracts from the Terms of Service which relate to these processing
operations are found below.

2.11 As the GDPR requires controllers to provide detailed information to users at the time when personal
data are obtained, including the provision of information about the purposes of the processing as
well as the legal bases for the processing, the Complainant argues that this lack of information
breaches the transparency obligations in the GDPR. 6

2.12 In the submissions on the Preliminary Draft Decision made on the Complainant’s behalf, it is argued
that the Commission has “failed to investigate the relevant facts”. 7 As far as it has been possible
to discern from the submissions, it appears that this assertion is linked to the Complainant’s
contention that the Commission has misconstrued the scope of the Complaint and/or failed to
carry out particular acts or investigative steps that the Complainant has demanded of the

2
For completeness, it should be noted that Facebook disputes the claim that the Data Policy is part of the Terms of
Service.
3
Facebook Submissions on Draft Report, paragraph 7.1(A)
4
Complaint, page 3.
4
Ibid.
5
For completeness, it should be noted that the legal bases for processing of personal data include consent of the
data subject, necessity based on the requirement to fulfil a contract with the data subject or processing based on
the legitimate interests of the data controller. There is no hierarchy as between these legal bases set down in the
GDPR.
6
Ibid, page 6 and paragraph 2.3.4.
7
Complainant Submissions on Preliminary Draft Decision, paragraph 4.1.
6

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Commission. I address this submission in the consideration of the scope of the Complaint below
and in Schedule 1 to this Decision. In reality, the essential facts relevant to this Complaint are
simple and not in dispute; it is the legal assessment of these facts under the GDPR that requires
determination in this Complaint.

2.13 The sections of the Terms of Service that relate to the data processing complained of are as
follows:

“Our Services:

Our mission is to give people the power to build community and bring the world closer
together. To help advance this mission, we provide the Products and services described
below to you:

Provide a personalized experience for you:
Your experience on Facebook is unlike anyone else's: from the posts,
stories, events, ads, and other content you see in News Feed or our video
platform to the Pages you follow and other features you might use, such
as Trending, Marketplace, and search. We use the data we have - for
example, about the connections you make, the choices and settings you
select, and what you share and do on and off our Products - to
personalize your experience.

Connect you with people and organizations you care about: We help
you find and connect with people, groups, businesses, organizations, and
others that matter to you across the Facebook Products you use. We use
the data we have to make suggestions for you and others - for example,
groups to join, events to attend, Pages to follow or send a message to,
shows to watch, and people you may want to become friends with.
Stronger ties make for better communities, and we believe our services
are most useful when people are connected to people, groups, and
organizations they care about.

Empower you to express yourself and communicate about what matters to you:
There are many ways to express yourself on Facebook and to communicate with
friends, family, and others about what matters to you - for example, sharing
status updates, photos, videos, and stories across the Facebook Products you use,
sending messages to a friend or several
people, creating events or groups, or adding content to your profile. We also have
developed, and continue to explore, new ways for people to use technology, such as
augmented reality and 360 video to create and share more expressive and engaging
content on Facebook.

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Help you discover content, products, and services that may interest you:
We show you ads, offers, and other sponsored content to help you
discover content, products, and services that are offered by the many
businesses and organizations that use Facebook and other Facebook
Products. Our partners pay us to show their content to you, and we
design our services so that the sponsored content you see is as relevant
and useful to you as everything else you see on our Products.

Combat harmful conduct and protect and support our community:
People will only build community on Facebook if they feel safe. We
employ dedicated teams around the world and develop advanced
technical systems to detect misuse of our Products, harmful conduct
towards others, and situations where we may be able to help support or
protect our community. If we learn of content or conduct like this, we will
take appropriate action - for example, offering help, removing content,
blocking access to certain features, disabling an account, or contacting
law enforcement. We share data with other Facebook Companies when
we detect misuse or harmful conduct by someone using one of our
Products.

Use and develop advanced technologies to provide safe and functional
services for everyone:
We use and develop advanced technologies - such as artificial
intelligence, machine learning systems, and augmented reality - so that
people can use our Products safely regardless of physical ability or
geographic location. For example, technology like this helps people who
have visual impairments understand what or who is in photos or videos
shared on Facebook or Instagram. We also build sophisticated network
and communication technology to help more people connect to the
internet in areas with limited access. And we develop automated systems
to improve our ability to detect and remove abusive and dangerous
activity that may harm our community and the integrity of our Products.

Research ways to make our services better:
We engage in research and collaborate with others to improve our
Products. One way we do this is by analyzing the data we have and
understanding how people use our Products. You can learn more about
some of our research efforts.

Provide consistent and seamless experiences across the Facebook Company Products:
Our Products help you find and connect with people, groups, businesses, organizations,

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

and others that are important to you. We design our systems so that your experience is
consistent and seamless across the different Facebook Company Products that you use.
For example, we use data about the people you engage with on Facebook to make it
easier for you to connect with them on Instagram or Messenger, and we enable you to
communicate with a business you follow on Facebook through Messenger.

Enable global access to our services:
To operate our global service, we need to store and distribute content
and data in our data centers and systems around the world, including
outside your country of residence. This infrastructure may be operated or
controlled by Facebook, Inc., Facebook Ireland Limited, or its affiliates

……………………….

How do we use your information

We use the information we have (subject to choices you make) as described below and to
provide and support the Facebook Products and related services described in the Facebook
Terms and Instagram Terms. Here's how:

Provide, personalize and improve our Products.
We use the information we have to deliver our Products, including to
personalize features and content (including your News Feed, Instagram
Feed, Instagram Stories and ads) and make suggestions for you (such as
groups or events you may be interested in or topics you may want to
follow) on and off our Products. To create personalized Products that are
unique and relevant to you, we use your connections, preferences,
interests and activities based on the data we collect and learn from you
and others (including any data with special protections you choose to
provide where you have given your explicit consent); how you use and
interact with our Products; and the people, places, or things you're
connected to and interested in on and off our Products. Learn more about
how we use information about you to personalize your Facebook and
Instagram experience, including features, content and recommendations
in Facebook Products; you can also learn more about how we choose the
ads that you see.

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

you follow on Instagram or communicate with using Messenger. We
can also make your experience more seamless, for example, by
automatically filling in your registration information (such as your
phone number) from one Facebook Product when you sign up for an
account on a different Product.

• Location-related information: We use location-related information such
as your current location, where you live, the places you like to go, and
the businesses and people you're near-to provide, personalize and
improve our Products, including ads, for you and others. Location
related information can be based on things like precise device location
(if you've allowed us to collect it), IP addresses, and information from
your and others' use of Facebook Products (such as check-ins or events
you attend).

• Product research and development: We use the information we have to
develop, test and improve our Products, including by conducting
surveys and research, and testing and troubleshooting new products
and features.

• Face recognition: If you have it turned on, we use face recognition
technology to recognize you in photos, videos and camera experiences.
The face-recognition templates we create are data with special
protections under EU law. Learn more about how we use face
recognition technology, or control our use of this technology in
Facebook Settings. If we introduce face-recognition technology to your
Instagram experience, we will let you know first, and you will have
control over whether we use this technology for you.

• Ads and other sponsored content: We use the information we have
about you-including information about your interests, actions and
connections-to select and personalize ads, offers and other sponsored
content that we show you. Learn more about how we select and
personalize ads, and your choices over the data we use to select ads
and other sponsored content for you in the Facebook Settings and
Instagram Settings.

Provide measurement, analytics, and other business services.
We use the information we have (including your activity off our Products,
such as the websites you visit and ads you see) to help advertisers and
other partners measure the effectiveness and distribution of their ads
and services, and understand the types of people who use their services
10

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

and how people interact with their websites, apps, and services. Learn
how we share information with these partners.

Promote safety, integrity and security.
We use the information we have to verify accounts and activity, combat
harmful conduct, detect and prevent spam and other bad experiences,
maintain the integrity of our Products, and promote safety and security
on and off of Facebook Products. For example, we use data we have to
investigate suspicious activity or violations of our terms or policies, or to
detect when someone needs help. To learn more, visit the Facebook
Security Help Center and Instagram Security Tips.

Communicate with you.
We use the information we have to send you marketing communications,
communicate with you about our Products, and let you know about our
policies and terms. We also use your information to respond to you when
you contact us.

Research and innovate for social good.
We use the information we have (including from research partners we
collaborate with) to conduct and support research and innovation on
topics of general social welfare, technological advancement, public
interest, health and well-being. For example, we analyze information we
have about migration patterns during crises to aid relief efforts. Learn
more about our research programs.”

SCOPE OF THE COMPLAINT

2.14 I have carried out my assessment of the scope of the Complaint to the extent that it relates to specified
data processing and specified alleged infringements of the GDPR. A chronology of issues that arose
in this regard (1) as between the parties and (2) as between the parties and the Commission in the
course of establishing the substantive scope of the Complaint is included in Schedule 1. Also
included in Schedule 1 are details of the approach I have adopted in determining the scope of the
Complaint. In determining the precise parameters of the scope of the Complaint, I have had regard
to the Complaint as a whole and, in particular, have taken note of the express statements in the
Complaint which define its scope. I have also had regard to the Investigator’s analysis in respect of
the scope of the Complaint.

2.15 On his assessment of the Complaint, the Investigator concluded that there were four key issues to be
analysed in the context of his Inquiry: 8

8
Final Report, paragraph 7.
11

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

a. Whether clicking “accept” on the Terms of Service was to be construed as an act of
consent, or must be an act of consent, to the processing of personal data for the purposes
of the GDPR – the Investigator’s conclusions 1 and 2 of the Final Report address this issue

b. Whether Facebook could rely on Article 6(1)(b) GDPR as a lawful basis for processing
personal data with respect to its Terms of Service – the Investigator’s conclusion 3 of the
Final Report addresses this issue

c. Whether Facebook misrepresented the legal basis for processing in a manner that caused
the Complainant to believe that consent was relied upon – the Investigator’s conclusions
4 and 10 of the Final Report address this issue

d. Whether Facebook had failed to provide the necessary information regarding its legal
basis for processing in connection with its Terms of Service and Data Policy – the
Investigator’s conclusions 5, 6, 7, 8 and 9 of the Final Report address this issue

2.16 I agree with the Investigator’s summary of the core issues in respect of issues (a) and (b).
In respect of issues (c) and (d), however, I take a different view.

2.17 Issue (c), as identified by the Investigator, solely addresses the allegation that Facebook
has misrepresented the lawful basis relied on in connection with the Terms of Service. I
agree that this issue falls within the scope of the Complaint. Issue (d), however, was
treated by the Investigator as a generalised assessment of whether Facebook’s Data Policy
complies with Article 13(1)(c) GDPR as a whole with regard to processing conducted on
foot of Article 6(1)(b) GDPR. This is based on the fact that the Complaint states, in
generalised terms, that:

“It remains, nevertheless, unclear which exact processing operations the controller chooses
to base on each specific legal basis under Article 6 and Article 9 of the GDPR.

The controller simply lists all six bases for lawful processing under Article 6 of the GDPR in
its privacy policy without stating exactly which legal basis the controller relies upon for
each specific processing operation.” 9

2.18 It is on that basis that the Investigator interpreted the scope of the Complaint as
comprising the allegation that the Data Policy breaches Article 13(1)(c) GDPR. It is crucial,
however, to view the above quotation in the context of the subsequent statement which
says:

9
Complaint, paragraph 1.3.
12

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

“In any case, the controller required the data subject to “agree” to the entire privacy policy
and to the new terms.

This leads to our preliminary assumption, that all processing operations described therein
are based on consent, or that the controller at least led the data subject to believe that all
these processing operations are (also) based on Article 6(1)(a) and/or 9(2)(a) of the
GDPR.” 10

2.19 I do not accept that the factual question of whether Facebook “misled” the data subject
(i.e. issue (c)) is a separate legal question from whether Facebook complied with its
transparency obligations in the context of processing allegedly carried out pursuant to
Article 6(1)(b) GDPR (i.e. issue (d)). There is no distinct legal issue raised by the question
whether, as a matter of fact, the Complainant did or did not believe that the processing
was based on Article 6(1)(a) GDPR (i.e. consent) and not on Article 6(1)(b) GDPR (i.e.
necessity for the performance of a contract). If Facebook has breached its transparency
obligations, it logically follows that the Complainant will have been unlawfully “misled”,
whether deliberately or otherwise. If Facebook has complied with its transparency
obligations, it cannot be the case that the Complainant was unlawfully misled. On that
basis, my view is that issues (c) and (d) are essentially concerned with the same issue.

2.20 In the submissions on the Preliminary Draft Decision, the Complainant’s representative
argues that the questions answered by the Preliminary Draft Decision do “not even come
close” to covering all aspects of the Complaint. 11 However, it is clear, as set out herein and
in Schedule 1, that this Complaint is limited to allegedly unlawful processing carried out
on foot of the “agreement” i.e. the acceptance of the Terms of Service, and the extent to
which the nature of that agreement was misleading. I therefore do not accept that the
questions addressed in the Preliminary Draft Decision do not cover all aspects of the
Complaint.

2.21 The Complainant’s submissions on the Preliminary Draft Decision further argue that there
has been a failure to investigate the relevant facts. It is argued that there is a fundamental
disagreement as to whether the agreement the Complainant has accepted is “a contract”
or “a consent”. 12 This issue was dealt with extensively in the Preliminary Draft Decision
and is determined below in this Decision.

2.22 While the Complainant’s submissions on the Preliminary Draft Decision call for the
Commission to engage in a thorough investigation as to the nature of this agreement,
having regard to the scope of the Complaint, this is, in my view, entirely unnecessary and
would not divulge any new Information or serve a useful purpose at this stage. As is set

10
Ibid page 3.
11
Complainant Submissions on Preliminary Draft Decision, paragraph 4.2.
12
Ibid, paragraph 4.3.1.
13

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

out in Section 3 below, there is no dispute in relation to the fact that there is a contract
between Facebook and the Complainant or the fact no consent within the meaning of the
GDPR has been provided by the Complainant in concluding the “agreement” in dispute.
What is in dispute, as set out in detail in this Decision and in Schedule 1, is the lawfulness
of the personal data processing and the transparency of the information provided.

2.23 Following the circulation of the Draft Decision to the supervisory authorities concerned for
the purpose of enabling them to express their views in accordance with Article 60(3) GDPR,
the supervisory authorities of Austria, Germany, France, the Netherlands and Portugal
raised objections in relation to the Commission’s assessment of the scope of the
Complaint, as summarised above.

Having considered those objections, the EDPB determined, at paragraph 197 of the Article 65
Decision, that the inquiry underpinning this Decision ought to have included an examination of
“[Facebook’s] processing operations, the categories of data processed (including to identify
special categories of personal data that may be processed), and the purposes they serve”.
Accordingly, the EDPB directed, at paragraph 198 of the Article 65 Decision, the Commission
to commence a new inquiry into these matters. While that direction cannot be addressed by
the Commission in this Decision, the Commission considers it necessary to note the position,
in light of the Commission’s assessment of the scope of the Complaint (as already recorded
above) and for the purpose of ensuring compliance with its obligation, pursuant to Article 65(6)
GDPR, to adopt its final decision on the basis of the Article 65 Decision. The EDPB further
directed the Commission to remove its proposed conclusion on Finding 1 (as set out in the
Draft Decision). That aspect of matters is addressed at the conclusion of the Commission’s
assessment of Issue 1, below.

2.24 On the basis of the above, the issues that will be addressed in this Decision are as follows:

• Issue 1 – Whether clicking on the “accept” button constitutes or must be considered consent
for the purposes of the GDPR

• Issue 2 – Reliance on Article 6(1)(b) as a lawful basis for personal data processing

• Issue 3 – Whether Facebook provided the requisite information on the legal basis for
processing on foot of Article 6(1)(b) GDPR and whether it did so in a transparent manner.

3 ISSUE 1 – WHETHER CLICKING ON THE “ACCEPT” BUTTON CONSTITUTES OR MUST BE CONSENT FOR THE PURPOSES OF
THE GDPR

WHETHER THE ACCEPTANCE IS CONSENT

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

3.1 As I have outlined in Section 2, the Complainant alleges that clicking on the “accept” button of the
engagement flow presented to existing users in respect of Facebook’s updated Terms of Service in
April 2018 constituted an act of consent by the data subject for the purposes of Article 6(1)(a)
GDPR. The first question to be considered is whether Facebook, via the updated Terms of Service,
sought to obtain the Complainant’s “consent” for the purposes of processing of personal data
under those Terms of Service. Facebook’s position, as noted above, is that it did not.

3.2 In this regard, I note that the Complainant’s position partly rests on several arguments to the effect
that the design of the engagement flow is “deceptive”. 13 The Complainant expresses particular
concerns in respect of the final stage of the engagement flow and alleges that the acceptance
process is set out in a misleading manner, such that a reasonable user would, and indeed the
Complainant did in fact, believe that they are consenting for the purposes of Article 6 GDPR to
data processing rather than simply signing up to a contract. 14 These arguments in relation to the
alleged misleading nature of the user engagement flow will be considered as part of Issue 3 in the
context of transparency requirements. This first issue is solely concerned with whether reliance is
placed on the legal basis of consent.

3.3 In this context, I will first consider whether, as a matter of fact, Facebook sought to rely on consent at
all as a legal basis. I will subsequently assess whether, as a matter of law, Facebook was obliged to
seek consent as a legal basis for processing, as the Complainant argues.

3.4 In its submissions on the Draft Report made to the Investigator, the Complainant argues that the “scope
of application” of consent and the “conditions of validity” under the GDPR must be distinguished.
The Complainant further argues that the “scope” of consent is any “expression of will by which the
data subject indicates his consent to the processing of his personal data". 15 The “conditions of
validity” are, in the Complainant’s view, the elements of the definition of consent set out in Article
4(11) GDPR. The Complainant further argues that “[t]o come up with the crazy idea that a violation
of the conditions of consent automatically leads to the inapplicability of these conditions is a legal
shot in the foot.” 16 The Complainant’s position is that there are some circumstances in which only
consent - and no other legal basis - is applicable, and therefore that there are circumstances where
consent must be applicable even if the data controller is not seeking to rely on consent and the
definition in Article 4(11) GDPR is not met. In the Complainant’s view, this should result in a
declaration that the data processing based on consent is unlawful for want of compliance with
these “conditions of validity”.

13
Complainant Submissions on Final Report, page 16.
14
Ibid, page 11.
15
Ibid, page 40.
16
Ibid.
15

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

3.5 Facebook’s position is that “[t]he agreement to enter into a contract is a wholly separate matter to any
form of consent to data processing…”, 17 and that:

“Article 4(11) GDPR is not relevant in this instance as Facebook Ireland is not seeking to
rely on it (and the alternative legal basis sought to be relied on is valid). It is not the case
that all types of processing must be assessed against the formal requirements under Article
4(11) GDPR. Indeed as the Draft Report acknowledges, consent is merely one of six possible
bases upon which data processing may be legitimised under Article 6 GDPR. It is Facebook
Ireland’s position that an assessment against the formal requirements under Article 4(11)
is only necessary and should only be undertaken where a controller purports to rely on
consent. Put another way, where the controller relies on a different legal basis for a
processing purpose, the analysis as to whether or not the processing is lawful should be
undertaken in respect of the specific requirements for only that legal basis.”

3.6 In light of this confirmation by the data controller that it does not seek to rely on consent in this context,
there can be no dispute that, as a matter of fact, Facebook is not relying on consent as the lawful
basis for the processing complained of. It has nonetheless been argued on the Complainant’s
behalf that Facebook must rely on consent, and that Facebook led the Complainant to believe that
it was relying on consent. It should be acknowledged that Facebook relies on consent for some
personal data processing activities on the platform, which users can provide or not provide
through mechanisms distinct from the initial accepting of the Terms of Service.

3.7 The Investigator expressed the view that:

“…while the GDPR specifies that certain well-defined agreements as to processing (i.e.
consent, as defined by the conditions set out in Article 4(11)) may legitimise processing
under Article 6(1)(a), it does not expressly require that all agreements regarding processing
must be legitimised on this basis.”19

3.8 Article 4 GDPR, as its title makes clear, sets out a series of definitions applicable under the GDPR as a
whole. Article 4(11) GDPR merely defines consent for the purposes of the GDPR, including for
the purpose of Article 6(1)(a) GDPR and Article 7 GDPR which sets out certain conditions for
consent where it is being relied upon as the legal basis of processing. Article 4(11) GDPR does not,
however, purport to determine the circumstances in which consent may be relied upon as a legal
basis. While consent for the purposes of the GDPR must satisfy the definition in Article 4(11) GDPR,
that provision does not in itself determine the circumstances in which consent may be relied upon
as a legal basis for processing. Any other reading of Article 4(11) GDPR is not consistent with a
systematic reading of the GDPR when it is clear that the legislator intended Article 4 GDPR to
provide definitions. Other definitions, such as that of “controller”, “processor”, “main
establishment” and “cross-border processing” are clearly just that: definitions. In any event, I am

17
Submission 22 February 2019, paragraph 2.6.
19
Final Report, paragraph 129.
16

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

of the view that, in the context of this Complaint, this issue is an academic one. The key point for
the purpose of this Decision is that Facebook never sought to obtain consent from users through
the clicking of “accept” to the Terms of Service.

3.9 I put the views set out above to the Parties in the Preliminary Draft Decision. Facebook submitted that
“the Complainant’s position is legally and factually wrong” and that Facebook “…does not seek to
obtain consent to data processing from users when users are asked to contractually agree to its
Terms of Service”. 18 Moreover, Facebook submits that it:

“…did not request or require the data subject’s consent to processing described in the Data
Policy nor did it seek the data subject’s consent to the processing described in, or otherwise
performed for the purposes of, the Terms of Service, and as a consequence that the data
subject did not in fact consent in this manner”.21

3.10 This confirms the position set out in the Preliminary Draft Decision: Facebook did not rely on consent
as a legal basis for processing in this context. On this basis, Facebook expressed its agreement with
the provisional finding that “it is not legally obliged to rely on consent in order to deliver the Terms
of Service and endorses the unequivocal decision of the Commission to reject the [Complainant’s]
argument…”.19

3.11 In contrast, the Complainant’s submissions on the Preliminary Draft Decision argue that the alleged
contract is an example of falsa demonstratio i.e. that Facebook has held out particular clauses as
constituting part of a contract when, as a matter of law, they actually do not.23 The Complainant
in this regard relies on the perceived intention of the parties, the “economic background and
common understanding”, and the fact that the shift from reliance on consent to reliance on
necessity for the performance of a contract was recent.

3.12 While this argument may be relevant in the context of reliance on Article 6(1)(b) GDPR – which is
considered as the second issue below – it does not address the essential issue arising for the
purposes of Article 6(1)(a) GDPR. In this case, Facebook is not relying on consent as a legal basis
for processing of personal data under the Terms of Service. Indeed, the parties appear to agree
that acceptance of the Terms of Service is not valid consent for the purposes of the GDPR.

3.13 For these reasons, I proposed, by way of the Draft Decision, to conclude that, as a matter of fact,
Facebook did not rely, or purport to rely, on the Complainant’s consent as a legal basis for the
processing of personal data under the Terms of Service.

18
Facebook Submissions on Preliminary Draft Decision, paragraph 1.7(B). See also paragraph 3.1 21
Ibid, paragraph 3.1.
19
Facebook Submissions on Preliminary Draft Decision, paragraph 4.1.
23
Ibid, 4.4.1.
17

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

As noted already above, however, the EDPB instructed the Commission (by way of paragraph
198 of the Article 65 Decision) to remove, from its Draft Decision, “its conclusion on Finding 1”.
Finding 1 included proposed conclusions on two linked questions, namely: (i) whether Facebook
sought to rely on consent in order to process personal data to deliver the Terms of Service; and
(ii) whether Facebook was legally obliged to rely on consent in order to do so. Given that my
previously proposed conclusion (as noted immediately above) in relation to the first of these
questions is encompassed by the EDPB’s instruction, I make no finding on this first question.

WHETHER THE CONTROLLER MUST RELY ON CONSENT

3.14 Based on a new understanding of this issue that evolved during the course of this Inquiry, the
Complainant made what I consider to be an alternative argument: namely, that Facebook was
legally obliged to rely on consent and that, as Facebook has not done so, the processing was
consequently unlawful.

3.15 In the Complainant’s submissions on the Preliminary Draft Decision, it is denied that the Complainant
advanced such an argument. 20 I have dealt with this point in part in footnote 36 of Schedule 1. It
remains the case that the Complainant has argued that where “the subject matter of the
declaration of intent…is primarily data processing” 21 the appropriate legal basis must derive from
Article 6(1)(a) GDPR, and where the subject matter of the contractual offer “is primarily some other
contractual service”, 22 the legal basis can derive from Article 6(1)(b) GDPR. In my view, it is difficult
to interpret this as anything other than an argument that consent is the only appropriate legal
basis for agreements primarily concerning data processing. This is, to put it another way, a
suggestion that consent is a higher order of legal basis, at least in respect of agreements that
primarily involve data processing. This being so, and for completeness, I will now consider whether
consent under Article 6(1)(a) GDPR must be relied on by the controller in this context.

3.16 The Investigator points out that the Complaint begins by claiming that the data subject “had to agree
to” Facebook’s Terms of Service and Data Policy at the time of the update in April 2018. 23 In my
view it is critically important to distinguish between agreeing to a contract (which may involve
processing of personal data) and providing consent to personal data processing specifically for the
purposes of legitimising that personal data processing under the GDPR. As noted by the EDPB,
these are entirely distinct concepts which “have different requirements and legal consequences”. 24

20
Complainant Submissions on Preliminary Draft Decision, paragraph 4.4.2.
21
Submissions on Draft Inquiry Report, page 35.
22
Ibid.
23
Final Report, paragraph 111, Complaint, Paragraph 1.3.
24
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online. services to data subjects, paragraph 17,
https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines-art_6-1-
badopted_after_public_consultation_en.pdf.
18

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

In particular, these are distinct legal bases for the processing of personal data under Article 6(1)(a)
and 6(1)(b) GDPR, with all the consequences that this entails.

3.17 In this context, it is important to emphasise that GDPR does not set out any form of hierarchy of lawful
bases that can be used for processing personal data, whether by reference to the categories of
personal data or otherwise. 25 There is no question that “one ground has normative priority over
the others”. 26 This position is reflected in the Guidance of the Article 29 Working Party, which,
although not legally binding, is nonetheless instructive in considering this issue. 27 I also note that,
in the context of Directive 95/46/EC, which preceded the GDPR, the Court of Justice of the
European Union (“the CJEU”) has explicitly held that obtaining the data subject’s consent is not a
requirement for reliance on the “legitimate interests” legal basis. 28 The CJEU thereby rejected the
argument that consent was a necessary legal basis in circumstances where the data controller
sought to rely on another legal basis under Article 7 of the Directive. I have been pointed to no
authority which supports the view that there is a particular lawful basis that is intrinsically
preferable over others, or that one legal basis has legal primacy over any other, or that fulfilling
one legal basis is a precondition for fulfilling a separate legal basis. In these circumstances, the
reasoning of the CJEU in respect of Article 7 of Directive 95/46/EC is equally applicable to Article 6
GDPR. Indeed, notwithstanding the thrust of the argument initially advanced, the Complainant’s
submissions on the Preliminary Draft Decision now acknowledge that there is no hierarchy of legal
bases under the GDPR. 29

3.18 For this reason, if and insofar as it arises, I conclude that neither Article 6(1) GDPR nor any provision
of the GDPR requires that the processing of personal data in particular contexts must necessarily
be based on consent under Article 6(1)(a) GDPR.

3.19 In many cases involving a contract between a consumer and an organisation, the lawful basis for
processing of personal data is “necessity for the performance of a contract” under Article 6(1)(b)
GDPR. It cannot be said that the fact of agreeing to certain contractual terms necessarily means
that any processing of personal data under such contract is based on consent for the purposes of
the GDPR. The question of whether a data controller can rely on Article 6(1)(b) GDPR turns on the
terms of the particular contract, and whether the impugned processing operation(s) is/are
necessary in order to bring about the performance of that contract. The nature and content of a
contract freely entered into by two parties cannot, however, introduce a higher category of, or
‘default’, legal basis. Nothing in the GDPR supports the view that there is any such higher category
or default legal basis. 30 I also note in this regard that the EDPB has advised that, in circumstances

25
C Kuner et al eds, The EU General Data Protection Regulation: A Commentary (Oxford 2020), page 329.
26
Ibid.
27
Guidance 06/2014, page 10, at https://ec.europa.eu/justice/article-
29/documentation/opinionrecommendation/files/2014/wp217_en.pdf.
28
Asociaţia de Proprietari bloc M5A-ScaraA v TK Case 708/18, paragraph 41.
29
Complainant Submissions on the Preliminary Draft Decision, paragraph 4.4.2.
30
C Kuner et al eds, The EU General Data Protection Regulation: A Commentary (Oxford 2020), page 329.
19

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

in which data processing is necessary to perform a contract, consent is not, in fact, an appropriate
lawful basis on which to rely. 31

3.20 I note, in this regard, that the Complainant has argued that a contract for a service with a social
network “primarily” concerns data processing and on this basis should be based on consent.36 At
the same time, the Complainant asserts that the data processing in question is in fact not necessary
for the performance of that same contract. I am unaware of any case-law or authority that suggest
that companies cannot rely, at least in part, on Article 6(1)(b) GDPR as a legal basis for processing
personal data simply because their businesses “primarily” concern data processing.

3.21 In truth, the Complainant’s arguments in this respect appear to be made in support of the separate
argument that Facebook cannot rely on Article 6(1)(b) as a lawful basis for processing. If the
Complainant succeeds in that latter argument, it follows that another legal basis must be relied on
and in this instance, in the Complainant’s view, that legal basis would have to be consent. In my
view, this alternative argument – to the effect that consent is the only remaining possible lawful
basis because no other basis can be used lawfully for this particular agreement – is properly
considered in the context of the second issue in the complaint, i.e. whether Facebook is entitled
to rely on Article 6(1)(b) GDPR.

3.22 Finally, I note the Complainant’s reliance on Article 7(2) GDPR, which states:

“If the data subject’s consent is given in the context of a written declaration which also
concerns other matters, the request for consent shall be presented in a manner which is
clearly distinguishable from the other matters, in an intelligible and easily accessible form,
using clear and plain language. Any part of such a declaration which constitutes an
infringement of this Regulation shall not be binding.”

3.23 I also note the Complainant’s reliance on Article 7(4) GDPR, which states:

“When assessing whether consent is freely given, utmost account shall be taken of
whether, inter alia, the performance of a contract, including the provision of a service, is
conditional on consent to the processing of personal data that is not necessary for the
performance of that contract.”

3.24 Article 7 GDPR concerns ‘conditions for consent’ and is only relevant for consideration where consent
is being relied upon as the legal basis for processing in the first instance. This was the view of

31
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects, paragraph 17,
https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelinesart_6-1-b-
adopted_after_public_consultation_en.pdf. 36 Submissions on Draft Inquiry Report, page 35.
20

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Advocate General Szpunar in Planet49. 32 Article 7 GDPR is not, in and of itself, indicative of which
lawful basis a controller must or indeed should rely on in a particular context. Instead, where a
controller is relying on consent, Article 7 GDPR assists in determining whether the ‘conditions for
validity’ (to use the Complainant’s own language) have been met.

3.25 I further note that the EDPB Guidelines on consent consider a number of circumstances in which
“bundling” (or what the Complainant refers to as “forced consent” or “hidden consent”) may
occur. This occurs when consent can neither be freely given nor easily withdrawn because the
provision of consent is made part of the terms of a contract, particularly in circumstances where
there is an unequal balance of power between the data controller and the data subject. 33 This,
however, only becomes relevant when the controller purports to rely on consent in the first place.

3.26 Having considered the submissions of the parties, including the submissions on the Preliminary Draft
Decision, I proposed to conclude, in the Draft Decision, that the legal basis for processing of
personal data under the Terms of Service between Facebook and its users, including the
Complainant, does not, as a matter of law, have to be consent under Article 6(1)(a) GDPR and, as
a matter of fact, Facebook does not rely on consent for this purpose and the agreement to the
Terms of Service does not constitute consent for the purposes of the GDPR.

As noted already above, however, the EDPB instructed the Commission (by way of paragraph
198 of the Article 65 Decision) to remove, from its Draft Decision, “its conclusion on Finding
1”.

Accordingly, I make no finding on the matters encompassed by the above assessment of Issue 1.

4 ISSUE 2 - RELIANCE ON ARTICLE 6(1)(B) GDPR AS A LAWFUL BASIS FOR PERSONAL DATA PROCESSING

4.1 As set out above, the Complainant contends that Facebook’s processing of personal data under the
Terms of Service must be based entirely on consent as a legal basis under the GDPR. The
Complainant’s argument also rests on the contention that Facebook cannot rely on Article 6(1)(b)
GDPR to process personal data in order to perform the Terms of Service.

4.2 In considering this issue, I will first address the relationship between the Terms of Service and the Data
Policy. This assessment is necessary as the Complainant argues that she “agreed” to the Data
Policy by accepting Facebook’s updated Terms of Service. Facebook has argued that this position
is not correct. After coming to a conclusion on this matter, I will then consider the substantive
question of whether Facebook is entitled to rely on Article 6(1)(b) GDPR as a lawful basis for the
processing of personal data.

32
Case 673/18 Planet49 GmbH v Bundesverband der Verbraucherzentralen und Verbraucherverbände –
Verbraucherzentrale Bundesverband e.V, (Opinion of AG Szpunar) paragraph 97.
33
Guidelines 05/2020 on consent under Regulation 2016/679:
https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf. Pages 6-7.
21

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

THE RELATIONSHIP BETWEEN THE TERMS OF SERVICE AND DATA POLICY

4.3 The Complainant alleges that in clicking the “accept” button, she agreed to both the Data Policy and
the Terms of Service and that the alleged non-compliance is compounded by the agreement to
both documents. 34 In examining this aspect of the Complaint, the Investigator was of the view
that that the data subject’s formal agreement to the Data Policy was not a component of the data
subject’s contract with Facebook. The Investigator also acknowledged in the Final Report that the
Complainant seems to have conceded that there is no “consent” and therefore no “agreement”
to the Data Policy. 35

4.4 In respect of this matter, the Investigator concluded that, as Facebook has stated that the Terms of
Service “make up this entire agreement” between Facebook and the Facebook user, there is no
explicit indication, in the view of the Investigator, that Facebook intends the separate Data Policy
to be part of that agreement. When Facebook sought agreement to the terms under dispute in
this Inquiry, it invited users to also accept the updated Terms of Service and also included
information on the Data Policy. In the Investigator’s view, this illustrates that the Terms of Service
and the Data Policy are entirely separate. Facebook’s position is that the Data Policy is simply a
compliance document setting out information required by the GDPR, whereas the contractual
document is the Terms of Service. 36

4.5 I note, therefore, the Investigator’s consideration of whether the Complainant was forced to consent
to all of the processing operations set out in the Data Policy. In my view, the acceptance in
question is not an act of consent but, on its terms, constituted acceptance of, or agreement to, a
contract i.e. the Terms of Service. Although the Data Policy was hyperlinked in the final stage of
the engagement flow, I am not satisfied that the Data Policy was thereby incorporated into the
Terms of Service. The “accept” button clearly referred to acceptance of the “terms” as distinct
from the Data Policy (and indeed the Cookies Policy). In my view, the Data Policy is as Facebook
has characterised it:

“While the Terms of Service list Facebook Ireland’s services and obligations, the delivery
and discharge of which require certain processing of personal data, they do not attempt to
comprehensively list Facebook’s Ireland’s processing since the Data Policy does this and is
the primary document to be considered when it comes to Facebook Ireland’s GDPR
obligations under Article 13. The distinct objectives and nature of these documents is
further outlined in Sections 2 and 3 above where we have explained that agreement is

34
Complaint, page 3.
35
Final Report, paragraph 145.
36
Facebook Submissions on Preliminary Draft Decision, paragraphs 5.5 - 5.6.
22

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

merely sought to the Terms of Service but not for the Data Policy which functions as a
transparency and not a contractual document.” 37

4.6 The Data Policy is a document through which Facebook seeks to comply with particular provisions of
the GDPR in relation to transparency, whereas the Terms of Service is the contract between
Facebook and its user. Facebook relies on various legal bases for various data processing
operations, some of which are based on consent and some of which are based on contractual
necessity. Where the legal basis of contractual necessity is relied on, the contract in question is
the Terms of Service. In my view, the contract in question, and therefore the contract for which
the analysis based on Article 6(1)(b) GDPR must take place, is the Terms of Service only. The Data
Policy is only relevant insofar as it sheds light on the processing operations carried out for which
Facebook relies on Article 6(1)(b) GDPR. It is essentially an explanatory document. After
considering these views, which were set out in the Preliminary Draft Decision, Facebook expressed
agreement with the provisional conclusions of the Commission in this regard. 38 The Complainant’s
submissions on the Preliminary Draft Decision did not express any further views on this issue.

4.7 The Data Policy itself references a very wide range of processing operations. As noted in Schedule 1,
the Complainant sought to direct the Commission to conduct an assessment of all processing
operations carried out by Facebook. I have explained why it is not open to a Complainant – who
must present a complaint with a reasonable degree of specificity – to demand such an assessment.
While the Complaint refers to various examples of data processing, e.g. the processing of
behavioural data, it does not go so far as to directly link the Complaint to specific processing
operations by reference to an identifiable body of data with any great clarity or precision. In the
circumstances, it is necessary to consider the issue relating to reliance on Article 6(1)(b) GDPR at
the level of principle, and my findings are made on that basis.

4.8 More specifically, insofar as the Complaint refers to particular processing activities, it has a specific
focus on data processed to facilitate behavioural advertising. This will accordingly be the focus of
the analysis in this Decision.

4.9 In order to ensure that this Inquiry has a reasonable degree of specificity, I will therefore consider
whether Facebook can, in principle, rely on Article 6(1)(b) GDPR for processing under the contract,
including and in particular in the context of behavioural advertising.

THE COMPLAINT, THE SUBMISSIONS OF THE PARTIES, AND THE REPORT

4.10 The Complainant argues that Facebook is not entitled to rely on Article 6(1)(b) GDPR, i.e. personal
data processing that is necessary for the performance of a contract, as a legal basis. The
Complainant contends that Facebook could only rely on Article 6(1)(b) GDPR in respect of

37
Submissions on Draft Report, paragraph 7.1(A)
38
Ibid.
23

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

processing that is “strictly necessary” to perform the contract, and that such processing must be
linked to “core” functions of the contract. To support this view, the Complainant relies on Opinion
06/2014 of the Article 29 Working Party which recommended that “[t]he contractual necessity
lawful basis must be interpreted strictly and does not cover situations where the processing is not
genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data
subject by the controller”. 3940

4.11 Specifically, the Complainant argues that the personalisation of posts and communication features
constitutes a “core” element of Facebook’s contract, but that personalised advertising does not.
The Complainant’s position is premised on the idea that there is an identifiable “purpose” or “core”
of each contract which is discernible by reference to the contract as a whole and the intention of
the parties (as opposed to being strictly limited to the text of the contract). The Complainant is
therefore asking that an assessment of the Terms of Service be carried out to determine what the
“core” purpose of the contract is. It would follow from the Complainant’s position that any
processing that is not strictly necessary to fulfil these “core” purposes or objectives, cannot be
carried out on foot of Article 6(1)(b) GDPR.

4.12 The Complainant takes issue with a lack of “differentiation” as between specific clauses or elements
of the contract in the Commission’s approach. 41 The Complainant argues that “investigation” and
“fact finding” should have taken place in order to determine what specific elements of the contract
are used by Facebook to justify specific processing operations. Firstly, it
is clear from the Terms of Service, which is, in the Complainant’s own words, a very descriptive
document, that Facebook intends to provide behavioural advertising as part of its contractual
service. While my view, as set out in Section 5 below, is that there have been significant failings of
transparency in relation to this processing, that does not change this basic fact that behavioural
advertising forms part of the service offered by Facebook. As noted above, the Complaint has a
specific focus on behavioural advertising. On that basis, and having regard to the need for a
reasonable degree of specificity in the presentation and investigation of complaints, it is not
necessary to undertake a comprehensive investigation of each and every processing operation
under the Terms of Service. I also emphasise, as I explain in further detail below, that I intend to
order Facebook to bring its documents into compliance for transparency purposes. Such an order
would vindicate the right of the Complainant and data subjects as a whole to get an answer to
“which specific clauses of the “Terms of Service” are used by Facebook to justify the specific purpose
of its processing, the type of data processed, and the applicable legal basis.” 42 What such
information would not do, is assist in deciding the question of principle as to whether Facebook
can rely on Article 6(1)(b) GDPR in order to provide a service that includes behavioural or targeted
advertising.

39
Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive
40
/46/EC, page 16, https://ec.europa.eu/justice/article-
29/documentation/opinionrecommendation/files/2014/wp217_en.pdf.
41
Complainant Submissions on Preliminary Draft Decision, paragraph 4.5.2.
42
Ibid.
24

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

4.13 As a preliminary matter, I emphasise that issues of interpretation and validity of national contract law
are not directly within the Commission’s competence. Nonetheless, it is important to note that
the legal concept of a “purpose” or “core” of a contract is one more often found in civil law
jurisdictions. The Commission’s role is in any event limited to interpreting and applying the GDPR
and, in interpreting and applying Article 6(1)(b) GDPR specifically, it must always be borne in mind
that the Commission is not competent to rule directly on matters of national contract law or to
determine questions of the general validity of a contract.

4.14 In this regard, I note that the Complainant explicitly sought to have the Commission investigate and
make findings in respect of contract and consumer law. In the Preliminary Draft Decision I stated
that I agree with the position of the Investigator that this falls outside the remit of a supervisory
authority under the GDPR and is, in any case, the subject of both an Austrian consumer case
against Facebook being pursued by Mr. Schrems, Honorary Chair of noyb, over the last 6 years, 43
and the Bundeskartellamt case being pursued by that office since 2016. 44 I further noted that the
Investigator correctly drew the Complaint’s attention to the relevant Irish consumer and
competition authorities, which have competence in this regard. I went on to observe that these
legal regimes would be a more appropriate avenue for the Complainant to ventilate the issues
surrounding contract law referred to above.

4.15 In the Complainant’s submissions on the Preliminary Draft Decision, the Complainant took issue with
these provisional conclusions. They were described as “a perversion of justice”, “an insult to any
informed reader”, “a cheap trick”, “simply a lie”, “(at best) too lazy” and “a wilful abuse of office”,
all within the same fifteen lines of text. 45 The Commission rejects, in the strongest terms, these
serious allegations of mala fides, dishonesty and otherwise illegal conduct. Such allegations go far
beyond what is commonly encountered in even the most robustly argued set of submissions in an
adversarial regulatory dispute. They have, moreover, been made without any foundation in fact
or evidence and appear to be based solely on the fact that the there is a difference between the
Complainant’s/the Complainant’s representative’s interpretation of the law and the interpretation
of the law set out in the Preliminary Draft Decision. The fact that the Complainant and/or the
Complainant’s representative have presented their arguments in this way is not conducive to the
proper handling and investigation of Complaints and is to be regretted.

4.16 The Complainant argues that in order to determine the nature of the “agreement”, it is necessary to
fully inquire into the nature and scope of the agreement, and to apply Austrian contract law in so
doing. In making this argument, the Complainant relies on a number of principles of contract law
including Directive 93/13/EC (“the Unfair Terms Directive”). Reliance on the law of contract and
on the Unfair Terms Directive is misplaced. If the Complainant contends that there is no contract,

43
Mag. Maximilian Schrems v Facebook Ireland Limited, Case 3 Cg 52/14k-91,
https://noyb.eu/sites/default/files/2020-06/Urteil%20FB_geschw%C3%A4rzt.pdf.
44
See, for example, https://www.lexology.com/library/detail.aspx?g=abb936bc-8f3e-4f82-9266-2b3c591a2517.
45
Complainant Submissions on Preliminary Draft Decision, paragraph 4.5.1.
25

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

or that aspects of the Terms of Service do not constitute a lawfully formed contract or lawful
and/or fair terms of the contract, it is open to her to pursue this matter before a relevant authority
or before a court of law. The Commission is not empowered to make decisions as to the validity of
contracts, be they consumer contracts or otherwise and, in particular, it has no jurisdiction
whatsoever to make decisions in respect of Austrian contract law. The Commission is tasked with
interpreting and applying the GDPR. Where the GDPR refers to a contract, the Commission cannot
determine the interpretation and validity of such a contract for the purposes of the law more
generally. The Commission is no more empowered to do this by law than it would be to declare
processing based on compliance with a legal obligation under Article 6(1)(c) GDPR to be unlawful
simply because a complainant would argue that the legal obligation being relied on was
unconstitutional in their country. These are matters for the national courts or such other bodies
as may be conferred with the jurisdiction to make such determinations under domestic law. Any
such decision on the part of the Commission would be ultra vires the 2018 Act, for reasons
explained in detail when I considered the extent of the Commission’s powers earlier in this
Decision. I do not accept that this amounts to “a denial of justice”, 46 for the reasons there set out.

4.17 The Complainant argues that the “Our Services” section of the Terms of Service “are all neutral factual
descriptions. Neither a duty of the user nor a service from Facebook results from the wording”. 47
The Complainant also argues that showing any user advertisements is a “factual procedure” rather
than a contractual obligation or duty.52 In addition, the Complainant’s argument endeavours to
draw a distinction between “implicit consent”, i.e. some form of agreement that is implicit or
obvious within a contract for services, and “compulsory consent”, i.e. consent which is made
contingent on the acceptance of a contract. 48 Applying the narrow interpretation of Article 6(1)(b)
GDPR that is proposed by the Complainant, the argument is that the processing required to deliver
the “factual” services set out in the contract cannot fall within Article 6(1)(b) GDPR. This rests on
the aforementioned distinction drawn by the Complainant between processing that is strictly
necessary to deliver the “core” objectives of the service i.e. providing a social network, and factual
events simply mentioned or described in the contract i.e. showing advertisements.

4.18 The Complainant has further argued that this “take it or leave it” approach to signing up or continuing
to use Facebook (to use the Complainant’s terminology) in any event does not constitute
processing that is permitted by Article 6(1)(b) GDPR. To assess whether the Complainant’s
interpretation of Article 6(1)(b) GDPR is correct, I must first consider whether the processing which
is carried out on foot of the acceptance of the contract is necessary to perform that contract. In
essence, this requires an assessment of whether the services offered by Facebook pursuant to the
contract are necessary to fulfil the contract’s core functions.

46
Ibid.
47
Submissions on Draft Report, paragraph 2.1.2
52
Ibid, paragraph 2.1.7.
48
Ibid, Paragraph 3.4.3.6.
26

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

4.19 In advancing the argument that Article 6(1)(b) GDPR can only be relied on to legitimise data processing
that constitutes “a core element of a social network”, 49 the Complainant relies on guidance of the
EDPB. Moreover, the Complainant argues that, inter alia, Facebook has made a “ridiculous and
impractical assertion that advertising (and similar secondary processing) is a core service.” 50 The
Complainant further argues that:

“Other elements which represent the core product of the platform (e.g. the user's page,
exchange of news, contact book, photo uploads) are, according to the public opinion,
certainly the subject of the product "social network" and thus the subject of the contract -
irrespective of the designation in the clauses.”

4.20 The Complainant is therefore of the view that this particular interpretation should be applied to the
circumstances of the Complaint by conducting an assessment as to what constitutes the “core” of
the contract between the user and Facebook. The argument is that any services (such as, in the
Complainant’s view, advertising and “secondary processing”) which do not form part of
the activities which are strictly necessary to fulfil the core objective of the contract cannot be
rendered lawful by Article 6(1)(b) GDPR.

4.21 Put very simply, the Complainant is advancing a narrow and purpose-based interpretation of Article
6(1)(b) GDPR, that argues that the data processing should be the least invasive processing possible
in order to fulfil the objective of the contract (here, what the overall contract sets out to do, rather
than only what the contract says). In contrast, Facebook is advancing a broader interpretation that
facilitates a certain degree of contractual freedom in relation to how broad the data processing
might be, provided that the processing is in fact necessary to perform a term of the specific
contract. Facebook argues that it is entitled to rely on Article 6(1)(b) GDPR to deliver services in a
contract even if that processing is not the most minimal processing available to it in order to deliver
the service being provided.

4.22 Facebook argues that there is no basis to contend that Facebook, in clearly relying on a contract with
the user, has attempted to mislead the user and to “infer” consent from a user. Facebook’s
position is that the condition of necessity for contractual performance “does not mean that
processing must be essential to the performance of the contract, or the only way to perform the
underlying contract”. 51 Facebook emphasises that, rather than being required to use the most
minimal processing possible in order to perform the contract, contractual freedom must allow the
parties to exercise a certain element of agency in coming to an agreement, even where that
agreement might involve the delivery of a service primarily using data processing. Facebook’s
position is therefore that the Complainant’s interpretation (and proposed application) of the GDPR
is incorrect and excessively narrow, insofar as the contract between Facebook and its users are
concerned.

49
Complaint, page 4.
50
Complainant Submission on Draft Report, paragraph 2.1.6.
51
Submissions on Draft Report, paragraph 4.2.
27

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

4.23 Facebook also argues that there is an absence of meaningful rationale in the Complaint as to why any
of the elements of its service described in Section 1 of its Terms of Service cannot be based on
Article 6(1)(b) GDPR. It submits that “Article 6(1)(b) forms part of the right to data protection, it is
not a derogation or limitation on the right. It operates as a safeguard by explaining the
circumstances in which the personal data can be processed”. 52 Facebook’s position is that the
Commission should apply a broader interpretation of Article 6(1)(b) GDPR, such that processing
that is necessary to deliver a contract can be lawful irrespective of whether the specific processing
is essential, or the most minimal way, to deliver the service. In relation to targeted behavioural
advertising specifically, Facebook argues that:

“Beyond ensuring the continued financing of the provision and development of the Service,
which is itself of significant benefit to users (as the Complaint explicitly recognises), the
data processing activities undertaken by Facebook Ireland primarily enable Facebook
Ireland to provide its personalised services to users (including curating individual’s News
Feed, the content they see, connections suggested, advertising and other commercial
content, shortcuts suggested and elements of the features they can enjoy). This is itself the
core of the Service and one of the principal reasons why users value the Service over and
above the services provided by Facebook Ireland’s competitors.” 53

4.24 The Investigator acknowledged the difficulties in interpreting contractual necessity in vacuo, where
there is limited harmonisation of contract law at European level and where the Commission is not
competent to rule on matters of contract law. 54 The Investigator expressed particular doubts
about applying a test based on what is necessary to fulfil the core functions/objectives of a
contract given the lack of certainty surrounding it. 55 The Investigator concluded that the concept
of necessity in Article 6(1)(b) GDPR “includes processing which is necessary to perform the full
agreement entered into between the parties, including optional or conditional elements of
contract.”. 56

4.25 The Investigator’s position is in contrast to that of the Complainant, which is that “necessity” should
be assessed strictly by reference to its meaning as an element in the proportionality test in
applying Article 52(1) of the European Charter of Fundamental Rights and Freedoms (“the
Charter”), i.e. that the measure be strictly necessary in order to fulfil the objective.

WHETHER FACEBOOK CAN RELY ON ARTICLE 6(1)(B) GDPR

52
Submission on Draft Report 29 July 2019, paragraph 4.2.
53
Submissions on Draft Report, paragraph 1.4.
54
Final Report, page 47.
55
Ibid, page 48.
56
Ibid, paragraph 203.
28

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

4.26 In coming to a conclusion on this matter in the Preliminary Draft Decision, I had regard to the
Guidelines of the EDPB on processing for online services based on Article 6(1)(b) GDPR. While these
Guidelines are not strictly binding and address this issue in general terms, they are nonetheless
instructive in considering this issue. The Guidelines state in clear terms that “the processing in
question must be objectively necessary for the performance of a contract with a data subject”. 57 In
my view, this turns on a consideration of what is meant by the concepts of “performance,
“necessity” and “contract” as understood in the context of data protection law and the application
of these concepts to the specific contract relied upon for the purposes of Article 6(1)(b) GDPR. This
remains my view in the context of this Decision.

4.27 It is, in my view, important to have regard not just to the concept of what is “necessary”, but also to
the concept of “performance”. The EDPB has stated that the controller should ensure “that
processing is necessary in order that the particular contract with the data subject can be
performed.” 58 A contract is performed when each party discharges their contractual obligations as
has been agreed by reference to the bargain struck between the parties. It follows that what is
“necessary” for the performance of a contract is anything that, if it did not take place, would mean
the specific contract had not been performed. In this regard, I note that the mere inclusion of a
term in a contract does not necessarily mean that it is necessary to perform the particular contract.
This understanding is consistent with the EDPB Guidance which states that the processing will be
necessary for the performance of a contract if “the main subject-matter of the specific contract
with the data subject cannot, as a matter of fact, be performed if the specific processing of the
personal data in question does not occur”. 59 It remains the case however that necessity cannot be
considered entirely in the abstract, and careful regard must be had for what is necessary for the
performance of the specific contract freely entered into by the parties.

4.28 The EDPB states that there is:

“…a distinction between processing activities necessary for the performance of a contract,
and terms making the service conditional on certain processing activities that are not in
fact necessary for the performance of the contract. ‘Necessary for performance’ clearly
requires something more than a contractual condition” [my emphasis]. 60

4.29 The Guidelines also set out that controller should:

“demonstrate how the main object of the specific contract with the data subject cannot,
as a matter of fact, be performed if the specific processing of the personal data in question

57
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines-art_6-1-
badopted_after_public_consultation_en.pdf, paragraph 22.
58
Ibid, paragraph 26.
59
Ibid, paragraph 30.
60
Guidelines 2/2019, paragraph 27.
29

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

does not occur. The important issue here is the nexus between the personal data and
processing operations concerned, and the performance or non-performance of the service
provided under the contract.” 61

4.30 On the question of necessity, I note that the EDPB has stated that the meaning of necessity as
understood in EU law must be considered when having regard to a provision of EU law, including
data protection law. 62 This is an uncontroversial statement. I also note that in Heinz Huber v
Bundesrepublik Deutschland, the CJEU held in the context of Directive 95/46 that necessity is an
existing principle of EU law that must be interpreted in a manner that “reflects the objective of
that directive”. 63 It is important to highlight, as the Investigator has, 64 that in the same case the
CJEU held that processing beyond the most minimal to meet the objective will still meet the
necessity test if it renders a lawful objective “more effective”. 65 However, the EDPB proposes clear
limits to this by stating “merely referencing or mentioning data processing in a contract is not
enough to bring the processing in question within the scope of Article 6(1)(b).” 66

4.31 The EDPB Guidelines assess necessity by reference to the “core” function of the contract. This is
supportive of the Complainant’s position that the “core” functions of a contract must be assessed
in order to determine what processing is objectively necessary in order to perform it. I agree with
this assessment for the reasons set out by the EDPB. In this vein, I would add that necessity is to
be determined by reference to the particular contract as between the parties. Indeed, the
question to be asked is whether the processing operation(s) is/are is necessary to fulfil the
“specific” 67 or “particular”73 contract with the data subject. This is the view taken by the EDPB
and, as Article 6(1)(b) GDPR clearly refers to the specific contract between a data controller and a
data subject, I am in agreement with the EDPB in this regard.

4.32 In accordance with the EDPB Guidelines, the processing in question must be more than simply the
processing of personal data which is referenced in the terms of the contract. Rather, it must be
necessary in order to fulfil the clearly stated and understood objectives or “core” of the contract.
The “core functions” cannot, however, be considered in isolation from the meaning of
“performance”, the meaning of “necessity” as set out above, and the content of the specific
contract in question. The question is therefore not what is necessary to fulfil the objectives of “a
social network” in a general sense, but what is necessary to fulfil the core functions of the
particular contract between Facebook and Facebook users. In order to carry out this assessment,
it is therefore necessary to consider the contract itself.

61
Ibid, paragraph 30.
62
Ibid, paragraph 23.
63
Case C‑524/06, Heinz Huber v Bundesrepublik Deutschland, 18 December
2008, para. 52.
64
Final Report, paragraph 202(vi).
65
Huber v Deutschland, paragraph 62.
66
Guidelines 2/2019, paragraph 27.
67
Ibid, paragraph 30.
73
Ibid, paragraph 26.
30

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

4.33 I recall my earlier statement that matters of national contract law are outside the scope of the
Commission. 68 Nonetheless, for the purposes of data protection law, I note that the EDPB
indicates that, in such an assessment, “regard should be given to the particular aim, purpose, or
objective of the service”.75 In my view, when examining what constitutes a “contract” for the
purposes of Article 6(1)(b) GDPR, the term “contract” does not necessarily refer to the entirety of
the (written) agreement between the parties. Rather, I agree that the correct approach is to
examine the actual bargain which has been struck between the parties and determine the core
function of the contract by reference to this. Therefore, the inclusion of a term which does not
relate to the core function of the contract could not be considered necessary for its performance.

4.34 As an aid to deciding whether Article 6(1)(b) GDPR is an appropriate lawful basis, and in particular in
considering the scope of the relevant contract, the EDPB suggests asking:

• “What is the nature of the service being provided to the data subject?
• What are its distinguishing characteristics? What is the exact rationale of the contract
(i.e. its substance and fundamental object)?
• What are the essential elements of the contract?
• What are the mutual perspectives and expectations of the parties to the contract?
• How is the service promoted or advertised to the data subject? Would an ordinary user
of the service reasonably expect?” 69

4.35 In considering this particular issue in the context of the Complaint, it is necessary to
identify the “core” functions of the contract between Facebook and Facebook users. At
this point, I note that the Complaint itself does not specify with any great precision the
extent of the processing (or indeed the processing operation(s)) that the Complainant
believes is not necessary for the purposes of performing the Terms of Service. The
Complainant has however made extensive submissions arguing that the serving of
behavioural advertising specifically is not necessary in order to fulfil the “core function” of
a social network. As a result, for the purposes of this Complaint, I propose to focus on this
element of the Terms of Service.

4.36 The contract between Facebook and Facebook users is divided into the following headings:

• “To Provide a Personalised Experience for you”;

68
In this regard, I also note that national contract law of individual Member States applies various standards to
determine when a contract will be deemed to be performed, what contractual terms can be breached without the
entire contract being deemed to be breached, and indeed how something can be deemed a “term” in the first place.
75
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of
online services to data subjects https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines-art_6-1-
badopted_after_public_consultation_en.pdf, paragraph 30.
69
Ibid, paragraph 33.
31

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

• “Connect you with people and organizations you care about”;
• “Empower you to express yourself and communicate about what matters to you”;
• “Help you discover content, products, and services that may interest you”;
• “Combat harmful conduct and protect and support our community”;
• “Use and develop advanced technologies to provide safe and functional services for
everyone”; and
• “Enable global access to our services”.

4.37 The first term in the Terms of Service, under the heading “To Provide a Personalised
Experience for you”, states that:

“from the posts, stories, events, ads, and other content you see in News Feed or our video
platform to the Pages you follow and other features you might use, such as Trending,
Marketplace, and search. We use the data we have – for example, about the connections
you make, the choices and settings you select, and what you share and do on and off our
Products – to personalize your experience” [my emphasis].

4.38 As well as the provision relating to advertisements at the beginning of the Terms of Service
already set out, I note that under the heading “Help you discover content, products, and
services that may interest you”, the contract states “[w]e show you ads, offers and other
sponsored content to help you to discover content, products and services…”.

4.39 The Complainant however argues that such advertising referred to in this term is not
necessary in order to deliver a social network, and that simply placing these terms in the
contract does not make them necessary. Both of these statements may be true, but it does
not follow that fulfilling these terms is not necessary in order to fulfil the specific contract
with Facebook. To do that, to use the language of the EDPB, it is necessary to consider “the
nature of the service being offered to the data subject”. Facebook’s argument is essentially
that personalised advertising constitutes the “core” of its service, and would therefore be
the Facebook service’s “distinguishing characteristics” (to use the language of the EDPB). 70
The Facebook service is clearly “promoted [and] advertised” 71 as being one that provides
personalised advertisements, and in my view, a reasonable user would be well-informed,
based on public debate of these issues in the media among other matters, that this is the
very nature of the service being offered by Facebook and contained within the contract.

4.40 However, the position of the Complainant seems to go so far as to say that processing will
generally only be necessary for the performance of the contract if not carrying out the
processing would make the performance of the contract impossible. Moreover, the
position of the EDPB is that:

70
Ibid, paragraph 33.
71
Ibid.
32

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

“as a general rule, processing of personal data for behavioural advertising is not necessary
for the performance of a contract for online services. Normally, it would be hard to argue
that the contract had not been performed because there were no behavioural ads. This is
all the more supported by the fact that data subjects have the absolute right under Article
21 to object to processing of their data for direct marketing purposes.” 72

4.41 The Guidelines, while not binding on the Commission, clearly set out a very restrictive view on
when processing should be deemed to be “necessary” for the performance of a contract, and
explicitly refer to personalised advertising as an example of processing that will usually not be
necessary. As the terms of the guidance makes clear, this is, however, a general rather than an
absolute rule. I note the EDPB has also acknowledged that “personalisation of content may (but
does not always) constitute an essential or expected element of certain online services”. 73 The
core area of dispute in applying Article 6(1)(b) GDPR is therefore whether – by reference to the
terms of the specific contract – the inclusion of behavioural advertising makes data processing
conditional on the delivery of a contract, where that processing is not itself necessary to actually
deliver the contract. The counter-argument is that such advertising, being the core of Facebook’s
business model and the core of the bargain being struck by Facebook users and Facebook, is
necessary to perform the specific contract between Facebook and the Complainant.

4.42 Appling the principles set out above to the particular circumstances of this case, it seems to me that
the core of the Facebook model, particularly in circumstances where users do not pay for the
service, is an advertising model. 74 The EDPB has, of course, set out that processing cannot be
rendered lawful by Article 6(1)(b) GDPR “simply because processing is necessary for the controller’s
wider business model”.82 The core of the service, however, as set out in the specific contract with
the data subject in this case, clearly includes (and indeed appears to be premised upon) the
provision of personalised advertising.

4.43 This analysis is reinforced when one answers the specific questions posed at paragraph 33 of the EDPB
Guidelines set out above. The nature of the service being offered to Facebook users is set out in
the first line of the Terms of Service: a personalised service that includes advertising. Moreover, a
distinguishing feature of the Facebook service (that, I think it might be fair to say, the Complainant
and Facebook would both agree on) is that it is a service funded by personalised advertising. As
the core of the bargain between the parties, this advertising therefore appears to be part of the
substance and fundamental object of the contract. It is, in fact, the core element of the commercial
transaction as between Facebook and Facebook users. It follows that this is a commercially
essential element of the contract. As this information is both clearly set out and publicly available,
it is difficult to argue that this is not part of the mutual expectations of a prospective user and of

72
Ibid, paragraph 52 (emphasis added).
73
Ibid, paragraph 54.
74
E.g. Facebook Submissions on the Draft Report, paragraph 6.3(C) and Facebook Submissions on Preliminary Draft
Decision, paragraph 5.8(C). 82 Ibid, paragraph 36.
33

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Facebook. Finally, it is clear that the service is advertised (and widely understood) as one funded
by personalised advertising, and so any reasonable user would expect and understand that this
was the bargain being struck, even if they might prefer that the market would offer them better
alternative choices. I therefore expressed the view, in the Preliminary Draft (and Draft) Decision,
that the answers to the questions proposed by the EDPB did not support the Complainant’s
argument in respect of Article 6(1)(b) GDPR in the context of the contract concluded between
Facebook and the Complainant at issue in this Complaint.

4.44 In the submissions on the Preliminary Draft Decision, the Complainant argues that this analysis
amounts to speculation. 75 While making the argument that the legal analysis must be based on
“hard evidence” rather than “views”, the only evidence put forward by the Complainant is her own
statement and a Gallup poll referenced in the Complaint. The Complainant goes on to suggest that
“we might as well ask the Oracle of Delphi what data subjects really know or think and what
economics really play out in a contractual relationship.” 76 While I have had due regard to the
matters put forward by the Complainant in support of the Complaint I am obliged to consider all
of the evidence before me and I am also entitled to take notice of matters in the public domain. In
any event, in this specific context, it is primarily by reference to the contract itself that the question
of reliance on Article 6(1)(b) GDPR must be assessed. Having regard to the clear terms of the
contract, targeted advertising forms a core element of Facebook’s business model and transaction
with users.

4.45 The Complainant’s submissions on the Preliminary Draft Decision go on to describe the “data for
service narrative” as “economically illiterate”, “clearly way too simplistic”, “deeply alarming” and
an “ancient industry lobbyist narrative”.85 In support of these assertions, it is argued that each visit
to Facebook involves spending time, “the most important online currency on Facebook”. The
submissions further argue that Facebook can only profit from advertising because users provide
relevant content to other users with no remuneration.

4.46 The fact that a user spending additional time on a platform is more lucrative for Facebook does
nothing to rebut the argument that targeted advertising lies at the core of the agreement. The
more time a user spends engaging with the platform, the more advertisements they will be
exposed to and the more data they will provide. Indeed, even if one uncritically accepts this
argument, it may be regarded as reinforcing the conclusion that the core of the business model is
the provision of data on personal activity to facilitate targeted advertising. The fact that intra-user
activity enables profit does not alter where those profits come from, or the nature of the
agreement and what is necessary in order to perform it. It is clear that the Complainant regards
this state of affairs as being unfair and/or unbalanced. Whether it is or it is not, this does not alter
the fact that the service in question is provided to users on this very basis.

75
Complainant Submissions on Preliminary Draft Decision, paragraph 4.5.3.
76
Ibid.
85
Ibid.
34

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

4.47 I have already pointed out that the Guidelines are non-binding and do not determine the application
of the general principles to specific cases. I agree with the majority of the arguments of both the
Complainant and the EDPB in relation to the correct interpretation of Article 6(1)(b) GDPR. 77
However, I have difficulty with a strict threshold of “impossibility” in the assessment of necessity.
By “impossibility”, I am referring to the argument put forward that a particular term of
a contract (here, behavioural advertising) is not necessary to deliver an overall service or contract.
In particular, I consider that is not correct to assess necessity as against the delivery of an overall
service in the abstract. Rather, as I have stated above, I consider the appropriate assessment to
be one which considers what is necessary by reference to core function of the particular contract.

4.48 While I accept that either form of assessment will require an element of reasoning in the abstract (in
particular, when considering the mutual perspectives and expectations), I am also of the view that
it is not for an authority such as the Commission, tasked with the enforcement of data protection
law, to make assessments as to what will or will not make the performance of a contract possible
or impossible. Instead, the general principles set out in the GDPR and explained by the EDPB in the
Guidance must be applied. These principles must be applied on a case-by-case basis. While the
examples provided in the EDPB Guidance are helpful and instructive, they are not conclusive of
the position in any specific case and indeed do not purport to be.

4.49 Even if, contrary to my view, the appropriate standard in assessing Article 6(1)(b) GDPR was one of
impossibility rather than necessity simpliciter, Facebook has submitted that “…it would be
impossible to provide the Facebook service in accordance with the Terms of Service without
providing personalised advertising”. 78 While it does not consider that this would be the correct
interpretation of the law, it considers that this standard would nonetheless be met under the
Terms of Service.

4.50 While I remain of the view that Article 6(1)(b) GDPR cannot be interpreted as meaning that, unless it
is impossible to perform the contract without particular acts or operations of data processing, such
processing is not necessary for the performance of the contract, this argument underlines the
extent to which targeted advertising forms a core part of the contract between Facebook and its
user.

4.51 Based on the above considerations, I proposed to conclude, in the Draft Decision, that neither Article
6(1)(b) nor any other provision of the GPDR precluded Facebook from relying on Article 6(1)(b)
GDPR as a legal basis to for the delivery of a service based on behavioural advertising of the kind
provided for under the contract between Facebook and its users at issue in this Complaint. As
discussed below, I further expressed the view that other provisions of the GDPR (such as

77
While in the submissions on the Preliminary Draft Decision the Complainant takes issue with my approach to the
EDPB Guidelines, the Complainant has made no additional arguments beyond those already set out about why this
legally cannot or should not be done: Complainant Submissions on the Preliminary Draft Decision, paragraph 4.5.5.
78
Ibid, paragraph 5.8(G).
35

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

transparency, which I consider at Issue 3) act to strictly regulate the manner in which this service
is to be delivered, and the information that should be given to users.

4.52 Having analysed the submissions of the parties, the terms of the GDPR, and the jurisprudence and
EDPB Guidelines, I proposed, by way of the Draft Decision, to find that there was no basis for the
contention that Facebook is precluded in principle from relying on Article 6(1)(b) GDPR for the
purposes of legitimising the personal data processing activities involved in the provision of its
service to users, including behavioural advertising insofar as that forms a core part of the service.
There is nothing in the GDPR that restricts or prohibits the use of these terms in the context of
processing personal data per se. As has been set out earlier, and as set out by the Investigator, it
is not for the Commission to rule on matters of contract law and contractual interpretation that
extend beyond the remit of data protection law. The lawful basis under Article 6(1)(b) GDPR simply
states that personal data may be processed where it is necessary for the performance of a
contract. In other words and, as I have already set out in analysis, the data may be processed if,
without such processing, the contract could not be performed. I am not convinced, for the reasons
set out, that Article 6(1)(b) GDPR goes a step further and excludes all processing unless the
fulfilment of some abstractly discerned purpose would be rendered impossible without that
processing. I also expressed the view, in the Draft Decision, that this application conforms broadly
to significant elements of the interpretation of Article 6(1)(b) GDPR proposed by the Complainant
and by the EDPB.

4.53 While I accepted that, as a general rule, the EPDB considers that processing for online behavioural
advertising would not be necessary for the performance of a contract for online services, in this
particular case, having regard to the specific terms of the contract and the nature of the service
provided and agreed upon by the parties, I proposed to conclude that Facebook may in principle
rely on Article 6(1)(b) as a legal basis of the processing of users’ data necessary for the provision
of its service, including through the provision of behavioural advertising insofar as this forms a core
part of that service offered to and accepted by users.

4.54 Having regard to the scope of the Complaint and this Inquiry, as described above, I added that this
proposed conclusion was not to be construed as an indication that all processing operations
carried out on users’ personal data are necessarily covered by Article 6(1)(b) GDPR.

4.55 Following the circulation of the Commission’s Draft Decision to the supervisory authorities concerned,
for the purpose of enabling them to express their views in accordance with Article 60(3) GDPR,
objections to this aspect of matters were raised by the supervisory authorities of Austria, Germany,
France, Italy, the Netherlands, Norway, Poland, Portugal and Sweden. Having considered the
merits of those objections, the EDPB determined as follows:

94. The EDPB considers it necessary to begin its assessment on the merits with a general
description of the practice of behavioural advertising carried out in the context of the Facebook
service before determining whether the legal basis of Article 6(1)(b) GDPR is appropriate for

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

this practice in the present case, based on the Facebook Terms of Service and the nature of its
products and features as described in those terms. The requests for preliminary rulings made
to the CJEU in the cases C- 252/21 79 and C-446/21 80 to which some of the documents in the file
refer 81 contain helpful descriptions of Meta IE’s behavioural advertising practices in the
context of its Facebook service.

95. These requests for preliminary rulings mention that Meta IE collects data on its individual
users and their activities on and off its Facebook social network service via numerous means
such as the service itself, other services of the Meta group including Instagram, WhatsApp and
Oculus, third party websites and apps via integrated programming interfaces such as Facebook
Business Tools or via cookies, social plug-ins, pixels and comparable technologies placed on the
internet user’s computer or mobile device. According to the descriptions provided, Meta IE links
these data with the user’s Facebook account to enable advertisers to tailor their advertising to
Facebook’s individual users based on their consumer behaviour, interests, purchasing power
and personal situation. This may also include the user’s physical location to display content
relevant to the user’s location. Meta IE offers its services to its users free of charge and
generates revenue through this personalised advertising that targets them, in addition to static
advertising that is displayed to every user in the same way.

96. The EDPB considers that these general descriptions signal by themselves the complexity,
massive scale and intrusiveness of the behavioural advertising practice that Meta IE conducts
through the Facebook service. These are relevant facts to consider to assess the
appropriateness of Article 6(1)(b) GDPR as a legal basis for behavioural advertising and to what
extent reasonable users may understand and expect behavioural advertising when they accept
the Facebook Terms of Service and perceive it as necessary for Meta IE to deliver its service 82.
Accordingly, the EDPB further considers that the IE SA could have added to its Draft Decision a
description of behavioural advertising that Meta IE conducts through the Facebook service to
appropriately substantiate its reasoning leading to its acceptance of Article 6(1)(b) GDPR as a
legal basis for that practice in accordance with the IE SA’s duty to state the reasons for an
individual decision 83.

79
C-252/21 Oberlandesgericht Düsseldorf request, pp.6-7.
80
C-446/21 Austrian Oberster Gerichtshof request paragraphs 2-3, 6-13, 15-23.
81
See for instance the references to these requests for a preliminary ruling in the AT SA Objection p.9 and Meta IE’s
Article 65 Submissions, p.14.
82
In the same vein, the Advocate General also provides a description of behavioural advertising in its Opinion on the
case C-252/21 Oberlandesgericht Düsseldorf request, see Opinion of the Advocate General on 20 September 2022),
ECLI:EU:C:2022:704, paragraphs 9 and 10.
83
See EDPB Guidelines on Article 65(1)(a) GDPR, paragraph 84 and EDPB Guidelines 02/2022 on the application of
Article 60 GDPR (Version 1.0, Adopted on 14 March 2022), paragraph 111 (stating: “[…] every decision that is aimed
at legal consequences needs to include a description of relevant facts, sound reasoning and a proper legal
assessment. These requirements essentially serve the purpose of legal certainty and legal protection of the parties
concerned. Applied to the area of data protection supervision this means that the controller, processor and
complainant should be able to acknowledge all the reasons in order to decide whether they should bring the case to
trial. Having regard to the decision making process within the cooperation mechanism, CSAs likewise need to be in
the position to decide on possibly taking actions (e.g. agree to the decision, provide their views on the subject
37

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

97. In the same vein, the EDPB also finds that the content of the Gallup Institute poll, which
the Complainant’s representative requested and subsequently submitted to the IE SA in its
submission of 20 November 2019, could have been part of the facts of the Draft Decision84. This
poll provides a supplementary and useful indication on the perspective of Facebook users,
which helps assessing whether they could expect being subject to behavioural advertising as
part of a contract. The results of the poll allege, inter alia, that only 1.6% to 2.5% of the 1.000
respondents 85, who are Facebook users, understood the request to accept the Facebook Terms
of Service to be a “contract” that provides them with a contractual right to personalised
advertisement. The IE SA acknowledges the Complainant’s submission of this poll in its Draft
Decision but seemingly dismisses it by focusing primarily on what it considers as primary sources
of factual evidence (primarily, the Facebook Terms of Service) and “matters in the public
domain” 86. Conversely, Meta IE seems to attach importance to this poll. Meta IE engaged an
expert to produce a report (the “Vanhuele Report”) that Meta IE appends to Annex 2 of its pre-
Article 65 submission to point to what Meta IE considers “serious flaws” in the report containing
the poll and allege that the Complainant misinterpreted its results 87.

…

101. The GDPR develops the fundamental right to the protection of personal data found in
Article 8(1) of the EU Charter of Fundamental Rights and Article 16(1) of the TFEU, which
constitute EU primary law 88. As the CJEU clarified, “an EU act must be interpreted, as far
as possible, in such a way as not to affect its validity and in conformity with primary law as
a whole and, in particular, with the provisions of the Charter. Thus, if the wording of
secondary EU legislation is open to more than one interpretation, preference should be
given to the interpretation which renders the provision consistent with primary law rather
than to the interpretation which leads to its being incompatible with primary law” 89. In the
face of rapid technological developments and increases in the scale of data collection and
sharing, the GDPR creates a strong and more coherent data protection framework in the
Union, backed by strong enforcement, and built on the principle that natural persons
should have control of their own personal data99. By ensuring a consistent, homogenous
and equivalent high level of protection throughout the EU, the GDPR seeks to ensure the

matter)”). See also by analogy Judgement of the Court of Justice of 26 November 2013, Kendrion NV v European
Commission, C-50/12 P, ECLI:EU:C:2013:771, paragraph 42.
84
An informal translation of the presentation of this Study, dated November 2019, as provided by the Complainant’s
representative through its public website, may be found here:
https://noyb.eu/sites/default/files/202005/Gallup_Facebook_EN.pdf (Date of consultation 21 November 2022).
85
According to the poll “Austrians that are active online, age 14 and older”.
86
Draft Decision, paragraph 4.44; Composite Response, paragraph 83.
87
Meta IE Article 65 Submissions, footnote 132, p.75, and Annex 2.
88
Recitals 1 and 2 GDPR.
89
Judgement of the Court of Justice of 21 June 2022, Ligue des droits humains v. Conseil des ministres, C-817/19,
ECLI:EU:C:2022:491, (hereinafter ‘C-817/19 Ligue des droits humains'), paragraph 86; and Judgement of the Court of
Justice of 2 February 2021, Consob, C-481/19, ECLI:EU:C:2021:84, paragraph 50 and the case-law cited. 99 Article
1(1)(2) and Recital 6 and 7 GDPR.
38

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

free movement of personal data within the EU 90. The GDPR acknowledges that the right to
data protection needs to be balanced against other fundamental rights and freedoms, such
as the freedom to conduct a business, in accordance with the principle of proportionality101
and has these considerations integrated into its provisions. The GDPR, pursuant to EU
primary law, treats personal data as a fundamental right inherent to a data subject and
his/her dignity, and not as a commodity data subjects can trade away through a contract 91.
The CJEU provided additional interpretative guidance by asserting that the fundamental
rights of data subjects to privacy and the protection of their personal data override, as a
rule, a controller’s economic interests 92.

102. The principle of lawfulness of Article 5(1)(a) and Article 6 GDPR is one of the main
safeguards to the protection of personal data. It follows a restrictive approach whereby a
controller may only process the personal data of individuals if it is able to rely on one of
the basis found in the exhaustive and restrictive lists of the cases in which the processing
of data is lawful under Article 6 GDPR 93.

103. The principle of lawfulness goes hand in hand with the principles of fairness and
transparency in Article 5(1)(a) GDPR. The principle of fairness includes, inter alia,
recognising the reasonable expectations of the data subjects, considering possible adverse
consequences processing may have on them, and having regard to the relationship and
potential effects of imbalance between them and the controller 94.

104. The EDPB agrees with the IE SA and Meta IE that there is no hierarchy between these legal
bases 95. However, this does not mean that a controller, as Meta IE in the present case, has
absolute discretion to choose the legal basis that suits better its commercial interests. The
controller may only rely on one of the legal basis established under Article 6 GDPR if it is
appropriate for the processing at stake 96. A specific legal basis will be appropriate insofar
as the processing can meet its requirements set by the GDPR 97 and fulfil the objective of
the GDPR to protect the rights and freedoms of natural persons and in particular their right
to the protection of personal data. The legal basis will not be appropriate if its application
to a specific processing defeats this practical effect “effet utile” pursued by the GDPR and

90
Article 1(3) and Recitals 9,10 and 13 GDPR. 101
Recital 4 GDPR.
91
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 54.
92
Judgement of the Court of Justice of 13 May 2014, Google Spain SL, C-131/12, ECLI:EU:C:2014:317, paragraphs 97
and 99.
93
Judgement of the Court of Justice of 11 December 2019, TK v Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18,
ECLI:EU:C:2019:1064, (hereinafter ‘C-708/18 TK v Asociaţia de Proprietari'), paragraph 37.
94
See, recital 39 GDPR and EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 11 and 12.
95
Draft Decision paragraph 3.16 and Meta IE's Article 65 Submissions paragraph 5.12.
96
As mentioned in the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 18, the identification of the
appropriate lawful basis is tied to the principles of fairness and purpose limitation. It will be difficult for controllers
to comply with these principles if they have not first clearly identified the purposes of the processing, or if processing
of personal data goes beyond what is necessary for the specified purposes. See also Section 6 of this Binding Decision
on the potential additional infringement of the principle of fairness.
97
C-708/18 TK v Asociaţia de Proprietari, paragraph 37.
39

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

its Article 5(1)(a) and Article 6 GDPR 98. These criteria stem from the content of the GDPR110
and the interpretation favourable to the rights of data subjects to be given thereto
described in paragraph 101 above.

105. The GDPR makes Meta IE, as a data controller for the processing at stake, directly
responsible for complying with the Regulation’s principles, including the processing of data
in a lawful, fair and transparent manner, and any obligations derived therefrom 99. This
obligation applies even where the practical application of GDPR principles such as those of
Article 5(1)(a) and Article (5)(2) GDPR is inconvenient or runs counter to the commercial
interests of Meta IE and its business model. The controller is also obliged to be able to
demonstrate that it meets these principles and any obligations derived therefrom, such as
that it meets the specific conditions applicable to each legal basis 100.

106. The first condition to be able to rely on Article 6(1)(b) GDPR as a legal basis to process the
data subject’s data is that a controller, in line with its accountability obligations under
Article 5(2) GDPR, has to be able to demonstrate that (a) a contract exists and (b) the
contract is valid pursuant to applicable national contract laws 101.

107. Both the IE SA and Meta IE consider that the Facebook Terms of Service make up the entire
agreement between the Facebook user and Meta IE and that the Data Policy is simply a
compliance document setting out information to fulfil the GDPR transparency
obligations 102. The IE SA thus considers that the contract for which the analysis based on
Article 6(1)(b) must take place, is the Facebook Terms of Service only 103.

108. The IE SA and Meta IE argue that the GDPR does not confer a broad and direct competence
to supervisory authorities to interpret or assess the validity of contracts 104. In its Draft
Decision, the IE SA noted that the Complainant explicitly sought to have it investigate and
make findings in respect of contract and consumer law. The IE SA noted that this falls
outside of the remit of a supervisory authority under the GDPR and are instead within the
competence of the relevant consumer and competition authorities117.

109. The EDPB agrees that SAs do not have under the GDPR a broad and general competence
in contractual matters. However, the EDPB considers that the supervisory tasks that the

98
See C-524/06 Huber, paragraph 52 on the concept of necessity being interpreted in a manner that fully reflects
the objective of Directive 95/46). On the importance of considering the practical effect (effet utile) sought by EU law
in its interpretation, see also for instance: C-817/19 Ligue des droits humains, paragraph 195; and Judgement of the
Court of Justice of 17 September 2002, Muñoz and Superior Fruiticola, C-253/00, ECLI:EU:C:2002:497, paragraph 30.
110
Art. 1(1)(2) and (5) GDPR.
99
Art. 5 (2) GDPR “Principle of accountability” of data controllers; see also C-252/21 Oberlandesgericht Düsseldorf
request, Opinion of the Advocate General on 20 September 2022, ECLI:EU:C:2022:704, paragraph 52.
100
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 26.
101
Binding Decision 2/2022, paragraph 84.
102
Draft Decision, paragraphs 4.4 to 4.6.
103
Draft Decision, paragraph 4.6.
104
Composite Response, paragraph 45; Meta IE Article 65 Submissions, paragraph 6.43.
117
Draft Decision, paragraph 4.14.
40

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

GDPR bestows on SAs imply a limited competence to assess a contract’s general validity
insofar as this is relevant to the fulfilment of their tasks under the GDPR. Otherwise, the
SAs would see their monitoring and enforcement task under Article 57(1)(a) GDPR limited
to actions such as verifying whether the processing at stake is necessary for the
performance of a contract (Article 6(1)(b) GDPR), and whether a contract with a processor
under Article 28(3) GDPR and data importer under Article 46(2) GDPR includes appropriate
safeguards pursuant to the GDPR.
Pursuant to the IE SA’s interpretation, the SAs would thus be obliged to always consider a
contract valid, even in situations where it is manifestly evident that it is not, for instance
because there is no proof of agreement between the two parties, or because the contract does
not comply with its Member State’s rules on the validity, formation or effect of a contract in
relation to a child 105.

110. As the DE and NL SAs 106 argue, the validity of the contract for the Facebook service
between Meta IE and the Complainant is questionable given the strong indications that
the Complainant was unaware of entering into a contract, and (as the IE SA establishes
with its Finding 3 of its Draft Decision) serious transparency issues in relation to the legal
basis relied on. In contract law, as a general rule, both parties must be aware of the
substance of the contract and the obligations of both parties to the contract in order to
willingly enter into such contract.

111. Notwithstanding the possible invalidity of the contract, the EDPB refers to its previous
interpretative guidance on this matter 107 to provide below its analysis on whether
behavioural advertising is objectively necessary for Meta IE to provide its Facebook
service to the user based on its Facebook Terms of Service and the nature of the service.

112. The EDPB recalls 108 that for the assessment of necessity under Article 6(1)(b) GDPR, “[i]t
is important to determine the exact rationale of the contract, i.e. its substance and
fundamental objective, as it is against this that it will be tested whether the data
processing is necessary for its performance” 109. As the EDPB has previously stated, regard
should be given to the particular aim, purpose, or objective of the service and, for
applicability of Article 6(1)(b) GDPR, it is required that the processing is objectively
necessary for a purpose and integral to the delivery of that contractual service to the data
subject 110.

113. Moreover, the EDPB notes that the controller should be able to justify the necessity of its
processing by reference to the fundamental and mutually understood contractual

105
Art. 8(3) GDPR.
106
DE SAs Objection, p.4 and NL SA Objection, paragraph 30.
107
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR.
108
See Binding Decision 2/2022, paragraph 89.
109
WP29 Opinion 06/2014 on the notion of legitimate interests, p. 17.
110
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 30.
124
See Binding Decision 2/2022, paragraph 90.
41

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

purpose. This depends not only on the controller’s perspective, but also on a reasonable
data subject’s perspective when entering into the contract124.

114. The IE SA accepts the EDPB’s position 111 that, as a general rule, processing of personal
data for behavioural advertising is not necessary for the performance of a contract for
online services126. However, the IE SA considers that in this particular case, having regard
to the specific terms of the contract and the nature of the Facebook service provided and
agreed upon by the parties, Meta IE may in principle rely on Article 6(1)(b) GDPR to
process the user’s data necessary for the provision of its service, including through the
provision of behavioural advertising insofar as this forms a core part of that service
offered to and accepted by users.

115. The IE SA views behavioural advertising as a “core”, “fundamental” and “commercially
essential” element of the contract and the commercial transaction between Meta IE and
the Facebook users 112. In support of this consideration, the IE SA refers to the information
provided in the Facebook Terms of Service under the headings: “Provide a personalized
experience for you” and “Help you discover content, products, and services that may
interest you” 113 . The information provided includes reference to ads and includes the
statement that “[w]e use the data we have … to personalize your experience”. The IE SA
further notes that the nature of the service being offered to Facebook users is set out in
the first line of the Facebook Terms of Service, 114 which reads textually: “Provide a
personalized experience for you:”. The IE SA considers that it is clear that the Facebook
service is advertised (and widely understood) as one funded by personalised advertising
and so, that any reasonable user would expect and understand and that this was the
“bargain being struck, even if they [the users] might prefer that the market would offer
them better alternative choices”130.

116. On this issue, the EDPB recalls that the concept of necessity has its own independent
meaning under EU law. It must be interpreted in a manner that fully reflects the objective
pursued by an EU instrument, in this case, the GDPR 115 . Accordingly, the concept of
necessity under Article 6(1)(b) GDPR cannot be interpreted in a way that undermines this
provision and the GDPR’s general objective of protecting the right to the protection of
personal data 116 or contradicts Article 8 of the Charter. On the processing of data in the
Facebook service, Advocate General Rantos supports a strict interpretation of the Article

111
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 52.
126
Draft Decision, paragraph 4.53.
112
Draft Decision, paragraphs 4.42, 4.43, 4.53, 4.55 and Finding 2.
113
Draft Decision, paragraphs 4.36 to 4.38.
114
Draft Decision, paragraph 4.43.
130
Draft Decision, paragraph 4.43.
115
See paragraph 101 above on the principles guiding the interpretation of the GDPR and is provisions. The CJEU
also stated in Huber that that “what is at issue is a concept [necessity] which has its own independent meaning in
Community law and which must be interpreted in a manner which fully reflects the objective of that Directive,
[Directive 95/46], as laid down in Article 1(1) thereof”. C-524/06 Huber, paragraph 52.
116
Art. 1(2) GDPR.
42

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

6(1)(b) GDPR among other legal basis, particularly to avoid any circumvention of the
requirement for consent 117.

117. Meta IE promotes among its prospective and current users the perception that the main
purpose the Facebook service serves and for which it processes its users’ data is to enable
them to communicate with others. Meta IE presents its Facebook service in its landing
website as a platform enabling users to “connect with friends and the world around you on
Facebook” and at the beginning of its Facebook Terms of Service 118 as being its mission “to
give people the power to build community and bring the world closer together. To help
advance this mission, we provide the Products and services described below to you: (...)”
which include in consecutive headings “Connect you with people and organizations you
care about: (...)”; “Empower you to express yourself and communicate about what matters
to you: (...)” and “Help you discover content, products and services that may interest you:
(...)”.

118. The fact that the Facebook Terms of Service 119 do not provide for any contractual obligation
binding Meta IE to offer personalised advertising to the Facebook users and any contractual
penalty if Meta IE fails to do so shows that, at least from the perspective of the Facebook
user, this processing is not necessary to perform the contract. Providing personalised
advertising to its users may be an obligation between Meta IE and the specific advertisers
that pay for Meta IE’s targeted display of their advertisements in the Facebook service to
Facebook users, but it is not presented as an obligation towards the Facebook users.

119. Nor does Meta IE’s business model of offering services, at no monetary cost for the user to
generate income by behavioural advertisement to support its Facebook service, among
others, make this processing necessary to perform the contract. Under the principle of
lawfulness of the GDPR and its Article 6, it is the business model which must adapt itself and
comply with the requirements that the GDPR sets out in general and for each of the legal
bases and not the reverse. As the Advocate General Rantos stressed recently in his opinion
on Meta IE’s processing in Facebook, based on Article 5(2) GDPR, it is the controller (Meta

117
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
paragraph 51. (The EDPB refers to the Advocate General’s Opinion in its Binding Decision as an authoritative source
of interpretation to underline the EDPB’s reasoning on the processing of data in the Facebook service, without
prejudice to the case-law that the CJEU may create with its future judgments on the Cases C-252/21 and C-446/21).
118
Which the IE SA Meta IE consider as constituting the entire contract with the Facebook users (see paragraph 101).
119
The Facebook Terms of Service as formulated in one-sided terms as follows: “These Terms govern your use of
Facebook and the products, features, apps, services, technologies, and software we offer (the Facebook Products or
Products), except where we expressly state that separate terms (and not these) apply.” While under Section 1 of the
Terms of Service Facebook announces that it “provides” the following services, Section 3 of the Terms of Service is
overwritten with “Your Commitments to Facebook and Our Community”. While Facebook itself only “offers” various
services, it makes clear that the Terms of Service unilaterally impose duties and obligations on the user. Otherwise,
the user may face suspension or termination of her/his account pursuant to Section 4.2 of the Terms of Service. No
(contractual) sanctions appear to apply in the event that Meta IE fails to provide or poorly performs one or more of
these services.
43

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

IE in this case) who is responsible for demonstrating that the personal data are processed
in accordance with the GDPR 120.

120. As the EDPB provided in its guidance 121 assessing what is “necessary” involves a combined,
fact-based assessment of the processing “for the objective pursued and of whether it is less
intrusive compared to other options for achieving the same goal”. If there are realistic, less
intrusive alternatives, the processing is not “necessary”. Article 6(1)(b) GDPR will not cover
processing that is useful but not objectively necessary for performing the contractual
service or for taking relevant pre-contractual steps at the request of the data subject, even
if it is necessary for the controller’s other business purposes.

121. On the question of whether here there are realistic, less intrusive alternatives to
behavioural advertising that make this processing not “necessary” 122, the EDPB considers
that there are. The AT, PL and SE SAs mention as examples contextual advertising based
on geography, language and content, which do not involve intrusive measures such as
profiling and tracking of users 123. In his recent opinion on Facebook, Advocate General
Rantos also refers to the Austrian Government’s “pertinent” observation that in the past,
Meta IE allowed Facebook users to choose between a chronological presentation and a
personalised presentation of newsfeed content, which, in his view, proves that an
alternative method is possible 124. By considering the existence of alternative practices to
behavioural advertising that are more respectful of the Facebook users’ right to data
protection, the EDPB, as the Advocate General, aims to assess if this processing is
objectively necessary to deliver the service offered, as perceived by the Facebook user
whose personal data is processed, and not to dictate the nature of Meta IE’s service or
impose specific business models on controllers, as Meta IE and the IE SA respectively
argue 125. The EDPB considers that Article 6(1)(b) GDPR does not cover processing which is
useful but not objectively necessary for performing the contractual service, even if it is
necessary for the controller’s other business purposes 126.

120
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, paragraph 52.
121
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 25.
122
In Schecke, the CJEU held that, when examining the necessity of processing personal data, the legislature needed
to take into account alternative, less intrusive measures. Judgement of the Court of Justice of 9 November
2010, Volker und Markus Schecke GbR, Joined Cases C-92/09 and C-93/09, ECLI:EU:C:2010:662, (hereinafter ‘Case
C92/09 and C-93/09 Schecke’), paragraph 52. This was repeated by the CJEU in the Rīgas case where it held that “As
regards the condition relating to the necessity of processing personal data, it should be borne in mind that
derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly
necessary”. Judgement of the Court of Justice of 4 May 2017, Valsts policijas Rīgas reģiona pārvaldes Kārtības
policijas pārvalde v Rīgas pašvaldības SIA ‘Rīgas satiksme’, C-13/16, ECLI:EU:C:2017:336, paragraph 30.
123
AT SA Objection; pp.4-5, PL SA Objection, p.2; SE SA Objection, p.3.
124
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, footnote 80.
125
Meta IE Article 65 Submissions, paragraph 6.33 and Composite Response, paragraph 71.
126
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 25.
143
Composite Response, paragraphs 67 and 68.
44

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

122. The EDPB considers that the absolute right available to data subjects, under Article
21(2)(3) GDPR to object to the processing of their data (including profiling) for direct
marketing purposes further supports its consideration that, as a general rule, the
processing of personal data for behavioural advertising is not necessary to perform a
contract. The processing cannot be necessary to perform a contract if a subject has the
possibility to opt out from it at any time, and without providing any reason.

123. The EDPB finds that a reasonable user cannot expect that their personal data is being
processed for behavioural advertising simply because Meta IE briefly refers to this
processing in the Facebook Terms of Service (which Meta IE and the IE SA consider as
constituting the entirety of the contract), or because of the “wider circumstances” or
“recognised public awareness of behavioural advertising” derived from its “widespread
prevalence” to which the IE SA refers143. Behavioural advertising, as briefly described in
paragraph 95 above, is a set of processing operations of personal data of great technical
complexity, which has a particularly massive and intrusive nature. In view of the
characteristics of behavioural advertising, coupled with the very brief and insufficient
information that Meta provides about it in the Facebook Terms of Service and Data Policy
(a separate document that the IE SA and Meta IE do not even consider part of the
contractual obligations), the EDPB finds it extremely difficult to argue that an average user
can fully grasp it, be aware of its consequences and impact on their rights to privacy and
data protection, and reasonably expect it solely based on the Facebook Terms of Service.
The EDPB recalls its Guidelines 2/2019 in which it argues that the expectations of the
average data subject need to be consider in light, not only of the terms of service but also
the way this service is promoted to users 127. Advocate General Rantos expresses similar
doubts where he says in relation to Facebook behavioural advertising practices “I am
curious as to what extent the processing might correspond to the expectations of an
average user and, more generally, what ‘degree of personalisation’ the user can expect
from the service he or she signs up for” 128 and adds in a footnote that he does not “believe
that the collection and use of personal data outside Facebook are necessary for the
provision of the services offered as part of the Facebook profile” 129.

124. Based on the considerations above, the EDPB considers that the main purpose for which
users use Facebook and accept the Facebook Terms of Service is to communicate with
others, not to receive personalised advertisements.

125. Meta IE infringed its transparency obligations under Article 5(1)(a), Article 12(1)
and Article 13(1)(c) GDPR by not clearly informing the Complainant and other users of the
Facebook service’s specific processing operations, the personal data processed in them,
the specific purpose they serve, and the legal basis on which each of the processing

127
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 57.
128
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, paragraph 56.
129
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, footnote 81.
45

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

operations relies, as the IE SA concludes in its Draft Decision130. The EDPB considers that
this fundamental failure of Meta IE to comply with its transparency obligations contradicts
the IE SA’s finding 131 that Facebook users could reasonably expect online behavioural
advertising as being necessary for the performance of their contract (as described in the
Facebook Terms of Service) with Meta IE.

126. The EDPB recalls that “controllers should make sure to avoid any confusion as to what the
applicable legal basis is” and that this is “particularly relevant where the appropriate
legal basis is Article 6(1)(b) GDPR and a contract regarding online services is entered into
by data subjects”, because “[d]epending on the circumstances, data subjects may
erroneously get the impression that they are giving their consent in line with Article 6(1)(a)
GDPR when signing a contract or accepting terms of service” 132 . Article 6(1)(b) GDPR
requires the existence, validity of a contract, and the processing being necessary to perform
it. These conditions cannot be met where one of the Parties (in this case the data subject) is
not provided with sufficient information to know that they are signing a contract, the
processing of personal data that it involves, for which specific purposes and on which legal
basis, and how this processing is necessary to perform the services delivered. These
transparency requirements are not only an additional and separate obligation, as the IE SA
seems to imply 133, but also an indispensable and constitutive part of the legal basis.

127. The risks to the rights of data subjects derived from this asymmetry of information and an
inappropriate reliance on this legal basis are higher in situations such as in the present
case, in which the Complainant and other Facebook users face a “take it or leave it”
situation resulting from the standard contract pre-formulated by Meta IE and the lack of
few alternative services in the market. The EU legislator has regularly identified and aimed
to address with multiple legal instruments these risks and the imbalance between the
parties to consumer contracts. For example, Directive 93/13/EEC on unfair terms in
consumer contracts 134 mandates, as the transparency obligations under the GDPR, the use
of plain, intelligible language in the terms of the contracts offered to consumers 135. This
Directive even provides that where there is a doubt about the meaning of a term, the
interpretation most favourable to the consumer shall prevail 136. Processing of personal
data that is based on what is deemed to be an unfair term under this Directive will generally
not be consistent with the requirement under Article 5(1)(a) GDPR that the processing is
lawful and fair 137.

130
Draft Decision, paragraphs 5.70, 5.71 and Finding 3.
131
Draft Decision, paragraphs 4.43, 4.44, 4.51, 4.53, Finding 2.
132
Binding Decision 01/2021, paragraph 214 and EDPB Guidelines 2/2019 on Article 6(1)(b), paragraph 20
133
Draft Decision, paragraph 4.51.
134
A contractual term that has not been individually negotiated is unfair under the Directive 93/13/EEC “if, contrary
to the requirement of good faith, it causes a significant imbalance in the parties’ rights and obligations arising under
the contract, to the detriment of the consumer”, see Art. 3(1) Directive 93/13/EEC.
135
Art. 4(2) and Art. 5 Directive 93/13/EEC.
136
Art. 5 Directive 93/13/EEC.
137
EDPB Guidelines on Article 6(1)(b)GPDR, footnote 10.
46

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

128. Advocate General Rantos concludes in reference to Meta IE that the fact that an
undertaking providing a social network enjoys a dominant position in the domestic market
for online social networks for private users “does play a role in the assessment of the
freedom of consent within the meaning of that provision, which it is for the controller to
demonstrate, taking into account, where appropriate, the existence of a clear imbalance of
power between the data subject and the controller, any requirement for consent to the
processing of personal data other than those strictly necessary for the provision of the
services in question, the need for consent to be specific for each purpose of processing and
the need to prevent the withdrawal of consent from being detrimental to users who
withdraw it” 138 . In line with the logic of this argument, the EDPB considers that the
dominant position of Facebook also plays an important role in the assessment of Meta IE’s
reliance on Article 6(1)(b) GDPR for its Facebook service and its risks to data subjects,
especially considering how deficiently Meta IE informs the Facebook users of the data it
strictly needs to process to deliver the service.

129. Given that the main purpose for which a user uses the Facebook service is to communicate
with others156, and that Meta IE conditions its use to the user’s acceptance of a contract
and the behavioural advertising it includes, the EDPB cannot see how a user would have
the option of opting out of a particular processing which is part of the contract as the IE SA
seems to argue 139. The users’ lack of choice in this respect would rather indicate that Meta
IE’s reliance on the contractual performance legal basis deprives users of their rights,
among others, to withdraw their consent under Article 6(1)(a) GDPR and Article 7 GDPR
and/or to object to the processing of their data based on Article 6(1)(f) GDPR.

130. The EDPB agrees with the AT, DE, FR, IT, NL, NO, PL, PT, and SE SAs 140 that there is a risk
that the Draft Decision’s failure to establish Meta IE’s infringement of Article 6(1)(b)
GDPR, pursuant to the IE SA’s interpretation of it, nullifies this provision and makes lawful
theoretically any collection and reuse of personal data in connection with the
performance of a contract with a data subject. Meta IE currently leaves the Complainant
and other users of the Facebook service with a single choice. They may either contract
away their right to freely determine the processing of their personal data and submit to
its processing for the obscure and intrusive purpose of behavioural advertising, which
they can neither expect, nor fully understand based on the insufficient information Meta
IE provides to them. Or, they may decline accepting the Facebook Terms of Service and
thus be excluded from a service that enables them to communicate with millions of users
and for which there are currently few realistic alternatives. This exclusion would thus also
adversely affect their freedom of expression and information.

138
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, Conclusion, paragraph 78(4). 156 See paragraphs 117-118 and 122-124.
139
Composite Response, paragraph 69.
140
AT SA Objection, pp.5-6; DE SAs Objection, pp.9-10; FR SA Objection, paragraphs 35-37; IT SA Objection, pp.5- 7;
NL SA Objection, paragraphs 27, 35-36; NO SA Objection, p.7; PL SA Objection, p.2; PT SA Objection, paragraphs 63-
64; SE SA Objection, p.5.
47

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

131. This precedent could encourage other economic operators to use the contractual
performance legal basis of Article 6(1)(b) GDPR for all their processing of personal data.
There would be the risk that some controllers argue some connection between the
processing of the personal data of their consumers and the contract to collect, retain and
process as much personal data from their users as possible and advance their economic
interests at the expense of the safeguards for data subjects. Some of the safeguards from
which data subjects would be deprived due to an inappropriate use of Article 6(1)(b) GDPR
as legal basis, instead of others such as consent 6(1)(a) GDPR and legitimate interest
6(1)(f) GDPR, are the possibility to specifically consent to certain processing operations
and not to others and to the further processing of their personal data (Article 6(4) GDPR);
their freedom to withdraw consent (Article 7 GDPR); their right to be forgotten (Article 17
GDPR); and the balancing exercise of the legitimate interests of the controller against their
interests or fundamental rights and freedoms (Article 6(1)(f) GDPR). As a result, owing to
the number of users, market power, and influence of Meta IE and its economically
attractive business model, the risks derived from the current findings of the Draft Decision
could go beyond the Complainant and the millions of users of Facebook service in the EEA
and affect the protection of the hundreds of millions of people covered by the GDPR.

132. The EDPB thus concurs with the objections of the AT, DE, FR, IT, NL, NO, PL, PT and SE
SAs 141 to Finding 2 of the Draft Decision in that the behavioural advertising performed by Meta
IE in the context of the Facebook service is objectively not necessary for the performance of
Meta IE’s alleged contract with data users for the Facebook service and is not an essential or
core element of it.

133. In conclusion, the EDPB decides that Meta IE has inappropriately relied on Article 6(1)(b)
GDPR to process the Complainant’s personal data in the context of the Facebook Terms of
Service and therefore lacks a legal basis to process these data for the purpose of
behavioural advertising. Meta IE has not relied on any other legal basis to process personal
data in the context of the Facebook Terms of Service for the purpose of behavioural
advertising. Meta IE has consequently infringed Article 6(1) GDPR by unlawfully processing
personal data. The EDPB instructs the IE SA to alter its Finding 2 of its Draft Decision, which
concludes that Meta IE may rely on Article 6(1)(b) GDPR in the context of its offering of the
Facebook Terms of Service, and to include an infringement of Article 6(1) GDPR based on
the shortcomings that the EDPB has identified.

4.56 On the basis of the above, and as directed by the EDPB further to the Article 65 Decision, I find that
Facebook was not entitled to rely on Article 6(1)(b) GDPR to process the Complainant’s personal
data for the purpose of behavioural advertising in the context of the Facebook Terms of Service.

141
AT SA Objection, pp. 1-2; DE SAs Objection, pp. 2 and 10; FR SA Objection, paragraphs 5-15 ; IT SA Objection, pp
1-7; NL SA Objection, paragraphs 4, 25-36; NO SA Objection, pp.1-2; PL SA Objection, pp. 1-2 ; PT SA Objection,
paragraphs 65-68; SE SA Objection, pp. 2-3.
48

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Finding 2: I find that Facebook was not entitled to rely on Article 6(1)(b) GDPR to process the
Complainant’s personal data for the purpose of behavioural advertising in the context of the Facebook
Terms of Service.

5 ISSUE 3 – WHETHER FACEBOOK PROVIDED THE REQUISITE INFORMATION ON THE LEGAL BASIS FOR PROCESSING ON FOOT
OF ARTICLE 6(1)(B) GDPR AND WHETHER IT DID SO IN A TRANSPARENT MANNER

5.1 Processing of personal data, including transparency requirements of the GDPR, are governed by the
overarching principles set out in Article 5 GDPR, which provides that:

“1. Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data
subject (‘lawfulness, fairness and transparency’);

(b) collected for specified, explicit and legitimate purposes and not further processed
In a manner that is incompatible with those purposes; further processing for archiving
purposes in the public interest, scientific or historical research purposes or statistical
purposes shall, in accordance with Article 89(1), not be considered to be incompatible with
the initial purposes (‘purpose limitation’);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for
which they are processed (‘data minimisation’);

(d) accurate and, where necessary, kept up to date; every reasonable step must be
taken to ensure that personal data that are inaccurate, having regard to the purposes for
which they are processed, are erased or rectified without delay (‘accuracy’);

(e) kept in a form which permits identification of data subjects for no longer than is
necessary for the purposes for which the personal data are processed; personal data may
be stored for longer periods insofar as the personal data will be processed solely for
archiving purposes in the public interest, scientific or historical research purposes or
statistical purposes in accordance with Article 89(1) subject to implementation of the
appropriate technical and organisational measures required by this Regulation in order to
safeguard the rights and freedoms of the data subject (‘storage limitation’);

(f) processed in a manner that ensures appropriate security of the personal data,
including protection against unauthorised or unlawful processing and against accidental
loss, destruction or damage, using appropriate technical or organisational measures
(‘integrity and confidentiality’).

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph
1 (‘accountability’).”

5.2 Recital 58 of the GDPR, which serves as an aid to interpretation, states:

“The principle of transparency requires that any information addressed to the public or to
the data subject be concise, easily accessible and easy to understand, and that clear and
plain language and, additionally, where appropriate, visualisation be used.

Such information could be provided in electronic form, for example, when addressed to the
public, through a website.

This is of particular relevance in situations where the proliferation of actors and the
technological complexity of practice make it difficult for the data subject to know and
understand whether, by whom and for what purpose personal data relating to him or her
are being collected, such as in the case of online advertising.

Given that children merit specific protection, any information and communication, where
processing is addressed to a child, should be in such a clear and plain language that the
child can easily understand.”

5.3 Article 12(1) GDPR provides for the general manner in which information required by the transparency
provisions of the GDPR should be set out:

“The controller shall take appropriate measures to provide any information referred to in
Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to
processing to the data subject in a concise, transparent, intelligible and easily accessible
form, using clear and plain language, in particular for any information addressed
specifically to a child. The information shall be provided in writing, or by other means,
including, where appropriate, by electronic means. When requested by the data subject,
the information may be provided orally, provided that the identity of the data subject is
proven by other means.”

5.4 Article 13 GDPR enumerates specific categories of information that must be provided to data subjects
by data controllers in order to comply with transparency obligations:

“1. Where personal data relating to a data subject are collected from the data subject, the
controller shall, at the time when personal data are obtained, provide the data subject with all of
the following information:

(a) the identity and the contact details of the controller and, where applicable, of the
controller’s representative;

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

(b) the contact details of the data protection officer, where applicable;

(c) the purposes of the processing for which the personal data are intended as well as the
legal basis for the processing;

(d) where the processing is based on point (f) of Article 6(1), the legitimate interests
pursued by the controller or by a third party;

(e) the recipients or categories of recipients of the personal data, if any;

(f) where applicable, the fact that the controller intends to transfer personal data to a third
country or international organisation and the existence or absence of an adequacy
decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or
the second subparagraph of Article 49(1), reference to the appropriate or suitable
safeguards and the means by which to obtain a copy of them or where they have been
made available.

2. In addition to the information referred to in paragraph 1, the controller shall, at the time
when personal data are obtained, provide the data subject with the following further information
necessary to ensure fair and transparent processing:

(a) the period for which the personal data will be stored, or if that is not possible, the
criteria used to determine that period;

(b) the existence of the right to request from the controller access to and rectification or
erasure of personal data or restriction of processing concerning the data subject or to
object to processing as well as the right to data portability;

(c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the
existence of the right to withdraw consent at any time, without affecting the lawfulness
of processing based on consent before its withdrawal;

(d) the right to lodge a complaint with a supervisory authority;

(e) whether the provision of personal data is a statutory or contractual requirement, or a
requirement necessary to enter into a contract, as well as whether the data subject is
obliged to provide the personal data and of the possible consequences of failure to
provide such data;

(f) the existence of automated decision-making, including profiling, referred to in Article
22(1) and (4) and, at least in those cases, meaningful information about the logic
involved, as well as the significance and the envisaged consequences of such processing
for the data subject.
51

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

3. Where the controller intends to further process the personal data for a purpose other than
that for which the personal data were collected, the controller shall provide the data subject prior
to that further processing with information on that other purpose and with any relevant further
information as referred to in paragraph 2.

4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has
the information.”

5.5 In its Transparency Guidelines, which have been adopted by the EDPB, the Article 29
Working Party found that:

“A central consideration of the principle of transparency outlined in these provisions is that
the data subject should be able to determine in advance what the scope and consequences
of the processing entails and that they should not be taken by surprise at a later point
about the ways in which their personal data has been used.” 142

5.6 In the Complaint, the Complainant alleges that Facebook’s updated Terms of Service and
the hyperlinked Data Policy, together with the mode of acceptance (namely, clicking an
“accept” button) of the Terms of Service, created the conditions which led to the belief
“that all these processing operations” were based on consent under 6(1)(a) GDPR. 143 The
Investigator therefore examined whether it could be alleged that the Complainant was led
to believe this was the case.

5.7 The Complainant argues that there was a lack of clarity in respect of the data processing
which was carried out on foot of the alleged “forced consent” to the Terms of Service.
Indeed, the Complaint states that “[e]ven if a trained lawyer reads all the text that the
controller provides, he/she can only guess what data is processed, for which exact purpose
and on which legal basis. This is inherently non-transparent and unfair within the meaning
of Articles 5(1)(a) and 13(c).” 144 Furthermore, the Complainant argues that:

“The controller has in fact relied on a number of legal grounds under Article 6(1) of the
GDPR, but has given the data subject the impression, that he solely relies on consent, by
requesting the data subject to agree to the privacy policy (see above). Asking for consent
to a processing operation, when the controller relies in fact on another legal basis is
fundamentally unfair, misleading and non-transparent within the meaning of Article
5(1)(a) of the GDPR.”

142
Article 29 Working Party Guidelines on transparency under Regulation 2016/679, page 7, paragraph 10,
https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227.
143
Complaint, page 3.
144
Ibid, paragraph 2.3.1.
52

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

5.8 The Complainant asserts that the clicking of “accept” on the Terms of Service generated
the belief that the processing was based on consent. In my view, this is surprising, given
the common nature of such “click wrap” contractual agreements utilised by most, if not
all, online platforms. Nonetheless, the Complainant outlined and provided the
Commission with an affidavit (sworn statement) sworn by the data subject, which stated
that the “overall impression” created by the “accept” button was that the data subject
was providing their consent within the meaning of Article 6(1)(a) GDPR. It is stated that
the data subject did not read the Legal Basis Information Page prior to agreeing to the
Terms of Service. The Complainant raised a number of other additional points relating to
the engagement flow, including its design, which according to the Complainant was
intended to cause “user fatigue” and also an alleged difficulty in navigating to the Legal
Basis Information Page.

5.9 In this way, inherent in this Complaint is the argument that the legal basis relied on by
Facebook for processing personal data in accordance with the acceptance of the Terms of
Service is unclear.
Article 5(1)(a) GDPR sets out the requirement that, at a general level, personal data must be
processed in a transparent manner. More specific transparency requirements are contained in
Articles 12 and 13 GDPR. In particular, Article 13(1)(c) GDPR requires that “the purposes of the
processing for which the personal data are intended as well as the legal basis for processing” must
be made clear to a user. Article 12(1) GDPR sets out that this information required by Article 13
GDPR must be provided in a clear and transparent manner. Article 13 GDPR therefore prescribes
the information which must be provided to the data subject whereas Article 12(1) GDPR sets out
the way in which this information should be provided.

5.10 Given the Complaint’s focus on the alleged “forced consent” and on processing carried out
on foot of the acceptance of the Terms of Service, I confined the transparency analysis in
the Preliminary Draft Decision to questions relating to information on the lawful basis for
processing data arising from that acceptance. It follows that, as well as Article 5(1)(a)
GDPR, Article 13(1)(c) GPDR must be considered, as well as the accompanying requirement
that the information required by that latter provision be set out in accordance with Article
12(1) GDPR. As I have already found that, to the extent specific processing operations are
complained of, Facebook sought to rely on Article 6(1)(b) GDPR, the central focus of this
Decision in respect of this issue is compliance with Article 13(1)(c) GDPR in the context of
that lawful basis.

5.11 In its submissions on the Draft Report, the Complainant further detailed her objections in
relation to transparency by arguing that “there is also no clear statement which data are
processed for which purposes under the legal basis of Article 6(1)(b) GDPR”, 145 and that
“[t]he only document Facebook puts forward to prove the complainant's alleged

145
Submissions on Final Report, paragraph 2.4.1.3.
164
Ibid, paragraph 3.4.3.1.1.
53

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

information about the alleged change of legal basis is the hard-to-find sub-sub-page on
"legal basis", which is anything but an easily accessible form”.164

THE “LAYERED” APPROACH

5.12 I have already set out the reasons for my disagreement with the Investigator’s use of a distinction
between the question of whether the data subject was misled and the broader question of
whether the Data Policy complies with the transparency provisions of the GDPR. The obligation for
a controller to comply with these transparency provisions constitutes, in and of themselves, the
entirety of the Complainant’s right not to be misled under the GDPR.

5.13 When the Investigator considered compliance with the transparency requirements in this context, he
adopted a “layered” approach. That is to say, each “layer” of the documents in question were
assessed in isolation for their individual compliance before a final “cumulative” view was
expressed. Facebook disagreed with this approach, arguing that “[t]he GDPR contains no such
concept of distinct layers and does not require a layered approach. Controllers are obliged to take
appropriate measures to provide information to data subjects and are permitted to achieve this in
ways they consider appropriate”. 146

5.14 The Investigator disagreed with Facebook’s submissions, and expressed the view that:

“in order to assess the layered provision of information, it is first necessary to consider the
discrete information sources separately, in order to arrive at an overall view. Accordingly,
the following assessment of primary, secondary and tertiary sources of information
provided by Facebook is not premised on “separatist approach”, rather, it constitutes a
comprehensive assessment of the manner in which information has been provided to the
data subject. The investigator also considers that, where a controller adopts a layered
approach to the provision of information, each layer must comply independently with the
requirement of Article 12(1) GDPR regarding the provision of information”.166

5.15 I respectfully disagree with the premise of the Investigator’s reasons for adopting this approach.
Article 12(1) GDPR is directed to ensuring, insofar as possible, that the data subject receives the
information that is “provided” by the data controller. It does this by reference to the potential
barriers that could operate to prevent the information from being received by the data subject.
The requirement, for example, for the data controller to use “clear and plain language” when
“providing” the information helps to ensure that the data subject is not hindered in receiving the
information because of an inability to understand complicated or technical jargon. Similarly, the
requirement for the data controller to “provide” the information in a “concise” manner helps to

146
Submissions 22 February 2019, paragraph 5.9.
166
Final Report, paragraphs 297-298.
54

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

ensure that the data subject is not hindered in receiving the information as a result of information
fatigue caused by the incorporation of the information into a long and rambling piece of text.

5.16 Article 12(1) GDPR, however, clearly deals with “any information referred to in Articles 13 and 14 and
any communication under Articles 15 to 22 and 34” [my emphasis]. Therefore, compliance with
this provision can only be assessed by reference to the provision of information mandated by
Articles 13 and 14 GDPR as appropriate; it is not a requirement applied generally to every single
piece of information provided to the data subject concerning data processing. There is no
requirement that the information mandated by Article 13(1)(c) GDPR be contained in any
particular “layer” of information; there is simply a requirement that the information be provided,
and that the information be set out in the manner required by Article 12(1) GDPR. Therefore, each
individual “layer” cannot be assessed by reference to Article 12(1) GDPR independently of the
information required by Article 13(1)(c) GDPR.

5.17 Given that a controller is free to choose not to put particular information in a particular layer, it must
follow that Article 12(1) GDPR cannot be used as a basis for assessing each layer independently. It
may well be the case that something about the “layered” approach taken by a controller could
ultimately mean the information required by Article 13(1)(c) GDPR is not set out in the manner
required by Article 12(1) GDPR. That in itself, however, is not a justification for an isolated and/or
abstract assessment of each individual layer, without reference to other layers, for compliance
with Article 12(1) GDPR. On that basis, while the Investigator’s view on the issue of infringements
was expressed by reference to each individual layer before finally arriving at a separate view in
relation to the documents as a whole, I propose to approach the assessment strictly by reference
to the requirements of Articles 12(1) and 13(1)(c) GDPR. Once the information has been provided
and has been provided in a compliant manner, it does not matter whether a controller has
achieved the objective by the use of layering, nor does it matter what precisely is contained in
each layer.

5.18 For the avoidance of doubt, I am not expressing any particular view on the merits or otherwise of
controllers adopting a layered approach. Moreover, I am conscious that a layered approach for the
provision of information on online services has been explicitly endorsed by the Article 29 Working
Party Guidelines (and, in turn, endorsed by the EDPB). 147 I am instead expressing a view on the
appropriate manner in which to assess the compliance of any such layered information with
Articles 12 and 13 GDPR. In my view, while the Investigator’s analysis was robust and
comprehensive, the consideration of the documents was not sufficiently holistic, insofar as
individual layers were initially assessed for compliance without reference to the information or
documents as a whole.

5.19 In addition, I should add that a cumulative assessment of the information provided and the manner
in which the information is provided must always be carried out, irrespective of whether the

147
Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on
11 April 2018.
55

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Investigator was correct to also assess each layer individually, or whether Facebook was correct to
argue that the individual layers should not be considered in this manner. In circumstances where
the layered documents, when considered cumulatively, lack the information required by Article 13
GDPR or are not set out in a manner compliant with Article 12 GDPR, it matters not whether any
individual layer is deficient or otherwise; there would still be an infringement of the provision.

5.20 The Investigator was of the general view that the “Legal Basis Information Page” (a term used by the
Investigator for an unnamed page linked to the Data Policy and Terms of Service) is transparent
about Facebook’s reliance on Article 6(1)(b) GDPR, and that therefore it was transparent that data
would be processed on that basis arising out of acceptance of the Terms of Service. 148 The
Investigator went on to express a number of views to the effect that Articles 12(1) and 13(1)(c)
GDPR were being infringed on the basis that each “layer” of information failed to set
out specific processing operations (or sets of operations), their individual purpose, and the lawful
basis being relied on for each. Facebook’s position is that Article 13(1)(c) GDPR “does not require
a controller to provide this information in relation to specific processing operations, rather, it
requires transparency in relation to the processing purposes.” 149 Facebook further argues that the
definition of “processing” in Article 4(2) GDPR, i.e. an “operation or sets of operations”, cannot be
used to circumvent, what they say is, the clear intention of the legislator to use the term
“processing” instead of “processing operations”, when the latter appears in the text of the GDPR
over fifty times. 150 I consider this argument in more detail below.

5.21 Many of the points of dispute that characterise the submissions of Facebook on the Draft Report and
the contents of the Final Report relate to the dispute as to the appropriateness of assessing
compliance with reference to each individual “layer” of information. I have set out my view in that
regard already. I also note that, in its submissions on the Preliminary Draft Decision, Facebook
expressed agreement with this conclusion, and maintained that the relevant consideration “is
whether, cumulatively, the data subject has been provided with the information required under the
GDPR.” 151 Therefore I will now proceed to consider whether, in my view, Facebook has been
transparent with the Complainant (and therefore with data subjects in general) in relation to
processing for which it indicated reliance on Article 6(1)(b) GDPR. I will make further reference to
the Reports and the submissions of the parties when considering that issue.

THE EXTENT OF THE OBLIGATION IN ARTICLE 13(1)(C) GDPR

5.22 In the Investigator’s view, Article 13(1)(c) requires a data controller to set out a description of the
processing operation or sets of operations undertaken by the controller to fulfil that purpose, and
the legal basis relied on by the controller in order to carry out that processing operation or sets of
operations. His view is that “the obligation under Article 13(1)(c) requires the provision of two types

148
Final Report, Paragraph 256.
149
Submissions of 22 February 2019, paragraph 2.2.
150
Submissions on the Draft Report (September 2019), paragraph 5.5.
151
Submissions on the Preliminary Draft Decision, paragraph 7.1.
56

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

of information to the data subject: (i) information which specifies the lawful basis for processing,
and (ii) information which describes the processing associated with that lawful basis”. 152
Facebook’s view on the matter is that there is no such specific obligation for “the legal basis being
mapped to the purpose of processing”.153 Facebook argues that the legal bases and purposes can
be set out in a manner that does not necessarily link one to the other.

5.23 Article 4(2) GDPR, which deals with interpretation, states that:

“’processing’ means any operation or set of operations which is performed on personal
data or on sets of personal data, whether or not by automated means, such as collection,
recording, organisation, structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignment or combination, restriction, erasure or destruction.” [emphasis added]

5.24 I also note that Recital 60 states that “principles of fair and transparent processing require that the
data subject be informed of the existence of the processing operation and its purposes”. The Article
29 Working Party has opined that:

“Transparency is intrinsically linked to fairness and the new principle of accountability
under the GDPR. It also follows from Article 5.2 that the controller must always be able to
demonstrate that personal data are processed in a transparent manner in relation to the
data subject. Connected to this, the accountability principle requires transparency of
processing operations in order that data controllers are able to demonstrate compliance
with their obligations under the GDPR.” 154

5.25 Facebook has sought to argue that the absence of a specific reference to processing “operation” in
Article 13(1)(c) GDPR means that the obligation to provide information to data subjects does not
necessitate an approach whereby the prescribed information is provided by reference to individual
processing operation(s). In the Preliminary Draft Decision, I did not agree with this position. The
Preliminary Draft Decision set out that Article 4(2) GDPR clearly identifies that the definitions set
out in that provision are “for the purposes of” the GDPR and that there is no limitation on the
application of the prescribed definitions, either within Article 4 GDPR or in the context of other
individual provisions of the Regulation. For this reason, the Preliminary Draft Decision expressed
the view that an argument premised on a suggestion that the definition of “processing” should
only be applied to those provisions that incorporate specific reference, within its own text, to an
“operation” or “operations”, was legally unsustainable based on a literal interpretation of the
GDPR.

152
Final Report, paragraph 283.
153
Submissions on the Final Report, paragraph 5.13.
154
Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on
11 April 2018.
57

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

5.26 I note that the Investigator agreed with Facebook’s argument that Article 13(1)(c) GDPR requires a
data controller to provide information in relation to the purpose(s) of the processing in conjunction
with the corresponding legal basis for processing. However, the phrase “for which the personal
data were intended”, suggests that the data controller should also provide this information in such
a way that enables the data subject to understand which personal data are/will be processed, for
what processing operation and by reference to which legal basis, at least in broad terms.

5.27 In expressing disagreement with the proposed literal interpretation of Article 13(1)(c) GDPR set out
in the Preliminary Draft Decision, Facebook submitted that “Facebook Ireland’s interpretation
directly tracks the actual wording of the relevant GDPR provision which stipulates only that two
items of information be provided about the processing (i.e. purposes and legal bases). It says
nothing about processing operations.” 155 Facebook submitted that because, in its view, Article
13(1) GDPR applies “at the time data is collected”, it therefore refers only to “prospective
processing”. It submits that, on this basis, Article 13(1)(c) GDPR does not relate to ongoing
processing operations, but is concerned solely with information on “intended processing”. 156
Facebook’s position is therefore that Article 13(1)(c) GDPR is future-gazing or prospective only in
its application and that such an interpretation is supported by a literal reading of the GDPR.

5.28 Facebook argues that, despite the provision of a clear definition of “processing” in Article 4(2) GDPR,
Article 13(1)(c) GDPR sets out:

“only two specific features of the processing that need to be provided. Article 13(1)(c) GDPR
does not require disclosure, for example, of various other aspects of processing referenced
in Article 4(2) GDPR, namely, the intended nature of the processing, or the intended form
in which the data will be processed, or the intended duration of the processing, which is
separately required and addressed by Article 13(2)(a) GDPR. Similarly, another aspect of
processing – namely, the identity of any recipient – is explicitly included under Article
13(1)(e) GDPR, but the same is not done as regards the specifying of processing operations.
As such, the generic definition of “processing” in Article 4(2) GDPR is not relevant to the
analysis of what Article 13(1)(c) GDPR requires.”177

5.29 Facebook’s argument above is premised on the suggestion that the various provisions of Article 13
GDPR require the disclosure to data subjects of specific aspects of the broader activity or
“processing” as defined by Article 4(2) GDPR, such as the identity of a recipient, the duration of
the processing, etc. Facebook makes the point that nothing in Article 13 requires it to specify if
storage, transmission or dissemination, for example, are the forms of processing engaged. That is
correct. However, what Article 13 does clearly require is that the purposes and legal bases must
be specified in respect of the intended processing. Purposes and legal bases cannot simply be cited
in the abstract and detached from the personal data processing they concern.

155
Submissions on the Preliminary Draft Decision, paragraph 8.2(A).
156
Ibid, paragraph 8.2(B).
177
Ibid, paragraph 8.2(C).
58

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

5.30 As Facebook’s position cannot be reconciled with a literal reading of the GDPR, for completeness, it
is necessary to consider whether its position is nonetheless justified by a systemic reading based
on the legislator’s objective and the contents of the GDPR as a whole. Firstly in relation to the
argument I have just dealt with, it is important to note that transparency, both under the GDPR
and in the Guidelines that are to be considered in this Decision, are directly linked to the principle
of accountability under the GDPR. In order to ensure that actual or intended processing is carried
out in an accountable and transparent manner, the interpretation proposed by Facebook cannot
be accepted. Firstly, the absence of any level of specificity as to what the data controller is doing
with the data, and more fundamentally what data they are processing at all, would render
information on the purposes of this unspecified processing almost useless to a data subject. In the
absence of information on the nature of the data being used and the nature of the processing
being carried out, it would be nigh on impossible to exercise data subject rights in an informed
manner. Such an absence of transparency and accountability could not be reconciled with a
purposive or systematic reading of the GDPR.

5.31 Facebook goes on to provide examples of previous drafts of the GDPR where the legislator considered
requiring additional material in Article 13 GDPR, including “the existence of certain processing
activities and operations for which a personal data impact assessment has indicated that there
may be a high risk”.157 The decision of the legislator not to include a requirement to provide such
information has no impact on the applicability of the clear definition of “processing” in Article 4(2)
GDPR, and therefore does not affect the appropriate literal interpretation of Article 13(1)(c) GDPR.
In any purposive or systematic approach to interpreting the provision, the decision not to require
information on processing which the controller itself has found to be high risk does not suggest
that the controller would not otherwise be required to disclose the existence of that processing.
It would simply require a controller to disclose that a data protection impact assessment indicated
the presence of a high risk. This therefore provides no evidence that the legislator excluded in any
way the interpretation of Article 13(1)(c) GDPR being proposed.

5.32 Article 5(1)(b) GDPR states that personal data shall be “collected for specified, explicit and legitimate
purposes and not further processed in a manner that is incompatible with those purposes”, and
Article 5(1)(c) GDPR states that the data shall be “limited to what is necessary in relation to the
purposes for which they are processed” [emphasis added]. The core principles clearly focus quite
closely on the purposes for processing (defined, by Article 4(11) GDPR, as “processing operations
or sets of operations). While Article 5 GDPR lays down six different principles, those principles are
interconnected and operate, in combination, to underpin the GDPR as a whole.

5.33 Considering the purpose limitation principle, I note that this principle identifies the obligations which
arise by reference to the terms “collection” and “further” processing. This is very similar to the
language of Article 13(1)(c) GDPR, as the introductory passage to Article 13 GDPR contains a
reference to “collection”, and Article 13(1)(c) GDPR itself refers to “the purposes of the processing

157
Ibid, paragraph 8.2(E).
59

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

for which the personal data are intended”. It therefore can be said that Article 13 GDPR also
considers “collection” and “further” processing. For this reason, it is useful to examine further the
requirements and function of the purpose limitation principle enshrined in Article 5(1)(b) GDPR.

5.34 The Article 29 Working Party has provided Guidance that states:

“When setting out the requirement of compatibility, the Directive does not specifically refer
to processing for the ‘originally specified purposes’ and processing for ‘purposes defined
subsequently’. Rather, it differentiates between the very first processing operation, which
is collection, and all other subsequent processing operations (including for instance the
very first typical processing operation following collection – the storage of data).

In other words: any processing following collection, whether for the purposes initially
specified or for any additional purposes, must be considered ‘further processing’ and must
thus meet the requirement of compatibility”

5.35 This introduces a distinction between “purpose specification” and “compatible use”. In relation to
specifying the purpose for which data is collected, the Article 29 Working Party stated that:

“[P]ersonal data should only be collected for ‘specified, explicit and legitimate’ purposes.
Data are collected for certain aims; these aims are the ‘raison d’être’ of the processing
operations. As a prerequisite for other data quality requirements, purpose specification will
determine the relevant data to be collected, retention periods, and all other key aspects of
how personal data will be processed for the chosen purpose/s.”

5.36 In considering the purpose limitation principle, i.e. compatible use, it was set out that:

“There is a strong connection between transparency and purpose specification. When the
specified purpose is visible and shared with stakeholders such as data protection
authorities and data subjects, safeguards can be fully effective. Transparency ensures
predictability and enables user control.”

5.37 It was further stated that:

“In terms of accountability, specification of the purpose in writing and production of
adequate documentation will help to demonstrate that the controller has complied with
the requirement of Article 6(1)(b). It would allow data subjects to exercise their rights more
effectively – for example, it would provide proof of the original purpose and allow
comparison with subsequent processing purposes.”

5.38 The Article 29 Working Party also emphasised the benefits to the data subject from such transparency
and accountability, by enabling them to make informed choices. While I note that the guidance of

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

the Article 29 Working Party is not binding on the Commission, it nevertheless is instructive in the
understanding of transparency obligations and their relationship with the overarching principles
enshrined in Article 5 GDPR. It is clear to me from the above that the purpose limitation principle
has an important role to play, both in relation to the empowerment
of the data subject, but also in relation to underpinning and supporting the objectives of the data
protection framework as a whole under the GDPR.

5.39 I am therefore of the view that, when considering what information must be provided in relation to
the “purposes” of any processing operation, such as by way of Article 13(1)(c) GDPR, it is
important, amongst other things, to consider how the quality of information provided may
potentially impact the effective operation of the other data protection principles. This is
particularly the case where the wording of Article 13(1)(c) GDPR maps the approach of Article
5(1)(b) GDPR, i.e. by describing the obligation arising by reference to “collection” and ‘further’
processing.

5.40 The data controller must identify the categories of personal data that will be collected if they are to
comply with the requirement to specify “purpose” in accordance with the purpose limitation
principle. I am of the view that having access to the information required by Article 13(1)(c) GDPR
in conjunction with the category/categories of personal data being processed is essential if the
data subject is to be empowered to hold the data controller accountable for compliance with the
Article 5(1)(b) GDPR purpose limitation principle. The Article 29 Working Party reflects this
approach in the Transparency Guidelines, by saying:

“Transparency, when adhered to by data controllers, empowers data subjects to hold data
controllers and processors accountable and to exercise control over their personal data by,
for example, providing or withdrawing informed consent and actioning their data subject
rights. The concept of transparency in the GDPR is user-centric rather than legalistic and is
realised by way of specific practical requirements on data controllers and processors in a
number of articles.” 158

5.41 For this reason, I expressed the view in the Preliminary Draft Decision that the information provided
must set out: the purpose(s) of the specified processing operation/set of processing operations for
which the (specified category/specified categories of) personal data are intended, and the legal
basis being relied upon to support the processing operation/set of operations. In that information,
there should be a clear link between the specified category/categories of data, the purpose(s) of
the specified operation(s), and the legal basis being relied on to support the specified operation(s).
In submissions on the Preliminary Draft Decision, the Complainant agreed with this position and
that “[w]ithout such linking, we would simply see generic lists of all data, all purposes and all legal
bases under Article 6(1) GDPR without any indication of the relationships between them.”. 159

158
Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on
11 April 2018.
159
Complainant Submissions on Preliminary Draft Decision, page 20.
61

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

5.42 However, Facebook disagreed with this analysis. To set out the position simply, Facebook argues that
it is only obliged to provide specific information on (1) the purposes for the processing it carries
out and (2) the legal bases upon which it relies. This amounts to simply setting out its own purposes
and the legal bases upon which it relies for the collection and processing of personal data in order
to fulfil those objectives. Its position is that two pieces of information are required and, in addition,
it argues that there is no requirement for the individual purposes to be linked with individual legal
bases.

5.43 Facebook submits that such a “third limb” is not necessary. It submits that purpose and legal basis are
“conceptually, capable of being explained and understood without any reference to the
practicalities of the processing operations”. It further submits that the provision of information on
processing operations would in fact not aid transparency. In this regard, it also reiterates
arguments already addressed above in relation to the alleged absence of a requirement under
Article 13(1)(c) GDPR to specify processing operations. 160 Facebook specifically argues that it
would be “very difficult to achieve in ways that are “concise” and “intelligible”, as required under
Article 12(1) GDPR. This supposed requirement would therefore be intrinsically unlikely to assist
data subjects or further the purposes behind the GDPR’s transparency regime” 161

5.44 As is evident from the assessments that follow, my view is that the Data Policy and related material
sometimes, on the contrary, demonstrate an oversupply of very high level, generalised
information at the expense of a more concise and meaningful delivery of the essential information
necessary for the data subject to understand the processing being undertaken and to exercise
his/her rights in a meaningful way. Furthermore, while Facebook has chosen to provide its
transparency information by way of pieces of text, there are other options available, such as the
possible incorporation of tables, which might enable Facebook to provide the information required
in a clear and concise manner, particularly in the case of an information requirement comprising
a number of linked elements. The importance of concision cannot be overstated nonetheless.
Facebook is entitled to provide additional information to its users above and beyond that required
by Article 13 and can provide whatever additional information it wishes. However, it must first
comply with more specific obligations under the GDPR, and then secondly ensure that the
additional information does not have the effect of creating information fatigue or otherwise
diluting the effective delivery of the statutorily required information. That is simply what the GDPR
requires.

5.45 In support of the argument that the Commission’s interpretation of Article 13(1)(c) GDPR is incorrect,
Facebook also refers to Article 14(1)(d) GDPR:

“14(1)(d) GDPR expressly requires a controller to provide information to the data subject
on the categories of personal data (in circumstances where Article 14 applies) further

160
Ibid, paragraph 8.3.
161
Ibid, paragraph 8.2(F).
62

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

reinforces this point - i.e. it is clear from the fact that the concept is referred to in Article
14(1)(d) GDPR, that the legislators made a deliberate choice not to include this concept in
Article 13(1)(c) GDPR. Indeed, if the Commission’s interpretation was correct there would
have been no need for Article 14(1)(d) GDPR, as Article 14(1)(c) GDPR would in any event
have to be approached on the basis that categories of data needed to be identified. As
such, the Commission’s approach appears to conflict with the statutory interpretation
principle expressio unis est exclusio alterius” 162

5.46 In addressing this argument, it is important to underline the fundamental differences between Articles
13 and 14 GDPR. The first fundamental difference between Articles 13 and 14 GDPR is that Article
13 GDPR is expressly stated to apply in circumstances where “personal data are collected from the
data subject”. Article 14 GDPR, on the other hand, only applies in circumstances where personal
data have been obtained from a source(s) other than the data subject. The second fundamental
difference is that the information prescribed by Article 13 GDPR must be provided to the data
subject “at the time when personal data are obtained”. The information prescribed by Article 14,
however, can only be provided after the personal data has been collected.

5.47 These fundamental differences give rise to variations in the information required to be provided
pursuant to Article 13 GDPR, on the one hand, and the information required to be provided
pursuant to Article 14 GDPR, on the other. Firstly, Article 13(2)(e) GDPR requires the controller to
inform the data subject as to “whether the provision of personal data is a statutory or contractual
requirement, or a requirement necessary to enter into a contract, as well as whether the data
subject is obliged to provide the personal data and of the possible consequences of failure to
provide such data.” Article 14 GDPR, on the other hand, contains no such requirement. The
rationale for this difference is clear. When this information is provided prior to the collection of
personal data, the data subject is empowered to exercise control over their personal data. It avoids
them being placed in a position where they provide personal data to the controller on a mistaken
understanding as to either the necessity for its collection, or of the potential consequences of
failure to provide it. The provision of such information would have no purpose if provided to the
data subject after the personal data has been collected, hence its omission from Article 14 GDPR.

5.48 Secondly, Article 14(1)(d) GDPR requires that the data subject to be provided with information as to
the “categories of personal data concerned” while Article 14(2)(f) GDPR requires the provision of
information as to the source “from which the personal data originate”. These requirements are
notably absent from Article 13. The rationale for these omissions is clear by reference to the
exemption to the obligation to provide information set out in Articles 13(4) and Article 14(5)(a)
GDPR. These exemptions provide that the controller’s obligation to provide the specified
information “shall not apply where and insofar as the data subject already has the information”.
Therefore, both of these transparency provisions clearly envisage that they need not apply where
the data subject has the information in question.

162
Ibid, paragraph 8.4(C).
63

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

5.49 In some cases where personal data has been collected from the data subject, the data subject may
already know the categories of personal data and the source of this information, because it is the
data subject that has provided the personal data to the controller. Equally, however, some
collection directly from the data subject is less obvious to the data subject for example where
metadata or device data is collected from them. The data subject will, however, likely never have
this knowledge if the data have been collected in the circumstances envisaged by Article 14 GDPR.
It is therefore envisaged by both Articles 13 and 14 GDPR that in all circumstances, the data subject
will have this information. In the case of Article 14 GDPR, the personal data has not been obtained
by the data subject, and so Article 14 GDPR specifies that additional information should be
provided. In the case of Article 13 GDPR, it may be the data subject who will have provided the
data, and so the data subject may already know this information. In my view, this is the distinction
between the provisions and the clear motivation of the legislator in including these categories of
information in Article 14 GDPR alone.

5.50 Furthermore, it is unclear why a data subject would only be entitled to this information if the
controller has acquired their personal data from another source. It is further difficult to understand
how such a difference in treatment, between two categories of data subject, could be consistent
with the GDPR, particularly where the difference in treatment concerns a core data subject right.
If this were true, a data subject would only be entitled to this information if the personal data were
obtained from a source other than themselves, but would not if it was obtained from them directly.
This entirely arbitrary distinction is inconsistent with the clear aims of the GDPR to provide a series
of universal rights to all data subjects, grounded on the universal right to data protection in Article
8 of the Charter. Therefore even if the interpretation advanced in the preceding paragraph were
incorrect, Facebook’s submissions would nonetheless not be supported by a purposive or
systematic reading of the GDPR.

5.51 In any event, Facebook’s submissions operate on the assumption that, as has been quoted above,
Article 14(1)(d) GDPR would not be necessary if the Commission’s interpretation of Article 13(1)(c)
GDPR were applied mutatis mutandis to Article 14(1)(c) GDPR. This conflates the information the
Commission’s interpretation requires i.e. the “processing operations or sets of operations”, and
the information required by Article 14(1)(d) GDPR, i.e. “categories of personal data”.

5.52 My view is Article 13(1)(c) GDPR therefore does require what has been described as the “third link”
in this chain: the relevant information for the purposes of Article 13(1)(c) GDPR must be provided
by reference to the processing operations themselves. This is supported both by a literal reading
of the provision, having regard to the definition in Article 4(2) GDPR, and the systematic reading I
have just set out above. This provision specifically refers to the purposes for which the personal
data are intended. When the purposes and legal basis for processing are identified, they
must be identified by reference to the personal data being processed or, at a minimum, the broad
personal data processing operations to which they relate. The purposes and legal basis of
processing personal data can only be understood by reference to the processing operations being
undertaken. In order for information in this regard to be meaningful, and to provide data subjects
with meaningful information as to whether they wish to exercise data subject rights, data subjects
64

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

must be provided with this information. This goes to the essence of transparency in relation to the
processing of personal data. In providing information on “the purposes of the processing for which
the personal data are intended as well as the legal basis for the processing” for the purposes of
Article 13(1)(c) GDPR, the data controller must do so by reference to the personal data being
processed or, at least, the broad personal data processing operations involved.

INFORMATION PROVIDED BY FACEBOOK IN RELATION TO PROCESSING IN ACCORDANCE WITH ARTICLE 6(1)(B) GDPR

5.53 The starting point in assessing this information provided by Facebook is the Data Policy. Facebook
itself asserts that this is the document it uses to comply with the transparency obligations under
Article 13(1)(b) GDPR. In the Data Policy, there is a section entitled “What is our legal basis for
processing data?”. The section dealing with contractual necessity is as follows:

“We collect, use and share the data that we have in the ways described above:

• as necessary to fulfil our Facebook Terms of Service or Instagram Terms of Use”

5.54 I note at this point that the Data Policy contains a hyperlink where users can “Learn more about these
legal bases and how they relate to the ways in which we process data”. This hyperlink is found at
the end of the section partly quoted above, which lists processing carried out pursuant to each
lawful basis under the GDPR. As I have set out in Section 2, this hyperlink directs Facebook users
to an unnamed page that the Investigator terms the “Legal Basis Information Page”. For clarity, I
retain this definition. This page sets out that:

“For all people who have legal capacity to enter into an enforceable contract, we process data
as necessary to perform our contracts with you (the Facebook Terms and Instagram Terms,
together, 'the Terms'). We describe the contractual services for which this data processing is
necessary in the “Our Services” section of the Terms, and in the additional informational
resources accessible from the Terms. The core data uses necessary to provide our contractual
services are:

• To provide, personalize, and improve our Facebook Products;
• To promote safety, integrity, and security;
• To transfer, transmit, store, or process your data outside the EEA, including to within the
United States and other countries;
• To communicate with you, for example, on Product-related issues; and
• To provide consistent and seamless experiences across the Facebook Company Products.

These uses are explained in more detail in our Data Policy, under “How do we use this
information?” and “How do we operate and transfer data as part of our global services?” and
“How do the Facebook Companies work together?” We’ll use the data we have to provide these

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

services; if you choose not to provide certain data, the quality of your experience using the
Facebook Products may be impacted.”

5.55 It is clear from the above that Facebook users are invited to receive more information from other
hyperlinked sources. In relation to the “Terms of Service” hyperlink, it directs users to the relatively
lengthy Terms of Service which includes several other hyperlinks, including a hyperlink to the Data
Policy. Users are also directed to the “Our Services” section of the Terms of Service, which sets out
the following:

“Our mission is to give people the power to build community and bring the world closer
together. To help advance this mission, we provide the Products and services described
below to you:

Empower you to express yourself and communicate about what matters to you:
There are many ways to express yourself on Facebook and to communicate with
friends, family, and others about what matters to you - for example, sharing
status updates, photos, videos, and stories across
the Facebook Products you use, sending messages to a friend or several people, creating
events or groups, or adding content to your profile. We also have developed, and continue
to explore, new ways for people to use technology, such as augmented reality and 360
video to create and share more expressive and engaging content on Facebook.

Help you discover content, products, and services that may interest you:

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

We show you ads, offers, and other sponsored content to help you
discover content, products, and services that are offered by the many
businesses and organizations that use Facebook and other Facebook
Products. Our partners pay us to show their content to you, and we
design our services so that the sponsored content you see is as relevant
and useful to you as everything else you see on our Products.

Provide consistent and seamless experiences across the Facebook Company Products:
Our Products help you find and connect with people, groups, businesses, organizations,
and others that are important to you. We design our systems so that your experience is
consistent and seamless across the different Facebook Company Products that you use.

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

For example, we use data about the people you engage with on Facebook to make it
easier for you to connect with them on Instagram or Messenger, and we enable you to
communicate with a business you follow on Facebook through Messenger.

5.56 In addition, users are directed to the “How do we use this information” section of the Data Policy. It
sets out the following:

“We use the information we have (subject to choices you make) as described below and to
provide and support the Facebook Products and related services described in the Facebook
Terms and Instagram Terms. Here's how:

• Information across Facebook Products and devices: We connect
information about your activities on different Facebook Products and
devices to provide a more tailored and consistent experience on all
Facebook Products you use, wherever you use them. For example, we
can suggest that you join a group on Facebook that includes people
you follow on Instagram or communicate with using Messenger. We
can also make your experience more seamless, for example, by
automatically filling in your registration information (such as your

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

phone number) from one Facebook Product when you sign up for an
account on a different Product.

• Location-related information: We use location-related information
such as your current location, where you live, the places you like to
go, and the businesses and people you're near-to provide, personalize
and improve our Products, including ads, for you and others. Location
related information can be based on things like precise device
location (if you've allowed us to collect it), IP addresses, and
information from your and others' use of Facebook Products (such as
check-ins or events you attend).

• Product research and development: We use the information we have
to develop, test and improve our Products, including by conducting
surveys and research, and testing and troubleshooting new products
and features.

• Face recognition: If you have it turned on, we use face recognition
technology to recognize you in photos, videos and camera
experiences. The face-recognition templates we create are data with
special protections under EU law. Learn more about how we use face
recognition technology, or control our use of this technology in
Facebook Settings. If we introduce face-recognition technology to
your Instagram experience, we will let you know first, and you will
have control over whether we use this technology for you.

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

5.57 Facebook users are invited, by way of various hyperlinks, to receive further information on the
matters set out above.

5.58 Facebook users are also invited, in the Legal Basis Information Page detailing processing based on
Article 6(1)(b) GDPR, to consider the sections of the Data Policy entitled “How do we operate and
transfer data as part of our global services” and How do the Facebook Companies work together?”
The former states as follows:

“We share information globally, both internally within the Facebook Companies and
externally with our partners and with those you connect and share with around the world
in accordance with this policy. Information controlled by Facebook Ireland will be
transferred or transmitted to, or stored and processed in, the United States or other
countries outside of where you live for the purposes as described in this policy. These data
transfers are necessary to provide the services set forth in the Facebook Terms and
Instagram Terms and to globally operate and provide our Products to you. We utilize
standard contractual clauses approved by the European Commission and rely on the
European Commission's adequacy decisions about certain countries as applicable for data
transfers from the EEA to the United States and other countries”

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

5.59 The latter states as follows:

“Facebook and Instagram share infrastructure, systems and technology with other
Facebook Companies (which include WhatsApp and Oculus) to provide an innovative,
relevant, consistent and safe experience across all Facebook Company Products you use.
We also process information about you across the Facebook Companies for these purposes,
as permitted by applicable law and in accordance with their terms and policies. For
example, we process information from WhatsApp about accounts sending spam on its
service so we can take appropriate action against those accounts on Facebook, Instagram
or Messenger. We also work to understand how people use and interact with Facebook
Company Products, such as understanding the number of unique users on different
Facebook Company Products.”

WHETHER FACEBOOK COMPLIES WITH ARTICLES 5(1)(A), 12(1) AND 13(1)(C) GDPR

5.60 As set out above, the information in the Legal Basis information Page and associated sections of the
referenced Data Policy is provided by way of a summary in the Legal Basis Information Page, which
directs users to various other documents and texts. The approach taken is somewhat disjointed in
that the “summary” of the “core data uses” has been set out in expressly generalised terms,
divorced from specific processing operations. If the user wishes to learn more, they must view the
Terms of Service and also review the sections of the Data Policy to which they are directed. When
all of the available information has been accessed, it becomes apparent that the texts provided
are variations of each other, in that they re-iterate the goals and objectives of Facebook in carrying
out data processing (for example, personalisation, communication, analytics, product
improvement, etc.) rather than elaborating on this or providing information concerning processing
operations. This approach lacks clarity and concision, and makes it difficult for the user to access
meaningful information as to the processing operations that will be grounded on Article
6(1)(b) GDPR or on other legal bases. In my view, insufficient detail has been provided in relation
to the processing operations carried out both in general and on the basis of Article 6(1)(b) GDPR
specifically. Such an approach deprives the user of meaningful information and further risks
causing significant confusion as to what legal basis will be relied upon to ground a specific
processing operation.

5.61 In response to the Preliminary Draft Decision, the Complainant agreed with the approach taken on
this issue, and emphasised that “the most relevant change in Facebook’s position”, in the
Complainant’s view is that the decision to rely on Article 6(1)(b) GDPR for the processing in
question and not consent, following the GDPR taking legal effect, was contained in the last layer
of information and not displayed prominently. 163

163
Complainant Submissions on Preliminary Draft Decision, page 19.
71

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

5.62 In response to the Preliminary Draft Decision, which provisionally found that the information was
provided in a disjointed manner and that the texts were variations of each other, Facebook
submitted that it “…maintains that the manner in which it has discharged its obligation under
Article 13(1)(c) GDPR is entirely appropriate and compliant with the GDPR.” 164 In particular, its
position is that the documents have been structured so as to present the information in as simple
a manner as possible. It also argues that the presence of information in separate hyperlinked pages
that at times contains cross-over “has been provided in a context where data subjects often wish
to periodically seek out information of interest to them instead of digesting the entirety of these
documents at once”. 165 It further defends the use of similar (but varied) text in the Data Policy to
the Terms of Service on the grounds that they are distinct documents with distinct purposes, and
that “[t]he use of summary bullet points, instead of reproducing the relevant text from the Terms
of Service in full makes the information more accessible to users regardless of their online or legal
sophistication.” 166

5.63 I do not accept these arguments. First of all, while it remains the case that it is for Facebook to provide
accessible information that is clear and concise for users regardless of their “sophistication”, that
does not detract from the core of the criticism that the disjointed information set out in
generalised terms is “divorced from specific processing operations”.188 It is not that the presence
of variations of the same information in several documents is of itself noncompliant, but rather
that it is not compliant when it amounts, in practice, to statements about services and objectives
that are not linked to specified processing operations and which do not provide meaningful
information to the data subject on the core issues identified in Article 13 GDPR. The fact that this
disjointed information is generalised and does not contain the required information (as has been
set out when I addressed the correct interpretation of Article 13(1)(c)
GDPR), renders the information as a whole unhelpful and ultimately inconsistent with Article 13
GDPR.

5.64 Put simply, it impossible to identify what processing operations will be carried out in order to fulfil
the objectives that are repeated throughout the documents and the legal basis for such
operations. In the absence of such information, the user is left to guess as to what processing is
carried out on what data, on foot of the specified lawful bases, in order to fulfil these objectives.
For the reasons set out above in relation to the correct interpretation of Article 13(1)(c) GDPR, this
is insufficient information.

5.65 I note that some minimal information is provided in relation to the processing that will be carried out,
notably in relation to location information and IP addresses. I note, however, that this is prefaced
by “such as”, and describes location-based information as “things like…” These are, in my view,
clear examples of the open-ended language that is not conducive to the provision of information

164
Ibid, paragraph 8.10.
165
Ibid.
166
Ibid, paragraph 8.11(A).
188
Paragraph 5.60 above.
72

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

in a transparent manner. Moreover, it is unclear for what purpose this personal data is used, and
indeed to what extent any such data might be (however minimally) processed to fulfil the
objectives of the contractual relationship between Facebook and a user, and to what extent the
processing of such data is based on another legal basis such as consent.

5.66 Article 12(1) GDPR requires information to be provided in a “concise, transparent, intelligible and
easily accessible form, using clear and plain language, in particular for any information addressed
specifically to a child.” The information that has been provided by Facebook is disjointed, and
requires users to move in and out of various sections of the Data Policy and Terms of Service. I
note that Facebook argues that “[c]ritically, it is the Data Policy and the Legal Basis Information
Page which are the means by which Facebook Ireland satisfies the requirements of Article 13(1)(c)
GDPR (as explained above) – not the Terms of Service”. 167 As I have set out, however, I am not
satisfied that the Data Policy and Legal Basis Information Page satisfy the requirements of Article
13(1)(c) GDPR either individually or cumulatively.

5.67 Facebook argues that it met the requirements of Article 12(1) GDPR and that:

“the GDPR allows considerable discretion for the controller as to the mode of compliance,
taking into account its interests as well as those of data subjects its likely better
understanding of both its services and its users, and; in particular allowing for a balancing
of thoroughness with concision, intelligibility and accessibility. The obligation is not to
provide information in a way that a particular supervisory authority (or anyone else)
considers to be the best or preferred manner, but to do so in a way that meets an objective
threshold standard.”190

5.68 There is no doubt but that a controller has a certain amount of discretion as to the mode of
compliance. Neither is there any question of a supervisory authority’s “preferred manner” having
any bearing on compliance with Article 12(1) GDPR, or any other provision. Rather it falls to the
supervisory authority to assess compliance with the relevant provisions of the GDPR. In this case,
there has been a failure to provide information in a concise manner in light of the failings
associated with the disjointed and generalised nature of the documents in question. The
information is neither concise nor transparent, and the language is neither clear nor plain, instead
being expressed by reference to abstract objectives and purposes without any connection to
specific categories of personal data or processing operations being undertaken.

5.69 Furthermore, it is concerning that, even if a user actively sought out the additional information that
is available by way of the various links from the Terms of Service, the user would be presented
with variations of information previously furnished rather than further and more detailed

167
Submissions on Draft Report, paragraph 7.1(A).
190
Ibid, paragraph 9.3.
73

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

information that would enable the user to better understand the processing involved. By way of
example, there is significant overlap between the information set out in the “How do we use this
information” section of the Data Policy and the contents of the “Our Services” section of the Terms
of Service. Similarly, the summary of “core uses” set out in the section of the Legal Basis
Information Page that deals with Article 6(1)(b) GDPR contains a sub-set of the information
provided in the “Our Services” section of the Terms of Service. The way in which the information
has been spread out on multiple subsections and has been drafted in similarly worded (and
hyperlinked) text means that a user could easily overlook any new elements available within the
linked text. It is not the case that a user would be presented with more detailed information once
they go to the pages they are directed to; the information made available is similar in both
substance and appearance to the information that is available both in the primary text and other
hyperlinked texts. The submissions of Facebook on the Preliminary Draft Decision, as set out
above, defend this practice. However, in my view, the varied sophistication of users is not a
sufficient excuse to provide information that is, as I have set out, variations of the same thing
rather than information that gradually becomes more detailed. This issue is compounded by the
absence of information on processing operations themselves. Even the most sophisticated user
would struggle to understand the purposes of the processing for which the personal data are
intended as well as the legal basis for the processing in this context.

5.70 I emphasise that the Investigator, in preparing the Final Report, carried out a highly detailed and
thorough analysis of the documents set out above and how they interrelate. While I have adopted
a different approach, in not considering each “layer” in the abstract, I am equally convinced that
the requisite information is neither present nor set out in a transparent manner. Moreover, I am
of the view that, where this is the case on a cumulative reading of all of the documents (a matter
on which I am in clear agreement with the Investigator), in this instance, nothing of substance
turns on the question of whether an individualised assessment of each “layer” should be carried
out.

5.71 I am of the view that the criticisms in the Complaint have merit to the extent that the information
provided was not to the standard of clarity required by the GDPR. The way in which the relevant
information has been presented requires the user to seek out the additional texts made available
by way of the various hyperlinks. There is no single composite text or layered route available to
the user such as would allow them to quickly and easily understand the full extent of processing
operations that will take place as regards their personal data arising from their acceptance of the
Terms of Service. Each additional layer presents the user with similar information to that already
provided as well as some new information which is not easy to identify, as the language used is
similar to the information that has been provided before. The user should not have to work so
hard to access the prescribed information; nor should there be ambiguity as to whether all sources
of information have been exhausted. This gives rise to real risks, such as those articulated by the
Complainant, that there will be confusion as to what legal basis is being relied on for what
processing operation(s). That is precisely what seems to have happened in the context of this
Complaint, and is one of the main factual themes running through this entire Inquiry.

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

5.72 Information on the specific processing operations (necessarily including the data processed) that will
be carried out for the purposes specified and by reference to the lawful bases specified (the latter
two being currently, in my view, set out in a disjointed manner) should have been provided to the
data subject. To the extent that this information was provided at all, it was not clearly linked with
a specific purpose or lawful basis, and was described in an ambiguous manner (such as in my
analysis of the information on location-based data above).

5.73 The alleged “forced consent” and the dispute surrounding the processing operations being carried
out, and the legal bases underpinning them, are reflective of a broader lack of clarity as regards
the link between the purposes of processing, the lawful bases of processing and the processing
operations involved. Article 13(1)(c) GDPR requires that this information be set out, and Article
12(1) GDPR requires that this same information be set out in a particular manner.

5.74 Finally, in its submission on the Preliminary Draft Decision, Facebook took issue with a proposed
finding of an infringement of Article 5(1)(a) GDPR. In particular, Facebook argued that there cannot
be an automatic infringement of Article 5(1)(a) GDPR simply because Articles 12(1) and 13(1)(c)
GDPR have been infringed, or in the alternative that nothing further has occurred beyond the
infringements to merit a finding of an infringement of Article 5(1)(a) GDPR. 168

5.75 The Commission does not consider that an infringement of Article 5(1)(a) GDPR necessarily or
automatically flows from findings of infringement under Articles 12 and/or 13 GDPR. Nevertheless,
there is an important link between these provisions.

5.76 By way of elaboration, at the core of this Complaint lies an assumption on the Complainant’s part that
Facebook, which relied largely on consent as a matter of data protection law for the processing in
question up to the coming into effect of the GDPR, was still relying on GDPR consent for the
acceptance of the Terms of Service following the coming into effect of the GDPR. It has been
submitted that this assumption was compounded by the engagement flow which presented users
with a number of opportunities to consent, before the final “I agree”.

5.77 While there is no particularised requirement under the GDPR to provide data subjects with
information on an alteration of a legal basis, or to provide information in a particular part of any
such engagement flow, the lack of clarity on such a fundamental issue underlines the inherent lack
of transparency in the information provided to the data subject. Article 5(1)(a) links transparency
to the overall fairness of the activities of a controller by requiring that personal data shall be
“processed lawfully, fairly and in a transparent manner in relation to the data subject”. 169 Having
regard to the findings made above, it is appropriate for the Commission to make a finding that
Facebook has also infringed Article 5(1)(a) GDPR in the circumstances of this case.

168
Facebook Submissions on Preliminary Draft Decision, section 10.
169
C Kuner et al eds, The EU General Data Protection Regulation: A Commentary (Oxford 2020), pages 314-315.
75

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Finding 3: In relation to processing for which Facebook indicated reliance upon Article 6(1)(b) GDPR,
Articles 5(1)(a), 12(1) and 13(1)(c) have been infringed.

Additional Issue: Whether Facebook infringed the Article 5(1)(a) GDPR principle of fairness

5.78 During the course of the Article 60 consultation period, the Italian SA raised an objection to the Draft
Decision, the purpose of which was to require the amendment of the Draft Decision to include a
new finding of infringement of the Article 5(1)(a) principle of fairness. The Commission decided
not to follow the objection in circumstances where compliance with the Article 5(1)(a) principle of
fairness was not examined during the course of this inquiry and, consequently, Facebook was
never afforded the opportunity to be heard in response to a particularised allegation of
wrongdoing, as required by Irish and EU law. Accordingly the Commission referred the objection
to the EDPB for determination pursuant to Article 65(1)(a) GDPR. Having considered the matter,
the EDPB determined as follows:

219. The EDPB underlines that the principles of fairness, lawfulness and transparency, all three
enshrined in Article 5(1)(a) GDPR, are three distinct but intrinsically linked and interdependent
principles that every controller should respect when processing personal data. The link between
these principles is evident from a number of GDPR provisions: Recitals 39 and 42, Articles 6(2)
and 6(3)(b) GDPR refer to lawful and fair processing, while Recitals 60 and 71 GDPR, as well as
Articles 13(2), 14(2) and 40(2)(a) GDPR refer to fair and transparent processing.

220. On the basis of the above consideration, the EDPB agrees with the IE SA’s view that
“Article 5(1)(a) links transparency to the overall fairness of the activities of a controller” 170 but
considers that the principle of fairness has an independent meaning and stresses that an
assessment of Meta IE’s compliance with the principle of transparency does not automatically
rule out the need for an assessment of Meta IE’s compliance with the principle of fairness too.

221. The EDPB recalls that, in data protection law, the concept of fairness stems from the EU
Charter of Fundamental Rights 171. The EDPB has already provided some elements as to the
meaning and effect of the principle of fairness in the context of processing personal data. For
example, the EDPB has previously opined in its Guidelines on Data Protection by Design and by
Default that “Fairness is an overarching principle which requires that personal data should not
be processed in a way that is unjustifiably detrimental, unlawfully discriminatory, unexpected
or misleading to the data subject” 172.

170
Draft Decision, paragraph 5.76.
171
Art. 8 EU Charter of Fundamental Rights states as follows: “1. Everyone has the right to the protection of personal
data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the
consent of the person concerned or some other legitimate basis laid down by law” (emphasis added).
172
EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, Version 2, Adopted on 20 October
2020 (hereinafter “EDPB Guidelines on Data Protection by Design and by Default”), paragraph 69.
76

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

222. Among the key fairness elements that controllers should consider in this regard, the
EDPB has mentioned autonomy of the data subjects, data subjects’ expectation, power
balance, avoidance of deception, ethical and truthful processing 173 . These elements are
particularly relevant in the case at hand. The principle of fairness under Article 5(1)(a) GDPR
underpins the entire data protection framework and seeks to address power asymmetries
between the data controllers and the data subjects in order to cancel out the negative effects
of such asymmetries and ensure the effective exercise of the data subjects’ rights. The EDPB
has previously explained that “the principle of fairness includes, inter alia, recognising the
reasonable expectations of the data subjects, considering possible adverse consequences
processing may have on them, and having regard to the relationship and potential effects of
imbalance between them and the controller” 174.

223. The EDPB recalls that a fair balance must be struck between, on the one hand, the
commercial interests of the controllers and, on the other hand, the rights and expectations of
the data subjects under the GDPR 175. A key aspect of compliance with the principle of fairness
under Article 5(1)(a) GDPR refers to pursuing “power balance” as a “key objective of the
controller-data subject relationship” 176, especially in the context of online services provided
without monetary payment, where users are often not aware of the ways and extent to which
their personal data is being processed 177 . Consequently, lack of transparency can make it
almost impossible in practice for the data subjects to exercise an informed choice over the use
of their data 178, which is in contrast with the element of “autonomy” of data subjects as to the
processing of their personal data 179.

224. Considering the constantly increasing economic value of personal data in the digital
environment, it is particularly important to ensure that data subjects are protected from any
form of abuse and deception, intentional or not, which would result in the unjustified loss of
control over their personal data. Compliance by providers of online services acting as controllers
with all three of the cumulative requirements under Article 5(1)(a) GDPR, taking into account
the particular service that is being provided and the characteristics of their users, serves as a
shield from the danger of abuse and deception, especially in situations of power asymmetries.

173
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
174
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 12.
175
On the balance between the different interests at stake see for example: Judgement of the Court of Justice of 12
December 2013, X, C-486/12, ECLI:EU:C:2013:836; Judgement of the Court of Justice of 7 May 2009, College van
burgemeester en wethouders van Rotterdam v M. E. E. Rijkeboer, C-553/07, ECLI:EU:C:2009:293; Judgment of the
Court (Grand Chamber) of 9 November 2010, Volker und Markus Schecke GbR (C-92/09) and Hartmut Eifert (C-93/09)
v Land Hessen, ECLI:EU:C:2010:662.
176
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
177
On “online services”, see further EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 3-5.
178
further EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 4.
179
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70. According to this element of fairness,
“data subjects should be granted the highest degree of autonomy possible to determine the use made of their
personal data, as well as over the scope and conditions of that use or processing”.
77

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

225. The EDPB has previously emphasised that the identification of the appropriate lawful
basis is tied to the principles of fairness and purpose limitation180. In this regard, the IT SA rightly
observes that while finding a breach of transparency relates to the way in which information
has been provided to users via the Facebook Terms of Service and Privacy Policy, compliance
with the principle of fairness also relates to “how the controller addressed the lawfulness of the
processing activities in connection with its social networking service” 181 . Thus, the EDPB
considers that an assessment of compliance by Meta IE with the principle of fairness requires
also an assessment of the consequences that the choice and presentation of the legal basis
entail for the Facebook service users. In addition, that assessment cannot be made in the
abstract, but has to take into account the specificities of the particular social networking service
and of the processing of personal data carried out, namely for the purpose of online behavioural
advertising182.

226. The EDPB notes that in this particular case the breach of Meta IE’s transparency
obligations is of such gravity that it clearly impacts the reasonable expectations of the Facebook
users by confusing them on whether clicking the “Accept” button results in giving their consent
to the processing of their personal data. The EDPB notes in this regard that one of the elements
of compliance with the principle of fairness is avoiding deception i.e. providing information “in
an objective and neutral way, avoiding any deceptive or manipulative language or design” 183.

227. As the IE SA itself notes, the Complainant argues that Meta IE relied on “forced consent”
for the processing simply because it did in fact believe that the legal basis for processing the
controller was relying upon was consent 184. This is illustrated by the multiple arguments that
the Complainant presents in order to demonstrate the “forced consent”, including the reference
to the use by Meta IE of “additional ‘tricks’ to pressure the users” 185 . For example, the
Complainant refers to the inclusion in the user interface page of “two fake red dots (violation
against Article 5(1)(a) – neither ‘fair’, nor ‘transparent’), that indicated that the user has new
messages and notifications, which he/she cannot access without consenting – even if the user
did not have such notifications or messages in reality” 186 . The EDPB considers that the LSA
should have taken into account the use of such practices by Meta IE in relation to the principle
of fairness, regardless of its finding that Meta IE has not sought to rely on consent in order to
process personal data to deliver the Facebook Terms of Service 187.

228. In addition, and as previously mentioned in paragraph 97 of this Binding Decision, the
Complainant presents the results of a poll according to which only 1.6% to 2.5% of the 1000

180
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 1.
181
IT SA Objection, paragraph 2.3.
182
See Draft Decision, paragraph 4.44 where the IE SA holds that “targeted advertising forms a core element of
Facebook’s business model” and Meta IE Article 65 Submissions, paragraph 6.32 where Meta IE claims that “It would
be impossible to provide the Facebook Service in accordance with the Terms of Service without providing behavioural
advertising”.
183
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
184
Draft Decision, paragraph 3.2.
185
Complaint, paragraph 1.4.
186
Complaint, paragraph 1.4.
187
Draft Decision, Finding 1.
78

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Facebook users who responded to the poll understood the request to accept the Facebook
Terms of Service to be a contract 188 . In the EDPB’s view, there are clear indications that
Facebook users’ expectations with regard to the applicable legal basis have not been fulfilled 189.

229. As recognised by the IE SA itself, “the user is left to guess as to what processing is carried
out on what data” 190. Therefore, the EDPB shares the IT SA’s concern that Facebook users are
left ”in the dark"214and considers that the processing by Meta IE cannot be regarded as ethical
and truthful 191 because it is confusing with regard to the type of data processed, the legal basis
and the purpose of the processing, which ultimately restricts the Facebook users’ possibility to
exercise their data subjects’ rights.

230. Furthermore, the EDPB considers that the extensive analysis by the IE SA with regard to
the issue of legal basis and transparency in relation to the processing being carried out in
reliance on Article 6(1)(b) GDPR is closely linked to the issue of compliance by Meta IE with the
principle of fairness. Considering the seriousness of the infringements of the transparency
obligations by Meta IE already identified in the Draft Decision and the related misrepresentation
of the legal basis relied on, the EDPB agrees with the IT SA that Meta IE has presented its service
to the Facebook users in a misleading manner 192, which adversely affects their control over the
processing of their personal data and the exercise of their data subjects' rights. Therefore, the
EDPB is of the opinion that the IE SA’s finding of breach of Article 5(1)(a) GDPR with regard to
the principle of transparency 193 should extend to the principle of fairness too.

231. This is all the more supported by the fact that, in the circumstances of the present case as
demonstrated above 194, the overall effect of the infringements by Meta IE of the transparency
obligations under Articles 5(1)(a), 12(1), 13(1)(c) GDPR and the infringement of Article 6(1)
GDPR219further intensifies the imbalanced nature of the relationship between Meta IE and the
Facebook users brought up by the IT SA objection. The combination of factors, such as the
asymmetry of the information created by Meta IE with regard to Facebook service users,
combined with the “take it or leave it” situation that they are faced with due to the lack of
alternative services in the market and the lack of options allowing them to adjust or opt out from
a particular processing under the contract with Meta IE, systematically disadvantages Facebook

188
See paragraph 97 of this Binding Decision.
189
According to the fairness element of “expectation”, “processing should correspond with data subjects’ reasonable
expectations” - EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
190
Draft Decision, paragraph 5.63.
214
IT SA Objection, paragraph 2.4
191
See EDPB Guidelines on Data Protection by Design and by Default, paragraph 70, where the EDPB explains that
“ethical” means that “[t]he controller should see the processing’s wider impact on individuals’ rights and dignity“ and
“truthful” means that “[t]he controller must make available information about how they process personal data, they
should act as they declare they will and not mislead the data subjects”.
192
IT SA Objection, paragraph 2.3.
193
Draft Decision, paragraphs 5.59-5.76.
194
See paragraphs 221-230 of this Binding Decision.
219
See paragraph 133 of this Binding Decision.
79

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

service users, limits their control over the processing of their personal data and undermines the
exercise of their rights under Chapter III of the GDPR.

232. Therefore, the EDPB instructs the IE SA to include a finding of an infringement of the
principle of fairness under Article 5(1)(a) GDPR by Meta IE, in addition to the infringement of the
principle of transparency under the same provision, and to adopt the appropriate corrective
measures, by addressing, but without being limited to, the question of an administrative fine for
this infringement as provided for in Section 9 of this Binding Decision.

5.79 Accordingly, and as directed by the EDPB further to the Article 65 Decision, I find that Facebook has
infringed the principle of fairness pursuant to Article 5(1)(a) GDPR.

Finding 4: Facebook has infringed the principle of fairness pursuant to Article 5(1)(a) GDPR.

6 SUMMARY OF FINDINGS

ISSUE FINDING

Reliance on Article 6(1)(b) GDPR I find that Facebook infringed Article 6(1)
GDPR when it relied on Article 6(1)(b) GDPR to
process the Complainant’s personal data for
the purpose of behavioural advertising in the
context of its offering of Terms of Service.

Whether Facebook failed to provide I find that Facebook has infringed Articles
necessary information regarding its legal basis 5(1)(a), 12(1) and 13(1)(c) GDPR
for processing pursuant to acceptance of the
Terms of Service and whether the information
set out was set out in a transparent manner

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

As raised by the Italian SA by way of its As directed by the EDPB pursuant to the
objection, whether Facebook infringed the Article 65 Decision, I find that Facebook has
Article 5(1)(a) principle of fairness in the infringed the Article 5(1)(a) principle of
context of its approach to the provision of fairness.
information as part of the presentation of its
Terms of Service to the Complainant.

7 DECISION ON CORRECTIVE POWERS

7.1 I have set out above, pursuant to Section 111(1)(a) of the 2018 Act, my view to the effect that the
Facebook has infringed Articles 5(1)(a), 12(1) and 13(1)(c) GDPR. As required by the EDPB pursuant
to the Article 65 Decision, I have also found that Facebook has infringed Article 6(1) GDPR as well
as the Article 5(1)(a) principle of fairness.

7.2 Under Section 111(2) of the 2018 Act, where the Commission makes a decision (in accordance with
Section 111(1)(a)), it must, in addition, make a decision as to whether a corrective power should
be exercised in respect of the controller or processor concerned and, if so, the corrective power
to be exercised. For the reasons set out above and the reasons below, my view is that corrective
measures should be exercised.

8 ORDER TO BRING PROCESSING INTO COMPLIANCE

8.1 Article 58(2) GDPR sets out the corrective powers which supervisory authorities may employ in respect
of non-compliance by a controller or processor.

8.2 My view is that the corrective power provided for in Article 58(2)(d) GDPR, i.e. an order to bring
processing into compliance (“the Order”), should be imposed. The Order would, firstly, require
Facebook to bring the Data Policy and Terms of Service into compliance with Articles 5(1)(a),
12(1) and 13(1)(c) GDPR as regards information provided on: (i) data processed pursuant to
Article 6(1)(b) GDPR as well as (ii) data processed for the purposes of behavioural advertising in
the context of the Facebook service, in accordance with the principles set out in this Decision.
Facebook argues that it is neither necessary nor proportionate to make this order. 195 For the
reasons set out above and below, I have concluded that it is necessary and proportionate to do
so.

8.3 It was proposed in the Preliminary Draft Decision that this order should be complied with within three
months of the date of notification of any final decision. Facebook argued that this was not a

195
Facebook Submissions on Preliminary Draft Decision, paragraph 11.
221
Ibid, paragraph 12.4.
81

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

reasonable period of time within which to make the necessary changes, as the changes would be
resource-intensive and would require “sufficient lead in time for preparing the relevant changes,
conducting and taking account of user testing of the proposed changes, internal crossfunctional
engagement as well as of course engagement with the Commission, and localisation and
translation of the information for countries in the European Region.”221

8.4 Facebook is a large multinational organisation with significant financial, technological and human
resources at its disposal. Moreover, the interim period, prior to any such rectification to the
current lack of information being provided to data subjects, will involve a serious ongoing
deprivation of their rights (as articulated in Section 9 below). Moreover, the Commission has
provided specific analysis to Facebook in relation to the correct interpretation of the provisions in
question and the requisite information that is absent from the relevant user-facing documents.
This specificity should negate any need for extensive engagement with the Commission during the
period of implementation, and provides clarity for Facebook as to what objective its very
significant resources should be directed towards in order to comply with this order. As such, I am
not satisfied that it would be impossible or indeed disproportionate to make an order in these
terms, having regard to the importance of the data subject rights involved, the specificity of the
order and Facebook’s resources.

8.5 I therefore order that the Terms of Service and Data Policy be brought into compliance within a period
of three months commencing on the day following the date of service, on Facebook, of this
Decision.

8.6 I consider that the Order is necessary to ensure that full effect is given to Facebook’s obligations under
Articles 5(1)(a), 12(1), and 13(1)(c) GDPR in light of the infringements outlined above. The
substance of the Order is the only way in which the defects pointed out in this Decision can be
rectified, which is essential to the protection of the rights of data subjects. It is on this basis that
I am of the view that this power should be exercised. Facebook disagrees and states that it is
already voluntarily attempting to alter the documents to express the views set out in the
Preliminary Draft Decision, and would therefore like to continue using “less onerous means” to
ensure compliance. 196

8.7 However, having regard to the non-compliance in this Decision, in my view, such an order is
proportionate and is the minimum order required in order to guarantee that compliance will take
place in the future. The fact that Facebook is already taking steps to bring its information into
compliance means that there would be nothing practically onerous about an order to carry out
something that Facebook already intends to carry out. On that basis I see nothing in these
arguments to suggest a lack of proportionality arises in relation to the Order.

196
Ibid, paragraphs 12.2 and 12.3.
82

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

8.8 As instructed by the EDPB, in paragraph 288 of the Article 65 Decision, the Order would, secondly,
require Facebook to take the necessary action to bring its processing of personal data for the
purposes of behavioural advertising (“the Processing”), in the context of the Facebook Terms of
Service, into compliance with Article 6(1) GDPR in accordance with the conclusion reached by
the EDPB, as recorded at paragraphs 132 and 133 of the Article 65 Decision within a period of
three months, commencing on the day following the date of service, on Facebook, of this
Decision. More specifically, in this regard, Facebook is required to take the necessary action to
address the EDPB’s finding that Facebook is not entitled to carry out the Processing on the basis
of Article 6(1)(b) GDPR, taking into account the analysis and views expressed by the EDPB in Section
4.4.2 of the Article 65 Decision. Such action may include, but is not limited to, the identification
of an appropriate alternative legal basis, in Article 6(1) GDPR, for the Processing together with the
implementation of any necessary measures, as might be required to satisfy the conditionality
associated with that/those alternative legal basis/bases.

8.9 By way of its Final Submissions, Facebook submitted as follows:

a. Firstly 197 , in relation to the matters covered by the term “the Processing” (as defined in
paragraph 8.8, above), Facebook noted its understanding that this term refers “specifically to
the processing for the purpose of behavioural advertising carried out by [Facebook] to-date on
the basis of Article 6(1)(b) GDPR in the context of the Terms of Service as considered in the
Inquiry.” Facebook noted that, as previously explained in its Article 65 Submissions, it carries
out certain other types of processing for behavioural advertising purposes on the basis of
Article 6(1)(a) GDPR. For the avoidance of doubt, I confirm Facebook’s understanding as to
the processing covered by the second limb of the above Order. The term “the Processing”, as
defined in paragraph 8.8, above, means any processing for behavioural advertising purposes
which has been carried out by Facebook to date, in reliance on Article 6(1)(b) GDPR.

b. Secondly, Facebook submitted 198 that, notwithstanding the EDPB’s determination, the
Commission has discretion as regards the date of commencement of the applicable
compliance periods. In this regard, Facebook noted that the Article 65 Decision does not
require the Commission to provide that the Order must take effect “on the day following the
date of service of the [Commission’s] final decision”. Facebook further submitted 199 that the
timeline for compliance, as regards the action required to be taken pursuant to both limbs of
the Order, should run consecutively rather than concurrently.

c. In support of the above submissions, Facebook has estimated that it “will take at least to
implement both compliance orders” by reference to the work that will be required to give
effect to the terms of the Order. This work includes (but is not limited to)

197
The Final Submissions, paragraph 2.4 (and footnote 6)
198
The Final Submissions, paragraph 4.3 and Section 5
199
The Final Submissions, paragraph 4.3 and Section 6
83

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

. Facebook has further identified that, once this
work is completed, it will then need to develop and/or update user-facing materials, to the
extent needed to explain these changes to users, including updates to the Privacy Policy and
other transparency notices.

d. Facebook has further submitted that, if the Order is made in the terms proposed, this would
require it to dedicate its resources to attempting to comply with the Order immediately and
“certainly before the period within which [Facebook] is entitled to appeal from the final
decision has elapsed.” This, according to Facebook, would seriously “impair and prejudice” its
right to an effective appeal.

8.10 Having considered the above matters in light of the Article 65 Decision, I do not agree with
Facebook’s submission that the Commission has discretion to delay the activation of the
timeline for compliance associated with any aspect of the Order. It is clear, from
paragraph 286 of the Article 65 Decision, that the EDPB considered it necessary for
Facebook to take the remedial action required to address the relevant infringements
“within three months”. While Facebook has correctly identified that the EDPB has not
expressly identified the starting point of this compliance period, the Commission’s view is
that it goes without saying that the starting point has to be the adoption and notification
of the Commission’s final decision, given that this is the earliest time from which the
applicable timeline for compliance can start to run. Any contrary suggestion would be
inconsistent with the need for urgent action that was clearly indicated to be required in
paragraphs 286, 288 and 290 of the Article 65 Decision. It would further render
meaningless the EDPB’s consideration of the compliance period in terms of a fixed number
of months (in this case, three).

8.11 Insofar as Facebook appears to consider it significant that the Commission itself amended
the terms of the existing Order such that the timeline for compliance is now stated to run
from the day following the date of service, on Facebook, of this Decision, the Commission
does not consider this to be a material amendment of the existing text. The Commission
considered it necessary to add this clarification to address the risk of there being a delay
between the date of adoption of this Decision and the date on which this Decision is
formally notified to/served upon Facebook (as has occurred in at least one previous
inquiry). The clarification ensures legal certainty, as regards the timelines associated with
the Order and Facebook’s right to a judicial remedy.

8.12 Finally, as regards the resources that Facebook will need to devote to the matters covered
by the terms of the Order, I note that I have already had regard to the significant financial,
technological and human resources at Facebook’s disposal. Furthermore, I do not agree
that Facebook will need to await the outcome of its efforts to achieve compliance with the
second limb of the Order before it might address the first limb. I note, in this regard, that
the first limb of the Order was present in the Draft Decision (dated 6 October 2021).
84

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Facebook was already aware of the likelihood that it would have to take action to address
the shortcomings identified as part of the analysis that underpinned the findings of
infringement of the transparency provisions (namely Articles 5(1)(a), 12(1) and 13(1)(c)
GDPR). In the circumstances, Facebook has already had time to begin the groundwork
required to achieve compliance with its transparency obligations.

8.13 For the avoidance of doubt, I am not persuaded by Facebook’s submission that the
envisaged date of commencement of the timeline for compliance would “seriously impair
and prejudice” its right to an effective appeal. I note, in this regard, that Facebook has not
explained how such a risk would arise from the timely implementation of the deadline for
compliance with the Order. I further note that matters pertaining to the possible filing of
any appeal will likely be dealt with by Facebook’s internal and external legal advisors as
opposed to the “stakeholders” whose input will be required as part of Facebook’s efforts
to achieve compliance with the terms of the Order. While I anticipate that there will, of
course, be overlap in terms of the resources that might need to devote time to both the
required remedial action and matters pertaining to the possible filing of any appeal, I do
not envisage how such overlap would be anywhere near total such as to give rise to a risk
to Facebook’s ability to exercise its right to an effective appeal. I further note that the
compliance deadline extends beyond the limitation periods prescribed for any application
for judicial redress under Irish law. In these circumstances, I am satisfied that Facebook’s
right to pursue judicial redress will not be impaired by the compliance periods outlined
above.

9 ADMINISTRATIVE FINE

9.1 I note that Article 58(2)(i) GDPR permits me to consider the imposition of an administrative fine,
pursuant to Article 83 GDPR, “in addition to, or instead of” the other measures outlined in Article
58(2), depending on the circumstances of each individual case. This is also reflected in Section 115
of the 2018 Act, which permits the Commission to impose an administrative fine on its own or in
combination with any other corrective power specified in Article 58(2) GDPR. Article 83(1) GDPR,
in turn, identifies that the administration of fines “shall in each individual case be effective,
proportionate and dissuasive”.

9.2 Further, when deciding whether or not to impose an administrative fine and the amount of any such
fine, Article 83(2) GDPR requires me to give “due regard” to eleven criteria. Those criteria, together
with my assessment of each, are set out below.

9.3 In the Draft Decision, I considered the imposition of an administrative fine in relation to the finding of
infringement identified at Finding 3 above, namely the finding of infringement of Articles 5(1)(a),
12(1) and 13(1)(c) GDPR in the context of Facebook’s approach to transparency. Following the
circulation of the Draft Decision to the supervisory authorities concerned for the purpose of
enabling them to share their views, in accordance with Article 60(3) GDPR, objections to the
85

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

administrative fines proposed by the Draft Decision were raised by the supervisory authorities of
Germany, France, the Netherlands, Norway and Poland. Having considered those objections, the
EDPB determined as follows:

351. The EDPB recalls that the consistency mechanism may also be used to promote a
consistent application of administrative fines. A fine should be effective, proportionate and
dissuasive, as required by Article 83(1) GDPR, taking account of the facts of the case. In
addition, when deciding on the amount of the fine, the LSA shall take into consideration the
criteria listed in Article 83(2) GDPR.
…

353. The finding in the Draft Decision of a transparency infringement for the processing
concerned still stands. The EDPB recalls that, on substance, no objections were raised on this
finding. Meta IE infringed its general transparency obligations by being unclear on the link
between the purposes of processing, the lawful bases of processing and the processing
operations involved, irrespective of the validity of the legal basis relied on for the ‘processing
concerned’. It remains the case that, for the transparency infringements, ‘the processing
concerned’ should be understood as meaning all of the processing operations that Meta IE
carries out on the personal data under its controllership for which Meta IE indicated it relied
on Article 6(1)(b) GDPR, including for the purposes of behavioural advertising. This is without
prejudice to the fact that Meta IE inappropriately relied on 6(1)(b) as a legal basis to process
personal data for the purpose of behavioural advertising as part of the delivery of its Facebook
service under the Facebook Terms of Service. Whether or not Meta IE appropriately chose its
legal basis for processing, the transparency infringement as assessed in the Draft Decision still
stands. Therefore, the IE SA must not modify this description retroactively in light of the
assessment of the validity of the legal basis, including for the purpose of carrying out any
reassessment of the administrative fines originally proposed by the Draft Decision, as might be
required by this Binding Decision.

354. In light of the objections found relevant and reasoned, the EDPB addresses whether the
Draft Decision proposes a fine for the transparency infringements that is in accordance with
the criteria established by Article 83(2) GDPR and the criteria provided for by Article 83(1)

GD PR. In doing this, the EDPB will first look into a preliminary matter, then assess the disputes

ari sen in respect of the analysis of sp ecific criteria under Article 83(2) performed by the LSA,

an d then examine whether the pro posed fine meets the requirements of effectiveness,

dis suasiveness and proportionality se t in Article 83(1) GDPR, including by affording adequate

we ight to the relevant factors and to the circumstances of the case.

Pre
liminary matter: the total turnover of the undertaking

355 . The DE SAs does not contest th identification of the relevant undertaking in the IE SAs
86

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Dr aft Decision, but contests the turn over figure cited in the Draft Decision. Though the IE SA

de ems the objection not relevant, in the Composite Response the IE SA agrees with the DE SAs

on the principle that the total tu rnover figure should be used when calculating the

ad ministrative fine. Moreover, the IE SA adds that “the turnover figure in the final decision will

in any event refer to the 2021 turnover for Meta Platforms, Inc. and Meta Ireland”.

356 . For the avoidance of doubt, the EDPB instructs the IE SA to take into consideration the
tot al turnover of all the entities co mposing the single undertaking, i.e. the consolidated

tur nover of the group of companies headed by Meta Platforms, Inc..

357 . On the notion of “preceding fin ancial year”, the EDPB recalls the decision taken in its
Bin ding Decision 1/2021 (paragraph 298) and takes note of the IE SA’s intention to take the

sa me approach in the current case.

h the approach taken by the IE SA for the present case
358 . In addition, the EDPB agrees wit o
inc ude in the Draft Decision a prov isional turnover figure based on the most up to date

fin ancial information available at the time of circulation to the CSAs pursuant to Article 60(3)

GD PR. The final decision will have to refer to the whole undertaking’s annual turnover

cor responding to the financial year preceding the date of the final decision.

Th
e number of data subjects affected (Article 83(2)(a) GDPR)

359 . The DE SAs puts forward that th e number of affected data subjects may be even higher
tha n the monthly users as of May 2021 in the European Economic Area confirmed

by Meta IE to the IE SA. The DE SAs refer to a Meta Platforms, Inc. press release of 27 January
20 21, inferrin g from that “whilst [M eta Platforms, Inc.] reported 2.80 billion monthly active

us rs, they report 3.30 billion ‘family monthly active people’ for 2020. Applying this increase
of
ab out 18 % there could be about affected data subjects ( plus 18 % =

)”.

360. The IE S A is “satisfied that the reference to the number of users of the ‘family’ of apps
refers to the t otal number of users across all apps owned by Meta Platforms Inc., (i.e. also

including user s of WhatsApp and Instagram) and not solely the number of users of the

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Facebook App Such apps are not covered by the Facebook Terms of Service, and so are not

relevant to the present circumstances”. Meta IE confirms the IE SA’s response, adding that the

2020 figures ci ted in the DE SAs’ objection “relate to the global number of unique people using

at least one of the Meta Family of Apps”.

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

361. From the elements put forward, the EDPB sees no reason to question the response
given by the IE SA on this objection. Therefore, the EDPB is of the view that the Draft Decision
does not need to be amended with regard to the number of data subjects affected. This is
without prejudice to the conclusions reached below on whether the fine is in line with Article
83, taking into consideration all the circumstances of the case, including the number of data
subjects.

On any action taken by the controller to mitigate the damage suffered by data subjects
(Article
83(2)(c) GDPR)

362. The PL SA disagrees with the mitigating factor identified by the IE SA by reference to
Meta IE’s willingness to engage in steps to bring its processing into compliance on a voluntary
basis pending the conclusion of the inquiry.

363. The IE SA states that “[Meta IE]’s willingness to engage in steps to bring its processing
into compliance on a voluntary basis” should be understood as actions taken to mitigate the
damage to data subjects, distinct from actions taken to comply. In the present case, the EDPB
fails to see how such a distinction can be made. Additionally, drawing this distinction seems
inconsistent with the IE SA’s position that the negative impact on data subjects lies precisely
in the transparency infringements and thus in the “the risks to data subjects in being unable to
effectively exercise their rights by being unable to discern what specific data processing is being
done on what legal basis and for what objective”. In other words, the damage caused to data
subjects is, in these circumstances, consubstantial with the finding of the infringement itself.

364. In addition, the EDPB agrees with the PL SA that the expression of an “intention to
bring the processing operations into the compliance with the provisions of GDPR” as such
cannot serve as evidence of actions already taken to mitigate damage suffered. In order for
this element to serve as a mitigating factor, further evidence would be necessary for instance
demonstrating that the controller did whatever they could in order to reduce the
consequences of the breach for the individuals concerned.

365. The EDPB agrees with the IE SA that “[taking] steps to attempt to comply with legal
obligations is a duty, and has no mitigating impact on a sanction for a breach of those
obligations”. In any case, Meta IE’s “decision to begin preparation for voluntary compliance on
the basis of the views set out in the Preliminary Draft Decision” is merely a first step of a longer
process towards full compliance with the GDPR. The information available in the file does not
include indications that the actions taken by the controller have gone beyond willingness to
prepare to change its practices in case this appeared necessary.

366. The EDPB finds the IE SA does not provide sufficient justification for the mitigating
factor identified, and instructs the IE SA to modify its Draft Decision on this matter, by
considering this factor as neither aggravating nor mitigating.

On other factors and the non-exhaustive nature of the criteria in Article 83(2) GDPR

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

367. Meta IE argues some CSAs “introduce criteria that are not provided for by Article 83(2)
GDPR”, which “amounts to a breach of the principle of legal certainty, which is of particular
importance with respect to the imposition of administrative fines which are criminal in nature”.

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

Meta IE acknowledges that Article 83(2)(k) GDPR is open-ended as it refers to any other
aggravating or mitigating factor applicable to the circumstances of the case, arguing however
that the criteria of Article 83(2) GDPR focus only on the data controller or processor, or on the
infringement.

368. The EDPB does not share such a restrictive reading of Article 83(2)(k) GDPR, which it
deems leaves room for “all the reasoned considerations regarding the socio-economic context
in which the controller or processor operates, those relating to the legal context and those
concerning the market context”. The EDPB considers this provision “of fundamental
importance for adjusting the amount of the fine to the specific case” and that “it should be
interpreted as an instance of the principle of fairness and justice applied to the individual case”.
The EDPB recalls that Article 83(2) GDPR contains a non-exhaustive list of assessment criteria
to be considered, if appropriate, by the LSA in determining the amount of the fine
corresponding to what is necessary to be effective, proportionate, and dissuasive in
accordance with Article 83(1) GDPR.

369. Given the open-ended nature of Article 83(2), the EDPB disagrees with the argument
by Meta IE contending that the principle of legal certainty was breached. In any case, the EDPB
recalls that it is settled case law that legal certainty is not absolute. All cases of application of
a general norm can “not be determined in advance by the legislature”. Therefore, legal
certainty “cannot be interpreted as prohibiting the gradual clarification of rules of criminal
liability by means of interpretations in the case-law” and undertakings are expected to take
appropriate legal advice to anticipate the possible consequences of a rule and to assess the risk
of infringement with “special care”. Finally, even if were the case that supervisory authorities
had previously issued conflicting views, such a circumstance would not be relevant when
assessing the predictability of an infringement. The ECtHR has also ruled that the fact that a
point of law is ruled on for the first time does not undermine legal certainty “if the meaning
given is both foreseeable and consistent with the essence of the offence”.

The financial benefit obtained from the infringement (Article 83(2)(k) GDPR)

370. As explicitly stated in Article 83(2)(k) GDPR, financial benefits gained directly or
indirectly from the infringement can be considered an aggravating element for the calculation
of the fine. When applying this provision, the supervisory authorities must “assess all the facts
of the case in a manner that is consistent and objectively justified”. Therefore, financial benefits
from the infringement could be an aggravating circumstance if the case provides information
about profit obtained as a result of the infringement of the GDPR.

371. The aim of Article 83(2)(k) is to ensure that the sanction applied is effective,
proportionate and dissuasive in each individual case. With regard to the financial benefits
obtained from the infringement, the EDPB considers that when there is a benefit, the sanction
should aim at “counterbalancing the gains from the infringement” while keeping an effective,
dissuasive and proportionate fine.

372. The financial benefit obtained by Meta IE was considered by the IE SA in the Draft
Decision with regard to the transparency infringements. The IE SA found it had insufficient
elements to conclude - beyond speculating - that Meta IE benefited from the infringement.

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

373. The DE SAs disagree with the IE SA’s decision to set aside this factor. The DE SA describes
a counterfactual - where there would be 1 million less monthly users ( of the monthly

users according to paragraph 9.15 of the Draft Decision if th e transparency

violations had not occurred) - which would amount to an estimated less in

turnover.

374. Considering the need to have fines that are effective, proportionate and deterrent, and
in lig ht of common accepted practice in the field of EU competition law, which inspired the

fining framework under the GDPR, the EDPB is of the view that, when calculating the

administrative fine, the supervisory authority could take account of the financial benefits

obtained from the infringement, in order to impose a fine that exceeds that amount.

375. In the present case, neither the IE SA nor the DE SAs have provided an estimation of the
financial benefit gained by Meta IE with the transparency infringements. The DE SAs’

calculation presents an example and is still largely based on assumptions on a lower number

of m onthly users. Due to this, the EDPB does not have sufficiently precise information to

evaluate the specific weight of the financial benefit obtained from the infringement.

376. Therefore, the EDPB considers that it does not have objective elements to conclude
whether the fine envisaged in relation to the transparency infringements takes sufficient

acco nt of the financial benefit obtained from the infringement and, therefore, has a
eterrent
effect in this respect.

377. Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no
effect if they are disproportionally low compared to the benefits obtained with the

infringement. The EDPB considers that the IE SA should ascertain if further estimation of the

financial benefit from the infringement of transparency obligations is possible in this case.

Insofar as this results in the need to increase the amount of the fine proposed, the EDPB

requ sts the IE SA to increase the amount of the fine proposed.

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

The p
rofitability of the undertaking - other factor (Article 83(2)(k) GDPR)

378. The DE SAs request the IE SA to consider, in addition to turnover, the annual profit of the
undertaking in its assessment. The DE SAs position is that the undertaking’s sensitivity to

administrative fines is significantly influenced by profitability, not only turnover. The DE SAs

argue that the Draft Decision does not demonstrate that profitability was taken into account

to as sess “sensitivity to administrative fines” and does not ensure the fine is effective,

proportionate and dissuasive.

379. Meta IE argues Article 83(2) GDPR does not identify annual profit as a factor to which the
LSA s hould have regard in calculating the amount of the administrative fine. The EDPB has

expla ned its view on the open-ended character of Article 83(2)(k) GDPR above (see paragraphs

367-369).

380. The EDPB recalls that in determining administrative fines under Article 83 GDPR the total
worldwide annual turnover of the undertaking should be considered, as this “gives an

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

indication, albeit approximate and imperfect, of the size of the undertaking and of its economic
power”. The EDPB does not find that in the case at hand the LSA should be requested to amend
its Draft Decision to additionally consider the annual profit of the undertaking. At the same
time, the EDPB reiterates that the imposition of an appropriate fine cannot be the result of a
simple calculation based on the total turnover and that as stated above all the circumstances
of the specific case have to be considered in order to assess if the administrative fine is
effective, proportionate and dissuasive as required by Article 83(1) GDPR.

381. Moreover, the size of the undertaking concerned and its financial capacity are
elements that should be taken into account in the calculation of the amount of the fine in order
to ensure its dissuasive nature. Taking into consideration the size and global resources of the
undertaking in question is justified by the impact sought on the undertaking concerned, in
order to ensure that the fine has sufficient deterrent effect, given that the fine must not be
negligible in the light, particularly, of its financial capacity. The EDPB recalls that a fine to be
imposed on an undertaking may need to be increased to take into account a particularly large
turnover of the undertaking, so the fine is sufficiently dissuasive. In this respect, the EDPB
further notes that in order to ensure a sufficiently deterrent effect, the global turnover of the
undertaking can be considered also in light of the undertaking’s ability to raise the necessary
funds to pay its fine.

The effectiveness, proportionality and dissuasiveness of the administrative fine (Article 83(1)
GDPR)

382. With regard to effectiveness of the fines, the EDPB recalls that the objective pursued
by the corrective measure chosen can be to re-establish compliance with the rules, or to punish
unlawful behaviour, or both. In addition, the EDPB notes that the CJEU has consistently held
that a dissuasive penalty is one that has a genuine deterrent effect. In that respect, a distinction
can be made between general deterrence (discouraging others from committing the same
infringement in the future) and specific deterrence (discouraging the addressee of the fine
from committing the same infringement again). Therefore, in order to ensure deterrence, the
fine must be set at a level that discourages both the controller or processor concerned as well
as other controllers or processors carrying out similar processing operations from repeating
the same or a similar unlawful conduct. Proportionality of the fine needs also to be ensured as
the measure must not go beyond what is necessary to attain that objective. In this respect, the
EDPB disagrees with Meta IE’s views that there is no basis to conclude that the amount of the
fine must have a general preventive effect.

383. The EDPB reiterates that it is incumbent upon the supervisory authorities to verify
whether the amount of the envisaged fines meets the requirements of effectiveness,
proportionality and dissuasiveness, or whether further adjustments to the amount are
necessary, considering the entirety of the fine imposed and all the circumstances of the case,
including e.g. the accumulation of multiple infringements, increases and decreases for
aggravating and mitigating circumstances and financial/socio-economic circumstances.
Further, the EDPB recalls that the setting of a fine is not an arithmetically precise exercise, and
supervisory authorities have a certain margin of discretion in this respect.

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

384. The DE, FR, NL, NO and PL SAs, object to the level of the fine envisaged in the Draft
Decision as they consider the proposed fine not effective, proportionate and dissuasive (Article

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

83(1) GDPR). These SAs argue that the elements of Article 83(2) GDPR are not weighed
correctly by the LSA when calculating the administrative fines in the present case, in light of
the requirements of Article 83(1) GDPR.

385. Specifically, the DE, FR, NL and NO SAs refer to the nature and gravity of the
infringement and the number of data subjects concerned. The PL SA adds that the gravity of
the infringement is compounded by the fact that the data processing is an essential part of
Meta IE’s business model. The DE SAs also refer to the infringement’s duration and the
negligence identified by the IE SA.

386. The EDPB takes note Meta IE’s disagreement with the fine proposed by the IE SA and
their view that any objections aiming to increase the quantum of fines are not compatible with
Article 83 GDPR.

387. The EDPB notes that in the Draft Decision the IE SA indicates being satisfied the
proposed fine is effective, proportionate and dissuasive, taking into account all the
circumstances of the IE SA’s inquiry. The IE SA assessed the different criteria of Article 83(2)
GDPR in relation to the transparency infringements found. The IE SA considered the
infringements as serious in nature, and in terms of gravity of the infringements found a
significant level of noncompliance. Furthermore, the EDPB underlines that, as established by
the IE SA, the infringements affect a significant number of data subjects and are extensive. The
EDPB also observes that the infringements is considered negligent in character. Further, the IE
SA considered the level of damage suffered by data subjects as being significant. In addition,
the IE SA identifies only one mitigating factor, however without articulating the weight
accorded to it.

388. Meta IE argues that reputation costs should also be taken into consideration, citing the
IE SA’s remark on “the significant publicity that a fine in this region will attract”. On principle,
the EDPB agrees that reputation costs could be taken into consideration to some extent, if
credible arguments are be put forward about the grave detriment that would ensue. Meta IE
does not present such arguments. The EDPB is of the view that in this case other incentives
would offset any reputational costs. As far as advertisers are concerned, Meta IE puts forward
that “[the] personalised nature of the Facebook Service is also the reason why it has been
instrumental in the success of small and medium sized businesses (‘SMEs’) worldwide, including
across the EU. Personalisation on the Facebook Service enables SMEs to compete for customers
through ‘customizing products and services, [...] building a unique brand image, tailoring
marketing to a specific audience and developing a strong one-to-one connection with a
community of customers’”. As far as users of the Facebook service are concerned, there are
network effects at play which leads to incentives to join - or not leave - the platform, so as not
to be excluded from participating in discussions, corresponding with and receiving information
from others.

389. The FR SA compares the proposed fine with the fine of 225 million euros decided upon
by the IE SA in its decision dated 20 August 2021 against WhatsApp Ireland Limited for
transparency infringements (breaches of Articles 12 and 13 GDPR). The FR SA also compares
with the fine of 746 million euros decided by the LU SA in its decision of 15 July 2021 against

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

the company Amazon Europe Core for carrying out behavioural advertising without a valid
legal basis and for transparency infringements (Articles 6, 12 and 13 GDPR). While the EDPB

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

agrees with both the IE SA and Meta IE that imposing fines requires a case-by-case assessment
under Article 83 GDPR, the EDPB notes that the cases cited by the FR SA do show marked
similarities with the current case, as they both refer to large internet platforms run by data
controllers with multi-national operations and significant resources available to them,
including large, in-house, compliance teams. Moreover, there are similarities with regard to
the infringements involved. Thus, these cases can give an indication on the matter.

390. The DE SAs calculate that the envisaged upper limit of the fine range is about 0.05 % of
the global annual turnover, which it notes is 80 times lower than the maximum ceiling
provided for in Article 83(5) GDPR. For illustrative purposes, the DE SAs add that this upper
limit would
amount to a fine of per person (on the basis of data subjects affected

100

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

according to paragraph 9.15 of the Draft Decision). Also illustrative is the amount of time, on
average, it took Meta IE to generate 36 million euros in turnover in 2020, which was about 4
hours and 30 minutes.

391. The EDPB agrees with the objections raised that - if the proposed fine was to be
imposed for the transparency infringements - there would be no sufficient special preventive
effect towards the controller, nor a credible general preventive effect. The proposed fine
amount, even where a final amount at the upper limit of the range would be chosen, is not
effective, proportionate and dissuasive, in the sense that this amount can simply be absorbed
by the undertaking as an acceptable cost of doing business. As behavioural advertising is at
the core of Meta IE’s business model, the risk of this occurring is all the greater. By bearing
the cost the administrative fine, the undertaking can avoid bearing the cost of adjusting their
business model to one that is compliant as well as any future losses that would follow from
the adjustment.

392. Though the IE SA touches upon the notions of effectiveness, proportionality and
dissuasiveness in relation to the proposed fine, there is no justification based on elements
specific to the case to explain the modest fine range chosen. Moreover, the EDPB notes that
while the IE SA takes into consideration the turnover of the undertaking to ensure that the
fine it proposed does not exceed the maximum amount of the fine provided for in Article 83(5)
GDPR, the Draft Decision does not articulate how and to what extent the turnover of this
undertaking is considered to ascertain that the administrative fine meets the requirement of
effectiveness, proportionality and dissuasiveness. In this regard the EDPB recalls that the
turnover of the undertaking concerned is not exclusively relevant for the determination of the
maximum fine amount in accordance with Article 83(4)-(6) GDPR, but should also be
considered for the calculation of the fine itself, where appropriate, to ensure the fine is
effective, proportionate and dissuasive in accordance with Article 83(1) GDPR. The EDPB
therefore instructs the IE SA to elaborate on the manner in which the turnover of the
undertaking concerned is considered for the calculation of the fine.

393. While a single mitigating factor identified by the IE SA is mentioned, there is no
indication the weight that has been attributed to this factor in the context of the Article 83(2)
assessment. As indicated above (see paragraph 366), the EDPB finds the Draft Decision does
not sufficiently justify this mitigating factor, hence it should not be considered an aggravating
or mitigating factor.

394. In light of the above, the EDPB considers that the proposed fine does not adequately reflect
the seriousness and severity of the infringements nor has a dissuasive effect on Meta IE.
Therefore, the fine does not fulfil the requirement of being effective, proportionate and
dissuasive in accordance with Article 83(1) and (2) GDPR. In light of this, the EDPB directs the IE
SA to set out a significantly higher fine amount for the transparency infringements identified, in
comparison with the upper limit for the administrative fine envisaged in the Draft Decision. In
doing so, the IE SA must remain in line with the criteria of effectiveness, proportionality, and
dissuasiveness enshrined in Article 83(1) GDPR in its overall reassessment of the amount of the
administrative fine.

101

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

9.4 I have taken account of the above directions of the EDPB in the Article 83(2) assessments set out
below.

9.5 As noted earlier in this Decision, the EDPB, by way of the Article 65 Decision, has also directed me to
find that Articles 6(1) and the Article 5(1)(a) principle of fairness have been infringed. Pursuant to
those determinations, the EDPB made further directions, as regards the imposition of additional
administrative fines. In relation to the finding of infringement of Article 6(1) GDPR, the EDPB
directed, at paragraph 473 of the Article 65 Decision, that:

“Taking into account the nature and gravity of the infringements as well as other aspects in
accordance with Article 83(2) GDPR, the EDPB considers that the IE SA must exercise its power
to impose an additional administrative fine.”

9.6 At paragraph 509, the EDPB further directed that:

“The EDPB instructs the IE SA to cover the additional infringement of Article 6(1) GDPR with an
administrative fine that is effective, proportionate and dissuasive in accordance with Article
83(1) GDPR.”

9.7 As regards the manner in which I should assess the new infringement of Article 6(1) GDPR, the EDPB
instructed as follows:

441. The EDPB concurs that the decision to impose an administrative fine needs to be taken on
a case-by-case basis in light of the circumstances and is not an automatic one. In the case at
hand, however, the EDPB agrees with the reasoning put forward by the AT, DE, FR, NO and SE
SAs in their objections. The EDPB reiterates that lawfulness of processing is one of the
fundamental pillars of the data protection law and considers that processing of personal data
without an appropriate legal basis is a clear and serious violation of the data subjects’
fundamental right to data protection.

102

103

442. Several of the factors listed in Article 83(2) GDPR speak strongly in favour of the
104

imposition of an administrative fine for the infringement of Article 6(1) GDPR. 105

106

The nature, gravity and duration of the infringement (Article 83(2)(a) GDPR) 107

108

443. As mentioned above and outlined below, the nature and gravity of the infringement
109

clearly tip the balance in favour of imposing an administrative fine. 110

111

444. With respect to the scope of processing, the EDPB notes the IE SA’s assessment that
112

the personal data processing carried out by Meta IE on the basis of Article 6(1)(b) GDPR is
113

extensive, adding that “[Meta IE] processes a variety of data in order to serve users
114

personalised advertisements, tailor their ‘News Feed’, and to provide feedback to advertising
115

partners on the popularity of particular advertisements. The processing is central to and
116

essential to the business model offered”. 117

118

445. In this respect, the EDPB also recalls that the infringement at issue relates to the
119

processing of personal data of a significant number of people and that the impact on them has
120

to be considered. 121

122

446. Though the damage is very difficult to express in terms of a monetary value, it remains
123

the case that data subjects have been faced with data processing that should not have
124

occurred (by relying inappropriately on Article 6(1)(b) as a legal basis as established in section
125

4.4.2). The data processing in question - behavioural advertising - entails decisions about
126

information that data subjects are exposed to or excluded from receiving. The EDPB recalls
127

that non-material damage is explicitly regarded as relevant in Recital 75 and that such damage
128

may result from situations “where data subjects might be deprived of their rights and freedoms
129

or prevented from exercising control over their personal data”. Given the nature and gravity of
130

the infringement of Article 6(1)(b), a risk of damage caused to data subjects is, in such
131

circumstances, consubstantial with the finding of the infringement itself. 132

133

The intentional or negligent character of the infringement (Article 83(2)(b) GDPR) 134

135

447. The SE SA argues the infringement of Article 6(1)(b) GDPR should be considered
136

intentional on Meta IE’s part, which is an aggravating factor. 137

138

448. The EDPB takes note of Meta IE’s position that it did not act intentionally with the aim
139

to infringe the GDPR, nor was negligent - but “has relied on what it has consistently considered
140

in good faith to be a valid legal basis for the purpose of processing of personal data for
141

behavioural advertising and which now requires escalation to the EDPB for resolution”. Before
142

addressing each of the elements of this claim, the EDPB first notes that establishing either
143

intent or negligence is not a requirement for imposing a fine, but deserves ‘due regard’.
144

Second, contrary to what Meta IE implies, the mere circumstance that a dispute between the
145

LSA and the CSAs has escalated to the EDPB does not serve as evidence that a controller acted
146

in good faith with respect to the disputed issues. First, the dispute arises only (long) after the
147

controller has decided on its course of action, and therefore cannot inform it. Second, a dispute
148

may simply bring to light that an LSA has decided to challenge a position commonly held by (a
149

majority of) the CSAs. 150

151

152

449. The EDPB Guidelines on calculation of fines confirm that there are two cumulative
153

elements on the basis of which an infringement can be considered intentional: the knowledge
154

of the breach and the willfulness in relation to such act. By contrast, an infringement is
155

“unintentional” when there was a breach of the duty of care, without having intentionally
156

caused the infringement. 157

158

450. The characterisation of an infringement as intentional or negligent shall be done on
159

the basis of objective elements of conduct gathered from the facts of the case. It is worth
160

noting the broader approach adopted with respect to the concept of negligence, since it also
161

encompasses situations in which the controller or processor has failed to adopt the required
162

policies, which presumes a certain degree of knowledge about a potential infringement. This
163

provides an indication that non-compliance in situations in which the controller or processor
164

should have been aware of the potential breach (in the example provided, due to the lack of
165

the necessary policies) may amount to negligence. 166

167

451. The SE SA argues that Meta IE “has continued to rely on Article 6(1)(b) for the
168

processing, despite the aforementioned Guidelines [2/2019 on the processing of personal data
169

under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects]170
–

which clearly gives doubt to the legality of the processing – which were first adopted on 9 April
171

2019 and made final on 8 October 2019. The infringement must in all cases be considered
172

intentional from that later date.” 173

174

452. The EDPB recalls that even prior to the adoption Guidelines 2/2019, there were clear
175

indicators that spoke against relying on contract as legal basis. First, in WP29 Opinion 02/2010
176

on online behavioural advertising, only consent - as required by Article 5(3) ePrivacy Directive
177

- is put forward as possible legal basis for this activity. As Article 6 GDPR resembles Article 7 of
178

the Data Protection Directive to a large extent, WP29 Opinion 02/2010 remained a relevant
179

source on this matter for controllers preparing for the GDPR to enter into application. Second,
180

WP29 Opinion 06/2014 on the notion of legitimate interests explicitly states that “the fact that
181

some data processing is covered by a contract does not automatically mean that the processing
182

is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for
183

building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website
184

and the items purchased. This is because the data controller has not been contracted to carry
185

out profiling, but rather to deliver particular goods and services, for example. Even if these
186

processing activities are specifically mentioned in the small print of the contract, this fact alone
187

does not make them ‘necessary’ for the performance of the contract”. 188

189

453. It stems from the above that Meta IE had (or should have had) knowledge about the
190

infringement of Article 6(1)(b) GDPR. However, this mere element is not sufficient to consider
191

an infringement intentional, as stated above, since the “aim” or “wilfulness” of the action
192

should be demonstrated. 193

194

454. The EDPB recalls that that having knowledge of a specific matter does not necessarily
195

imply having the “will” to reach a specific outcome. This is in fact the approach adopted in the
196

EDPB Guidelines on calculation of fines and WP29 Guidelines on Administrative Fines, where
197

the knowledge and the “wilfulness” are considered two distinctive elements of the 198

199

intentionality. While it may prove difficult to demonstrate a subjective element such as the
200

“will” to act in a certain manner, there need to be some objective elements that indicate the
201

existence of such intentionality. 202

203

455. The EDPB recalls that the CJEU has established a high threshold in order to consider an
204

act intentional. In fact, even in criminal proceedings the CJEU has acknowledged the existence
205

of “serious negligence”, rather than ‘intentionality’ when “the person responsible commits206
a

patent breach of the duty of care which he should have and could have complied with in view
207

of his attributes, knowledge, abilities and individual situation”. In this regard, the EDPB
208

confirms that a company for whom the processing of personal data is at the core of its business
209

activities is expected to have sufficient measures in place for the safeguard of personal data:
210

this does not, however, per se change the nature of the infringement from negligent to
211

intentional. 212

213

456. In this regard, the SE SA puts forward that Meta IE based its processing of personalised
214

advertisement on consent until the GDPR came into force on 25 May 2018, and at this time
215

switched to relying on Article 6(1)(b) GDPR for the processing in question instead. The timing
216

and the logistics for this switch suggests this act was done with the intention of circumventing
217

the new rights of users under Article 6(1)(a) GDPR. The SE SA adds that “[the] proposed finding
218

of infringement concerning information deficits about the processing, namely on what legal
219

basis it is based, further supports this conclusion, since it goes to show that Facebook was
220

aware of the questionable legality of that basis and tried to conceal the infringement to avoid
221

scrutiny by supervisory authorities and data subjects”. 222

223

457. The EDPB considers the timing of the changes made by Meta IE to its Facebook Terms
224

of Service as an objective element; however, this alone does not indicate intention. Around
225

this time period, many controllers updated their data protection policies. The objection
226

suggests that the conclusion on intentionality is corroborated by the shortcomings to the
227

transparency obligations: in the EDPB’s view, the combination of the timing of the change of
228

legal basis with the lack of transparency is not sufficient to indicate intention either. 229

230

458. Therefore, on the basis of the available information, the EDPB is not able to identify231
a

will of Meta IE to act in breach of the law, as it cannot be concluded that Meta IE intentionally
232

acted to circumvent its legal obligations. 233

234

459. Therefore, the EDPB considers that the arguments put forward by the SE SAs do not
235

meet the threshold to demonstrate the intentionality of the behaviour of Meta IE. Accordingly,
236

the EDPB is of the view that the Draft Decision does not need to include this element. 237

238

460. At the same time, the EDPB notes that, even establishing that the infringement was
239

committed negligently, a company for whom the processing of personal data is at the core of
240

its business activities should have in place sufficient procedures for ensuring compliance with
241

the GDPR. 242

243

461. The EDPB does not accept Meta IE’s claim of “good faith”, but is of the view that Meta
244

IE was certainly seriously negligent in not taking adequate action, within a reasonable time
245

period, following the adoption of Guidelines 2/2019 on 9 April 2019. Even before that date,246

247

the EDPB considers there was at the very least negligence on Meta IE’s part considering the
248

contents of WP29 Opinion 02/2010 on online behavioural advertising and WP29 Opinion
249

06/2014 on the notion of legitimate interests (see paragraphs 452 - 453 above), which mean
250

Meta IE had (or should have had) knowledge about the infringement of Article 6(1)(b) GDPR,
251

the fact that processing of personal data is at the core of its business practices, and the
252

resources available to Meta IE to adapt its practices so as to comply with data protection
253

legislation. 254

255

The degree of responsibility of the controller taking into account technical and organisational
256

measures implemented pursuant to Articles 25 and 32(Article 83(2)(d) GDPR) 257

258

462. The EDPB considers the degree of responsibility of Meta IE’s part to be of a high level,
259

on the same grounds as set in the Draft Decision with regard to the transparency
260

infringements. 261

262

The manner in which the infringement became known (Article 83(2)(h) GDPR) 263

264

463. The DE SAs identify an aggravating factor in the fact that the “infringement became
265

known by a complaint of a data subject, not by chance or report by the controller itself”. 266

267

464. The EDPB considers that, as a rule, the circumstance that the infringement became
268

known to the LSA by way of a complaint should be considered neutral. The DE SAs do not put
269

forward reasons that would justify a departure from the rule in the present case. 270

271

465. Therefore, the EDPB is of the view that the Draft Decision does not need to include this
272

element as an aggravating or mitigating factor. 273

274

The financial benefit obtained from the infringement (Article 83(2)(k) GDPR) 275

276

466. The DE SAs and SE SA argue Meta IE gained financial benefits from their decision to
277

rely on contract as legal basis for behavioural advertising, rather than obtaining consent from
278

the users of Facebook. The DE SAs engaged in a detailed calculation to justify their estimation
279

of the benefit, although acknowledging it was based on assumptions. While not providing an
280

estimate of its size, the SE SA considers the existence of financial benefit sufficiently proven on
281

the basis of “the self-evident fact that Facebook has made significant financial gain from being
282

able to provide personal advertisement as part of a whole take it or leave it offer for its social
283

media platform service, as opposed to establishing a separate legal basis for it. By also being
284

unclear in the information to data subjects, it is a reasonable assumption that more data
285

subjects have been misled into being subject to the processing, thus increasing the financial
286

benefits gained by Facebook pursuant to personal advertisement”. 287

288

467. The EDPB recalls that financial benefits from the infringement could be an aggravating
289

circumstance if the case provides information about profit obtained as a result of the
290

infringement of the GDPR. 291

292

468. In the present case, the EDPB considers that it does not have sufficiently precise
293

information to evaluate the specific weight of the financial benefit obtained from the
294

infringement. 295

296

469. Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no
effect if they are disproportionally low compared to the benefits obtained with the
infringement. The EDPB considers that the IE SA should ascertain if an estimation of the financial
benefit from the infringement is possible in this case. Insofar as this results in the need to
increase the amount of the fine proposed, the EDPB requests the IE SA to increase the amount
of the fine proposed.

The profitability of the undertaking - other factor (Article 83(2)(k) GDPR)

470. For the reasons stated above (paragraphs 378 - 381), the EDPB is of the view that the
Draft Decision does not need to include this element as aggravating or mitigating factor as put
forward by the DE SAs.

Competitive advantage - other factor (Article 83(2)(k) GDPR)

471. The NO SA identifies an aggravating factor in that “that the unlawful processing of
personal data in all likelihood has contributed to the development of algorithms which may be
harmful on an individual or societal level, and which may have considerable commercial value
to FIL. The algorithms may have contributed to giving FIL a competitive advantage vis-à-vis its
competitors”.

472. On principle, the EDPB agrees that a competitive advantage could be an aggravating
factor if the case provides objective information that this was obtained as a result of the
infringement of the GDPR. In the present case, the EDPB considers that it does not have
sufficiently precise information to evaluate the existence of a competitive advantage resulting
from the infringement. The EDPB considers that the IE SA should ascertain if an estimation of
the competitive advantage derived from the infringement is possible in this case. Insofar as this
results in the need to increase the amount of the fine proposed, the EDPB requests the IE SA to
increase the amount of the fine proposed.

***

473. Taking into account the nature and gravity of the infringement as well as other aspects in
accordance with Article 83(2) GDPR, the EDPB considers that the IE SA must exercise its power
to impose an additional administrative fine. Also, covering this additional infringement with a
fine would be in line with the IE SA’s (proposed) decision to impose administrative fines in this
case for the transparency infringements relating to processing carried out in reliance on Article
6(1)(b) GDPR. The EDPB underlines that, in order to be effective, proportionate and dissuasive,
a fine should reflect the circumstances of the case. Such circumstances not only refer to the
specific elements of the infringement, but also those of the controller or processor who
committed the infringement, namely its financial position.

297

9.8 I have taken account of the above directions of the EDPB in the Article 83(2) assessments
set out below.

9.9 Finally, in relation to the new finding of infringement of the Article 5(1)(a) principle of
fairness that was established by the EDPB, the EDPB further directed that:

477. As previously established, the principle of fairness under Article 5(1)(a) GDPR, although
intrinsically linked to the principles of lawfulness and transparency under the same provision,
has an independent meaning. It underpins the whole data protection framework and plays a
key role for securing a balance of power in the controller-data subject relationship.

478. Considering the EDPB’s findings in Section 6 that Meta IE has not complied with key
requirements of the principle of fairness as defined by the EDPB, namely allowing for autonomy
of the data subjects as to the processing of their personal data, fulfilling data subjects’
reasonable expectation, ensuring power balance, avoiding deception and ensuring ethical and
truthful processing, as well as the overall effect of the infringement by Meta IE of the
transparency obligations and of Article 6(1) GDPR, the EDPB reiterates its view that Meta IE has
infringed the principle of fairness under Article 5(1)(a) GDPR and agrees with the IT SA that this
infringement should be adequately taken into account by the IE SA in the calculation of the
amount of the administrative fine to be imposed following the conclusion of this inquiry.

479. Therefore, the EDPB instructs the IE SA to take into account the infringement by Meta IE
of the fairness principle enshrined in Article 5(1)(a) GDPR as established above when,
reassessing the administrative fines for the transparency infringements and the determination
of the fine for the lack of legal basis. If, however, the IE SA considers an additional fine for the
breach of the principle of fairness is an appropriate corrective measure, the EDPB requests the
IE SA to include this in its final decision. In any case, the IE SA must take into account the criteria
provided for by Article 83(2) GDPR and ensuring it is effective, proportionate and dissuasive in
line with Article 83(1) GDPR.

9.10 For the avoidance of doubt, the Commission does not consider an additional fine for the
breach of the Article 5(1)(a) principle of fairness that was established by the Article 65
Decision to be an appropriate corrective measure. The Commission notes, in this regard,
that the EDPB’s finding of infringement of the Article 5(1)(a) fairness principle was largely
based on the lack of transparency, as regards the information that was presented to the
data subject concerning the processing that would be carried out further to the Terms of
Service (see, for example, paragraphs 226, 229 and 230 of the Article 65 Decision). The
Commission’s Draft Decision contains separately proposed findings of infringement of the
transparency obligations set out in Articles 5(1)(a), 12(1) and 13(1)(c) and proposes to
exercise corresponding corrective powers in the form of administrative fines and an order
to bring processing into compliance. In the circumstances, the imposition of a further fine

298

for the finding of infringement of the Article 5(1)(a) fairness principle would risk punishing
Facebook twice for the same wrongdoing.

9.11 From the above starting points, the required assessments, for the purpose of Article 83(2),
of the infringements that were found to have occurred elsewhere in this Decision are set
out immediately below.

Article 83(2)(a): the nature, gravity and duration of the infringement taking into account the nature
scope or purpose of the processing concerned as well as the number of data subjects affected and the
level of damage suffered by them

9.12 I note that Article 83(2)(a) GDPR requires consideration of the identified criterion by
reference to “the infringement” as well as “the processing concerned”.

The infringements of Articles 5(1)(a), 12(1) and 13(1)(c) GDPR in the context of transparency

9.13 Considering first the meaning of “infringement”, it is clear from Articles 83(3)-(5) GDPR,
that “infringement” means an infringement of a provision of the GDPR. In the context of
this Inquiry, I have made findings that reflect my view that Facebook infringed Articles
5(1)(a), 12(1) and 13(1)(c) GDPR (“the Transparency Infringements”). Thus, “the
infringement”, for the purpose of my corresponding assessment of the Article 83(2) GDPR
criteria, should be understood (depending on the context in which the term is used) as
meaning an infringement of Articles 5(1)(a), 12(1) and 13(1)(c) GDPR. While each is an
individual “infringement” of the relevant provision, they all concern transparency and, by
reason of their common nature and purpose, are likely to generate the same, or similar,
outcomes in the context of some of the Article 83(2) GDPR assessment criteria.
Accordingly, and for ease of review, I will assess all three infringements simultaneously,
by reference to the collective term “Transparency Infringements”, unless otherwise
indicated to the contrary.

9.14 The phrase “the processing concerned”, in the context of the Transparency Infringements,
should be understood as meaning all of the processing operations that Facebook carries
out on the personal data under its controllership for which it indicated reliance on Article
6(1)(b) GDPR, including for the purposes of behavioural advertising 200. The within Inquiry
was based on an assessment of the extent to which Facebook complies with its
transparency obligations in the context of a specific Complaint. The Inquiry examined,
inter alia the extent of the information Facebook provided to the Complainant about
processing carried out in reliance on Article 6(1)(b) GDPR. Given the generality of the

200
See para. 353 of the EDPB’s Binding Decision 3/2022 on the dispute submitted by the Irish SA on Meta
Platforms Ireland Limited and its Facebook service (Art. 65 GDPR), adopted on 5 December 2022.
299

Complaint and therefore the Inquiry, the precise parameters of this processing were not
directly relevant to the factual analysis carried out. The phrase “the processing
concerned”, in the context of the Transparency Infringements, therefore refers simply to
the processing addressed in the Preliminary Draft Decision i.e. the processing carried out
by Facebook for the purpose of delivering its Terms of Service, including processing
personal data for behavioural advertising. Notwithstanding the EDPB’s determination
that Facebook is not permitted to rely on Article 6(1)(b) GDPR when processing personal
data for behavioural advertising purposes, I am required (by paragraph 353 of the Article
65 Decision) to retain the scope of the “processing concerned”, as set out above.

The infringement of Article 6(1) GDPR in the context of processing for behavioural advertising

9.15 In the context of the infringement of Article 6(1) GDPR that was established by the EDPB
in the Article 65 Decision, the phrase “the processing concerned” should be understood
as meaning all of the processing operations that are carried out by Facebook for the
purpose of behavioural advertising.

9.16 From this starting point, I will now assess the Article 83(2)(a) criterion in light of the
particular circumstances of the Inquiry. I note, in this regard, that Article 83(2)(a)
comprises the nature, gravity and duration of the infringement; the nature, scope or
purpose of the processing concerned; the number of data subjects affected; and the level
of damaged suffered by them; as follows:

Nature, gravity and duration of the infringement

9.17 In terms of the nature of the Transparency Infringements, the proposed findings concern
infringements of the data subject rights. As set out in the analysis of Article 13(1)(c) GDPR
above, my view is that the right concerned – the right to information – is a cornerstone
of the rights of the data subject. Indeed, the provision of the information concerned goes
to the very heart of the fundamental right of the individual to protection of personal data
which stems from the free will and autonomy of the individual to share their personal
data in a voluntary situation such as this. If the required information has not been
provided, the data subject has been deprived of the ability to make a fully informed
decision as to whether they wish to use a service that involves the processing of their
personal data and engages their associated rights. Furthermore, the extent to which a
data controller has complied with its transparency obligations has a direct impact on the
effectiveness of the other data subject rights. If data subjects have not been provided
with the prescribed information, they may be deprived of the knowledge they need in
order to consider exercising one of the other data subject rights.

9.18 I further note, in this regard, that Articles 83(4) and (5) GDPR are directed to the maximum
fine that may be imposed in a particular case. The maximum fine prescribed by Article
300

83(5) GDPR is twice that prescribed by Article 83(4) GDPR. The infringements covered by
Article 83(5) GDPR include infringements of the data subject’s rights pursuant to Article
12 to 22 GDPR and infringements of the principles in Article 5 GDPR. It is therefore clear
that the legislator considered the data subject rights and the Article 5 GDPR principles to
be particularly significant in the context of the data protection framework as a whole.

9.19 Facebook has argued that the nature of the Transparency Infringements amount to a
good faith difference of opinion, and present a new and subjective interpretation of the
GDPR. 201 As part of my assessment of the Article 83(2)(c) GDPR criterion, which requires
consideration of “any action taken by the controller or processor to mitigate the damage
suffered by data subjects”, I note that it would be unfair to criticize Facebook for failing
to take action to mitigate any damage suffered in circumstances where its position was
that no infringement had occurred and, accordingly, no damage had been suffered by
data subjects. This does not, however, do anything to alter the infringement’s objectively
serious character.

9.20 In terms of the nature of the Article 6(1) infringement that was established by the EDPB,
paragraph 441 of the Article 65 Decision provides that:

“The EDPB reiterates that lawfulness of processing is one of the fundamental pillars of the data
protection law and considers that processing of personal data without an appropriate legal basis
is a clear and serious violation of the data subjects’ fundamental right to data protection.”

9.21 In considering the nature and scope of the processing in the context of the analysis leading
to the finding of infringement of Article 6(1) itself, the EDPB noted, at paragraphs 95 and
96 of the Article 65 Decision, that:

“… Meta IE collects data on its individual users and their activities on and off its Facebook social
network service via numerous means such as the service itself, other services of the Meta group
including Instagram, WhatsApp and Oculus, third party websites and apps via integrated
programming interfaces such as Facebook Business Tools or via cookies, social plug-ins, pixels
and comparable technologies placed on the internet user’s computer or mobile device.
According to the descriptions provided, Meta IE links these data with the user’s Facebook
account to enable advertisers to tailor their advertising to Facebook’s individual users based on
their consumer behaviour, interests, purchasing power and personal situation. This may also
include the user’s physical location to display content relevant to the user’s location. Meta IE
offers its services to its users free of charge and generates revenue through this personalised
advertising that targets them, in addition to static advertising that is displayed to every user in
the same way.

201
Facebook Submissions on Preliminary Draft Decision, paragraph 13.2.
301

The EDPB considers that these general descriptions signal by themselves the complexity, massive
scale and intrusiveness of the behavioural advertising practice that Meta IE conducts through
the Facebook service. These are relevant facts to consider to assess the appropriateness of
Article 6(1)(b) GDPR as a legal basis for behavioural advertising and to what extent reasonable
users may understand and expect behavioural advertising when they accept the Facebook
Terms of Service and perceive it as necessary for Meta IE to deliver its service.”

9.22 With specific reference to the scope of the processing, paragraph 444 of the Article 65
Decision, provides that:

“… the EDPB notes the IE SA’s assessment that the personal data processing carried out by Meta
IE on the basis of Article 6(1)(b) GDPR is extensive, adding that “[Meta IE] processes a variety of
data in order to serve users personalised advertisements, tailor their ‘News Feed’, and to provide
feedback to advertising partners on the popularity of particular advertisements. The processing
is central to and essential to the business model offered”

9.23 It is therefore clear that the EDPB considers the Article 6(1) infringement to concern one
of the “fundamental pillars” of the GDPR and the nature and scope of the processing to
be extensive, complex, intrusive and on a massive scale. The Commission further notes,
in this regard, that paragraph 443 of the Article 65 Decision indicates that the EDPB
considered the nature of the infringement to be significant, in the context of its conclusion
that an administrative fine ought to be imposed in relation to the infringement of Article
6(1) GDPR.

9.24 In terms of the gravity of the Transparency Infringements, my findings are such that
Facebook has not provided the required information in the required manner under Article
13(1)(c) GDPR and has also infringed Articles 12(1) and 5(1)(a) GDPR. This, in my view,
represents a significant level of non-compliance, taking into account the importance of
the right to information, the consequent impact on the data subjects concerned and the
number of data subjects potentially affected (each of which is considered further below).

9.25 Facebook argues that the Transparency Infringements are on the lower end of the scale
in their nature and gravity because the Commission’s interpretation amounts to new and
subjective views being imposed on it. 202 I do not accept that these views are new or
subjective. I set out at Section 5 in great detail the extent to which this level of compliance
is expected by the transparency guidelines, which are a publicly available document. The

202
Ibid.
302

clear inconsistencies between the transparency guidelines and the manner in which
Facebook attempted to comply with its obligations makes clear that the Commission’s
interpretation is neither new nor subjective. The Commission is carrying out its functions
under the GDPR, by interpreting and applying the relevant provisions of the GDPR to the
Complaint before it. Facebook also argues that no evidence has been presented of the
impact on data subjects from a lack of transparency. 203 On the contrary, this entire
Complaint arises from a failure to provide sufficiently transparent information such that
the Complainant could understand the agreement to the Terms of Service was not
consent in the sense meant in the GDPR. Moreover, I have already set out in Section 5 the
risks to data subjects in being unable to effectively exercise their rights by being unable
to discern what specific data processing is being done on what legal basis and for what
objective. This is more than sufficient to show the negative impact that this has had on
data subjects and specifically on the Complainant. Given that this concerns a significant
impact in the manner set out in this Decision, I cannot accept the suggestion from
Facebook that the proposed administrative fine be replaced with a reprimand. 204

9.26 In terms of the gravity of the Article 6(1) infringement that was established by the EDPB,
the Article 65 Decision does not identify, with any particularisation, the EDPB’s position
on the gravity of the Article 6(1) infringement. The Commission notes, however, that
paragraph 443 of the Article 65 Decision indicates that the EDPB considered the gravity
of the infringement to be significant, in the context of its conclusion that an administrative
fine ought to be imposed in relation to the infringement of Article 6(1) GDPR:

“As mentioned above and outlined below, the nature and gravity of the infringement clearly tip
the balance in favour of imposing an administrative fine.”

9.27 The Commission, for its part, notes that infringements of Article 6 are subject to the higher
fining threshold set out in Article 83(5) GDPR. The maximum fine prescribed by Article
83(5) GDPR is twice that prescribed by Article 83(4) GDPR. This arrangement clearly
indicates that the legislator considered the matters covered by Article 83(5) GDPR to be
particularly significant in the context of the data protection framework as a whole.

9.28 In terms of the duration of the Transparency Infringements, this complaint-based Inquiry
relates in part to a lack of information provided to the Complainant as regards the lawful
basis relied on and the connection between Article 6(1)(b) GDPR and specific processing
operations or sets of operations. The Complaint therefore relates to the transparency of
the relevant documents at the time the Complaint was lodged. In that sense, this Inquiry

203
Ibid.
204
Ibid.
303

relates to specific alleged infringements at a specific point in time, because that is what
the Complaint concerns. In imposing corrective powers however, the GDPR requires that
the broader impact of infringements be considered (as I will set out below in relation to
each individual criterion). To that extent, it is necessary at times to move from the specific
to the general.

9.29 I note at this juncture that Facebook has taken issue with various alleged inconsistencies
between the approach to factors considered in administrative fines in the Preliminary
Draft Decision and in other decisions made by the Commission under the GDPR to date. 205
The Commission does not agree that there is any inconsistency in the manner in which it
has assessed the Article 83(2) GDPR criteria. The Commission is not required to apply the
same approach across all inquiries, regardless of the differences between such inquiries.
The Commission’s approach to the presence or absence of relevant previous
infringements (for the purpose of the Article 83(2)(e) GDPR assessment) differs,
depending inter alia on the contexts of different types of controllers, particularly as
concerns the scale of the processing at issue. Unlike the position with the smallerscale
domestic inquiries to which Facebook refers, inquiries into larger internet platforms
generally concern data controllers or processors with multi-national operations and
significant resources available to them, including large, in-house, compliance teams.

9.30 Moreover, such entitles are further likely to be engaged in business activities that are
uniquely dependent on the large-scale processing of personal data. The Commission’s
view is that the size and scale of such entities, the level of dependency on data processing
and the extensive resources that are available to them necessitate a different approach
to the absence of previous relevant infringements. That approach has been reflected in
the decisions that differ in their considerations of particular factors from this one. In the
circumstances, the Commission does not accept that there has been an inconsistency in
the Commission’s approach to determining the quantum of any fine.

9.31 In relation to the infringement of Article 6(1) that was established by the EDPB, the Article
65 Decision does not contain any indication in relation to the manner in which the EDPB
took account of the duration of the Article 6(1) infringement. The Commission notes that
the infringement has occurred since 25 May 2018 and remains ongoing.

Taking into account the nature, scope or purpose of the processing concerned

9.32 The personal data processing carried out by Facebook pursuant to Article 6(1)(b) GDPR is
extensive. Facebook processes a variety of data in order to serve users personalised
advertisements, tailor their “News Feed”, and to provide feedback to advertising partners
on the popularity of particular advertisements. The processing is central to and essential

205
Ibid, paragraph 14.2.
304

to the business model offered, and, for this reason, the provision of compliant
information in relation to that processing becomes even more important. This, indeed,
may include location and IP address data.

9.33 The EDPB’s views, as regards the scope of the processing concerned, in the context of the
Article 6(1) infringement have already been recorded at paragraph 9.21, above.

The number of data subjects affected

9.34 In the context of the Transparency Infringements, I noted, in the Draft Decision, that
Facebook has confirmed that, as of the date of the Complaint, it had approximately
monthly active users and that, as of May 2021, it had approximately monthly
active users in the European Economic Area. 206

9.35 Eurostat, the statistical office of the European Union confirms that, as of 1 January 2020,
the population of the “”EU 27” was approximately 488 million, the population of the UK
was approximately 67 million, the population of Norway was approximately 5 million, and
the populations of Iceland and Liechtenstein were approximately 364,000 and 39,000
respectively. 207

9.36 By reference to these figures, the total population of the EEA (including the UK) by
reference to the latest available figures is approximately 520 million. While it is not
possible, or indeed necessary, for me to identify the precise number of users affected by
the Infringements, it is useful to have some point of reference in order to consider the
extent of EEA data subjects that are potentially affected by the Infringements. The figures
available for Facebook equates to approximately of the population of the EEA
(including the UK), by reference to the Eurostat figures above.

9.37 In relation to the finding of infringement of Article 6(1) GDPR that was established by the
EDPB, paragraph 445 of the Article 65 Decision recalls, by reference to the assessment
recorded immediately above, that “the infringement at issue relates to the processing of
personal data of a significant number of people”. Footnote 886 (to paragraph 445 of the
Article 65 Decision) further references paragraph 9.17 of the Commission’s Draft Decision,
with the EDPB noting that this figure “amounts to roughly of the population [of the
EEA, including the UK].”

The level of damage suffered by them

206
Ibid, paragraph 4.11.
207
https://ec.europa.eu/eurostat/tgm/table.do?tab=table&init=1&language=en&pcode=tps00001&plugin=1.
305

9.38 In the context of the Transparency Infringements, I note that Recital 75 (which acts as an
aid to the interpretation of Article 24 GDPR, the provision that addresses the
responsibility of the controller), describes the “damage” that can result where processing
does not accord with the requirements of the GDPR:

“The risk to the rights and freedoms of natural persons, of varying likelihood and severity,
may result from personal data processing which could lead to physical, material or
nonmaterial damage, in particular: … where data subjects might be deprived of their rights
and freedoms or prevented from exercising control over their personal data …”

9.39 As set out above, my findings are such that users have not been provided with the
information in relation to processing pursuant to Article 6(1)(b) GDPR that they are
entitled to receive. This represents, in my view, quite a significant information deficit and
one which, by any assessment of matters, can equate to a significant inability to exercise
control over personal data. I have also pointed out the centrality of the processing to
Facebook’s business model. This makes it all the more important that information on this
processing be provided in a transparent manner, and makes the implications of it not
being provided in such a manner all the more significant.

9.40 I further note that the failure to provide all of the prescribed information undermines the
effectiveness of the data subject rights and, consequently, infringes the rights and
freedoms of the data subjects concerned. A core element of transparency is empowering
data subjects to make informed decisions about engaging with activities that cause their
personal data to be processed, and making informed decisions about whether to exercise
particular rights, and whether they can. This right is undermined by a lack of transparency
on the part of a data controller.

9.41 Facebook argues that the above amounts to mere speculation.208 I have already set out
in detail in this Decision the risks to data subject rights involved in the denial of
transparency, and indeed provided the concrete example of the breach of the
Complainant’s rights to transparency about the use of her personal data. This is more than
sufficient to show that rights have been damaged in a significant manner, given the lack
of an opportunity to exercise data subject rights while being fully informed.

9.42 In the context of the infringement of the infringement of Article 6(1) GDPR that was
established by the EDPB, paragraph 446 of the Article 65 Decision records that:

208
Facebook Submissions on Preliminary Draft Decision, paragraph 4.13.
306

“Though the damage is very difficult to express in terms of a monetary value, it remains the case
that data subjects have been faced with data processing that should not have occurred … . The
data processing in question – behavioural advertising – entails decisions about information that
data subjects are exposed to or excluded from receiving. The EDPB recalls that non-material
damage is explicitly regarded as relevant in Recital 75 and that such damage may result from
situations “where data subjects might be deprived of their rights and freedoms or prevented
from exercising control over their personal data”. Given the nature and gravity of the
infringement of Article 6(1) GDPR, a risk of damage caused to data subjects is, in such
circumstances, consubstantial with the finding of the infringement itself.”

9.43 Paragraph 129 of the Article 65 Decision considers the risks arising from the Article 6(1)
infringement as follows:

“Given that the main purpose for which a user uses the Facebook service is to communicate with
others, and that Meta IE conditions its use to the user’s acceptance of a contract and the
behavioural advertising it includes, the EDPB cannot see how a user would have the option of
opting out of a particular processing which is part of the contract as the IE SA seems to argue.
The users’ lack of choice in this respect would rather indicate that Meta IE’s reliance on the
contractual performance legal basis deprives users of their rights, among others, to withdraw
their consent under Article 6(1)(a) GDPR and Article 7 GDPR and/or to object to the processing
of their data based on Article 6(1)(f) GDPR.”

9.44 The EDPB further considered, at paragraph 131 of the Article 65 Decision, that:

“Some of the safeguards from which data subjects would be deprived due to an inappropriate
use of Article 6(1)(b) GDPR as legal basis, instead of others such as consent 6(1)(a) GDPR and
legitimate interest 6(1)(f) GDPR, are the possibility to specifically consent to certain processing
operations and not to others and to the further processing of their personal data (Article 6(4)
GDPR); their freedom to withdraw consent (Article 7 GDPR); their right to be forgotten (Article
17 GDPR); and the balancing exercise of the legitimate interests of the controller against their
interests or fundamental rights and freedoms (Article 6(1)(f) GDPR). As a result, owing to the
number of users, market power, and influence of Meta IE and its economically attractive
business model, the risks derived from the current findings of the Draft Decision could go beyond
the Complainant and the millions of users of Facebook service in the EEA and affect the
protection of the hundreds of millions of people covered by the GDPR.”

9.45 It therefore appears that the EDPB considered the infringement to give rise to a risk of
loss of control over, and ability to exercise choice concerning, one’s personal data. This

307

is consistent with the Complainant’s position that the infringement had the effect of
negating her free will (see point ii, page 17 of the Complaint).

9.46 The Commission considers that the infringement of the Article 5(1)(a) fairness principle
may be taken into account, as required by the Article 65 Decision, under this particular
heading. The Commission notes, in this regard, paragraph 224 of the Article 65 Decision,
which records the EDPB’s view that:

“Considering the constantly increasing economic value of personal data in the digital
environment, it is particularly important to ensure that data subjects are protected from any
form of abuse and deception, intentional or not, which would result in the unjustified loss of
control over their personal data. Compliance by providers of online services acting as controllers
with all three of the cumulative requirements under Article 5(1)(a) GDPR, taking into account
the particular service that is being provided and the characteristics of their users, serves as a
shield from the danger of abuse and deception, especially in situations of power asymmetries.”

9.47 The EDPB further notes, at paragraphs 229 and 230 of the Article 65 Decision, that:

“… the EDPB shares the IT SA’s concern that Facebook users are left ”in the dark" and considers
that the processing by Meta IE cannot be regarded as ethical and truthful because it is confusing
with regard to the type of data processed, the legal basis and the purpose of the processing,
which ultimately restricts the Facebook users’ possibility to exercise their data subjects’ rights.

… Considering the seriousness of the infringements of the transparency obligations by Meta IE
already identified in the Draft Decision and the related misrepresentation of the legal basis relied
on, the EDPB agrees with the IT SA that Meta IE has presented its service to the Facebook users
in a misleading manner, which adversely affects their control over the processing of their
personal data and the exercise of their data subjects' rights.”

9.48 The EDPB’s views highlight the same damage as already identified above, namely the loss
of control over, and ability to exercise choice concerning, one’s personal data.

9.49 On the basis of the views that have been expressed by the EDPB, as recorded above, I
conclude that the infringement of Article 6(1) GDPR falls within the upper range of the
scale, in terms of seriousness, for the purpose of the assessment of the Article 83(2)(a)
criterion. By way of its Final Submissions, Facebook expressed its disagreement with this
proposed conclusion and the underlying assessments set out above.

308

Facebook’s Final Submissions in response to the assessment of the Article 6(1) infringement for the
purpose of Article 83(2), as introduced to this Decision following the adoption of the Article 65 Decision

9.50 Following the amendment of the Draft Decision to take account of the EDPB’s Article 65
Decision, Facebook was invited to exercise its right to be heard in relation to those aspects
of the Draft Decision in relation to which the Commission was required to make a final
determination or, otherwise, to exercise its discretion. Facebook furnished its
submissions on these matters under cover of letter dated 19 December 2022 (“the Final
Submissions”).

9.51 In relation to the nature of the Article 6(1) infringement, Facebook submitted 209 that the
EDPB’s conclusion on this aspect of matters “is not correct and not supported by the
evidence, particularly where (i) the [Commission] itself found [Facebook’s] reliance on
Article 6(1)(b) for [behavioural advertising purposes] valid in principle, meaning the
infringement cannot be said to have been “clear”; and (ii) the Article 65 Decision
acknowledges that legal bases are available [to support processing for behavioural
advertising] and that there is no hierarchy between those legal bases.” In this regard,
Facebook respectfully urges the Commission not to adopt the EDPB’s “flawed arguments”
with respect to Article 83(2)(a) in light of a number of “significant errors in the EDPB’s
reasoning” that it has identified in its Final Submissions.

9.52 In circumstances where the Article 65 Decision is binding upon the Commission, I am not
in a position to act contrary to, or otherwise look behind, the views that have been so
expressed the EDPB.

9.53 In relation to the gravity of the Article 6(1) infringement, Facebook, firstly, noted that the
Article 65 Decision does not articulate any clear reasoning or position with respect to the
gravity of the purported infringement, rendering the assessment of this element
meaningless. Facebook has further submitted 210 that a “finding in respect of gravity
cannot simply be extrapolated from the fact that the infringement found is subject to a
particular fining cap in accordance with Article 83(5), with no reference to the facts.”
Facebook submitted that gravity should not be considered significant or an aggravating
factor for the same reasons as those provided in response to the proposed assessment of
the nature of the assessment, as summarised above.

9.54 As before, the Commission is not in a position to act contrary to the views that have been
clearly expressed by the EDPB in its binding Article 65 Decision. As already acknowledged,
the EDPB has not elaborated on the reasons why it considers the gravity of the Article 6(1)
infringement to be one of the factors that tip the balance in favour of the imposition of a

209
The Final Submissions, paragraphs 9.4 to 9.7
210
The Final Submissions, paragraphs 9.8 to 9.13
309

fine. This does not alter the fact, however, that the EDPB clearly considered the gravity
of the Article 6(1) infringement to be of one of the factors that warranted the imposition
of an administrative fine. In these circumstances, it is not open to the Commission to
conclude that the gravity of the infringement is not significant, in terms of its impact on
the overall assessment of the Article 83(2)(a) criterion.

9.55 In relation to the duration of the Article 6(1) infringement, Facebook has submitted 211
that the duration of the alleged infringement “should not be considered an aggravating
factor in this particular case”. In the absence of any specific direction from the EDPB, in
this regard, the Commission has not treated this factor as being significant, in terms of its
impact on the overall assessment of the Article 83(2)(a) criterion.

9.56 In relation to the number of data subjects and the level of damage suffered by them,
Facebook has submitted212 that:

• “the only data subject who is relevant for the purpose of Article 83(2)(a) is the data subject
represented by the Complainant and any consideration of the level of damage suffered is
confined to a consideration of any damage the Complainant may have suffered. No evidence
of any such damage has been adduced in the Inquiry”;

• “even if it is open to the [Commission] to consider whether other data subjects have been
affected and to have regard to any damage suffered by them, there is no evidence whatsoever
in this Inquiry that any other data subjects have suffered any damage.”

• “the [Commission’s] assessment of whether damage has been suffered for the purposes of
Article 83(2)(a) must be based on evidence of damage stemming from the specific infringement in
question (here, the Article 6(1) GDPR infringement). It is not permissible for the DPC to assume that the
Complainant has suffered damage or to base the calculation of the proposed Article 6(1) fine on “the
same damage as already identified” as the basis for the purposed Article 5(1)(a) fine.”

• “an alleged “loss of control” should not be equated with damage within the meaning of Article
83(2)(a) GDPR”;

• There is no factual or evidential basis to support an assertion that users experienced a “loss
of control”. “This is especially true considering that everyone has a choice as to whether they
wish to use the Facebook Service in the first place and can always deactivate their accounts.”

211
The Final Submissions, paragraphs 9.14 to 9.19
212
The Final Submissions, paragraphs 9.20 to 9.29
310

9.57 In response to the above submissions, it is, firstly, important to note that the Commission
is subject to a binding decision of the EDPB, which includes an assessment of the damage
suffered by data subjects, at paragraph 446 thereof. In the circumstances, it is not open
to the Commission to find that no damage has been suffered. Secondly, the Complainant
herself identified the damage that she alleges to have suffered in connection with the
matters which formed the basis for the EDPB’s findings of infringement of Article 6(1) and
the Article 5(1)(a) principle of fairness. Thirdly, as regards the damage suffered by data
subjects other than the Complainant, the matters covered by the findings of infringement
are not matters on which any individual user of the Facebook Service has the power to
exercise choice (other than, of course, the choice to use the Facebook Service or not).
Where any individual data subject chooses to use the Facebook Service, the basic
processing that takes place (the subject of the within Inquiry) is the same as that applied
to the personal data of the Complainant. In these circumstances, it cannot be said that
the identified damage suffered, i.e. loss of control over one’s personal data, is limited to
the Complainant alone. For these reasons, it is appropriate for the Commission to take
account of the damage suffered by all user data subjects as part of the Article 83(2)
assessment.

9.58 Having taken account of the Final Submissions, I remain of the view that the infringement
of Article 6(1) GDPR falls within the upper range of the scale, in terms of seriousness, for
the purpose of the assessment of the Article 83(2)(a) criterion.

ARTICLE 83(2)(B): THE INTENTIONAL OR NEGLIGENT CHARACTER OF THE INFRINGEMENT

9.59 In assessing the character of the Transparency Infringements, I note that the GDPR does not identify
the factors that need to be present in order for an infringement to be classified as either
“intentional” or “negligent”. The Article 29 Working Party considered this aspect of matters in its
“Guidelines on the application and setting of administrative fines for the purposes of Regulation
2016/679” as follows:

“In general, “intent” includes both knowledge and wilfulness in relation to the
characteristics of an offence, whereas “unintentional” means that there was no intention
to cause the infringement although the controller/processor breached the duty of care
which is required in the law.” 213

9.60 The Administrative Fines Guidelines go on to distinguish between circumstances that are indicative
of ‘intentional breaches’ and those that are indicative of breaches occasioned by unintentional,

Article 29 Working Party “Guidelines on the application and setting of administrative fines for the purposes of
213

Regulation 2016/679”, page 11.
311

or negligent, conduct. In this regard, the Guidelines cite “failure to read and abide by existing
policies” and “human error” as being examples of conduct that may be indicative of negligence.

9.61 The Complainant has clearly asserted that the alleged infringements on Facebook’s part were
intentional acts. Moreover, she states that the character of the infringement is that it was a
decision made knowingly to present information in a particular way. Facebook is however entitled
to a hold differing position in relation to the interpretation of particular provisions of the GDPR.
While Facebook may have believed that it was in compliance with the GDPR, it is my view that the
Transparency Infringements arose out of a deliberate decision. It is important that Facebook
provides clarity about the precise extent of the processing operations carried out pursuant to
Article 6(1)(b) GDPR and that it adheres strictly to its transparency obligations when choosing the
lawful bases on which they rely.

9.62 Facebook cites the above passage from the Fining Guidelines to support its position that “intention”
refers to a deliberate breach of the GDPR rather than a deliberate act. 214 I note in this regard that
the Fining Guidelines refer to two requirements, “knowledge” and “wilfulness”. This suggests a
controller must infringe the GDPR both in full knowledge of the infringement’s characteristics and
also in a deliberate manner. Having considered the nature of the infringements further in the
context of the Fining Guidelines, I accept Facebook’s submissions that any intentional breach must
be an intentional and knowing breach of a provision of the GDPR. There is no evidence that this
has taken place.

9.63 Facebook also argues that even if the position on the definition of intent is accepted, what occurred
was not a deliberate act but an omission. 215 In light of my finding in the above paragraph it is
unnecessary to consider this submission.

9.64 I am therefore satisfied that the failure to provide the requisite information was negligent in
character. Facebook is under a clear legal duty to correctly apply the law and it has not done so.
This amounts to a breach of the duty imposed by the provisions of the GDPR, and is on that basis
a negligent infringement.

9.65 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, paragraphs
449 to 461, inclusive, of the Article 65 Decision record as follows:

“The EDPB Guidelines on calculation of fines confirm that there are two cumulative elements
on the basis of which an infringement can be considered intentional: the knowledge of the
breach and the wilfulness in relation to such act. By contrast, an infringement is “unintentional”
when there was a breach of the duty of care, without having intentionally caused the
infringement.

214
Facebook Submissions on Preliminary Draft Decision, paragraph 4.14.
215
Ibid.
312

The characterisation of an infringement as intentional or negligent shall be done on the basis
of objective elements of conduct gathered from the facts of the case. It is worth noting the
broader approach adopted with respect to the concept of negligence, since it also encompasses
situations in which the controller or processor has failed to adopt the required policies, which
presumes a certain degree of knowledge about a potential infringement. This provides an
indication that non-compliance in situations in which the controller or processor should have
been aware of the potential breach (in the example provided, due to the lack of the necessary
policies) may amount to negligence.”

…

The EDPB recalls that even prior to the adoption [of] Guidelines 2/2019, there were clear
indicators that spoke against relying on contract as legal basis. First, in WP29 Opinion 01/2010
on online behavioural advertising, only consent – as required by Article 5(3) ePrivacy Directive
– is put forward as possible legal basis for this activity. As Article 6 GDPR resembles Article 7 of
the Data Protection Directive to a large extent, WP29 Opinion 02/2010 remained a relevant
source on this matter for controllers preparing for the GDPR to enter into application. Second,
WP Opinion 06/2014 on the notion of legitimate interests explicitly states that “the fact that
some data processing is covered by a contract does not automatically mean that the processing
is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for
building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website
and the items purchased. This is because the data controller has not been contracted to carry
out profiling, but rather to deliver particular goods and services, for example. Even if these
processing activities are specifically mentioned in the small print of the contract, this fact alone
does not make them ‘necessary’ for the performance of the contract”

It stems from the above that Meta IE had (or should have had) knowledge about the
infringement of Article 6(1)(b) GDPR. However, this mere element is not sufficient to consider
an infringement intentional, as stated above, since the “aim” or “wilfulness” of the action
should be demonstrated.

The EDPB recalls that that having knowledge of a specific matter does not necessarily imply
having the “will” to reach a specific outcome. This is in fact the approach adopted in the EDPB
Guidelines on calculation of fines and WP29 Guidelines on Administrative Fines, where the

313

knowledge and the “wilfulness” are considered two distinctive elements of the intentionality.
While it may prove difficult to demonstrate a subjective element such as the “will” to act in a
certain manner, there need to be some objective elements that indicate the existence of such
intentionality.

The EDPB recalls that the CJEU has established a high threshold in order to consider an act
intentional. In fact, even in criminal proceedings the CJEU has acknowledged the existence of
“serious negligence”, rather than ‘intentionality’ when “the person responsible commits a
patent breach of the duty of care which he should have and could have complied with in view
of his attributes, knowledge, abilities and individual situation”. In this regard, the EDPB
confirms that a company for whom the processing of personal data is at the core of its business
activities is expected to have sufficient measures in place for the safeguard of personal data:
this does not, however, per se change the nature of the infringement from negligent to
intentional.

In this regard, the SE SA puts forward that Meta IE based its processing of personalised
advertisement on consent until the GDPR came into force on 25 May 2018, and at this time
switched to relying on Article 6(1)(b) GDPR for the processing in question instead. The timing
and the logistics for this switch suggests this act was done with the intention of circumventing
the new rights of users under Article 6(1)(a) GDPR. The SE SA adds that “[the] proposed finding
of infringement concerning information deficits about the processing, namely on what legal
basis it is based, further supports this conclusion, since it goes to show that Facebook was
aware of the questionable legality of that basis and tried to conceal the infringement to avoid
scrutiny by supervisory authorities and data subjects”.

The EDPB considers the timing of the changes made by Meta IE to its Facebook Terms of Service
as an objective element; however, this alone does not indicate intention. Around this time
period, many controllers updated their data protection policies. The objection suggests that the
conclusion on intentionality is corroborated by the shortcomings to the transparency
obligations: in the EDPB’s view, the combination of the timing of the change of legal basis with
the lack of transparency is not sufficient to indicate intention either.

Therefore, on the basis of the available information, the EDPB is not able to identify a will of
Meta IE to act in breach of the law, as it cannot be concluded that Meta IE intentionally acted
to circumvent its legal obligations.

Therefore, the EDPB considers that the arguments put forward by the SE SAs do not meet the
threshold to demonstrate the intentionality of the behaviour of Meta IE. Accordingly, the EDPB
is of the view that the Draft Decision does not need to include this element.

At the same time, the EDPB notes that, even establishing that the infringement was committed
negligently, a company for whom the processing of personal data is at the core of its business
activities should have in place sufficient procedures for ensuring compliance with the GDPR.

314

The EDPB does not accept Meta IE’s claim of “good faith”, but is of the view that Meta IE was
certainly seriously negligent in not taking adequate action, within a reasonable time period,
following the adoption of Guidelines 2/2019 on 9 April 2019. Even before that date, the EDPB

315

considers there was at the very least negligence on Meta IE’s part considering the contents of
WP29 Opinion 02/2010 on online behavioural advertising and WP29 Opinion 06/2014 on the
notion of legitimate interests … , which mean Meta IE had (or should have had) knowledge about
the infringement of Article 6(1)(b) GDPR, the fact that processing of personal data is at the core
of its business practices, and the resources available to Meta IE to adapt its practices so as to
comply with data protection legislation.”

9.66 As set out above, the EDPB determined the Article 6(1) infringement to be “seriously negligent” in
character. In the circumstances, I proposed to treat this factor as an aggravating factor of
significant weight.

9.67 Facebook disagrees 216 with the above conclusion on the basis of a range of submissions, all of which
challenge the basis for the EDPB’s conclusion. Facebook submits that the finding of infringement
of Article 6(1) GDPR can “at most be considered inadvertent, such that this should not be treated
as an aggravating factor for the purpose of Article 83(2).” In the alternative, Facebook has
submitted that the Commission should not afford any material weight to this factor in light of its
“good faith reliance on what it considered to be a valid legal basis, (b) the errors in the reasoning
of the EDPB [as identified]; and (c) the lack of legal certainty in the interpretation of Article 6(1)(b)
GDPR.”

9.68 As already noted, above, the Article 65 Decision is binding upon the Commission. In the
circumstances, it is not open to the Commission to disregard the views that have been clearly
expressed by the EDPB, in relation to the character of the Article 6(1) infringement. In
circumstances where the EDPB has determined the Article 6(1)(b) infringement to be “seriously
negligent” in character, I remain of the view that this requires me to treat this factor as an
aggravating factor of significant weight, notwithstanding Facebook’s Final Submissions on the
point.

ARTICLE 83(2)(C): ANY ACTION TAKEN TO MITIGATE THE DAMAGE TO DATA SUBJECTS

9.69 Facebook’s position is that its approach to transparency, in the context in which the Transparency
Infringements have been found, complies fully with the GDPR. Notwithstanding my proposed
disagreement with this position, I accept that it represents a genuinely held belief on Facebook’s
part. This does not alter the fact that infringements have occurred. On that basis, there has been

216
The Final Submissions, paragraphs 9.30 to 9.37
316

no effort to mitigate the damage to data subjects, given Facebook’s position was that no damage
was taking place.

9.70 Facebook argues that this analysis is flawed because it takes no account of the effort made to comply
with the GDPR. There is no reason why, on the basis of Transparency Guidelines, Facebook could
not have taken steps to ensure compliance and thereby mitigate damage. I am not satisfied that
there is any reason why day-to-day compliance related activities in a large multinational
organisation, which is an important legal duty and commonplace business activity, could be
considered a mitigating factor. Taking steps to attempt to comply with legal obligations is a duty,
and has no mitigating impact on a sanction for a breach of those obligations. This is distinct from
any act that might be taken to mitigate specific damage to data subjects. I am not of course
treating this factor as aggravating given that, beyond simply complying with the GDPR, there are
no obvious mitigating steps that could have been taken. It is on this basis that I treat this factor as
neither mitigating nor aggravating.

9.71 By way of the Draft Decision, I proposed to take account of and acknowledge, as a mitigating factor,
Facebook’s willingness to engage in steps to bring its processing into compliance on a voluntary
basis pending the conclusion of this Inquiry. Further, however, to an objection raised by the Polish
SA, during the Article 60 consultation period, the EDPB determined, in paragraphs 362 to 366 of
the Article 65 Decision, as follows:

363. The IE SA states that “[Meta IE]’s willingness to engage in steps to bring its processing
into compliance on a voluntary basis” should be understood as actions taken to mitigate the
damage to data subjects, distinct from actions taken to comply685. In the present case, the
EDPB fails to see how such a distinction can be made. Additionally, drawing this distinction
seems inconsistent with the IE SA’s position that the negative impact on data subjects lies
precisely in the transparency infringements and thus in the “the risks to data subjects in being
unable to effectively exercise their rights by being unable to discern what specific data
processing is being done on what legal basis and for what objective”686. In other words, the
damage caused to data subjects is, in these circumstances, consubstantial with the finding of
the infringement itself687.

365. The EDPB agrees with the IE SA that “[taking] steps to attempt to comply with legal
obligations is a duty, and has no mitigating impact on a sanction for a breach of those
obligations”. In any case, Meta IE’s “decision to begin preparation for voluntary compliance
on the basis of the views set out in the Preliminary Draft Decision” is merely a first step of a
longer process towards full compliance with the GDPR. The information available in the file

317

does not include indications that the actions taken by the controller have gone beyond
willingness to prepare to change its practices in case this appeared necessary.

9.72 On the basis of the above, and in accordance with the instruction of the EDPB, the
Commission treats this factor as neither mitigating nor aggravating.

9.73 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB,
this aspect of the Article 83(2) assessment has not been addressed in the Article 65
Decision. I note that Facebook, throughout the course of the Inquiry, considered that it
was entitled to process personal data for behavioural advertising purposes, insofar as that
formed a core part of the Facebook Terms of Service, in reliance on Article 6(1)(b) GDPR.
That being the case, it follows that Facebook could not have been expected to take action
“to mitigate the damage suffered by data subjects” in circumstances where it did not
consider any infringement to have occurred or any damage to have been suffered by data
subjects. In the circumstances, the Commission proposed to consider this factor to be
neither aggravating nor mitigating.

9.74 By way of the Final Submissions, Facebook has urged me to take account of various
mitigating matters such as the absence of evidence of harm and the fact that various
voluntary steps have been taken to improve transparency for users since the Inquiry has
commenced, including as recently as July 2022. I note that I have already addressed
Facebook’s submissions concerning the absence of evidence of harm, as part of the Article
83(2)(a) assessment. In relation to the voluntary changes that have been made since the
date of circulation, to the CSAs, of the Draft Decision, the Commission is unable to give
credit to these changes, as a mitigating factor, without an assessment of the changes
themselves. Given that such an assessment is not possible within the temporal scope of
the within Inquiry, the Commission is unable to treat this matter as a mitigating factor.
Accordingly, I remain of the view that this factor ought to be treated as neither
aggravating nor mitigating.

ARTICLE 83(2)(D): THE DEGREE OF RESPONSIBILITY OF THE CONTROLLER OR PROCESSOR TAKING INTO ACCOUNT TECHNICAL
AND ORGANISATIONAL MEASURES IMPLEMENTED BY THEM PURSUANT TO ARTICLES 25 AND 32

318

9.75 The Fining Guidelines set out that:

“The question that the supervisory authority must then answer is to what extent the
controller “did what it could be expected to do” given the nature, the purposes or the size
of the processing, seen in light of the obligations imposed on them by the Regulation.”

9.76 In relation to Facebook’s responsibility from a technical and organisational perspective, Facebook
has argued that, given it did not deliberately and knowingly break the law. It could not be said to
have responsibility “at the highest level”. 217 While I accepted this argument and revised my
provisional view as a consequence, I nonetheless consider that Facebook’s responsibility is
certainly at a high level.

9.77 In this regard, I once again emphasise that the position as implemented represented a genuinely held
belief, and the modes of implementation of compliance utilised by Facebook in this regard
constituted a genuine effort to implement compliance based on this genuinely held belief. This
genuine effort, however, has ultimately fallen short in terms of compliance in significant respects.
I have found that it concerns serious data processing, and that it was deliberate act, in spite of the
genuinely help belief that the modes of implementation were compliant. The degree of
responsibility on Facebook’s part is therefore, in my view, responsibility of a high level.

9.78 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, paragraph
462 of the Article 65 Decision provides that:

“The EDPB considers the degree of responsibility of Meta IE’s part to be of a high level, on the
same grounds as set [out] in the Draft Decision with regard to the transparency infringements.”

9.79 In the circumstances, the Commission proposed to consider this to be an aggravating factor, of
moderately significant weight.

9.80 By way of the Final Submissions, Facebook disagreed 218 with the above assessment on the basis that
“the EDPB’s conclusion at para. 462 of the Article 65 Decision that [Facebook] had a “high degree”
of responsibility pursuant to this factor is based on an incomplete analysis and the EDPB fails to
consider any of the relevant subfactors set forth by the Article 29 Working Party Draft
Administrative Fine Guidelines in reaching its conclusion.”

217
Ibid, paragraph 14.16.
218
The Final Submissions, paragraphs 9.42 to 9.47
319

9.81 As already noted above, the EDPB’s Article 65 Decision is binding upon the Commission. Accordingly,
the Commission is not permitted to look behind the EDPB’s views and determinations. In the
circumstances, I remain of the view that this factor ought to be treated as an aggravating factor,
of moderately significant weight, notwithstanding Facebook’s Final Submissions.

ARTICLE 83(2)(E): ANY RELEVANT PREVIOUS INFRINGEMENTS BY THE CONTROLLER OR PROCESSOR

9.82 In the context of the Transparency Infringements, I noted that there have been no relevant previous
infringements by Facebook of the GDPR in this regard on which findings have been made.
Facebook once again compares the lack of mitigation in this regard to a decision of the
Commission on a domestic matter. 219 I have already set out my views on these arguments above.
Further, the Article 83(2) GDPR criteria are matters that I must consider when deciding whether
to impose an administrative fine and, if so, the amount of that fine. The Article 83(2) GDPR criteria
are not binary in nature, such that, when assessed in the context of the circumstances of
infringement, they must be found to be either a mitigating or an aggravating factor.

9.83 Accordingly, it does not follow that the absence of a history of infringement must be taken into
account as a mitigating factor. This is particularly the case where the GDPR has only been in force
for a relatively short period of time. On this basis, my view is that this is neither a mitigating factor
nor an aggravating one for the purpose of this assessment.

9.84 In relation to the infringement of Article 6(1) that was established by the EDPB, the Article 65
Decision has not addressed this particular aspect of matters. As at the date of circulation of the
Commission’s Draft Decision, were there no relevant previous infringements by Meta IE that fell
to be considered under this particular heading. In the circumstances, I proposed to consider this
factor to be neither mitigating nor aggravating.

9.85 Facebook, by way of the Final Submissions 220, disagrees with the above and, instead, urges the
Commission to treat this factor as mitigating, in line with the Commission’s approach in other
(named) inquiries. I note, in this regard, that the named inquiries do not concern cross-border
processing.

9.86 In response to the above, the Commission is not required to apply the same approach across all of
its inquiries. The Commission’s approach to the presence or absence of relevant previous

219
Ibid, paragraphs 4.17-4.18.
220
The Final Submissions, paragraphs 9.48 to 9.50
320

infringements (for the purpose of the Article 83(2)(e) assessment) differs, depending inter alia on
the contexts of different types of controllers and, in particular, the scale of the processing at issue.
Unlike the position with the smaller-scale domestic inquiries that Facebook has cited as examples,
inquiries into larger internet platforms generally concern data controllers or processors with
multi-national operations and significant resources available to them, including large, in-house,
compliance teams. Such entitles are further likely to be engaged in business activities that are
uniquely dependent on the large-scale processing of personal data. The Commission’s view is that
the size and scale of such entities, the level of dependency on data processing and the extensive
resources that are available to them necessitate a different approach to the absence of previous
relevant infringements. That approach has been reflected in the decisions that have been cited
by Facebook in support of its submission. I note, in this regard, that Facebook’s submissions do
not reference the Commission’s decision in the Twitter (breach notification) inquiry, nor the
Commission’s decision in the WhatsApp (own volition) transparency inquiry, nor the Facebook (12
breaches) inquiry. The Commission’s approach to the Article 83(2) assessment, as recorded in
these decisions (amongst others), is consistent with that applied to the within inquiry.
Accordingly, I remain of the view that this factor ought to be treated as neither mitigating nor
aggravating.

ARTICLE 83(2)(F): THE DEGREE OF COOPERATION WITH THE SUPERVISORY AUTHORITY, IN ORDER TO REMEDY THE
INFRINGEMENT AND MITIGATE THE POSSIBLE ADVERSE EFFECTS OF THE INFRINGEMENT

9.87 The Fining Guidelines state that:

“… it would not be appropriate to give additional regard to cooperation that is already
required by law for example, the entity is in any case required to allow the supervisory
authority access to premises for audits/inspection.”

9.88 In the context of the Transparency Infringements, Facebook argues that cooperation in this matter
should be treated as a mitigating factor and again cites a decision of the Commission. 221 I once
again refer to my analysis on that issue above. Furthermore, I cannot accept that such activity, in
the ordinary course of adhering to legal duties to cooperate and engage with a regulator, could
be found to be a mitigating factor in a sanction. If this were the case, all controllers would get the
benefit of such a mitigating factor aside from those that did not actively behave in an
uncooperative manner. This position reflects the erroneous treatment of the Article 83(2) GDPR
factors as binary choices between mitigation and aggravation to which I have already referred.

9.89 For these reasons, while Facebook has cooperated fully with the Commission at all stages of the
Inquiry, it is required to do so by law. Furthermore, I note that the cooperation that would be
relevant to the assessment of this criterion is cooperation “in order to remedy the infringement

221
Ibid, paragraph 14.19.
321

and mitigate the possible adverse effects of the infringement”. In the circumstances, and in light
of my views set out above, nothing arises for assessment by reference to this criterion.

9.90 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the Article
65 Decision has not addressed this particular aspect of matters. In the circumstances, the
Commission proposes to consider this factor to be neither mitigating nor aggravating for the
same reasons set out in the Article 83(2)(c) assessment, above.

9.91 By way of the Final Submissions, Facebook has submitted 222 that I should treat this factor as
mitigating in light of the fact that it has taken “various voluntary steps to improve transparency
for its users (which the EDPB considers underpins the alleged Article 6(1) infringement) throughout
the course of the Inquiry … and will undertake all efforts to comply with any order issued by the
[Commission], as required.” Facebook further submits that it has cooperated fully with the
Commission throughout the Inquiry.

9.92 I have already addressed the reasons why I cannot take account, as a mitigating factor, of any
voluntary steps taken by Facebook following the date of circulation of the Draft Decision to the
CSAs (the steps taken before that date having been deemed, by the EDPB, to be insufficient to be
treated as a mitigating factor). While the Commission recognises that Facebook has cooperated
fully throughout the Inquiry, the Commission notes that Facebook is obliged to do so by virtue of
Article 31 GDPR. Furthermore, and while the Commission acknowledges Facebook’s commitment
to undertake “all efforts to comply with any order” that might be issued further to this Decision,
I again note that Facebook is subject to an obligation to comply with the terms of the relevant
order. In the circumstances, I am unable to take account of such matters as mitigating factors.

9.93 Accordingly, I remain of the view that this factor ought to be treated as neither mitigating nor
aggravating.

ARTICLE 83(2)(G): THE CATEGORIES OF PERSONAL DATA AFFECTED BY THE INFRINGEMENT

9.94 In the context of the Transparency Infringements, I noted that the lack of transparency concerned
broad categories of personal data relating to users who sign up to the service. I have set out
several times in this Decision that the assessment of data processing in this Inquiry was, by its
nature, rather generalised. Indeed, the lack of transparency on Facebook’s part has itself
contributed to a lack of clarity on precisely what categories of personal data are involved. I

222
The Final Submissions, paragraphs 9.51 to 9.53
249
Ibid, paragraph 14.20.
322

therefore agree with Facebook’s submission that this is not an aggravating factor,249 and I also do
not regard it as a mitigating one.

9.95 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the Article 65
Decision has not addressed this particular aspect of matters. The Commission notes, however,
the “relevant facts” identified by the EDPB in paragraphs 95 and 96 of the Article 65 Decision,
including in relation to the personal data concerned, as follows:

“… Meta IE collects data on its individual users and their activities on and off its Facebook social
network service via numerous means such as the service itself, other services of the Meta group
including Instagram, WhatsApp and Oculus, third party websites and apps via integrated
programming interfaces such as Facebook Business Tools or via cookies, social plug-ins, pixels
and comparable technologies placed on the internet user’s computer or mobile device.
According to the description provided, Meta IE links these data with the user’s Facebook account
to enable advertisers to tailor their advertising to Facebook’s individual users based on their
consumer behaviour, interests, purchasing power and present situation. This may also include
the user’s physical location to display content relevant to the user’s location.”

9.96 While, as noted already in the Commission’s Draft Decision, it was neither necessary, for the purpose
of the examination of the Complaint, nor possible, from an examination of the relevant privacy
material, to identify the particular categories of personal data undergoing processing, it seems
clear that the EDPB considered the processing to concern a broad range of categories of personal
data. Given the nature of behavioural advertising, it appears to be beyond dispute that the
processing of a broad range of personal data is required to be carried out to achieve the objectives
of behavioural advertising. In the circumstances, I proposed to consider to consider this to be an
aggravating factor of moderately significant weight.

9.97 By way of the Final Submissions, Facebook submits 223 that this factor should be treated neutrally in
circumstances where the views of the EDPB that form the basis for the Commission’s assessment
under this heading rely, in turn, on “descriptions of processing that are inaccurate and outside the
scope of the Inquiry …”.

9.98 As already outlined above, the Article 65 Decision is binding upon the Commission. Accordingly, it is
not open to the Commission to revisit or otherwise look behind the views expressed, and
determinations made, by the EDPB. In the circumstances, I remain of the view that this factor
ought to be treated as an aggravating factor of moderately significant weight.

223
The Final Submissions, paragraphs 9.54 to 9.57
323

ARTICLE 83(2)(H): THE MANNER IN WHICH THE INFRINGEMENT BECAME KNOWN TO THE SUPERVISORY AUTHORITY, IN
PARTICULAR WHETHER, AND IF SO TO WHAT EXTENT, THE CONTROLLER OR PROCESSOR NOTIFIED THE INFRINGEMENT

9.99 In the context of the Transparency Infringements, I noted that the subject matter became known to
the Commission due to an Inquiry conducted on foot of the Complaint. The subject matter did not
give rise to any requirement of notification, and I have already acknowledged several times that
the controller’s genuinely held belief is that no infringement is/was occurring.

9.100 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, paragraph
465 of the EDPB Decision records the EDPB’s view that: “the Draft Decision does not need to
include this element as an aggravating or mitigating factor.” Accordingly, I proposed to consider
this factor this factor to be neither mitigating nor aggravating. Facebook, by way of the Final
Submissions, confirmed 224 its agreement with the above approach. In the circumstances, I
conclude that this factor is neither mitigating nor aggravating.

ARTICLE 83(2)(I): WHERE MEASURES REFERRED TO IN ARTICLE 58(2) HAVE PREVIOUSLY BEEN ORDERED AGAINST THE
CONTROLLER OR PROCESSOR CONCERNED WITH REGARD TO THE SAME SUBJECT-MATTER, COMPLIANCE WITH THOSE
MEASURES

9.101 In the context of the Transparency Infringements, I concluded that this criterion is not applicable.

9.102 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the Article
65 Decision has not addressed this particular aspect of matters. The Commission notes that
measures have not previously been ordered against Facebook with regard to the same subject
matter. In the circumstances, the Commission proposes to consider this factor as neither
mitigating nor aggravating. Facebook, by way of the Final Submissions, confirmed 225 its
agreement with the above approach. In the circumstances, I conclude that this factor is neither
mitigating nor aggravating.

ARTICLE 83(2)(J): ADHERENCE TO APPROVED CODES OF CONDUCT PURSUANT TO ARTICLE 40 OR APPROVED CERTIFICATION
MECHANISMS PURSUANT TO ARTICLE 42

9.103 In the context of the Transparency Infringements, I concluded that this criterion is not applicable.

9.104 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the Article
65 Decision has not addressed this particular aspect of matters. The Commission proposes to
consider this factor as neither mitigating nor aggravating in circumstances where nothing arises

224
The Final Submissions, paragraph 9.58
225
The Final Submissions, paragraph 9.59
324

for assessment under this heading. Facebook, by way of the Final Submissions, confirmed 226 its
agreement with the above approach. In the circumstances, I conclude that this factor is neither
mitigating nor aggravating.

226
The Final Submissions, paragraph 9.60
325

ARTICLE 83(2)(K): ANY OTHER AGGRAVATING OR MITIGATING FACTOR APPLICABLE TO THE CIRCUMSTANCES OF THE CASE,
SUCH AS FINANCIAL BENEFITS GAINED, OR LOSSES AVOIDED, DIRECTLY OR INDIRECTLY, FROM THE INFRINGEMENT

9.105 In the Preliminary Draft Decision I considered the following factors in the context of the
Transparency Infringements:

• Facebook does not charge for its service.

• The subject matter of the infringements relate directly to the provision of information in
relation to what is, by Facebook’s own admission, its core business model i.e. personalised
advertising provided pursuant to a contract with users.

• The question is therefore whether a more transparent approach to processing operations
carried out on foot of that contract would represent a risk to Facebook’s business model. In
my l view it would, if existing or prospective users were dissuaded from using the service by
clearer explanations of the processing operations carried out, and their purposes.

• In my view the above risk is sufficiently high to justify the conclusion that this lack of
transparency has the potential to have resulted in financial benefits for Facebook.

9.106 Facebook however argues that this does not at all propose a financial risk, and argues that
no evidence of same has been presented.227 Neither I nor Facebook can know, until the
contingent event has happened, which one of us is correct in our belief as to the likely
impact, on the continued growth of the user base. Given that any general consideration
of this is ultimately involves an element of speculation on both Facebook’s and the
Commission’s part, I considered, in the Draft Decision, that this factor is neither
aggravating nor mitigating.

9.107 Following the circulation of the Draft Decision to the supervisory authorities concerned
for the purpose of enabling them to share their views in accordance with Article 60(3)
GDPR, an objection was raised on behalf of supervisory authorities of Germany,
concerning this aspect of matters.

9.108 Having considered the merits of the objection, the EDPB, by way of paragraph 377 of the
Article 65 Decision, instructed the Commission to:

“ascertain if further estimation of the financial benefit from the infringement of transparency
obligations is possible in this case. Insofar as this results in the need to increase the amount of
the fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.”

227
, paragraph 14.21.
326

9.109 As recognised by the EDPB, at paragraph 370 of the Article 65 Decision, the Commission
is required to “assess all the fact of the case in a manner that is consistent and objectively
justified.” Despite specific requests made by the Commission during the course of the
Article 65 deliberations, no directions have been provided by the EDPB, in its Article 65
Decision, as to the manner in which the Commission might seek to ascertain, on an
objectively justifiable basis, an estimation of the financial benefit gained from an
infringement such as the one under assessment. In the absence of directions, the
Commission is unable to ascertain an estimation of the matters identified above.

9.110 The Commission separately notes, under this heading, the EDPB’s view, as set out in the
EDPB’s Binding Decision 1/2021 228 (paragraphs 409 to 412, inclusive), that the turnover
of the undertaking concerned ought to be taken into account not just for the calculation
of the applicable fining “cap” but also for the purpose of assessing the quantum of the
administrative fine itself. This position is further reflected in the Fining Guidelines
04/2022 (see, for example, paragraph 49). The EDPB, by way of paragraph 393 of the
Article 65 Decision, reiterated this position and instructed the Commission to “elaborate
on the manner in which the turnover of the undertaking concerned is considered for the
calculation of the fine.”

9.111 The Commission’s assessment of the undertaking concerned and the applicable turnover
figure is detailed further, below. While this is not a matter that can properly be classified
as either mitigating or aggravating, by reference to the circumstances of the case, the
Commission has taken the significant turnover of the undertaking concerned into account
when determining the quantum of the proposed fine, as set out below.

9.112 In relation to the finding of infringement of Article 6(1) GDPR that was established by the
EDPB, paragraphs 467 to 469 of the Article 65 Decision records the EDPB’s views that, for
the purpose of the Article 83(2)(k) assessment:

“The EDPB recalls that financial benefits from the infringement could be an aggravating
circumstance if the case provides information about profit obtained as a result of the
infringement of the GDPR.

In the present case, the EDPB considers that it does not have sufficiently precise information to
evaluate the specific weight of the financial benefit obtained from the infringement.

Binding decision 1/2021 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding
228

WhatsApp Ireland under Article 65(1)(a) GDPR, adopted 28 July 2021

327

Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no effect
if they are disproportionally low compared to the benefits obtained with the infringement. The
EDPB considers that the IE SA should ascertain if an estimation of the financial benefit from the
infringement is possible in this case. Insofar as this results in the need to increase the amount
of the fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.”

9.113 In a similar vein, the EDPB, at paragraph 472 of the Article 65 Decision, expressed the view
that:

“On principle, the EDPB agrees that a competitive advantage could be an aggravating factor if
the case provides objective information that this was obtained as a result of the infringement of
the GDPR908. In the present case, the EDPB considers that it does not have sufficiently precise
information to evaluate the existence of a competitive advantage resulting from the
infringement. The EDPB considers that the IE SA should ascertain if an estimation of the
competitive advantage derived from the infringement is possible in this case. Insofar as this
results in the need to increase the amount of the fine proposed, the EDPB requests the IE SA to
increase the amount of the fine proposed.”

9.114 Despite specific requests made by the Commission, during the course of the Article 65
deliberations, no directions have been provided by the EDPB, in its Article 65 Decision, as
to the manner in which the Commission might seek to ascertain an estimation of: (i) the
financial benefit gained from an infringement such as the one under assessment; or (ii)
the competitive advantage derived from the infringement. I note, in this regard, the views
previously expressed by the EDPB 229 that:

“… when deciding on the imposition of corrective measures in general, and fines in particular,
“supervisory authorities must assess all the facts of the case in a manner that is consistent and
objectively justified.”

9.115 In the absence of directions, the Commission is unable to ascertain an estimation of the
matters identified above. Accordingly, I am unable to take these matters into account for
the purpose of this assessment.

Binding decision 1/2021 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding
229

WhatsApp Ireland under Article 65(1)(a) GDPR, adopted 28 July 2021, paragraph 403.
328

9.116 As before, the Commission separately notes, under this heading, the EDPB’s view, as set
out in the EDPB’s binding decision 1/2021 230 , that the turnover of the undertaking
concerned ought to be taken into account not just for the calculation of the applicable
fining “cap” but also for the purpose of assessing the quantum of the administrative fine
itself. This position is further reflected in the Fining Guidelines 04/2022 (see, for example,
paragraph 49 thereof). The Commission’s assessment of the undertaking concerned and
the applicable turnover figure is detailed further below in this Decision. While this is not
a matter that can properly be classified
as either mitigating or aggravating, by reference to the circumstances of the case, the Commission
has taken the significant turnover of the undertaking concerned into account when determining
the quantum of the proposed fine, as set out below.

9.117 Facebook, by way of the Final Submissions, expressed 231 its disagreement with the
Commission’s proposal to have regard to the turnover of the undertaking concerned in
calculating the amount of the fine. As already noted above, this requirement was
previously determined by the EDPB in its Binding Decision 1/2021 and reiterated in the
Article 65 Decision. In the circumstances, it is not open to the Commission to disregard
this requirement. Neither is it open to the Commission to treat “Meta Ireland alone” as
being the relevant “undertaking” for these purposes 232.

WHETHER TO IMPOSE AN ADMINISTRATIVE FINE

The Transparency Infringements

9.118 I proposed to impose an administrative fine in relation to the Transparency Infringements in
circumstances where:

• The infringements are serious in nature. The lack of transparency goes to the heart of data
subject rights and risks undermining their effectiveness by not providing transparent
information in that regard. While the infringements considered here relate to one lawful
basis, it nonetheless concerns vast swathes of personal data impacting millions of data
subjects. When such factors are considered, it is clear that the infringements are serious in
their gravity. I have taken this into account when determining, for the purpose of Article

230
, paragraphs 409 to 412, inclusive
231
The Final Submissions, paragraphs 9.62 to 9.68
232
See the Article 65 Decision, paragraph 496
329

83(2)(a) GDPR, that the infringements are at the upper end of the scale, in terms of
seriousness.

• Over of the population of the EEA seems to be impacted by the infringements. This is a
very large figure. I consider this to be an aggravating factor of significant weight.

• I note in particular the impact a lack of transparency has on a data subject’s ability to be fully
informed about their data protection rights, or indeed about whether in their view they
should exercise those rights. I have taken this into account when determining, for the purpose
of Article 83(2)(a) GDPR, that the infringements are at the upper end of the scale, in terms of
seriousness.

• I have already found that the infringement was negligent. While I am not calling into question
Facebook’s right to come to a genuine view on this matter, I am taking into account the failure
of an organisation of this size to provide sufficiently transparent materials in relation to the
core of its business model. For the avoidance of doubt, and noting the views expressed by
the EDPB in its Fining Guidelines 04/2022, that “(a)t best, negligence could be regarded as
neutral”, I have taken this into account as a neutral factor.

• I note that Facebook’s Data Policy and Terms of Service have been amended, and because
this is an Inquiry into a particular complaint the documents being considered are no longer
contemporary. Therefore, I am not attaching significant weight to the question of the duration
of the infringement, in circumstances where more recent versions of the relevant documents
are outside the scope of the Inquiry. In the circumstances, and for the avoidance of doubt, I
have taken this into account as a neutral factor.

9.119 Facebook argues that the infringements set out above are “co-extensive” and amount to
the same infringement. 233 It is incorrect to state that these amount to different labels for
the same infringement. One amounts to a failure to provide information that is required
by the law. The other amounts to a failure to provide the information required by the law
(only some of which has been provided) in the manner the law requires. The information
that is and is not provided both relate to data processing on foot of one provision of the
GDPR. That does not in and of itself render them the same infringement. A failure to
provide certain information and a failure to set out other information in a particular
manner are self-evidently different infringements in their character.

9.120 Based on the analysis set out above, the nature, gravity and duration of the infringements
and the potential number of data subjects affected, I proposed, by way of the Draft

233
, paragraph 15.1.
330

Decision, to impose the following administrative fines in respect of the Transparency
Infringements:

• In respect of the failure to provide sufficient information in relation to the processing
operations carried out on foot of Article 6(1)(b) GDPR, thereby infringing Articles 5(1)(a) and
13(1)(c) GDPR, I propose a fine of between €18 million and €22 million.

• In respect of the failure to provide the information that was provided on the processing
operations carried out in foot of Article 6(1)(b) GDPR, in a concise, transparent, intelligible
and easily accessible form, using clear and plain language, thereby infringing Articles 5(1)(a)
and 12(1) GDPR, I propose a fine of between €10 million and €14 million.

9.121 In determining the quantum of the fines proposed above, I took account of the
requirement, set out in Article 83(1) GDPR, for fines imposed to be “effective,
proportionate and dissuasive” in each individual case. My view was that, in order for any
fine to be “effective”, it must reflect the circumstances of the individual case. As already
discussed above, the Infringements are serious, both in terms of the extremely large
number of data subjects potentially affected, the categories of personal data involved,
and the consequences that flow from the failure to comply with the transparency
requirements for users.

9.122 In order for a fine to be “dissuasive”, it must dissuade both the controller/processor
concerned as well as other controllers/processors carrying out similar processing
operations from repeating the conduct concerned.

9.123 As regards the requirement for any fine to be “proportionate”, this requires the
adjustment of the quantum of any proposed fine to the minimum amount necessary to
achieve the objectives pursued by the GDPR. My view was that the fines proposed above
did not exceed what was necessary to enforce compliance with the GDPR, taking into
account the size of Facebook’s user base, the impact of the infringements on the
effectiveness of the data subject rights enshrined in
Chapter III of the GDPR and the importance of those rights in the context of the GDPR as a whole.

9.124 Accordingly, my view was that the fines proposed above would, if imposed on Facebook,
be effective, proportionate and dissuasive, taking into account all of the circumstances of
the Inquiry.

9.125 Further to the circulation of the Draft Decision to the concerned supervisory authorities
for the purpose of enabling them to express their views in accordance with Article 60(3)
GDPR, objections were raised in relation to this aspect of matters by the supervisory

331

authorities of Germany, France, the Netherlands, Norway and Poland. Having considered
the merits of those objections, the EDPB determined as follows:

391. The EDPB agrees with the objections raised that - if the proposed fine was to be
imposed for the transparency infringements - there would be no sufficient special preventive
effect towards the controller, nor a credible general preventive effect. The proposed fine
amount, even where a final amount at the upper limit of the range would be chosen, is not
effective, proportionate and dissuasive, in the sense that this amount can simply be absorbed
by the undertaking as an acceptable cost of doing business. As behavioural advertising is at
the core of Meta IE’s business model, the risk of this occurring is all the greater. By bearing the
cost the administrative fine, the undertaking can avoid bearing the cost of adjusting their
business model to one that is compliant as well as any future losses that would follow from
the adjustment.

332

it proposed does not exceed the maximum amount of the fine provided for in Article 83(5)
GDPR, the Draft Decision does not articulate how and to what extent the turnover of this
undertaking is considered to ascertain that the administrative fine meets the requirement of
effectiveness, proportionality and dissuasiveness. In this regard the EDPB recalls that the
turnover of the undertaking concerned is not exclusively relevant for the determination of the
maximum fine amount in accordance with Article 83(4)-(6) GDPR, but should also be considered
for the calculation of the fine itself, where appropriate, to ensure the fine is effective,
proportionate and dissuasive in accordance with Article 83(1) GDPR. The EDPB therefore
instructs the IE SA to elaborate on the manner in which the turnover of the undertaking
concerned is considered for the calculation of the fine.

393. While a single mitigating factor identified by the IE SA is mentioned, there is no indication
the weight that has been attributed to this factor in the context of the Article 83(2) assessment.
As indicated above (see paragraph 366), the EDPB finds the Draft Decision does not sufficiently
justify this mitigating factor, hence it should not be considered an aggravating or mitigating
factor.

394. In light of the above, the EDPB considers that the proposed fine does not adequately
reflect the seriousness and severity of the infringements nor has a dissuasive effect on Meta IE.
Therefore, the fine does not fulfil the requirement of being effective, proportionate and
dissuasive in accordance with Article 83(1) and (2) GDPR. In light of this, the EDPB directs the
IE SA to set out a significantly higher fine amount for the transparency infringements identified,
in comparison with the upper limit for the administrative fine envisaged in the Draft Decision.
In doing so, the IE SA must remain in line with the criteria of effectiveness, proportionality, and
dissuasiveness enshrined in Article 83(1) GDPR in its overall reassessment of the amount of the
administrative fine.

9.126 I note that, with the exception of the proposed treatment, in the Draft Decision, of the matters
originally assessed pursuant to Article 83(2)(c) (which has now been amended in line with the
instruction set out in the Article 65 Decision), the EDPB agreed with the manner in which the
Commission assessed the circumstances of the Transparency Infringements for the purposes of
the Article 83(2) criteria. That being the case, it seems clear that the EDPB’s instruction, above,
concerns my view that the originally proposed fines were effective, proportionate and dissuasive
for the purpose of Article 83(1) GDPR. In other words, the focus of the EDPB’s instruction is the
quantum of the fines that were originally proposed by the Article 60 Draft Decision. I note, in this
regard, the EDPB’s instruction that I set out a “significantly” higher fine, in comparison with the
upper limit for the originally proposed administrative fines. By way of guidance, the Article 65
Decision records as follows:

with the fine of 746 million euros decided by the LU SA in its decision of 15 July 2021 against
the company Amazon Europe Core for carrying out behavioural advertising without a valid
legal basis and for transparency infringements (Articles 6, 12 and 13 GDPR). While the EDPB
agrees with both the IE SA and Meta IE that imposing fines requires a case-by-case assessment
under Article 83 GDPR, the EDPB notes that the cases cited by the FR SA do show marked
similarities with the current case, as they both refer to large internet platforms run by data
controllers with multi-national operations and significant resources available to them,
including large, in-house, compliance teams. Moreover, there are similarities with regard to
the infringements involved. Thus, these cases can give an indication on the matter.

9.127 On the basis of the instruction and guidance set out above, I propose to impose administrative fines
as follows:

9.128 I expressed the (provisional) view that administrative fines within these ranges would satisfy the
requirement, in Article 83(1) GDPR for any administrative fine imposed to be effective,
proportionate and dissuasive in each individual case. In this regard, I have taken account of:

a. The purpose of the fine, which is to sanction the infringements of Articles 12(1), 13(1)(c),
5(1)(a) (and taking into account the infringement of the Article 5(1)(a) fairness principle) that
was found to have occurred (by the EDPB in the Article 65 Decision);

b. The requirement for any fine to be effective. In this regard, I note that the fines proposed
above reflect the circumstances of the case, including both the specific elements of the
infringement as well as those elements that relate to the controller which committed the
infringement, namely its financial position (as required by paragraph 414 of the EDPB’s
Binding Decision 1/2021);

c. The requirement for a genuinely deterrent effect, in terms of discouraging both Facebook and
others from committing the same infringement in the future;

334

d. The requirement for any fine to be proportionate and to not exceed what is necessary to
achieve the stated objective (as recorded at a., above). The Commission considers that the
fines proposed are proportionate to the circumstances of the case, taking into account the
gravity of the infringements and all of the elements that may lead to an increase (aggravating
factors) or decrease (mitigating factors) of the initial assessment as well as the significant
turnover of the undertaking concerned. It also takes account of the views, assessments and
instructions of the EDPB, as set out in the Article 65 Decision (and incorporated into this
Decision, above). It also takes account of the fact that the fine will be imposed in addition to
an order requiring Facebook to take action to bring its processing into compliance.

Facebook’s Final Submissions in response to the re-assessment of the administrative fines originally
proposed by the Draft Decision, in relation to the Transparency Infringements

9.129 Facebook, by way of the Final Submissions 234, has challenged the proposed reassessment
of the fines corresponding to the Transparency Infringements.

9.130 Insofar as the relevant submissions express disagreement with matters that have been
determined by the EDPB or, otherwise, upon which the EDPB has expressed a view, in the
Article 65 Decision, that decision is binding upon the Commission. Accordingly, it is not
open to the Commission to disregard or otherwise look behind any views expressed or
instructions given by the EDPB in the Article 65 Decision.

9.131 Furthermore, insofar as the relevant submissions restate matters that have already been
considered by the Commission (such as Facebook’s view that the Transparency
Infringements are “technical in nature”), I do not propose to engage further with such
matters.

9.132 As regards Facebook’s submission 235 that its willingness to engage in steps to bring its
processing into compliance on a voluntary basis pending the conclusion of this Inquiry on
the basis that it has “now clearly “gone beyond willingness” to give effect to such
substantial changes”, I am unable to take account of any such action given that it occurred
after the circulation of the Draft Decision to the CSAs for their views, pursuant to Article
60(3) GDPR and, otherwise, in the absence of an assessment of the adequacy of the steps
taken.

9.133 Facebook has further submitted that the proposed increase is incompatible with Article
83(1) GDPR. It also notes the inconsistency between the increased fining ranges being
proposed and the Commission’s previously expressed view that the lower fining ranges
proposed by the Draft Decision were effective, proportionate and dissuasive. It is

234
The Final Submissions, paragraphs 13.1 to 14.26
235
The Final Submissions, paragraph 13.5
335

important to bear in mind, in this regard, that the Commission’s view, that the previously
proposed fining ranges were effective, proportionate and dissuasive, has been overtaken
by the Article 65 Decision. The EDPB, in that decision, expressed a range of views and it
is not open to the Commission to look behind those views, as appears to be suggested by
Facebook.

9.134 As regards Facebook’s submissions 236 directed to challenging how the increased fining
ranges might be said to be “effective, proportionate and dissuasive”, I note that these
submissions share a range of common arguments, including:

• Submissions that it is not appropriate for the Commission to take account of Facebook’s
“financial position” and questioning the difference between “financial position” and
“turnover” in circumstances where the Commission previously indicated that it had taken
Facebook’s turnover into account when assessing the quantum of the originally proposed
fining ranges;

• Submissions concerning the level of the increase proposed by the Commission. Facebook
has submitted, in this regard, that the Commission “has proposed an increase well in
excess of the purported instruction of the EDPB “to set out a significantly higher fine
amount” in respect of these alleged infringements”. Facebook has further suggested that:
“(i)t appears (although this is not clear) that the [Commission] was influenced in this
regard by the EDPB’s comments regarding fines imposed by other supervisory authorities
in respect of transparency infringements, namely the WhatsApp and Amazon Decisions.
Without engaging in any factual assessment of these decisions, the EDPB asserts that
these cases “show marked similarities with the current case, as they both refer to large
internet platforms run by data controllers with multi-national operations and significant
resources available to them, including large, in-house, compliance teams. Moreover,
there are similarities with regard to the infringements involved”.

9.135 As already noted above, the Commission is required, by the Article 65 Decision and
Binding Decision 1/2021, to take account of the turnover of the undertaking concerned
when quantifying the amount of the proposed administrative fine. The Commission did
so as part of its original assessment, however the EDPB, by way of the Article 65 Decision,
instructed the Commission to re-assess quantum on the basis that the proposed amounts
were insufficient to satisfy the requirements of Article 83(1) GDPR. The Article 65
Decision provides at paragraph 391, for example, that:

“The EDPB agrees with the objections raised that - if the proposed fine was to be imposed for
the transparency infringements - there would be no sufficient special preventive effect
towards the controller, nor a credible general preventive effect. The proposed fine amount,

236
The Final Submissions, paragraphs 14.5 to 14.26
336

even where a final amount at the upper limit of the range would be chosen, is not effective,
proportionate and dissuasive, in the sense that this amount can simply be absorbed by the
undertaking as an acceptable cost of doing business. As behavioural advertising is at the core
of Meta IE’s business model, the risk of this occurring is all the greater. By bearing the cost the
administrative fine, the undertaking can avoid bearing the cost of adjusting their business
model to one that is compliant as well as any future losses that would follow from the
adjustment.” [emphasis added]

9.136 In the circumstances, it was incumbent on the Commission to re-assess the manner in
which account was previously taken of the turnover of the undertaking concerned. The
Commission notes, in this regard, the very significant turnover of the Meta Platforms, Inc.
group of companies and considers that the increased fining ranges take appropriate
account of that significant level of turnover, as required by the Article 65 Decision. For
the avoidance of doubt, however, the Commission has, first and foremost, addressed its
mind to the Article 83 framework when assessing the questions of whether an
administrative fine ought to be imposed and, if so, the amount of any such fine. That
ought to be clear from the detailed analysis of the individual circumstances of this Inquiry
set out in this Section 9. Otherwise, the Commission has re-assessed the quantum of its
originally proposed fines by reference to the instructions and directions provided by the
EDPB in the Article 65 Decision. Any suggestions of comparison with the Amazon or
WhatsApp decisions are without foundation.

9.137 Having taken account of the Final Submissions, I remain of the views set out in paragraphs
9.127 and 9.128, above.

Proposed quantum of fining range - the Article 6(1) GDPR infringement

9.138 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB in
the Article 65 Decision, my conclusions, further to the Article 83(2) assessment recorded
above, are that:

• The infringement of Article 6(1) GDPR (and taking into account the infringement of the
Article 5(1)(a) fairness principle) has been assessed as falling at the upper end of the scale,
in terms of seriousness, for the purpose of Article 83(2)(a).

• The seriously negligent character of the Article 6(1) GDPR infringement ought, in the
particular circumstances of this inquiry, to be taken into account as an aggravating factor
of significant weight.

• The degree of responsibility of the controller is to be treated as an aggravating factor, of
moderately significant weight.

337

• The broad range of categories of personal data affected by the infringement ought to be
taken into account as an aggravating factor of moderately significant weight.

• Otherwise, the assessments of the Article 83(2)(c), 83(2)(e), 83(2)(f), 83(2)(h), 83(2)(i),
83(2)(j) and 83(2)(k) criteria are to be treated as neither mitigating nor aggravating for the
purpose of the Article 6(1) GDPR infringement.

9.139 On the basis of the above, I proposed to impose an (additional) administrative fine of an
amount falling within the range of €55 million and €65 million, in respect of the
infringement of Article 6(1) GDPR (and taking into account the infringement of the Article
5(1)(a) fairness principle).

9.140 I expressed the (provisional) view that an administrative fine within this range would
satisfy the requirement in Article 83(1) GDPR for any administrative fine imposed to be
effective, proportionate and dissuasive in each individual case. In this regard, I have taken
account of:

a. The purpose of the fine, which is to sanction the infringement of Article 6(1) (and taking
into account the infringement of the Article 5(1)(a) fairness principle) that was found to
have occurred (by the EDPB in the Article 65 Decision);

b. The requirement for any fine to be effective. In this regard, the Commission notes that
the fine proposed above reflects the circumstances of the case, including both the specific
elements of the infringement as well as those elements that relate to the controller which
committed the infringement, namely its financial position (as required by paragraph 414
of the EDPB’s Binding Decision 1/2021);

c. The requirement for a genuinely deterrent effect, in terms of discouraging both Facebook
and others from committing the same infringement in the future;

d. The requirement for any fine to be proportionate and to not exceed what is necessary to
achieve the stated objective (as recorded at a., above). The Commission considers that
the fine proposed is proportionate to the circumstances of the case, taking into account
the gravity of the infringements and all of the elements that may lead to an increase
(aggravating factors) or decrease (mitigating factors) of the initial assessment as well as
the significant turnover of the undertaking concerned. It also takes account of the fact
that the fine will be imposed in addition to an order requiring Facebook to take action to
bring its processing into compliance;

e. I have also taken particular account, in this regard, of the facts that:

338

i. The EDPB’s finding of infringement of Article 6(1) GDPR was partially based on
the lack of transparency (see, for example, paragraphs 123, 125 and 126 of the
Article 65 Decision) as regards the information that was presented to the data
subject concerning the processing that would be carried out further to the
Facebook Terms of Service.

ii. The EDPB’s finding of infringement of Article 5(1)(a) fairness principle was
similarly largely based on the lack of transparency (see, for example, paragraphs
226, 229 and 230 of the Article 65 Decision), as regards the information that was
presented to the data subject concerning the processing that would be carried
out further to the Terms of Service.

iii. As already noted, this Decision contains separate findings of infringement of the
transparency obligations set out in Articles 5(1)(a), 12(1) and 13(1)(c) and
proposes to exercise corresponding corrective powers in the form of
administrative fines and an order to bring processing into compliance. I have
taken these separate punitive and remedial, respectively, measures into account
when proposing the fining range set out above so as to avoid the risk of punishing
Facebook twice in respect of the same conduct. This factor necessitated a
moderately significant reduction in the fine that might otherwise have been
imposed, notwithstanding the significant turnover of the undertaking concerned
and the outcome of the Article 83(2)(a) assessment, as recorded above.

9.141 Facebook, by way of its Final Submissions, disagreed with the above assessments of the
Article 6(1) GDPR infringement. For ease of response, I have summarised the relevant
submissions thematically, as follows:

Discretion of the Commission

9.142 Under this heading, Facebook submitted, firstly 237 , that by proposing “exponential
increases to the administrative fines in respect of [the Transparency Infringements] … the
[Commission] has taken account of the Article 65 Decision and no additional
administrative fine is required or warranted in respect of the infringement of Article 6(1)
GDPR”. Facebook notes, in this regard, that the Article 65 Decision requires the
Commission to impose an administrative fine to “cover” the EDPB’s finding of
infringement of Article 6(1) GDPR.

237
The Final Submissions, paragraph 8.1
339

9.143 It submitted, secondly 238, that the imposition of a fine for the Article 6(1) infringement
while also substantially increasing the fines for the Transparency Infringements is
disproportionate and unnecessary in circumstances where the infringements are based
on the same underlying processing and alleged harm to data subjects.

9.144 Thirdly, it submitted 239 that, just as the Commission has decided not to impose an
additional fine in respect of Article 5(1)(a) (fairness principle) GDPR due to the overlapping
nature of the infringements, it should similarly decide not to impose an additional fine in
relation to the Article 6(1) infringement because this would risk punishing Facebook twice
for the same wrongdoing. Furthermore, it submitted 240 that it was “particularly
inappropriate for the [Commission] to impose three separate and substantial fines in
respect of these infringements, having regard to the principle of concurrence of laws. It
cannot plausibly be maintained that these infringements are sufficiently distinct to
warrant three separate fines in circumstances where the [Commission] itself considers the
conduct constituting the alleged Article 6(1) infringement to be so similar to the other
infringements that it can incorporate significant elements of the fines assessment by
reference.”

9.145 The above submissions are premised upon the misunderstanding that the Commission
has discretion, as regards, the imposition of a fine for the Article 6(1) infringement. The
Commission, being subject to a binding decision of the EDPB, has no such discretion. This
is clear from the Article 65 Decision itself, in particular paragraphs 441 and 442 thereof,
which state that:

“the EDPB agrees with the reasoning put forward by the [supervisory authorities of Austria,
Germany, France, Norway and Sweden] in their objections. The EDPB reiterates that lawfulness
of processing is one of the fundamental pillars of the data protection law and considers that
processing of personal data without an appropriate legal basis is a clear and serious violation of
the data subjects’ fundamental right to data protection.

Several of the factors listed in Article 83(2) GDPR speak strongly in favour of the imposition of
an administrative fine for the infringement of Article 6(1) GDPR.”

9.146 In the circumstances, it is clear that the Commission is required to impose an
administrative fine in respect of the finding of infringement of Article 6(1) GDPR that was
established by the EDPB and, when doing so, to take account of the instructions,

238
The Final Submissions, paragraph 8.1
239
The Final Submissions, paragraph 8.2
240
The Final Submissions, paragraph 8.4
340

deliberations and determinations of the EDPB, as recorded in Section 9.2.4.2.1 of the
Article 65 Decision.

9.147 It is important to note that this instruction (to impose an administrative fine for the Article
6(1) infringement) sits separately to, and alongside, the EDPB’s further instruction that
the Commission “set out a significantly higher fine amount” in respect of the
Transparency Infringements that were already proposed by way of the Draft Decision.

9.148 Finally, as regards the Commission’s decision not to impose a separate administrative fine
in respect of the infringement of the Article 5(1)(a) principle of fairness that was
established by the EDPB, the Article 65 Decision specifically afforded the Commission
discretion in relation to the manner in which this particular infringement might be
addressed by way of a corrective power.
This is clear from paragraph 479 of the Article 65 Decision. The inclusion of this express discretion
is in marked contrast with the absence of any similar discretion in relation to the
imposition/increase of administrative fines for the Article 6(1) and Transparency Infringements.

Inadequate Rationalisation

9.149 Under this heading, Facebook submitted 241 that “the reasoning in the Draft Decision in
respect of the calculation of the fines is inadequate, such that it is impossible to
understand how the proposed fining ranges have been calculated or how the different
factors discussed by the [Commission] have had an impact on the proposed fine and, as a
result, to make meaningful submissions in respect of same.”

9.150 I do not agree that this is the case. As is evident from the extensive analysis set out above,
the Commission has clearly identified the factors that were considered relevant for the
purpose of each of the individual Article 83(2) assessments. Furthermore, the manner in
which the relevant factors have been taken into account, as a mitigating or aggravating
factor, as well as the weight that has been attributed to each one has been clearly
addressed.

9.151 This approach is in line with the Commission’s obligation to provide reasons for its
decisions. While the Commission is required to explain how it arrived at the level of a
proposed fine, it is not required to apply such specificity so as to allow a controller or
processor to make a precise mathematical calculation of the expected fine 242.

Incompatibility with Article 83(1) GDPR

The Final Submissions, paragraph 9.2
241

See, by analogy, HSBC Holdings plc and Others v Commission, T-105/17, ECLI:EU:T:2019:675, paragraphs 336 –
242

354.
341

9.152 Facebook, by way of its Final Submissions, has submitted 243 that the proposed fine for the
Article 6(1) infringement “– both individually and taken cumulatively with the other
significant administrative fines being proposed in respect of the Transparency
Infringements – is inconsistent with the requirements of Article 83(1) GDPR”.

9.153 Facebook further submits that the proposed fine is “manifestly excessive and far higher
than the minimum amount necessary to be “effective” and “dissuasive”, and is therefore
not “proportionate”.”

9.154 Facebook, thirdly, submits that the reasoning in the Draft Decision as to why the
administrative fines comply with the requirements of Article 83(1) GDPR is “wholly
inadequate”. Facebook has added, in this regard, that this has undermined its ability to
make meaningful submissions in response to same.

9.155 I note that, in having detailed my views as to the reasons why I consider the proposed
fines to be effective, proportionate and dissuasive, I have followed the directions of the
EDPB that were set out on this particular matter in its Binding Decision 1/2021 244 .
Accordingly, I consider that the Commission has adequately addressed this aspect of
matters.

9.156 Otherwise, I note that I have already addressed many of the matters raised by Facebook
as part of this aspect of its Final Submissions elsewhere in this Decision. In relation to
Facebook’s submissions concerning the “very onerous compliance order requiring
significant expenditure of resources”, it is important to recall that the objective sought to
be achieved by the Order (the remediation of any identified infringements) differs from
the objective sought to be achieved by the imposition of an administrative fine (the
sanctioning of any identified infringements). Furthermore, the “significant expenditure
of resources” are the resources of Facebook itself, which is, as already noted, an entity
with significant resources available to it. In the circumstances, I do not agree that, in the
circumstances of this particular inquiry, such matters should operate to offset the
quantum of any proposed fine.

9.157 Having completed my assessment of whether or not to impose a fine (and of the amount
of any such fine), I must now consider the remaining provisions of Article 83 GDPR, with
a view to ascertaining if there are any factors that might require the adjustment of the
proposed fines.

243
The Final Submissions, paragraphs 10.1 to 10.25
244
See Binding Decision 1/2021, paragraphs 413 to 416
342

9.158 Having taken account of the Final Submissions, I remain of the views set out in paragraphs
9.139 and 9.140, above.

10 OTHER RELEVANT FACTORS

ARTICLE 83(3) GDPR

10.1 Article 83(3) GDPR provides that:

“If a controller or processor intentionally or negligently, for the same or linked processing
operations, infringes several provisions of this Regulation, the total amount of the
administrative fine shall not exceed the amount specified for the gravest infringement.”

10.2 As outlined previously, Facebook’s infringements of Articles 5(1)(a), 13(1)(c), and 12(1) GDPR all
relate to the same processing operations concerning its processing carried out in accordance with
Article 6(1)(b) GDPR. Therefore, the total amount of the administrative fine must not exceed the
amount specified for the gravest infringement. The gravest infringement identified is the failure
to provide the information mandated by Articles 13(1)(c) and 5(1)(a) GDPR.

10.3 Subsequent to the finalisation of the Preliminary Draft Decision, the EDPB adopted a binding decision
(“the EDPB Decision”)272 relating to IN 18-12-2, an inquiry conducted by the Commission into
WhatsApp Ireland Limited’s compliance with Articles 12, 13 and 14 GDPR. The EDPB Decision
arose out of a dispute resolution procedure pursuant to Article 65 GDPR, and was adopted by the
Commission in conjunction with the Commission’s final decision on 2 September 2021.

10.4 The EDPB Decision applies an interpretation of Article 83(3) GDPR that differs from the interpretation
I set out in the Preliminary Draft Decision. In light of the Commission’s obligations of cooperation
and consistency in, inter alia, Articles 60(1) and 63 GDPR, it is necessary for me to follow the
EDPB’s interpretation of Article 83(3) GDPR in future inquiries given that it is a matter of general
interpretation that is not specific to the facts of the case in which it arose.

10.5 The relevant passage of the EDPB decision is as follows:

“315. All CSAs argued in their respective objections that not taking into account
infringements other than the “gravest infringement” is not in line with their interpretation
of Article 83(3) GDPR, as this would result in a situation where WhatsApp IE is fined in the
same way for one infringement as it would be for several infringements. On the other
hand, as explained above, the IE SA argued that the assessment of whether to impose a
fine, and of the amount thereof, must be carried out in respect of each individual
infringement found and the assessment of the gravity of the infringement should be done
by taking into account the individual circumstances of the case. The IE SA decided to

343

impose only a fine for the infringement of Article 14 GDPR, considering it to be the gravest
of the three infringements.

316. The EDPB notes that the IE SA identified several infringements in the Draft
Decision for which it specified fines, namely infringements of Article 12, 13 and 14 GDPR,
and then applied Article 83(3) GDPR.

317. Furthermore, the EDPB notes that WhatsApp IE agreed with the approach of the
IE SA concerning the interpretation of Article 83(3) GDPR. In its submissions on the
objections, WhatsApp IE also raised that the approach of the IE SA did not lead to a
restriction of the IE SA’s ability to find other infringements of other provisions of the GDPR
or of its ability to impose a very significant fine. WhatsApp IE argued that the alternative
interpretation of Article 83(3) GDPR suggested by the CSAs is not consistent with the text
and structure of Article 83 GDPR and expressed support for the IE SA’s literal and purposive
interpretation of the provision.

272https://edpb.europa.eu/system/files/2021-

09/edpb_bindingdecision_202101_ie_sa_whatsapp_redacted_en.pdf.
318. In this case, the issue that the EDPB is called upon to decide is how the calculation
of the fine is influenced by the finding of several infringements under Article 83(3) GDPR.

319. Article 83(3) GDPR reads that if “a controller or processor intentionally or
negligently, for the same or linked processing operations, infringes several provisions of
this Regulation, the total amount of the administrative fine shall not exceed the amount
specified for the gravest infringement.”

320. First of all, it has to be noted that Article 83(3) GDPR is limited in its application
and will not apply to every single case in which multiple infringements are found to have
occurred, but only to those cases where multiple infringements have arisen from “the
same or linked processing operations”.

321. The EDPB highlights that the overarching purpose of Article 83 GDPR is to ensure
that for each individual case, the imposition of an administrative fine in respect of an
infringement of the GDPR is to be effective, proportionate and dissuasive. In the view of
the EDPB, the ability of SAs to impose such deterrent fines highly contributes to
enforcement and therefore to compliance with the GDPR.

322. As regards the interpretation of Article 83(3) GDPR, the EDPB points out that the
effet utile principle requires all institutions to give full force and effect to EU law. The EDPB
considers that the approach pursued by the IE SA would not give full force and effect to

344

the enforcement and therefore to compliance with the GDPR, and would not be in line with
the aforementioned purpose of Article 83 GDPR.

323. Indeed, the approach pursued by the IE SA would lead to a situation where, in
cases of several infringements of the GDPR concerning the same or linked processing
operations, the fine would always correspond to the same amount that would be
identified, had the controller or processor only committed one – the gravest –
infringement. The other infringements would be discarded with regard to calculating the
fine. In other words, it would not matter if a controller committed one or numerous
infringements of the GDPR, as only one single infringement, the gravest infringement,
would be taken into account when assessing the fine.

324. With regard to the meaning of Article 83(3) GDPR the EDPB, bearing in mind the
views expressed by the CSAs, notes that in the event of several infringements, several
amounts can be determined. However, the total amount cannot exceed a maximum limit
prescribed, in the abstract, by the GDPR. More specifically, the wording “amount specified
for the gravest infringement” refers to the legal maximums of fines under Articles 83(4),
(5) and (6) GDPR. The EDPB notes that the Guidelines on the application and setting of
administrative fines for the purposes of the Regulation 2016/679 state that the
"occurrence of several different infringements committed together in any particular single
case means that the supervisory authority is able to apply the administrative fines at a
level which is effective, proportionate and dissuasive within the limit of the gravest
infringement". The guidelines include an example of an infringement of Article 8 and
Article 12 GDPR and refer to the possibility for the SA to apply the corrective measure
within the limit set out for the gravest infringement, i.e. in the example the limits of Article
83(5) GDPR.

325. The wording “total amount” also alludes to the interpretation described above.
The EDPB notes that the legislator did not include in Article 83(3) GDPR that the amount
of the fine for several linked infringements should be (exactly) the fine specified for the
gravest infringement. The wording “total amount” in this regard already implies that other
infringements have to be taken into account when assessing the amount of the fine. This
is notwithstanding the duty on the SA imposing the fine to take into account the
proportionality of the fine.

326. Although the fine itself may not exceed the legal maximum of the highest fining
tier, the offender shall still be explicitly found guilty of having infringed several provisions
and these infringements have to be taken into account when assessing the amount of the
final fine that is to be imposed. Therefore, while the legal maximum of the fine is set by
the gravest infringement with regard to Articles 83(4) and (5) GDPR, other infringements
cannot be discarded but have to be taken into account when calculating the fine.

345

327. In light of the above, the EDPB instructs the IE SA to amend its Draft Decision on
the basis of the objections raised by the DE SA, FR SA and PT SA with respect to Article
83(3) GDPR and to also take into account the other infringements – in addition to the
gravest infringement – when calculating the fine, subject to the criteria of Article 83(1)
GDPR of effectiveness, proportionality and dissuasiveness.”

10.6 The impact of this interpretation would be that administrative fine(s) would be imposed
cumulatively, as opposed to imposing only the proposed fine for the gravest infringement.
The only applicable limit for the total fine imposed, under this interpretation, would be
the overall “cap”. By way of example, in a case of multiple infringements, if the gravest
infringement was one which carried a maximum administrative fine of 2% of the turnover
of the undertaking, the cumulative fine imposed could also not exceed 2% of the turnover
of the undertaking.

10.7 In this Inquiry, all of the infringements that have been found to have occurred (either by
the Commission directly or by the EDPB in the Article 65 Decision) are subject to the higher
fining “cap” set out in Article 83(5) GDPR. Accordingly, the total amount of administrative
fines that may be imposed must not exceed 4% of the total worldwide annual turnover of
the undertaking concerned.

10.8 As the EDPB Decision was adopted subsequent to Facebook having made submissions on
the Preliminary Draft Decision, I afforded Facebook an opportunity to make submissions
on this specific matter: that is, the EDPB’s interpretation of Article 83(3) GDPR.

10.9 As a preliminary matter, Facebook has objected to the manner in which it has been asked
to make submissions on this interpretation, and in particular that it was provided with an
extract copy of a working draft rather than an entire copy of the working draft of the Draft
Decision. This, in its view, results in a requirement to make submissions “in the abstract”
without having sight of the reasoning for the alteration of the fining range. 245

10.10 As is set out in this Decision, Facebook has already been afforded an opportunity to make
comprehensive submissions on the Preliminary Draft Decision that addressed every factor
proposed by the Commission for consideration in determining, if any, the appropriate
fine. It was not the intention of the Commission, in this regard, to seek additional
submissions from Facebook on the reasoning for a particular fining range, those
submissions having already been made in detail. The purpose of requesting new
submissions, on this point, was to enable Facebook to exercise a right to be heard on the
application of the interpretation of Article 83(3) GDPR in the EDPB Decision. On this basis,

245
Ibid, paragraph 2.1.
346

I do not accept that Facebook has been deprived of the opportunity to “meaningfully
exercise right to be heard”. 246

10.11 On the substance, Facebook has argued that the above interpretation and application of
Article 83(3) GDPR is incorrect and/or should not be applied because: the EDPB decision
is incorrect as a matter of law and is, in any event, not binding on the Commission; even
if the decision were binding on the Commission, it does not require that the Commission
impose administrative fines in the manner proposed; the Commission has not had regard
to the criteria of effectiveness, proportionality and dissuasiveness in Article 83(1) GDPR
when determining the total cumulative proposed fine; and no decision on the correct
interpretation of Article 83(3) GDPR should be made prior to the determination of a
pending application by WhatsApp Ireland, pursuant to Article 263 TFEU, before the
General Court of the Court of Justice of the European Union, to annul the EDPB Decision
(“the Annulment Proceedings”). 247

10.12 Facebook’s first substantive submission on this matter is that the EDPB Decision is not
binding on the Commission. A number of legal arguments are made in this regard,
including that binding decisions of the EDPB only apply to specific individual cases (as set
out in article 65(1) GDPR) 248 and that only the CJEU can issue binding decisions on matters
of EU law. 249 For the avoidance of
doubt, the Commission has not expressed the view, nor does it hold the view, that the EDPB
Decision is legally binding on it in this Inquiry and/or generally. The Commission is nonetheless, in
this regard, bound by a number of provisions of the GDPR and the real question that arises in this
context is the extent to which the Commission should have regard to the EDPB’s approach.

10.13 The Commission is bound by Article 60(1) GDPR, which states in the imperative that “the
lead supervisory authority shall cooperate with the other supervisory authorities
concerned in accordance with this Article in an endeavour to reach consensus” [emphasis
added]. The Commission is similarly required to cooperate with other supervisory
authorities, pursuant to Article 63 GDPR. Facebook has argued that these obligations
relate only to specific cases where a dispute has arisen. 250 Moreover, it submits that the
EDPB’s function in ensuring correct application of the GDPR is provided for instead in
Article 70(1) GDPR, such as through issuing opinions and guidelines. 251

246
Ibid.
247
Facebook Submissions 9 September 2021, paragraph 1.2.
248
Ibid, paragraph 3.4.
249
Ibid, paragraph 3.6.
250
Ibid, paragraph 3.3.
251
Ibid, paragraph 3.5.
347

10.14 It is not the position of the Commission that the EDPB in and of itself has the power to
issue decisions of general application that bind supervisory authorities. The issue is not
the powers or functions of the EDPB, but rather the legal responsibility of the Commission
to the concerned supervisory authorities, who in themselves happen to be constituent
members of the EDPB. In this regard, assistance is provided in the interpretation of the
Commission’s duties under Article 60(1) GDPR by Recital 123, which states that
“…supervisory authorities should monitor the application of the provisions pursuant to this
Regulation and contribute to its consistent application throughout the Union…”. The
Commission’s view is that the duty to cooperate and ensure consistency that is placed on
it by the GDPR would be rendered ineffective were it not to ensure, to the best of its
ability, such interpretations were applied consistently.

10.15 The alternative scenario, as proposed by Facebook, would result in entrenched
interpretations being consistently advanced by individual supervisory authorities. The
consequence would be inevitable dispute resolution procedures under Article 65 GDPR,
and the issuing of a binding decision once again applying an alternative interpretation to
the specific facts at hand that had already been comprehensively addressed in a previous
dispute resolution procedure. Such a scenario would deprive the duties to cooperate and
act consistently of almost any meaning. In the Commission’s view, such an interpretation
would therefore be contrary to the principle of effet utile. This is, as has been set out, a
distinct issue from the legal powers or functions of the EDPB itself.

10.16 Facebook has argued that the EDPB Decision “did not direct the [Commission] to impose
separate fines in respect of each infringement and to then add those fines together”, but
rather that the final amount should be considered in accordance with the requirements
that the fine be effective, proportionate and dissuasive pursuant to Article 83(1) GDPR. It
submits that overlap between the infringements should be taken into account, in this
regard. 252 It goes on to argue that as there is “…significant – if not complete – overlap
between the infringements” 253 and that the fines relate to “…what is essentially the same
set of facts and alleged infringement…”, the fine is contrary to the EU law principles of
proportionality, ne bis in idem and concurrence of laws. 254

10.17 Facebook develops this aspect of its argument in a later section of its submission, by
suggesting that “it appears…that the [Commission] does not propose to engage in any
meaningful assessment of whether the total fine [meets the Article 83(1) GDPR
criteria]”. 255 Facebook argues that because the Commission viewed the fines proposed in
the Preliminary Draft Decision as effective, proportionate and dissuasive, a fine that is

252
Ibid, paragraph 4.2.
253
Ibid, paragraph 4.4.
254
Ibid, paragraph 4.3.
255
Ibid, paragraph 5.6.
348

between €8 million and €12 million higher must go beyond that standard. 256 Facebook
also argues that its ability to make submissions in relation to this new proposed fine is
“restricted” due to it not being given sight of the entire working draft but simply of the
working draft relevant to the application of the EDPB’s interpretation of Article 83(3)
GDPR.285

10.18 In relation to the requirements of Article 83(1) GDPR, which includes the EU law principle
of proportionality relied on by Facebook, the Commission refutes any suggestion that it
has not had regard to this provision in proposing a final fine. The latter part of Section 9
of this Decision set out, in detail, the Commission’s reasoning as to why the proposed fine
is effective, proportionate, and dissuasive. Moreover, as has been set out, Facebook has
provided extensive submissions on the Preliminary Draft Decision as to its views on what
an effective, dissuasive and proportionate sanction would be. I therefore reject any
suggestion that there was “a failure to adequately consider whether, taken as a whole,
the proposed fines in respect of all the infringements are effective, proportionate and
dissuasive”. 257

10.19 Facebook has already provided submissions on the Preliminary Draft Decision, which
clearly set out its view on the approach to fines in this matter, without prejudice to its
view that no infringement of the GDPR has taken place. The purpose of the additional
opportunity for submissions referred to here was to address the interpretation of Article
83(3) GDPR in the EDPB Decision and its application to this Inquiry, not to reopen the
question of the appropriate quantum for any administrative fine and/or to provide for an
additional round of submissions on that issue. The Commission in any event rejects any
suggestion that the Article 83(1) GDPR criteria are not met by the new fine on the
application of the new interpretation of Article 83(3) GDPR, and as is seen in Section 9
above, I have given due consideration to this and to Facebook’s submissions in
this regard. I therefore remain satisfied that the proposed application of Article 83(3) GDPR is
consistent with Article 83(1) GDPR, for the reasons set out here and in Section 9.

10.20 In relation to the alleged contravention of the ne bis in idem principle, I also reiterate the
views expressed at the end of Section 9 herein, in relation to the Transparency
Infringements. It sets out that the failure to provide required information, and the failure
to set out required information in a transparent manner, are entirely different wrongs.
The legislator has provided for two distinct requirements, and each individual
requirement has been infringed by Facebook. For these reasons and the reasons set out
above, I do not accept this submission. Similarly, the Commission is not applying a new
and retroactive view of wrongdoing to the conduct in a manner envisaged by principle of

256
Ibid, paragraph 5.10.
285
Ibid, paragraph 5.11
257
Ibid, paragraph 5.12.
349

concurrence of laws. It is simply determining the proper interpretation of Article 83(3)
GDPR. This has no impact on the Commission’s detailed consideration of Facebook’s
submissions on the separate and more general question of the appropriate penalty.

10.21 It also argues that the taking into account of the undertaking’s turnover is incorrect as a
matter of law, as it is not set out as a factor in Article 83(2) GDPR. In this regard, the
Commission relies on its existing analysis of its obligations to cooperate with the
concerned supervisory authorities and apply the GDPR consistently. For the same reasons
provided to support the Commission’s decision to apply the EDPB Decision’s
interpretation of Article 83(3) GDPR in general, the Commission intends to maintain this
consideration of the undertaking’s turnover.

10.22 Finally, Facebook has argued that, in light of the intended Annulment Proceedings in
respect of the WhatsApp Decision, the Commission should not finalise the Draft Decision
until a final decision as to the correct interpretation of Article 83(3) GDPR has been made
by the CJEU. Facebook’s submission is simply that “there is, at a minimum, very
considerable doubt as to the correct interpretation of Article 83(3) GDPR” and that on this
basis the Commission should not proceed with this Decision until the matter is finalised. 258
Facebook has provided no legal authority in support of this proposition. Notwithstanding
the possible overlap between some of the questions referred and the issues arising for
decision in this inquiry, given the advanced stage of this Inquiry I am satisfied that there
is no reason to delay this matter. The prospect of intended legal proceedings in respect
of a separate decision does not provide any basis in law for suspending a separate Inquiry.

10.23 For the sake of completeness, I note that Facebook reiterated its concerns as part of its
Final Submissions 259 . I have already addressed the subject-matter of those concerns
above.

ARTICLE 83(5) GDPR

10.24 Turning, finally, to Article 83(5) GDPR, I note that this provision operates to limit the
maximum amount of any fine that may be imposed in respect of certain types of
infringement, as follows:

“Infringements of the following provisions shall, in accordance with paragraph 2, be
subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up
to 4% of the total worldwide annual turnover of the preceding financial year, whichever is
higher:
(a) the basic principles for processing … pursuant to Articles 5, 6, 7 and 9;

258
Ibid, paragraph 6.3.
259
The Final Submissions, paragraphs 11.1 to 11.2 and paragraphs 15.1 to 15.3
350

(b) the data subjects’ rights pursuant to Articles 12 to 22; …”

10.25 In order to determine the applicable fining “cap”, it is firstly necessary to consider
whether or not the fine is to be imposed on “an undertaking”. Recital 150 clarifies, in this
regard, that:

“Where administrative fines are imposed on an undertaking, an undertaking should be
understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those
purposes.”

10.26 Accordingly, when considering a respondent’s status as an undertaking, the GDPR
requires me to do so by reference to the concept of ‘undertaking’, as that term is
understood in a competition law context. In this regard, the CJEU has established that:

“an undertaking encompasses every entity engaged in an economic activity regardless of
the legal status of the entity and the way in which it is financed” 260.

10.27 The CJEU has held that a number of different enterprises could together comprise a single
economic unit where one of those enterprises is able to exercise decisive influence over
the behaviour of the others on the market. Such decisive influence may arise, for example,
in the context of a parent company and its wholly owned subsidiary. Where an entity
(such as a subsidiary) does not independently decide upon its own conduct on the market,
but carries out, in all material respects, the instructions given to it by another entity (such
as a parent), this means that both entities constitute a single economic unit and a single
undertaking for the purpose of Articles 101 and 102 TFEU. The ability, on the part of the
parent company, to exercise decisive influence over the subsidiary’s behaviour on the
market, means that the conduct of the subsidiary may be imputed to the parent company,
without having to establish the personal involvement of the parent company in the
infringement290.

10.28 In the context of Article 83 GDPR, the concept of ‘undertaking’ means that, where there
is another entity that is in a position to exercise decisive influence over the
controller/processor’s behaviour on the market, then they will together constitute a
single economic entity and a single undertaking. Accordingly, the relevant fining “cap” will
be calculated by reference to the turnover of the undertaking as a whole, rather than the
turnover of the controller or processor concerned.

260
Höfner and Elser v Macrotron GmbH (Case C-41/90, judgment delivered 23 April 1991), EU:C:1991:161, para. 21.
290
Akzo Nobel and Others v Commission, (Case C-97/08 P, judgment delivered 10 September 2009) EU:C:2009:536,
paragraphs 58 – 60.
351

10.29 In order to ascertain whether a subsidiary determines its conduct on the market
independently, account must be taken of all the relevant factors relating to the economic,
organisational and legal links which tie the subsidiary to the parent company, which may
vary from case to case 261.

10.30 The CJEU has, however, established 262 that, where a parent company has a 100%
shareholding in a subsidiary, it follows that: the parent company is able to exercise
decisive influence over the conduct of the subsidiary; and a rebuttable presumption arises
that the parent company does in fact exercise a decisive influence over the conduct of its
subsidiary.

10.31 The CJEU has also established that, in a case where a company holds all or almost all of
the capital of an intermediate company which, in turn, holds all or almost all of the capital
of a subsidiary of its group, there is also a rebuttable presumption that that company
exercises a decisive influence over the conduct of the intermediate company and
indirectly, via that company, also over the conduct of that subsidiary 263.

10.32 The General Court has further held that, in effect, the presumption may be applied in any
case where the parent company is in a similar situation to that of a sole owner as regards
its power to exercise a decisive influence over the conduct of its subsidiary 264 . This
reflects the position that:

“… the presumption of actual exercise of decisive influence is based, in essence, on the
premise that the fact that a parent company holds all or virtually all the share capital of
its subsidiary enables the Commission to conclude, without supporting evidence, that that
parent company has the power to exercise a decisive influence over the subsidiary without
there being any need to take into account the interests of other shareholders when
adopting strategic decisions or in the day-to-day business of that subsidiary, which does
not determine its own market conduct independently, but in accordance with the wishes
of that parent company … 265”

261
Ori Martin and SLM v Commission (C-490/15 P, judgment delivered 14 September 2016) ECLI:EU:C:2016:678,
paragraph 60.
262
Akzo Nobel and Others v Commission, (C-97/08 P, judgment delivered 10 September 2009).
263
Judgment of 8 May 2013, Eni v Commission, Case C-508/11 P, EU:C:2013:289, paragraph 48.
264
Judgments of 7 June 2011, Total and Elf Aquitaine v Commission, T-206/06, not published, EU:T:2011:250,
paragraph 56; of 12 December 2014, Repsol Lubricantes y Especialidades and Others v Commission, T-562/08, not
published, EU:T:2014:1078, paragraph 42; and of 15 July 2015, Socitrel and Companhia Previdente v Commission, T-
413/10 and T-414/10, EU:T:2015:500, paragraph 204.
265
Opinion of Advocate General Kokott in Akzo Nobel and Others v Commission, C-97/08 P, EU:C:2009:262, point 73
(as cited in judgment of 12 July 2018, The Goldman Sachs Group, Inc. v European Commission, Case T-419/14,
ECLI:EU:T:2018:445, paragraph 51).
352

10.33 Where the presumption of decisive influence has been raised, it may be rebutted by the
production of sufficient evidence that shows, by reference to the economic,
organisational and legal links between the two entities, that the subsidiary acts
independently on the market.

10.34 It is important to note that “decisive influence”, in this context, refers to the ability of a
parent company to influence, directly or indirectly, the way in which its subsidiary
organises its affairs, in a corporate sense, for example, in relation to its day-to-day
business or the adoption of strategic decisions. While this could include, for example, the
ability to direct a subsidiary to comply with all applicable laws, including the GDPR, in a
general sense, it does not require the parent to have the ability to determine the purposes
and means of the processing of personal data by its subsidiary.

10.35 I have noted already that Facebook’s ultimate parent is Facebook Inc. I also note that Note
22 of the Financial Statements most recently filed, as at the date of preparation of the
Preliminary Draft Decision 266, further confirms, on page 34, that:

“Controlling parties:

At 31 December 2018, the company is a wholly-owned subsidiary of Facebook
International Operations Limited, a company incorporated in the Republic of Ireland, its
registered office being 4 Grand Canal Square, Grand Canal Harbour, Dublin 2.

The ultimate holding company and ultimate controlling party is Facebook Inc., a company
incorporated in Wilmington, Delaware, United States of America. The ultimate holding
company and controlling party of the smallest and largest group of which the company is
a member, and for which consolidated financial statements are drawn up, is Facebook,
Inc.”

10.36 On this basis, it is my understanding that Facebook is a wholly-owned subsidiary of
Facebook International Operations Limited; Facebook International Operations Limited is
wholly owned and controlled by Facebook Inc.; and, as regards any intermediary
companies in the corporate chain, between Facebook and Facebook, Inc., it is assumed,
by reference to the statement at Note 22 of the Notes to the Financial Statements (quoted
above) that the “ultimate holding company and controlling party of the smallest and
largest group of which [Facebook] is a member … is Facebook, Inc.”. It is therefore
assumed that Facebook, Inc. is in a similar situation to that of a sole owner as regards its

266
While I note that Facebook has since filed its Directors Report and Financial Statements for the financial year
ending 31 December 2020, I note that the relevant information set out therein is materially identical to that recorded
in this Decision.
353

power to (directly or indirectly) exercise a decisive influence over the conduct of
Facebook.

10.37 It seemed therefore at the time of preparing the Preliminary Draft Decision, that the
corporate structure of the entities concerned is such that Facebook Inc. is in a position to
exercise decisive influence over Facebook’s behaviour on the market. Accordingly, a
rebuttable presumption will arise to the effect that Facebook Inc. does in fact exercise a
decisive influence over the conduct of Facebook on the market.

10.38 If this presumption is not rebutted, it would mean that Facebook, Inc. and Facebook
constitute a single economic unit and therefore form a single undertaking within the
meaning of Article 101 TFEU. Consequently, the relevant fining “cap” for the purpose of
Articles 83(4) and (5) GDPR, would fall to be determined by reference to the consolidated
turnover of the group of companies headed by Meta Platforms, Inc.. Facebook has made
submissions in this regard in an attempt to rebut the presumption of decisive influence.

10.39 In particular, Facebook submitted that the presumption of decisive influence on the
market does not translate into a data protection context without considering what
“behaviour on the market” means in a data protection context. 267 It argues that this
analysis should focus instead on the entity that has the decision-making capacity in the
context of data protection matters, rather than matters relating to the market in general
as is the case in competition law. I do not agree with this assessment. Firstly, the
suggested approach (involving an assessment of where the decisionmaking power lies, in
relation to the processing of personal data) is effectively a replication of the assessment
that must be undertaken at the outset of the inquiry process, the outcome of which
determines (i) the party/parties to which the inquiry should be addressed; and (ii) (in cross
border processing cases) the supervisory authority with jurisdiction to conduct the
inquiry. Given the consequences that flow from this type of assessment, it would not be
appropriate for this assessment to be conducted at the decision-making stage of an
inquiry.

10.40 Secondly, the suggested approach could not be applied equally in each and every case.
Where, for example, the presumption of decisive influence has been raised in the context
of a crossborder processing case where one of the entities under assessment is outside
of the EU, an assessment of that entity’s ability to exercise decisive influence over the
respondent’s data processing activities would likely exceed scope of Article 3 GDPR. Such
a scenario risks undermining the Commission’s ability to comply with its obligation,
pursuant to Article 83(1) GDPR, to ensure that the imposition of fines, in each individual
case, is “effective, proportionate and dissuasive”.

267
Facebook Submissions on Preliminary Draft Decision, paragraph 16.2.
354

10.41 Finally “behaviour on the market” has a meaning normally ascribed to it in EU competition
law. In summary, “behaviour on the market” describes how an entity behaves and
conducts its affairs in the context of the economic activity in which it engages. Such
behaviour will include matters such as the policies and procedures it implements, the
marketing strategy it pursues, the terms and conditions attaching to any products or
services it delivers, its pricing structures, etc. I therefore can see no basis in law, in
Facebook’s submissions or otherwise, to deviate from this well-established principle as
set out both in the GDPR, other provisions of EU law and the jurisprudence of the CJEU.

10.42 Applying the above to Article 83(5) GDPR, I first note that, in circumstances where the
fine is being imposed on an ‘undertaking’, a fine of up to 4% of the total worldwide annual
turnover of the preceding financial year may be imposed. I note, in this regard, that Meta
Platforms, Inc. reported the generation of revenue in the amount of $117,929 billion in
respect of the year ended 31 December 2021. That being the case, the fine proposed
above does not exceed the applicable fining “cap” prescribed by Article 83(5) GDPR 268.

SUMMARY OF ENVISAGED ACTION

10.43 I therefore decide to exercise the following corrective powers:

10.44 An order is hereby made, pursuant to Article 58(2)(d) GDPR, requiring Facebook to bring processing
into compliance (“the Order”) within a period of three months commencing on the day following
the date of service, on Facebook, of this Decision. More specifically, the Order:

a. firstly, requires Facebook to bring the Data Policy and Terms of Service into compliance
with Articles 5(1)(a), 12(1) and 13(1)(c) GDPR as regards information provided on: (i) data
processed pursuant to Article 6(1)(b) GDPR as well as (ii) data processed for the purposes
of behavioural advertising in the context of the Facebook service, in accordance with the
principles set out in this Decision; and

b. secondly, requires Facebook to take the necessary action to bring its processing of
personal data for the purposes of behavioural advertising (“the Processing”), in the
context of the Facebook Terms of Service, into compliance with Article 6(1) GDPR in
accordance with the conclusion reached by the EDPB, as recorded at paragraphs 132 and
133 of the Article 65 Decision. More specifically, in this regard, Facebook is required to
take the necessary action to address the EDPB’s finding that Facebook is not entitled to
carry out the Processing on the basis of Article 6(1)(b) GDPR, taking into account the
analysis and views expressed by the EDPB in Section 4.4.2 of the Article 65 Decision. Such

https://investor.fb.com/investor-news/press-release-details/2022/Meta-Reports-Fourth-Quarter-and-Full-
268

Year2021-Results/default.aspx
355

action may include, but is not limited to, the identification of an appropriate alternative
legal basis, in Article 6(1) GDPR, for the Processing together with the implementation of
any necessary measures, as might be required to satisfy the conditionality associated with
that/those alternative legal basis/bases.

10.45 An administrative fine is hereby imposed, pursuant to Articles 58(2)(i) and 83, addressed to
Facebook, in the amount of €210 million. For the avoidance of doubt, that fine reflects the
infringements that were found to have occurred, as follows:

a. In respect of the failure to provide sufficient information in relation to the processing
operations carried out in purported reliance on Article 6(1)(b) GDPR, thereby infringing
Articles 5(1)(a) and 13(1)(c) GDPR, a fine in the amount of €80 million is hereby imposed.

b. In respect of the failure to provide the information that was provided on the processing
operations carried out in purported reliance on Article 6(1)(b) GDPR, in a concise,
transparent, intelligible and easily accessible form, using clear and plain language, thereby
infringing Articles 5(1)(a) and 12(1) GDPR, a fine in the amount of €70 million is hereby
imposed.

c. In respect of the infringement of Article 6(1) GDPR (and taking into account the
infringement of the Article 5(1)(a) fairness principle), a fine in the amount of €60 million
is hereby imposed.

This Decision is addressed to:

Meta Platforms Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2

Dated the 31st day of December 2022

Decision-Maker for the Commission:

_______________________________________ Helen
Dixon
Commissioner for Data Protection

356

SCHEDULE 1

3 CHRONOLOGY, PROCEDURAL AND SCOPE MATTERS PERTAINING TO INQUIRY PROVISIONALLY DECIDED

1.6 The Complaint was lodged with the Austrian DPA on 25 May 2018 (the date on which the GDPR became
applicable) by the Complainant’s representative: “noyb – European Center for Digital Rights”
(“NOYB”). The legal framework for the Complaint as lodged with the Commission is set out below.
In brief, the Complaint concerns the lawfulness of Facebook’s processing of personal data,
specifically data processing on foot of the Complainant’s acceptance of Facebook’s Terms of Service,
and the transparency of information provided by Facebook to the Complainant about that
processing.

1.7 The Commission began the Inquiry by designating an investigator (“the Investigator”), who produced
a draft of an inquiry report (“the Draft Report”) and, following submissions from the Parties, a final
inquiry report (“the Final Report”). In considering this Inquiry, I have relied on the facts as set out
in the Final Report. I have also had regard to the views set out by the Investigator in the Final Report,
as well as to the entirety of the file, in preparing this Schedule.

1.8 The preliminary draft decision (“the Preliminary Draft Decision”) set out my provisional findings, as
the decision-maker in this matter, in relation to (i) whether or not an infringement of the GDPR has
occurred/is occurring; and (ii) the envisaged action to be taken by the Commission in respect of
same. The Preliminary Draft Decision was circulated to Facebook and NOYB (collectively “the
Parties”) on 14 May 2021. I received submissions from the Parties.

1.9 The submissions were received and taken into account by the Commission. I have finalised a draft
version this Schedule and a draft decision (“the Draft Decision”), which was submitted by the
Commission to other concerned supervisory authorities (‘the CSAs”) (within the meaning of Article
4(22) GDPR), pursuant to Article 60 GDPR, on 6 October 2021. The Preliminary Draft Decision and
this Schedule were provided to the Parties for the purpose of allowing them to make submissions
in relation to my provisional findings. I considered the submissions so made by the Parties and,
where necessary, made amendments to take account of these prior to the finalisation of the Draft
Decision. The Schedule and Draft Decision were circulated to the CSAs in accordance with the
procedure set out in Article 60 GDPR and as explained in, inter alia, my letters sent to Facebook and
the Complainant respectively on 17 April 2020 (“the Article 60 Process”).

1.10 The cross-border processing under examination in this Inquiry was such that all other EU/EEA
supervisory authorities (“SAs, each one being an “SA”) were engaged as supervisory authorities
concerned (“CSAs”) for the purpose of the cooperation process outlined in Article 60 of the GDPR.
Following the circulation of the Draft Decision and Schedule to the CSAs for the purpose of enabling
them to express their views, in accordance with Article 60(3) GDPR, objections were raised by the

357

SAs of Austria, Sweden, Norway, the Netherlands, Poland, Finland, France, Portugal, Italy and
Hamburg (representing a co-ordinated response by the German SAs). A number of comments were
also exchanged by various CSAs.

1.11 Having considered the matters raised, the Commission, by way of a Composite Response
Memorandum dated 25 July 2022, set out its responses to the various objections and comments.
Ultimately, it was not possible to reach consensus with the CSAs on the subject-matter of the
objections and, accordingly, the Commission determined that it would not follow them. That being
the case, the Commission referred the objections to the EDPB for determination pursuant to the
Article 65(1)(a) dispute resolution mechanism. In advance of doing so, the Commission invited
Facebook to exercise its right to be heard on all of the material that the Commission proposed to
put before the EDPB. Facebook exercised its right to be heard by way of its submissions dated 15
July 2022 (the “Article 65 Submissions”).

1.12 The EDPB adopted its Article 65 Decision on 5 December 2022 and notified it to the Commission and
all other CSAs on 6 December 2022. As per Article 65(1), the EDPB’s decision is binding upon the
Commission. Accordingly, and as required by Article 65(6) of the GDPR, the Commission has now
amended its Draft Decision, by way of this Decision, in order to take account of the EDPB’s
determination of the various objections from the CSAs which it deemed to be “relevant and
reasoned” for the purpose of Article 4(24) of the GDPR. As part of the amendment process,
Facebook was invited to exercise its right to be heard in relation to any matters in relation to which
the Commission was required to make a final determination or, otherwise, exercise its own
discretion. Facebook exercised its right to be heard by way of its submissions furnished under cover
of letter dated 19 December 2022 (“the Final Submissions”)

1.13 For the avoidance of doubt, this Schedule is an integral and operative part of my final decision (“the
Decision) for the purposes of Article 60 and 65 GDPR. The previous division of material into two
documents is entirely a structural choice, so as to enable a more exclusive focus on the substantive
Complaint in the main document, while dealing with matters of a more procedural nature herein.
It has been incorporated into the Decision itself as part of the finalisation process, prior to adoption.

LEGAL BASIS FOR THE INQUIRY

1.14 The Inquiry in this case was conducted by the Investigator under Section 110 of the 2018 Act.

1.15 The decision-making process for the Inquiry which applies to this case is provided for under Section
113(2)(a) of the 2018 Act. Additionally, Section 113(3)(a) of the Act requires that the Commission
must consider the information obtained during the Inquiry; decide whether an infringement is
occurring or has occurred; and if so, decide on the envisaged action (if any) to be taken in relation
to the data controller. This function is performed by me in my role as the decision-maker. In so

358

doing, I have carried out an independent assessment of all of the materials provided to me by the
Investigator.

1.16 As stated above, the Inquiry was commenced pursuant to Section 110 of the 2018 Act. By way of
background in this regard, under Part 6 of the 2018 Act, the Commission has the power to
commence an inquiry on several bases, including on foot of a complaint, or of its own volition.

1.17 In his consideration of the material gathered during the initial stages of this Inquiry, the Investigator
was satisfied that Facebook constitutes a data controller and that the processing referred to in the
Complaint constitutes cross-border processing, such that the Commission is the lead supervisory
authority as set out in the GDPR. I make my decision in this regard below.

REFERRAL BY AUSTRIAN DPA

1.18 The Complaint was referred to the Commission by the Austrian DPA on the basis that (i) the Complaint
concerns cross-border processing and (ii) Facebook, as the data controller, has its main
establishment in Ireland. In this regard, the Austrian DPA forwarded the Complaint to the
Commission on 30 May 2018. The Commission assessed the Complaint and as lead supervisory
authority, commenced the Inquiry under Section 110 of the 2018 Act on 20 August 2018. The Parties
were also notified of the commencement of the Inquiry on 20 August 2018.

STATUS OF NOYB

1.19 NOYB is acting as a representative of a named individual in accordance with Article 80 GDPR, which
states that:

“The data subject shall have the right to mandate a not-for-profit body, organisation or
association which has been properly constituted in accordance with the law of a Member
State, has statutory objectives which are in the public interest, and is active in the field of
the protection of data subjects’ rights and freedoms with regard to the protection of their
personal data to lodge the complaint on his or her behalf…”

1.20 For the purposes of assessing compliance with Article 80 GDPR, it is necessary to assess whether
NOYB was a properly constituted not-for-profit body with objectives in the public interest and that
was actively engaged in “the field of the protection of data subject rights”. In this regard, the
Investigator consulted NOYB’s website, and NOYB’s articles of association, which explain that it is a
“verein” (association) under Austrian law. Having reviewed paragraphs 91-96 of the Final Report
and Appendix 4 of the Final Report (NOYB’s articles of association), I am satisfied that NOYB meets
the definition set out in Article 80 GDPR. NOYB is a not-for-profit body that appears on its face
(although the Commission has no specific competence to rule in this regard) to be validly

359

constituted in accordance with Austrian law, with objectives which are in the public interest. From
having reviewed this information, I am also satisfied that NOYB is active in the field of the protection
of data subject rights. On this basis, I am satisfied that these all meet the definition in Article 80
GDPR.

1.21 Moreover, it is necessary to determine the validity of the data subject’s mandate in order to decide
whether NOYB may represent them. I am satisfied, having reviewed paragraphs 98-101 of the Final
Report and Appendix 3 of the Final Report (the data subject’s “mandate”) that the mandate
provided to NOYB by the data subject was lawful, and that therefore NOYB has the right to represent
the data subject in this matter. The mandate includes the name, address and signature of the data
subject being represented by NOYB. I note, as was noted by the Investigator, that the mandate
specifically refers to “forced consent to the update privacy policy that I clicked on to in May 2018”.
On an objective reading of this mandate, NOYB was given authority to represent the data subject in
relation to alleged infringements of the GDPR concerning agreement to the Terms of Service and
Data Policy.

1.22 I have also considered “Attachment F” to the Complainant’s submissions on the Draft Report i.e. an
affidavit (sworn statement). This affidavit, sworn on 3 September 2019, states that, in the data
subject’s view, NOYB has the authority to represent them “in all matters and in all arguments and
legal claims against Facebook according to Article 80 GDPR”. My view is that this cannot alter, post
hoc, the nature of the data subject mandate that was provided to NOYB in accordance with Article
80 GDPR to launch a complaint on its behalf. The nature of the Complaint was specified and detailed
in the mandate. However, as the scope of the Complaint as I propose to find below does not, in my
view, conflict with the mandate, the question of whether “Attachment F” can broaden the scope of
NOYB’s mandate is moot.

1.23 Facebook expressed no particular view on NOYB’s status under Article 80 GDPR, or on the data
subject’s mandate.

PROCEDURAL CONDUCT OF INQUIRY

1.24 As set out above, the Inquiry was commenced on 20 August 2018 for the purposes of examining and
assessing the circumstances surrounding the Complaint as referred to the Commission by the
Austrian DPA, with a view to ultimately facilitating a decision under Section 113(2)(a) of the Act.

1.25 The Commission commenced the Inquiry as it was “of the opinion that one or more provisions of the
[2018] Act and/or the GDPR may have been contravened in relation to the personal data of the data
subject who is represented by the Complainant pursuant to Art. 80(1) GDPR…” 269 The Commission
formed this view on the basis of the contents of the Complaint and the arguments it sets out. The

269
Letter of the Commission to Facebook, 20 August 2018.
360

Parties were informed of the commencement of the Inquiry by letters dated 20 August 2018. The
letter to Facebook set out that the scope of the Inquiry would encompass the contents of the
Complaint. The letter also set out a number of queries for Facebook.

1.26 Facebook responded to these queries by way of correspondence, with an attached schedule and
appendices, on 27 September 2018.

1.27 Following this, the Investigator wrote to the Complainant on 23 November 2018 to set out his views
on the scope of the Complaint. In this context, a number of procedural issues were raised by the
Complainant in correspondence dated 3 December 2018. These issues consisted of an allegation of
delay on the part of the Commission, and an allegation of bias on the part of the Commission, and
a rejection of the interpretation of the Complaint’s scope proposed by the Investigator. The
Investigator responded to the Complainant on 16 January 2019 refuting the allegations in strong
terms. A further phone call took place between the Investigator and Mr. Maximilian Schrems, a
representative of the Complainant, on 26 January 2019, in this regard.

1.28 The Investigator wrote to Facebook on 25 January 2019 to set out his views on the scope of the
Complaint, in the same manner as set out in the letter to the Complainant on 23 November 2018.
Facebook raised a number of preliminary procedural queries with the Investigator by letter dated 5
February 2019. Facebook enquired as to whether its submissions of 27 September 2018 would be
taken into account in circumstances where it was of the view that these submissions extended
beyond the scope as set out by the Investigator in the letter of 25 January 2019. Facebook also
sought assurances in respect of the confidentiality of information provided in submissions to the
Commission, and queried how information would be shared with concerned supervisory authorities
pursuant to Article 60 GDPR.

1.29 The Investigator responded to Facebook’s query on 8 February 2019, and confirmed that Facebook’s
submission of 27 September 2018 would be taken into account. Furthermore, the Investigator
informed Facebook that it would consider the matter of confidentiality of material in the context of
the Article 60 Process by way of separate correspondence. The Investigator also asked Facebook to
set out clearly any material that it regarded as confidential and/or commercially sensitive in any
submissions to the Commission, including the submissions of 27 September 2018 in this Inquiry.

1.30 Facebook corresponded further with the Commission on 13 February 2019 seeking confirmation that
aspects of the submission of 27 September 2018 that did not fall within the scope of the Complaint
as set out the Investigator’s letter of 25 January 2019 would not be taken into account. Facebook
also sought an extension to the deadline (which was 15 February 2019) that had been set for
submissions in the Investigator’s letter of 25 January 2019. The Investigator wrote to Facebook on
15 February 2019 confirming that the extension would be granted and asking Facebook to specify
any part of the submission of 27 September 2018 that it argued should not be taken into account.

361

1.31 In response to the letter of 25 January 2019, Facebook sent its submissions on 22 February 2019, in
accordance with the extension of time provided by the Investigator. The Complainant was informed of
same. On 23 March 2019, the Complainant wrote to the Commission to request an update as to
progress, which was provided by the Investigator on 28 March 2019. That letter set out the procedure
that would be followed in terms of the preparation of a Draft Report, the Final Report, and the decision-
making process.

1.32 Mr Schrems raised a number of concerns with the Investigator in a phone conversation on 1 April
2019. Further to this, the Complainant wrote to the Investigator on 19 April 2019 to set out the
concerns in writing. These concerns related to dealing directly with the Commission in
circumstances where the Complaint was lodged with the Austrian DPA, as well as concerns
surrounding the applicability of Irish procedural law as opposed to Austrian procedural law, and
conflicts between Irish procedural law and Austrian procedural law. These concerns were also raised
by the Complainant in its submissions on the Draft Report and were addressed in the Final Report.
I address these concerns and procedural issues below.

1.33 Having completed the Draft Report, the Investigator furnished the parties with a copy of the Draft
Report on 28 June 2019. Facebook’s submissions on the Draft Report were received by the
Investigator on 28 July 2019, and the Complainant’s submissions on same were received by the
Investigator on 9 September 2019. The Investigator proceeded to prepare the Final Report.

1.34 As has already been outlined, Facebook asserted confidentiality over some material sent to the
Commission in the context of its submissions during the course of the Inquiry. The Complainant
argued that it was entitled to view the material, and also formally requested access to the entire
investigation file. Facebook subsequently expressed its willingness to share all relevant material
with the Complainant on a voluntary basis. I have considered the issues surrounding the
confidentiality dispute in the correspondence between the parties. I am satisfied that no additional
issues of confidentiality arise in circumstances where no specific issues of commercial sensitivity
have been identified by Facebook in response to such requests, aside from Facebook’s position that
the ongoing Inquiry is, in general, a confidential process.

1.35 The Parties were furnished with each other’s submissions on the Draft Report, for their information.
The Final Report was provided to me as decision-maker on 4 April 2020.

1.36 In terms of its contents, the Final Report sets out the factual background, and the scope and legal
basis, for the Inquiry. It also provides an outline of the facts as established during the course of the
Inquiry, an outline of the dispute about the scope of the Inquiry and the Investigator’s view on same,
and an outline of the procedural disputes that arose during the Inquiry and the Investigator’s view
on same. The Final Report further sets out the Investigator’s views as to whether, in respect of
these matters, Facebook complied with its obligations under GDPR and the 2018 Act.

362

1.37 A draft of this Schedule and the Preliminary Draft Decision, i.e. a draft of this decision prepared to
enable to parties to make submissions, were sent to the parties on 14 May 2021. The parties
furnished the Commission with submissions on that Preliminary Draft Decision and the draft of the
Schedule, which I have taken account of in preparing this Schedule and the Decision. The
Complainant was not furnished with the section of the Preliminary Draft Decision that addressed
the envisaged action i.e. what corrective powers would be imposed, as this is a matter for the
Commission and not something that falls within the framework of a complaint pursuant to Article
77 GDPR.

1.38 As for any alleged failure to hear the complainant on the question of corrective powers, my view is
that this is simply not a matter for a complainant. A complaint consists of an allegation that unlawful
processing is taking place, and therefore is an allegation of an infringement. The question of a
corrective power e.g. an administrative fine is solely within the competence of the Commission.

1.39 The Complainant, in this regard, provided the example of a ban on unlawful processing as something
a Complainant should be heard in relation to. 270 In making this argument, the Complainant points
out that the Complaint in fact seeks a specific “remedy”, i.e. the ending of all processing that the
Complainant believes to be unlawful.301

1.40 It must be acknowledged, however, that the position adopted in the Preliminary Draft Decision was
that no unlawful processing had been identified by the Complainant, and the proposed
infringements related to transparency rather than to the processing of data. As such, it must
logically follow that the Commission was not proposing a ban on any processing, given that the
Preliminary Draft Decision did not propose to find that any unlawful processing was actually taking
place. In this regard, even if there were merit to this argument in some particular circumstances, it
was clearly not applicable in the context in which it was made.

1.41 Furthermore, in circumstances where the Commission was minded to find that unlawful processing
was taking place, the position of the Complainant in this regard is abundantly clear. Were the
Commission not minded to ban any such processing, the Complainant’s position is clearly that it
should. If the Commission were minded to ban it, the Complainant has made it clear that it would
agree with the decision. In that sense, the Complainant has in fact been heard in no uncertain terms
in relation to the question of whether any processing (the processing in question being considered
in detail in the accompanying Decision) should be banned.

1.42 What has happened is that the Complainant has not been furnished with, and given the opportunity
to make submissions on, the section of the Preliminary Draft Decision that proposed an
administrative fine, something which is not a matter for the Complainant in any event. As I have set
out, the Preliminary Draft Decision did not propose to find that any unlawful processing was taking

270
Ibid, paragraph 3.4.5.
301
Ibid.
363

place. This leads to the inevitable conclusion that the section of the Preliminary Draft Decision the
Complainant was not provided with would not (and indeed could not) propose banning processing.
Therefore even taking this particular argument of the Complainant at its height, it is not applicable
in these circumstances.

1.43 Moreover, the Complainant was afforded a right to be heard on the impact any alleged unlawful
processing had on her, which is a factor to be considered in the imposition of an administrative fine
under Article 83(2)(a) GDPR. This provided the Complainant with an opportunity to speak to the
only factor in my consideration of which the Complainant has direct experience.

1.44 For the above reasons, these suggestions on the part of the Complainant’s representative to the
effect that it was not afforded a full right to be heard in relation to this inquiry are either ill-founded
or based on mischaracterisations of fact and law.

4 Procedural Issues to be Decided

2.1 As set out above, this is the Schedule to the Decision made by the Commission, (at this point, I note
that I am the sole member of the Commission) in accordance with Section 113 of the 2018 Act. Section
113 of the 2018 Act provides as follows:

(2) Where section 109 (4)(a) applies, the Commission shall—

(a) in accordance with subsection (3), make a draft decision in respect of the complaint
(or, as the case may be, part of the complaint) and, where applicable, as to the
envisaged action to be taken in relation to the controller or processor concerned, and

(b) in accordance with Article 60 and, where appropriate, Article 65, adopt its decision in
respect of the complaint or, as the case may be, part of the complaint.

(3) In making a draft decision under subsection (2)(a), the Commission shall, where applicable, have
regard to—

(a) the information obtained by the Commission in its examination of the complaint,
including, where an inquiry has been conducted in respect of the complaint, the
information obtained in the inquiry, and

(b) any draft for a decision that is submitted to the Commission by a supervisory
authority in accordance with Article 56(4).

(4) Where the Commission adopts a decision under subsection (2)(b) to the effect that an
infringement by the controller or processor concerned has occurred or is occurring, it shall, in
addition, make a decision—
364

(a) where an inquiry has been conducted in respect of the complaint—

(i) as to whether a corrective power should be exercised in respect of the
controller or processor concerned, and

(ii) where it decides to so exercise a corrective power, the corrective power
that is to be exercised,

2.2 In accordance with Section 113, it is for me, as the sole member of the Commission, to
consider the information obtained in the course of the Inquiry; to decide whether an
infringement is occurring or has occurred; and if so, to decide on the envisaged action in
respect of the controller (if any). In so doing, I will carry out an independent assessment of
all of the materials provided to me by the Investigator.

2.3 Given that the Commission is the lead supervisory authority under Article 56(1) GDPR for
the purposes of the data processing operations at issue, I was obliged under Section 113(2)
and Article 60(3) GDPR to complete the Draft Decision and provide it to the CSAs, as defined
in Article 4(22).

2.4 As set out above at paragraph 1.1, this concerns my Decision, having submitted the Draft
Decision under Article 60(3) GDPR to the CSAs, and having taken account of the Article 65
Decision, as explained in the text of the Decision itself. The purpose of the Draft Schedule
and the Preliminary Draft Decision were to allow the parties to make any submissions in
respect of my provisional findings set out. This is the finalised version of the Schedule and
Decision, as also explained in further detail in the Decision.

DECISION-MAKING PROCESS – MATERIALS CONSIDERED

2.5 The Final Report was transmitted to me on 4 April 2020, together with the Investigator’s file,
containing copies of all correspondence exchanged between the Investigator and the Parties; and
copies of any submissions made by the Parties, including the submissions made by the Parties in
respect of the Investigator’s Draft Report. A letter then issued to the Parties on 17 April 2020 to
confirm the commencement of the decision-making process.

2.6 As decision-maker, I must be satisfied that Facebook is a controller within the meaning of the GDPR,
that the Commission has competence in respect of this Inquiry, and that fair procedures have been
followed throughout the Inquiry. As I have set out above, a number of procedural complaints were
made by NOYB throughout the Inquiry process. These issues are addressed in this Schedule.

365

2.7 The Complainant’s submissions on the Preliminary Draft Decision took issue with this approach. It was
argued that this breached the Complainant’s right to be heard. 271 It was also argued that the use of
the term “materials considered” suggested that there must be some materials that the Commission
did not consider. 272 For the avoidance of doubt, I have considered all material submitted to me by
the Parties, and the entire file in general. There is no question of any breach of the Complainant’s
right to be heard.

FACEBOOK AS CONTROLLER

2.8 In commencing the Inquiry, the Investigator was satisfied that Facebook is the controller, within the
meaning of Article 4(7) of the GDPR, in respect of the personal data that was the subject of the
Complaint. In this regard, Facebook confirmed that it was the controller for data processing in the
European Union in a letter to the Commission dated 25 May 2018, appended to the Investigator’s
Final Report (“the Final Report”) at Appendix 8.

2.9 The concept of controllership is defined in Article 4(7) GDPR which states that a controller is

“the natural or legal person, public authority, agency or other body which, alone or jointly
with others, determines the purposes and means of the processing of personal data; where
the purposes and means of such processing are determined by Union or Member State
law, the controller or the specific criteria for its nomination may be provided for by Union
or Member State law”.

2.10 In considering whether Facebook is a controller within the EU for the purposes of the GDPR, I note
that Facebook’s Dublin office constitutes Facebook’s International Headquarters, and that
Facebook had approximately 1,300 direct employees and several thousand further indirect
employees working for their Dublin office at the time of the preparation of the Preliminary Draft
Decision. 273 Amongst these employees are key data protection personnel, including Facebook’s
Head of Data Protection and Associate General Counsel. In the context of the Commission’s work
as Ireland’s data protection regulator, it has become clear that Facebook determines the purposes
and means of data processing through its role as a global centre of decision-making within
Facebook companies generally, and particularly in relation to the processing of personal data. I
am therefore satisfied that it is a data controller for European (and, indeed, EMEA) users as
defined by Article 4(7) GDPR.

2.11 In relation to the work of the Commission, and my work as Commissioner, it is clear to me based on
direct experience that decisions in relation to the purposes and means of data processing for

271
Complainant Submissions on Preliminary Draft Decision, paragraph 2.2.
272
Ibid, paragraph 3.1.
273
https://www.irishtimes.com/business/technology/facebook-ireland-staff-log-some-of-the-highest-salaries-
inthe-state-1.4096130; https://www.thejournal.ie/facebook-jobs-sheryl-sandberg-4451174-Jan2019/.
366

European data subjects are made by Facebook Ireland Limited (“Facebook”). I note the
submissions made by Facebook on 27 September 2018, in which it stated that it “…is both
responsible for, and has the power to make, decisions about the purposes and means of processing
of personal data from EU data subjects…”. 274 Moreover, the submission stated that:

“Facebook Ireland is the service provider of the Service in the EU and also determines the
purposes and means of processing EU users’ data. It is the only entity with decision-making
power regarding:

• Setting polices governing how EU user data is processed;
• Deciding whether and how our products that involve processing of user data will be
offered in the EU;
• Controlling the access to and use of EU user data; and
• Handling and resolving data-related inquiries and complaints from European users of
the Service whether directly or indirectly via regulators.” 275

2.12 By way of a specific recent example, the Commission attended Facebook’s Dublin office in order to
inspect documents relating to the roll-out of a dating feature. This roll-out was delayed as a result
of concerns expressed by the Commission about the compliance of the feature with data
protection law. In the context of this inspection, it was clear that decisions in relation to this data
processing were made by Facebook, just as other such decisions have been made in the past, and
are made on a daily basis. For these reasons, I am in agreement with the Investigator, and find
that Facebook is a data controller as defined by Article 4(7) GDPR. Specifically, I am satisfied that
Facebook is the data controller for users in the European Union.

COMPETENCE OF THE COMMISSION

2.13 Pursuant to Article 56(1) GDPR, “the supervisory authority of the main establishment or of the single
establishment of the controller or processor shall be competent to act as lead supervisory authority
for the cross-border processing carried out by that controller or processor”. It follows that the
Commission is only competent to act as the lead supervisory authority if (i) Facebook’s main or
single establishment in the Union is located is Ireland, and (ii) there is cross-border processing as
defined in the GDPR.

2.14 I will first consider whether Facebook is the main or single establishment of the Facebook group
within the Union. The term “main establishment” in respect of a controller, is defined in Article
4(16) GDPR as “…the place of its central administration in the Union” where “decisions on the
purposes and means of the processing of personal data are taken.”

274
Facebook Submissions 27 September 2018, paragraph 2.2.
275
Ibid, paragraph 2.4
367

2.15 Facebook confirmed to the Commission, in a letter of 25 May 2018 at Appendix 8 of the Final Report:
“…we wish to formally confirm that the following controllers will have their main establishment in
the European Union in Ireland: Facebook Ireland Limited…”. Furthermore, having reviewed the
Directors’ Report and Financial Statements most recently filed on behalf of Facebook with the
Companies Registration Office (in respect of the financial year ended 31 December 2018), I note
that page 3 of the Directors’ Report confirms that:

“Facebook Ireland Limited (“the company”) is a wholly-owned subsidiary of Facebook
International Operations Limited, which is its immediate parent and controlling party.
Facebook International Operations is incorporated in the Republic of Ireland and its
ultimate parent is Facebook, Inc. (“Facebook”), a company incorporated in Wilmington,
Delaware, United States of America.”

2.16 In their submissions of 27 September 2018, Facebook submitted that:

“Facebook Ireland has more than personnel at its headquarters in Dublin who
manage, among other things, the operations and data processing relating to EU users,
including the analysis and exercise of those users’ rights, information security including
user information security, engineering, user support, law enforcement response, data
protection and privacy operations and policy and legal teams including, critically, the data
protection teams. Facebook Ireland’s senior decision makers operate in cross-functional
teams, which include representatives from its Legal, Policy, Law Enforcement Response,
Community Operations, Information Security, and Privacy Operations. The DPO and his
office provide oversight of these teams and their work. These decision makers formulate
user data processing policies and oversee the implementation of these policies in respect
of users of the Service in the EU. On a daily basis, Facebook Ireland’s personnel are
responsible for managing the personal data of EU users and determining the means and
purposes of processing this personal data.” 276

2.17 In this regard, I further note that the Investigator, and the Commission generally, was satisfied, in
commencing the Inquiry, that Facebook was the main establishment in the European Union within
the meaning of Article 56(1) GDPR. I further note that nothing has been brought to my attention
to suggest that the position, in this regard, has changed since I considered it in the context of the
preparation of the Preliminary Draft Decision.

2.18 As I have already observed, Facebook’s headquarters in Dublin constitutes Facebook’s International
Headquarters. Moreover, I have already found, for the reasons set out above, that decisions on
the purposes and means of the processing of personal data are taken by Facebook. For these
reasons and the reasons already set out above, I am satisfied that Facebook Ireland is

276
Ibid, paragraph 2.9.
368

Facebook’s place of central administration in the Union. I am also satisfied, on the information available
to me, that decisions which relate to the means and purposes of data processing are made by Facebook.

2.19 To turn to cross-border processing, cross-border processing is defined in Article 4(23) GDPR as
either:

“(a) processing of personal data which takes place in the context of the activities of
establishments in more than one Member State of a controller or processor in the Union
where the controller or processor is established in more than one Member State; or

(b) processing of personal data which takes place in the context of the activities of a single
establishment of a controller or processor in the Union but which substantially affects or
is likely to substantially affect data subjects in more than one Member State.”

2.20 In its submissions dated 27 September 2018, Facebook confirmed that “Facebook Ireland provides
the Service to hundreds of millions of users across the EU and in doing so is engaged in crossborder
processing pursuant to Article 4(23) GDPR.” 277

2.21 I also note that the Investigator was satisfied that there was cross-border processing carried out by
Facebook (within the meaning of Article 4(23) GDPR), in relation to the personal data that was the
subject of the Complaint.309 Given the scale of Facebook’s operations across the European Union
outlined above, I am satisfied that there is cross-border processing as defined in the GDPR for the
purposes of this Complaint.

2.22 I am satisfied based on the above evidence secured through publicly available sources, information
voluntarily provided by Facebook, and information acquired by the Commission in the course of
conducting investigations, that Facebook is the data controller for EU users and is the
organisation’s place of central administration in the Union. I am also satisfied, for the reasons set
out above, that this Complaint concerns cross-border processing. I therefore agree with the
Investigator that Facebook meets the definition of “main establishment” in Article 4(16) GDPR,
and that therefore the Commission is competent to act as lead supervisory authority in
accordance with Article 56 GDPR.

ISSUES OF AUSTRIAN LAW

2.23 The next procedural issue is an overarching point that is relevant to each of the other individual
points raised by the Complainant, and so I will consider this point before considering the other
points in turn. This Complaint was lodged with the Austrian DPA, who then transferred the

277
Facebook Submissions 27 September 2018 paragraph, 2.7.
309
Final Report, page 19-20.
369

Complaint to the Commission as lead supervisory authority in accordance with Article 56 GDPR.
The Commission then launched a statutory inquiry in accordance with Irish law. The Complainant,
however, argues that because the Complaint itself was lodged with the Austrian DPA in Austria,
the Complaint must be handled in accordance with the procedural laws of both Austria and
Ireland. The Complainant’s representative has initiated legal proceedings in Austria against the
Austrian DPA in this regard (“the Austrian Proceedings”).

2.24 Briefly, and by way of background, the Austrian Proceedings arise out of a formal complaint made by
the Complainant to the Austrian DPA (“the Austrian Complaint”). The Austrian Complaint argues
that the Commission has contravened Austrian law by not adhering to the relevant procedural rules
and not applying Austrian contract law to this Complaint. The Complainant also argues that the
Commission has contravened Austrian law by not considering certain matters that the Complainant
deems to be within the scope of the Complaint. On this basis and others (which are not directly
relevant for these purposes), the Complainant asks that the Austrian DPA lift a suspension currently
in operation on its handling of the Complaint so that it can also deal with that same Complaint. The
Austrian DPA rejected these arguments for a number of reasons, including that it cannot act while
the Commission’s procedures are ongoing. The Complainant has appealed this decision of the
Austrian DPA in the Austrian courts, resulting in the Austrian Proceedings.

2.25 The Complainant made similar arguments in its submissions to the Investigator, 278 and specifically
argues that the applicable procedural law is the Allgemeines Verwaltungsverfahrengesetz (“the
AVG”), Austria’s code of administrative procedure. It is the Complainant’s view that the AVG
permits the alteration of the scope of a procedure in particular circumstances, and seeks to rely on
this in order to dispute the Investigator’s view of the scope of the Complaint, and to alter that scope.
My decision on procedural matters relating to the scope of the Complaint is considered in detail
below, and at this point I am solely considering the applicability or otherwise of the AVG to the
actions of the Commission in general.

2.26 As the decision-maker at the Commission, I take no view on the Complainant’s characterisation of
the AVG or of any other questions of Austrian law. The Commission was established in Ireland by
the 2018 Act, thereby meeting Ireland’s obligations to establish such an authority under Article 51
(and Chapter VI generally) GDPR, given it is directly applicable in Ireland pursuant to Article 288 of
the Treaty on the Functioning of the European Union. Section 12 of the 2018 Act provides a number
of functions for the Commission “in addition to the functions assigned to the Commission by virtue
of its being the supervisory authority for the purposes of the Data Protection Regulation”.

2.27 Chapter VI of the GDPR sets out in detail the responsibilities and powers of supervisory authorities.
While it is not necessary to set out Chapter VI here, it is noteworthy that Article 51(1) GDPR states
that “[e]ach Member States shall provide for one or more independent public authorities to be
responsible for monitoring the application of this Regulation” [my emphasis]. Moreover, Section 12

278
Complainant Submissions of 9 September 2019, paragraph 1.1.
370

of the 2018 Act does not confer any powers on the Commission in respect to the laws of any other
jurisdiction.

2.28 The powers of the Commission must be limited to those conferred on it by law. The Commission is
tasked with encouraging, monitoring and enforcing compliance with the GDPR. In that context it is,
like all other public authorities in the State, bound by the administrative law of Ireland and EU law,
including EU law on fair procedures and the European Charter of Fundamental Rights and Freedoms.
Further, as I stated above, Article 56(1) GDPR sets out that “the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be competent to act
as lead supervisory authority”.

2.29 The Commission therefore derives its legal authority to handle the Complaint from the GDPR and
the 2018 Act, and is, in that regard, bound by the legal order set out above. The Commission is not
bound, nor must it have regard to, the administrative law of Austria, or of any other jurisdiction.
Moreover, it seems to me that not only does the administrative law of Austria not bind the
Commission, but that any attempt by the Commission to apply such law would be plainly ultra vires
the powers conferred on the Commission by law.

2.30 The parties were afforded an opportunity to address the provisional conclusions reached in the
Schedule to the Preliminary Draft Decision. In making the argument that this position was “an
archaic and purely nationalistic idea of international law”, the Complainant’s submissions advance
the position that, while the Commission operates under Irish and EU law, it must at times interpret
the AVG. This is said to include interpreting and applying Austrian law in order to determine the
scope of the complaint.279 It is also argued that the Commission has failed to cooperate with the
Austrian DPA by asking for clarifications on the nature of the law.

2.31 To address the latter issue first, the Commission has cooperated in full with the Austrian DPA
throughout this Inquiry.

2.32 In relation to the possible application of Austrian procedural law, at no point do the Complainant’s
submissions point to any legal authority for the proposition that the Commission must interpret and
apply aspects of Austrian procedural law to this Complaint, beyond the citation of the provisions of
Austrian law themselves which are said to be relevant. The Commission has not sought clarifications
on Austrian procedural law given the Commission does not accept, and has not been presented with
any legal authority for, the suggestion that it must apply, interpret, or in any way consider the
procedural law of Austria.

2.33 No further distinct argument was made to elaborate on why Austrian law would be applicable to any
procedure being conducted by an Irish supervisory authority in Ireland. The Commission is
established under Irish law, specifically the Data Protection Act 2018, and must exercise its functions

279
Complainant submissions on Preliminary Draft Decision, page 7.
371

under and in accordance with the 2018 Act and applicable EU law, including, in particular, the GDPR.
This being so, I find that I am not obliged to apply Austrian procedural law in the exercise of my
functions in this Inquiry. Indeed, it must be open to doubt whether the Commission would ever
have jurisdiction or competence to do so.

ALLEGATION OF BIAS

2.34 As has been set out above, the Complainant wrote to the Investigator on 3 December 2018 raising a
number of procedural issues, including an allegation of bias on the part of the Commission, which I
will address here. I will subsequently address the Complainant’s allegation that the manner in which
the Commission dealt with the scope of the Complaint was contrary to its right to fair procedures,
before considering the substantive question of the scope of the Complaint under examination.

2.35 In the letter dated 3 December 2018, the Complainant alleged that there had been prior “approval”
by the Commission of the legal bases used by Facebook for processing personal data. This was
based in part on a statement made in Vienna’s Landesgericht (Regional Court) that the “used legal
basis for the processing of data under GDPR was developed under extended regulatory
involvement by the [Commission] in multiple personal meetings between November 2017 and July
2018”. 280 In the letter, the Complainant stated that “[t}his does not just raise questions about your
claim that you have to “investigate” and “inquire” [sic.] this matter – when in fact you have already
negotiated with the Facebook Group about these legal and factual questions between 2017 and
2018, but raises issues about an obvious bias of a decision maker that has previously approved the
criticized mechanism.” 281

2.36 In the same letter, the Complainant referred to the existence of a rule against bias in both Ireland
and in Austria, but did not elaborate on its legal views of the nature of the test in either
jurisdiction, and did not present any arguments explaining why, in its view, the Commission had
acted in a manner that contravened any such test. Moreover, the Complainant offered no
evidence to substantiate the factually inaccurate claim that the Commission “previously
approved” the “mechanism” in question or to substantiate the allegation that the consultation
process gave rise to the apprehension of bias.

2.37 The Investigator responded to this and other allegations in a letter dated 16 January 2019. The
Investigator correctly observed that the allegations of bias were unsubstantiated, and confirmed
that “[the Commission] does not and never has, endorsed, jointly developed, approved or in any
other way assented or consented to a controller’s or processor’s policies or position in relation to
compliance with its data protection obligations.” It was clarified that the interactions referred to
by the Complainant were for the purpose of “being updated…and being providing high level

280
Case 3Cg52/14k at the LGfZRS Wien, paragraph 209.
281
Letter from Complainant to Commission 3 December 2018.
372

feedback” to both Facebook and to a large number of other private and public sector
organisations with which the Commission interacts as part of its “consultation and engagement
with regulatory stakeholders.” I agree with the Investigator’s view just set out, for the reasons
which I have set out above.

2.38 I also note and agree with the Investigator’s statement in the same letter that outlined the
Commission’s statutory obligations under the Data Protection Acts 1988 and 2003, which were in
force at the time. This also applies, as was pointed out by the Investigator, under Article 57 GDPR.
The Commission implements these obligations to promote awareness of data protection law by
maintaining an active consultation function. The Investigator also clarified that the Commission
“makes it abundantly clear to any organisation that seeks to consult with it that this is the premise
upon which consultation takes place and that it is entirely a matter for that organisation to ensure
that it is in compliance with data protection law.” This is, in my view, an accurate characterisation
of the position. In a subsequent telephone call with staff of the Commission on 25 January 2019,
Mr. Schrems, raised the matter of bias once again. At this point, a Deputy Commissioner at the
Commission, reiterated the DPC’s position, in this regard, to Mr. Schrems. 282

2.39 This issue of bias was not raised again until the Complainant furnished the Investigator with
submissions on the Draft Report dated 9 September 2019. For the sake of completeness, the
entirety of the Complainant’s submission, in this regard, is set out below:

“Since it follows from Facebook's submission (e.g. page 2 of the submissions of 27. 9. 2018)
that the Irish DPC even worked out (!) the procedure criticised in the complaint together with
Facebook in ten sessions, the problem of bias is once again drawn to attention.

It seems difficult to imagine, for example, that the authority could make use of its power to
issue penalties if it had worked on the punishable conduct with Facebook in advance. This also
gives rise to a potential conflict with the GDPR, which provides in Article 83(1) for "effective,
proportionate and dissuasive" penalties.

We do not yet know how the Irish authority intends to take case [sic.] of this problem and we
expressly reserve the right to appeal any decision on this basis.” 283

2.40 As is evident from this quotation, the Complainant offered no specific evidence in respect of this
unsubstantiated allegation that “the Irish DPC even worked out(!) the procedure criticised in the
complaint together with Facebook”. Moreover, no reference is made to the Commission’s
clarification that no approval or authorisation for the Terms of Service was provided to Facebook

282
Memorandum of phone call, 25 January 2019.
283
Submissions of Complainant 9 September 2019, pages 6-7, paragraph 1.8.
373

by the Commission. The premise of the Complainant’s argument, as had already been pointed out
by the Investigator, is incorrect. The reference to “meetings” in Facebook’s submissions cited by
the Complainant in the above quotation is the only reference to the Commission’s consultation
function in any submissions made by Facebook in relation to this Inquiry. The reference is as
follows:

“We have drafted this response against the background of our detailed direct engagement
with the Commission prior to the implementation of the recent update to our terms, spanning
10 meetings, which covered many of the issues responded to herein. Facebook Ireland has not
materially changed its compliance approach since these meetings.”

2.41 It is clear that this is a reference to a consultative process, and at no point does Facebook assert that
the Terms of Service were approved or endorsed by the DPC; it is merely asserted that these
Terms of Service have not changed since a consultation process took place. Facebook would of
course not be entitled to rely on remarks made in such meetings. In addition, it is not clear to me
how Facebook can be said to be using the above statement to support its legal position, or indeed
any argument, in relation to the Inquiry. For the purpose of providing additional context, I also
emphasise that this quotation is taken from a two-page covering letter preceding submissions to
the Commission in the context of the Inquiry as opposed to being extracted from the body of such
submissions to the Commission.

2.42 Finally, this matter was raised, indirectly, in the form of an “open letter” published by NOYB and sent
to other European Data Protection Authorities and to the European Data Protection Board (“the
EDPB”). In this letter, public allegations were made about the Commission’s cooperation with
what the Complainant calls Facebook’s “consent bypass”. 284 To the extent that this letter directly
addresses the allegation of bias at all, it once again proceeds on the false factual premise that that
Facebook “simply followed the [Commission]’s advice.” It is further alleged that this renders the
Commission’s processes “structurally biased because it is essentially reviewing its own legal
advice”. It has already been clarified above that, contrary to this assertion, the Commission did
not approve any such mechanism, nor did it provide legal advice to Facebook. It has also been
clarified that Facebook has in fact not sought to rely on such consultations in this Inquiry.

2.43 In the open letter, it was alleged that “[k]eeping these meetings confidential is only adding to the
impression that the [Commission] and Facebook have engaged in a relationship that is
inappropriate for a neutral and independent oversight authority.” 285 Aside from the fact that the
Commission’s consultation function is widely publicised, such an allegation has no basis in law.
The relevant facts have been provided to the Complainant by the Commission on multiple
occasions, and a reasonable and objective explanation of those facts has been provided to the
Complainant by the Commission on multiple occasions.

284
Open letter of NOYB, page 3, https://noyb.eu/sites/default/files/2020-05/Open%20Letter_noyb_GDPR.pdf.
285
Ibid.
374

2.44 It is factually not the case that the Commission endorsed or approved of the Terms of Service and
Data Policy of Facebook or indeed of any other organisation. Moreover, irrespective of any
feedback that may or may not have been provided to Facebook or any other organisation, the
Commission always emphasises that the consultation function is entirely distinct from any
statutory inquiries, investigations, or decisions of the Commission. I also emphasise that this
decision-making process is also functionally independent of the procedure conducted by the
Investigator that led to the Final Report, just as the statutory inquiries are functionally
independent from any and all consultations with the Commission. The factual premise of the
allegation is incorrect, and the test for bias has not been met.

2.45 The parties were afforded an opportunity to address the provisional conclusions reached in the
Schedule to the Preliminary Draft Decision. The Complainant disagrees that no evidence of bias
has been provided, and points to a statement made in an Austrian court by a representative of
Facebook. That statement consists of the quotation in paragraph 2.32 above. I have set out my
views on that statement. The Complainant goes on to argue that “[t]he DPC has also never
provided any evidence, memo or other evidence to substantiate its claims that these meetings did
not have the substance that Facebook alleged”. 286 This does not in any way the substantiate the
serious allegation of bias made by the Complainant.

2.46 Firstly it has not been denied by the Commission or Facebook that “these meetings did not have the
substance that Facebook alleged”. The presence of engagement and consultation does not of
course, in and of itself, suggest approval of any kind. Any decision by Facebook, or an individual
employee of Facebook, to reference such meetings in the context of defending particular practices
is a matter for Facebook. In this regard, it is relevant to note that the Commission is not party to
the Austrian proceedings referred to by the Complainant. To the extent that Facebook seeks to
rely on or has ever relied on any consultative process with the Commission in order to defend the
lawfulness of a particular practice, this has been in error. More pertinently, for present purposes,
Facebook makes no such argument in the context of this Complaint. This is because the
Commission never provided any such approval in this case nor does it do so in the context of its
engagement and consultation role more generally. Unfortunately the Complainant and/or her
representative has chosen to rely on one specific isolated statement – in proceedings to which
the Commission is not a party - and to make assumptions on the basis of that statement which
do not correspond to the factual position. In circumstances where the allegation of bias has not
been substantiated, I must reject that allegation.

2.47 I am therefore satisfied that fair procedures have been followed in this and every regard thus far
throughout the Inquiry.

3. THE SCOPE OF THE COMPLAINT AND INQUIRY

286
Complainant Submissions on Preliminary Draft Decision, page 8.
375

PROCEDURAL ISSUES SURROUNDING THE SCOPE OF THE COMPLAINT

3.1. The question of scope is also considered in the main body of this Decision, and therefore this section
is to be read in conjunction with the Decision. The Complainant also alleged that in determining
the scope of the Complaint and in not allowing the Complainant to revise the scope of that
Complaint, the Commission was acting contrary to the Complainant’s right to fair procedures. In
the letter dated 3 December 2018, the Complainant specifically articulated its view that it
objected to a “one shot” approach, and instead argued it should be afforded the opportunity to
respond to Facebook’s views on the Complaint. These arguments were necessarily linked to the
Complainant’s assertion of a right of access to all of Facebook’s submissions to the Commission in
respect of this Complaint, an issue which has now been disposed as these submissions have been
shared with the Complainant on a voluntary basis, as described above. The Complainant sought
to advance the argument that the Commission should engage in an openended inquiry into each
individual processing operation carried out by Facebook.

3.2. In response, in the letter dated 16 January 2019, the Investigator informed the Complainant that:

“the DPC has identified two main issues (each with associated sub-issues for consideration,
as detailed in our most recent communication to you) which are the primary focus of that
statutory inquiry. The DPC considers that all data protection matters raised in your
complaint fall within these two main issues, as set out in detail in our letter dated 23
November 2018. As such the DPC’s position is that the scope of the current inquiry captures
all elements of the Facebook complaint.”

3.3. This matter was not raised again until the Complainant contacted the Investigator by email on 23
March 2019 seeking an update on the status of the Complaint. The Investigator responded by
letter dated 28 March 2019. This letter outlined the procedure that would be followed going
forward, and the Investigator also reaffirmed that “the DPC notified NOYB of its view concerning
the scope of inquiry C-18-5-5.”

3.4. The Complainant wrote to the Investigator by letter dated 19 April 2019, and addressed the issue of
the scope of the Complaint further. The Complainant stated that “we reserve the right to amend
our arguments should one of the controllers seek to depart from the factual or legal premises our
complaints were based on.” It was also emphasised, in that regard, that “the complaints explicitly
states that the complaints are based on our knowledge at the time of submission”. Contrastingly,
Facebook argued that the Complaint’s scope should be strictly limited to processing that was
Facebook processed on foot of consent.

3.5. In the Draft Report, the Investigator relied on a statement in the Complaint which read:

376

“For practical reasons, the scope of this complaint is explicitly limited to any processing
operations that are wholly or partly based on Article 6(1)(a) and/or Article 9(2)(a) of the
GDPR. Our current understanding is, that these are used as bases for all processing
operations described in the controller’s privacy policy…” 287

3.6. The Investigator went on to consider in detail the contents of the Complaint, including its focus on
the Complainant’s view that all data processing pursuant to the data subject’s acceptance of the
Terms of Service was based on consent. 288 The Investigator also set out that, in the words of the
Complainant, the Complaint rested on a “preliminary assumption” that all processing carried out
pursuant to the Terms of Service was based on consent or, alternatively, that all processing based
on these documents “simply has no legal basis”. 289 The Investigator observed that the legal
analysis in the Complaint was confined to the issue of consent. 290

3.7. Having outlined the scope, the Complaint then states that “[n]evertheless, nothing in this complaint
shall indicate that other legal bases the controller may rely on are not equally invalid or may not
be equally the subject of subsequent legal actions.” 291 This qualifying remark, while alluding to the
fact that the Complainant may have other views in relation to other legal bases for data processing
carried out by Facebook, is evidently not one that describes the character of the Complaint in
question. While such a remark clearly refers to hypothetical positions the Complainant may have
or take in the future, it cannot alter the limiting character of the preceding statement in and of
itself. It instead clarifies that the Complainant reserves its position in respect of any other legal
bases on which Facebook may or may not rely.

3.8. Having taken an objective reading of the Complaint, the Investigator concluded that the issues that
arose were:

• Issue (a): the acceptance of the Terms of Service and/or Data Policy was an act of consent;
• Issue (b): Facebook cannot lawfully rely on necessity for the performance of a contract to
process data arising out of the data subject’s acceptance of those same documents;
• Issue (c): Facebook misrepresented the legal basis for processing this data; and
• Issue (d): Facebook failed to provide the necessary information regarding its legal basis
for processing this data.

3.9. In its submissions on the Draft Report, the Complainant argued that “the DPC believes it
can exclude certain questions from the proceedings and arbitrarily determine a scope of
procedure

287
Complaint, paragraph 1.6.
288
Draft Report, Page 5.
289
Ibid, page 6.
290
Ibid, page 7.
291
Complaint, Paragraph 1.6.
377

based on the hypothetical or guessed will of the complainant”. 292 The assertion was made that
“[i]t is also not alien to Irish procedural law that a request may be amended if, based on the
defendant's submissions, another alleged legal basis for data processing arises.” 293

3.10. The Investigator gave consideration to these submissions and ultimately did not revise his
view. 294 Facebook also remained of the view that, contrary to both the view of the
Investigator and the Complainant, the Complaint should be strictly limited to data
processing carried out, as a matter of fact, on the basis of consent. 295 The Investigator
found that it was not necessary to engage in a factual “trawl” of each one of Facebook’s
processing operations, but instead to carry out a legal and factual analysis based on the
objective content of the Complaint itself. 296 This was not based on an assessment of the
“will” of the Complainant, hypothetical or otherwise, but simply on an assessment of the
content of the Complaint.

3.11. In submissions on the Schedule to the Preliminary Draft Decision, the Complainant
maintained this position. Not only were further arguments made in support of the
argument that the Commission has breached the Complainant’s right to fair procedures
by misinterpreting the scope of the Complaint, but the Complainant’s submissions also
accuse the Commission of either “simply not understand[ing] or read[ing] large parts of –
or, as it seems to us wilfully mischaracterises the submissions of the Complainant”. 297
These most serious accusations are refuted by the Commission in the strongest of terms.
For the avoidance of doubt, the Commission has given full consideration to all relevant
material, including, but not limited to, all submissions made by the Complainant. The
Commission also rejects the unfounded accusations of mala fides that are made in the
alternative in this regard.

3.12. The Complainant also relies on Austrian procedural law in the submissions on the
Preliminary Draft Decision in order to argue that the Complaint should be interpreted in
a particular manner. In this regard I reiterate that there is no legal authority for the
proposition that the Commission is bound to interpret and apply Austrian procedural law
to the Complaint, and further note that the Complainant has been unable to produce such
authority despite having ample opportunity to do so. In particular the Complainant argues
that the core of the Complaint’s scope is the “remedy” being sought, i.e. a ban on all
processing carried out on foot of the “consent bypass”.330 It goes without saying that in

292
Submissions of 9 September 2019, page 5, paragraph 1.3.
293
Ibid.
294
Final Report, page 18.
295
Ibid, page 11.
296
Ibid, page 13.
297
Complainant Submissions on Preliminary Draft Decision, page 5.
330
Ibid, page 8.
378

order for such a ban to become relevant to any procedure, there must be a finding of a
breach of the GDPR on the basis alleged in the first instance. This is why the first step in
any such analysis involves considering the infringement in advance of this proposed
“remedy”.

3.13. The Commission, in the Preliminary Draft Decision, considered the allegation that an
infringement is taking place in the form of unlawful processing arising from the alleged
consent bypass. The Commission has considered further submissions from the Parties in
this regard, and formed a view in the Draft Decision. It is difficult to see how the absence
of the exercise of a particular corrective power, which necessarily can only be imposed if
the Commission finds that an alleged infringement has made out, can be characterised as
a failure to deal with the entire scope of a Complaint.

3.14. The Complainant also alleges that it has been unable to respond to Facebook’s “defence”.
The Complainant submits that there has been no opportunity to respond to Facebook’s
argument that it actually relies on a different legal basis for processing personal data to
the one the Complainant thought it relied on. 298 On the contrary, the Complainant has
made extensive submissions on this argument that has been put forward by Facebook,
both in its submissions on the Draft Report and in its submissions on the Preliminary Draft
Decision. Contrary to what is argued on the Complainant’s behalf, no dispute has been
“removed” from scope. Both legal bases that have arisen over the course of this Inquiry
are fully considered in the Decision, as they were considered in the Preliminary Draft
Decision.

3.15. I must make an assessment as to whether the Complainant’s specific allegations of
procedural unfairness in how this was addressed by the Commission thus far have merit.
In the “open letter” to which I have already referred, the Complainant alleged that “the
Investigator departed from the applications that were made in accordance with Austrian
procedural law and decided to investigate only certain elements of our complaint and to
reinterpret our requests.” 299

3.16. It does not seem to me that the above quotation is an accurate characterisation of what
has taken place. I have already (as had the Investigator) set out views on why Austrian
procedural law does not apply to the activities of the Commission. The merits or
otherwise of the Investigator’s objective analysis of the content of the Complaint is
addressed later in this section. I do not accept, however, that there is, in principle, a
procedural defect in limiting the scope of a complaint-based inquiry to the objective
contents of the very Complaint that led the Commission to conduct an Inquiry. As well as

298
Ibid, paragraph 3.4.1.
299
Open letter, page 6 https://noyb.eu/sites/default/files/2020-05/Open%20Letter_noyb_GDPR.pdf.
379

conforming to Section 113 of the 2018 Act (set out earlier in this Section of the Schedule),
this approach is perfectly logical.

3.17. The Complainant’s arguments in relation to any alleged procedural defects in the manner
in which the scope of the Complaint is to be determined, i.e. by the objective content of
the Complaint, are based on Austrian Administrative law, and particularly on the AVG.
Insofar as that those arguments are based on Austrian law, for reasons already set out,
the Commission cannot consider those arguments, save to the extent that they raise
issues of either Irish or EU law. I note
that Facebook did not make submissions on the issue of the applicability or otherwise of the AVG
during this Inquiry.

3.18. Moreover, as I have set out, the decision to conduct a complaint-based Inquiry arising out
of the contents of a Complaint seems to me to be a perfectly logical approach. The
alternative would be an open-ended procedure, where the content of a “complaint”
would crystallise at some unspecified future date. The inherent problem with such an
approach is that it would not amount to an inquiry based on the Complaint which was
lodged with the Commission, but would instead be an inquiry directed by the
Complainant, with its subject matter and steps dictated on an evolving and ongoing basis
by the Complainant. Furthermore, it is unclear how it could be said that such an approach
constitutes a complaint that concerns personal data relating to the complainant. This
would presumably only occur once a complainant is satisfied of receipt of all information
they might require, and has been afforded the opportunity to amend the complaint itself
based on the submissions of the other party.

3.19. The unfairness that could arise from such an approach stems from the fact that it would,
in effect, enable a form of post-hoc amendment to an existing complaint over the course
of an indefinite period of time, which could only come to an end at a time and in a manner
of the Complainant’s choosing. This would not only amount to a fundamentally one-sided
approach, but would also alter the character of the inquiry to the extent that it could no
longer be described as “complaintbased”, but rather “complainant-led”.

3.20. This also applies to aspects of the Complaint that either reserve the Complainant’s
position or express views on hypothetical investigative and/or corrective powers that, in
the Complainant’s personal view, the Commission should exercise. I see no breach of fair
procedures in considering the Complaint as a whole in order to determine the exact
infringements being alleged. There is no procedural right to make generalised requests to
the Commission to either conduct broadbased investigations or exercise particular
corrective powers in the context of a complaint. In any case, as I have also set out above,
the question of a “remedy”, here a ban on processing (which now is said by the
Complainant to be at the core of the Complaint), can only arise when a particular
infringement involving unlawful processing has been made out.
380

3.21. The Complainant, having lodged the Complaint via the Austrian DPA, responded to the
Draft Report, which set out clearly the submissions of Facebook and the Investigator’s
views on same. The Complainant will also be afforded the opportunity to make
submissions on the Preliminary Draft Decision. No suggestion has been made that the
alternative procedure proposed by the Complainant is a requirement of Irish law, nor that
the procedure that has been followed in relation to the scope breaches any rules of fair
procedures in Irish law. Moreover, I am unaware of any case law or statutory provisions
in Irish law or EU law that suggests that such an approach is contrary to the Complainant’s
right to fair procedures, and the Complainant has not referred to any such law in its
submissions.

SUBSTANTIVE SCOPE OF THE COMPLAINT

3.22. Put in high-level terms, this complaint-based Inquiry concerns the requirement under EU data
protection law for any entity collecting and processing personal data to establish “a lawful basis”
for the processing under Articles 6 GDPR. This particular Complaint was lodged by reference to
Facebook and its lawful basis for processing user personal data and “special category” personal
data. I have set out, in summary form, the contents of the Complaint and arguments contained in
it at Section 2 of this document.

3.23. “Personal data” is defined under Article 4(1) GDPR as:

“any information relating to an identified or identifiable natural person (‘data subject’);
an identifiable natural person is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an identification number, location
data, an online identifier or to one or more factors specific to the physical, physiological,
genetic, mental, economic, cultural or social identity of that natural person”.

3.24. Moreover, Article 4(13) GDPR defines the “genetic data” referred to above as:

“personal data relating to the inherited or acquired genetic characteristics of a natural
person which give unique information about the physiology or the health of that natural
person and which result, in particular, from an analysis of a biological sample from the
natural person in question”.

3.25. Article 4(14) GDPR defines “biometric data” as:

“personal data resulting from specific technical processing relating to the physical,
physiological or behavioural characteristics of a natural person, which allow or confirm

381

the unique identification of that natural person, such as facial images or dactyloscopic
data”.

3.26. Finally, “data concerning health” is defined by Article 4(15) GDPR as:

“personal data related to the physical or mental health of a natural person, including the
provision of health care services, which reveal information about his or her health status”.

3.27. The other special categories or personal data referred to in Article 9 GDPR are not defined in the
GDPR.

3.28. As set out above, Article 6 GDPR sets out the lawful bases for the processing of personal data. The
provisions of Article 6 that arise in this complaint-based Inquiry are the first two lawful basis listed
in the Article, in Articles 6(1)(a) and 6(1)(b) GDPR. Article 6(1) GDPR states:

“6. 1 Processing shall be lawful only if and to the extent that at least one of the following
applies:

(a) the data subject has given consent to the processing of his or her personal data
for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data
subject is party or in order to take steps at the request of the data subject prior to entering
into a contract;

(d) processing is necessary in order to protect the vital interests of the data subject or
of another natural person;

(e) processing is necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the
controller or by a third party, except where such interests are overridden by the interests
or fundamental rights and freedoms of the data subject which require protection of
personal data, in particular where the data subject is a child.

Point (f)f the first subparagraph shall not apply to processing carried out by public
authorities in the performance of their tasks.”

3.29. A number of conditions for consent are enumerated in Article 7 GDPR:

382

“1. Where processing is based on consent, the controller shall be able to demonstrate that
the data subject has consented to processing of his or her personal data.

2. If the data subject’s consent is given in the context of a written declaration which
also concerns other matters, the request for consent shall be presented in a manner which
is clearly distinguishable from the other matters, in an intelligible and easily accessible
form, using clear and plain language. Any part of such a declaration which constitutes an
infringement of this Regulation shall not be binding.

3. The data subject shall have the right to withdraw his or her consent at any time.
The withdrawal of consent shall not affect the lawfulness of processing based on consent
before its withdrawal. Prior to giving consent, the data subject shall be informed thereof.
It shall be as easy to withdraw as to give consent.

4. When assessing whether consent is freely given, utmost account shall be taken of
whether, inter alia, the performance of a contract, including the provision of a service, is
conditional on consent to the processing of personal data that is not necessary for the
performance of that contract.”

3.30. Article 13(c) GDPR requires data controllers to provide information to data subjects on
“the purposes of the processing for which the personal data are intended as well as the
legal basis for the processing”.

3.31. Article 12(1) GDPR requires that “[t]he controller shall take appropriate measures to
provide any information referred to in Articles 13 and 14…to the data subject in a concise,
transparent, intelligible and easily accessible form, using clear and plain language…”.

3.32. Unusual circumstances arise in relation to this Complaint because of its very starting-
point, namely, the assertion that clicking on Facebook’s Terms of Service purported to
bring all personal data processing under the lawful basis of consent for the purposes of
Article 6(1)(a) GDPR. This starting point was rejected in Facebook’s submissions. While
the Investigator did not agree with the entirety of Facebook’s submissions by any means,
he also rejected this premise. I also rejected it in the Draft Decision. This rejection of the
foundational premise of the Complaint has inevitably rendered the overall subject-matter
of the Complaint effectively less cohesive.

3.33. The Complaint also refers to processing of special category data covered by Article 9
GDPR. The Complainant’s submissions on the Draft Report make further arguments in this
regard, particularly in relation to medical data and in relation to special category data
processed by Facebook on the consent of the user (such as facial recognition data).
Facebook’s position is that it does not process any special category data arising out of the

383

acceptance of the Terms of Service, but only arising from data for which consent is
specifically sought.

3.34. In the Draft Decision, I expressed the view that, for the reasons set out above and the
additional reasons set out below where I make conclusions on the scope of the Complaint,
the Complaint even taken at its height quite clearly only concerns data processing arising
out of accepting the Terms of Service. The Complainant’s central arguments on “forced
consent” are predicated on the assertion by the Complainant that accepting the Terms of
Service is forcing a consent to personal data processing for the purposes of the GDPR.
Moreover, the Complainant’s representative has made clear that it views the core of the
Complaint as asking for a ban on the processing of data being processed on foot of the
“consent bypass”. In order to establish an entitlement to such a remedy, it must be
established that accepting the Terms of Service results in unlawful data processing.
Whether one focuses on the acceptance of the Terms of Service or on the remedy sought,
the lawfulness of the processing arising from this acceptance, either pursuant to consent
under Article 6(1)(a) GDPR or necessity for the performance of a contract under Article
6(1)(b) GDPR, was, in my view, clearly at the heart of this Complaint.

3.35. I did not however, in the Draft Decision, accept that the processing of sensitive categories
of personal data on the basis of Article 9 GDPR consent fell within the scope of this Inquiry.
Facebook undoubtedly does process special category data on the basis of explicit consent
under Article 9 GDPR on its platform including in terms of the separate consent collected
for its facial recognition feature. I expressed the view, in the Draft Decision, that the
Complaint was one about whether the Terms of Service (which is the contract with the
user) are a deliberately veiled and inadequate means of forcing consent under GDPR, or
whether they are, as Facebook contends, a contract with the user for which certain data
processing is necessary in order to perform that contract.

3.36. The Complaint considered Article 9 GDPR in circumstances where the Complainant was
of the view that consent was being sought to process personal data (including special
category data). It subsequently came to light that Facebook relied on Article 6(1)(b) GDPR
for the processing complained of. The Complainant has presented no evidence to suggest
that any of this processing carried out on foot of Article 6(1)(b) GDPR involves processing
special category data. As this legal basis is not contained within Article 9 GDPR, such
processing would obviously be unlawful if it were taking place. It is denied by the
controller that such processing is taking place, no evidence has been presented that it is
taking place, and no allegation has been made that it is taking place (aside from in the
context of the Complainant’s initial mistaken view that the processing complained of is
based on consent). I therefore was unable to see, when preparing the Draft Decision, how
Article 9 GDPR properly remained within the scope of this Complaint as it is now
understood by the Parties. As set out in paragraph 2.23 of this Decision, the EDPB, in the
Article 65 Decision, took a different view, on this particular issue.
384

3.37. Having reviewed and considered all of the material submitted by the Complainant, I
concluded, in the Draft Decision, that the core of the issues raised by the Complainant
were as follows:

a. Accepting the Terms of Service offered by Facebook in April 2018 specifically constituted
an act of consent to personal data processing under the GDPR. The precise extent of the
processing complained of is unclear in the Complaint. A particular focus was, however,
placed on both processing in order to deliver behavioural advertising, and on special
category data. The Complainant takes issue with any unlawful processing based on this
agreement, whatever that agreement’s legal character might be. 300

b. The Complainant argues that 6(1)(a) GDPR, i.e. consent, is the mandatory, default lawful
basis for personal data processing where there is a contract or agreement primarily
concerned with personal data processing. 301

c. Consent under the GDPR is simply an indication of agreement by the data subject
according to the Complainant. The necessary attributes of freely given, specific, informed
and unambiguous are merely “conditions for its validity”, but not features of objective
“consent”.

d. As an alternative to point (a), Facebook is not entitled to rely on the “necessary for the
performance of a contract” legal basis under Article 6(1)(b) GDPR other than for very
limited processing such as friends lists, photo albums, profiles and news. It therefore
cannot rely on this as an alternative legal basis to consent for the acceptance of the Terms
of Service as a whole. In this regard, the Complainant argues that the “purpose” of the
contract (here, to deliver a social media service) must be considered.

e. On the basis of all of the above, the Complainant contends that clicking accept on
Facebook’s Terms of Service was an attempt by Facebook to seek consent under the GDPR
- just not valid consent. The Complainant describes this as “forced consent”, in that the
only choice a user had in April 2018 was to delete their Facebook account, and “hidden
consent”, in that some of the description of the Facebook service in the Terms of Service
(such as personalisation) implicitly relies on processing of personal data.

300
Complainant Submissions on Preliminary Draft Decision, paragraph 3.4.3.
301
The Complainant characterises this as a “straw man argument” in the paragraph cited ibid. It is instead argued
that the position is that “when interpreting an agreement that is primarily concerned with one party agreeing to
allow the processing of personal data, such an abandoning of the Complainant’s right to data protection must
logically be interpreted as being a “consent” in nature.” The Commission sees this as arguing precisely what is
contained in the above paragraph i.e. where there is an agreement primarily concerned with processing data, that
agreement must be interpreted as consent. On that basis this characterisation of the Complaint is retained herein.
385

f. The Complainant contends that Facebook leads data subjects to believe that it relies on
consent as lawful basis for personal data processing and/or is not transparent about its
lawful bases for processing personal data.

3.38. On the counter side to this, Facebook argues that it forms a contract with its users for the
use of its free service. The Commission observes that this is delivered in the form of a
“Click Wrap” agreement that the user signs up to when clicking “Accept” on the Terms of
Service and it looks similar to an industry standard format for such agreements. Its
intention was, Facebook says, to rely on the legal basis of Article 6(1)(b) GDPR (necessary
for the performance of a contract) for processing carried out on foot of the acceptance of
the Terms of Service (and, for other separate processing, it would rely on legitimate
interest and consent).

3.39. In this regard, it claims that the processing is necessary for the performance of the
contract with the user and that the Data Policy further sets out, in more detail, the other
legal bases that would be relied upon for other data processing operations. These bases,
as I have said, included a reliance on consent for certain operations (such as facial
recognition, where special category data is processed). Facebook rejects the idea that it
sought to persuade users that consent was the legal basis for all personal data processing.
It further accordingly rejected the Investigator’s analysis of whether valid consent was
collected at the point of acceptance of the Terms of Service, on the basis that Facebook
never sought to rely on consent.

3.40. The Investigator, for his part, took the Complaint at face value and on its literal terms and
analyses each of the arguments made by the Complainant in the original Complaint
submitted. This seemed to me, when preparing the Draft Decision, to have been a sensible
and correct approach. This was not an “own volition” Inquiry where the Commission was
entitled to scope matters of risk which it decided warranted investigation. While it is
normally the role of the Investigator to focus on the establishment of facts, to set out
what elements of the GDPR are engaged against those facts, to come to a preliminary
view on whether there are likely infringements identified which will then be the subject
of further legal analysis and ultimately decision-making by the Commission, this case is
somewhat different.

3.41. By reference to the above approach, the facts to be established are fairly limited and are
largely relating to the wording of Facebook’s Terms of Service and its Data Policy, and the
design of its User Engagement Flow introduced in April 2018 to guide users through the
process of accepting the updated Terms of Service. In fact, it appears to me that the
Investigator ended up devoting time responding to legal and theoretical assertions of the
Complainant, such as the argument that consent is a lex specialis and therefore the
mandatory legal basis where a contract primarily concerns personal data processing.
386

Consequently, the Final Report contains more legal analysis and argument than might
otherwise have been the case (relative to a draft decision). I have considered all of the
analysis of the Investigator carefully and, in some instances, I adopt it and concur with it.
In other instances I reject it, replace it, and explain why.

3.42. Another feature of the Complaint is a section entitled “Applications”. In this section, the
Complainant requests an investigation of a very specific nature, and sets out the
corrective powers that the Complainant believes should be imposed i.e. an administrative
fine and a prohibition on the “relevant processing operations”. This section asks the
Commission to:

“fully investigate this complaint, by especially using its powers under Article 58(1)(a), (e)
and (f) of the GDPR, to particularly determine the following facts:
(i.) which processing operations the controller engages in, in relation to the personal data
of the data subject,
(ii.) for which purpose they are performed,
(iii.) on which legal basis for each specific processing operation the controller relies on and
(iv.) he/she additionally requests that a copy of any records of processing activities (Article
30 of the GDPR) are acquired.”

3.43. The right to lodge a complaint with a supervisory authority is governed by Article 77 GDPR.
Article 77(1) states how a complaint may be made: “every data subject shall have the right
to lodge a complaint with a supervisory authority…if the data subject considers that the
processing of personal data relating to him or her infringes this Regulation” [emphasis
added]. Neither the request above, nor a request to impose specified corrective powers,
can be considered to constitute part of a complaint made in accordance with Article 77(1)
GDPR. The Complainant does not specify any processing operations or any alleged
infringements of the GDPR in the above request, but simply asks the Commission to
gather information on its behalf. Neither the GDPR nor the 2018 Act confer a particular
right on a Complainant to make such a request, nor to specify what corrective powers
should be imposed in circumstances where the supervisory authority is of the view that
an infringement has occurred/is occurring. The Complainant, as I have already set out,
also argues the right to demand such “applications” is part of Austrian procedural law. I
have already set out in detail why I do not accept that Austrian procedural law is
applicable to the exercise of my functions.

3.44. In those circumstances, it was for the Investigator, and ultimately for me as decision-
maker, to carry out an objective reading of the Complaint. In so doing, I must consider not
only the content of the Complaint, but also the legal framework by which the Commission
is bound. It is also necessary that an inquiry conducted on foot of a complaint must be
feasible and workable. According to Article 77(1) GDPR, a complaint should relate to data
processing that, in a complainant’s view, infringes the GDPR. There is a lack of reasonable
387

specificity in the above request in relation to processing operations or alleged
infringements.

3.45. Any request to investigate all processing, or hypothetical processing, particularly a
request of such an indefinite nature, does not, in my view, conform to the requirements
of Article 77 GDPR. Such a request does not specify any data processing or any alleged
infringement, and would result in a practically unworkable inquiry. Rather than being a
complaint about specific processing operations, the Complaint in this matter has, at times,
strayed into the territory of instructing the Commission to conduct an open-ended
inquiry, and to direct that inquiry and the Commission’s resources in a manner
determined by the Complainant. It is instead for the Commission to decide on the manner
in which a reasonably specific Complaint is to be investigated.

3.46. Moving to Facebook’s views on the scope of the Complaint, when the scope set out above
was put to Facebook in the Preliminary Draft Decision, it argued that

“[i]f the Complaint had intended to raise concerns about Facebook Ireland's compliance
with Articles 5, 12 and 13 GDPR, it would not have said “the scope of this complaint is
explicitly limited to any processing operations that are wholly or partly based on Article
6(1)(a) and/or Article 9(2)(a) of the GDPR.” 302

3.47. Facebook’s position is therefore that the issues of transparency fall outside the scope of
the Complaint and by extension this Inquiry, and requested that the Commission
reconsider the scope as set out in the Preliminary Draft Decision. 303 In its submissions,
Facebook simply stated that it did not accept that there was, as has been found by the
Commission, an “inherent allegation in this Complaint that the legal basis relied on by
Facebook for processing personal data in accordance with the acceptance of the Terms of
Service is unclear”. 304 Facebook has not provided more detailed submissions on this issue.

3.48. The Complaint, as Facebook correctly points out, concerns what the Complainant refers
to as “forced consent”. 305 In making this Complaint, it is argued that there has been an
attempt to mislead on Facebook’s part. Indeed, the Complaint rests on the allegation that
Facebook attempted to mislead the Complainant and users generally by informing them
that they were required to consent to certain processing in order to remain a Facebook
user. Following submissions from Facebook to the effect that it was not relying on consent
but instead the performance of the contract as a legal basis, the Complainant went on to

302
Facebook Submissions on Preliminary Draft Decision, paragraph 2.1.
303
Ibid, paragraph 2.3.
304
Preliminary Draft Decision, paragraph 5.9 [cited in Facebook Submissions on the Preliminary Draft Decision,
paragraph 6.1].
305
Facebook Submissions on Preliminary Draft Decision, paragraph 2.1.
388

argue that the agreement had the appearance of consent, and that this in itself was
misleading. The Complainant has repeated this argument in the submissions on the
Preliminary Draft Decision. 306

3.49. The Complainant also argues that the Terms of Service themselves are vague, and that
this has some bearing on either the nature of the agreement or on how to determine with
any precision what processing operations are necessary in order to perform that contract.
The Complainant has referred to a lack of an awareness, based on the information
provided, of precisely what data is actually processed. These concerns go to the very heart
of the principles of transparency and accountability in the GDPR. While the Complaint
stated that it is “limited to any processing operations that are wholly or partly based on
Article 6(1)(a) and/or Article 9(2)(a) of the GDPR”, this does not exclude the transparency
of those processing operations. The processing operations being considered remain the
same even where the transparency of the information provided on those processing
operations is had regard to.

3.50. The Complaint has a clear focus on an alleged lack of transparency on Facebook’s part.
Having considered the submissions of both the Complainant and Facebook on this issue,
I concluded that the Complaint does indeed raise issues of transparency. As I have set
out in paragraph 3.1, the conclusions on scope reflected in this Schedule 1 must read in
conjunction with both Section 2 of
this Decision as well as the corresponding assessment and determination of the scope of the
Complaint made by the EDPB in the Article 65 Decision, as summarised at paragraph 2.23 of this
Decision.

306
Complainant Submissions on Preliminary Draft Decision, pages 15-19.
389

SCHEDULE 2

390

Davranışsal Reklamda Sözleşmeye Dayalı Veri İşleme

Türkçe özet

Hukuki mesele

Sonuç

Karar metni