Instagram'da Davranışsal Reklamcılığın Hukuki Dayanağı

This document reflects the view of the DPC. Many positions brought by noyb are reframed by the DPC.

In the matter of the General Data Protection Regulation

DPC Inquiry Reference: IN-18-5-7

In the matter of TSA, a complainant, concerning a complaint directed against Meta Platforms
Ireland Limited (formerly Facebook Ireland Limited) in respect of the Instagram Service

Decision of the Data Protection Commission made pursuant to Section 113 of the Data Protection Act,
2018
and Articles 60 and 65 of the General Data Protection Regulation

Further to a complaint-based inquiry commenced pursuant to Section 110 of the Data Protection Act
2018

DECISION

Decision-Maker for the Commission:

Helen Dixon
________________________________
Commissioner for Data Protection

Dated the 31st December 2022

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland

An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (0)76 1104800

1. Introduction .......................................................................................................................... 4
2. Factual Background and the Complaint ..................................................................................... 4
FACTUAL BACKGROUND
.................................................................................................................................. 5
OVERVIEW OF THE COMPLAINT ........................................................................................................................
8 Legal Basis of Processing
........................................................................................................................ 8
Transparency .......................................................................................................................................
10
Corrective Powers ................................................................................................................................
11
SCOPE OF THE COMPLAINT ............................................................................................................................
11
3. Issue 1 – Whether Clicking on the “Agree to Terms” Button Constitutes or must be consent for the
purposes of the GDPR
..................................................................................................................15
Introduction .............................................................................................................................................
15
Relevant Provisions ..................................................................................................................................
15
Whether Clicking “Agree to Terms” Constitutes Consent for the Purposes of the GDPR .........................
16
Whether Meta Ireland must rely on Consent ...........................................................................................
19
4 Issue 2 - Reliance on 6(1)(b) GDPR as a lawful basis for personal data processing
..........................24
Introduction .............................................................................................................................................
24

Relevant Provisions ..................................................................................................................................
24
Assessment of whether Meta Ireland was entitled to Rely on Article 6(1)(b) GDPR ................................
25 Relationship between the Terms of Use and the Data Policy
................................................................ 25
Whether Meta Ireland was Entitled to Rely on Article 6(1)(b) GDPR
..................................................... 27
Finding 2: .............................................................................................................................................
49
5 Issue 3 – Whether Meta Ireland provided the requisite information on the legal basis for
processing on foot of Article 6(1)(b) GDPR and whether it did so in a transparent manner
....................................49
Introduction .............................................................................................................................................
49
Relevant Provisions ..................................................................................................................................
50
The “Layered” Approach ......................................................................................................................
52
Information provided to the Data Subject in respect of the purposes and/or legal basis of processing ..
55
Information provided by Meta Ireland in relation to Processing in accordance with Article 6(1)(b) ........
67
Whether Meta Ireland Complies with Article 5(1)(a), 12(1) and 13(1)(c) GDPR ......................................
73
Article 5(1)(a) GDPR – Principle of Transparency .....................................................................................
78
Finding 3: .............................................................................................................................................
81
6 Whether Meta Ireland infringed the article 5(1)(a) principle of fairness
.......................................82 Finding 4:
............................................................................................................................................. 85
7 Summary of Findings
.............................................................................................................86 8 Decision on Corrective
Powers ...............................................................................................86
9. Order to Bring Processing into Compliance
..............................................................................87
10. Administrative Fine ...........................................................................................................91
3

ARTICLE 83(2)(A): THE NATURE, GRAVITY AND DURATION OF THE INFRINGEMENT TAKING INTO ACCOUNT THE NATURE
SCOPE OR PURPOSE OF THE PROCESSING CONCERNED AS WELL AS THE NUMBER OF DATA SUBJECTS AFFECTED AND THE
LEVEL OF DAMAGE SUFFERED BY THEM ...........................................................................................................
105
ARTICLE 83(2)(B): THE INTENTIONAL OR NEGLIGENT CHARACTER OF THE INFRINGEMENT ........................................ 118
ARTICLE 83(2)(C): ANY ACTION TAKEN TO MITIGATE THE DAMAGE TO DATA SUBJECTS ............................................ 123
ARTICLE 83(2)(D): THE DEGREE OF RESPONSIBILITY OF THE CONTROLLER OR PROCESSOR TAKING INTO ACCOUNT TECHNICAL
AND ORGANISATIONAL MEASURES IMPLEMENTED BY THEM PURSUANT TO ARTICLES 25 AND 32 ............................... 124

ARTICLE 83(2)(E): ANY RELEVANT PREVIOUS INFRINGEMENTS BY THE CONTROLLER OR PROCESSOR ........................... 126

ARTICLE 83(2)(F): THE DEGREE OF COOPERATION WITH THE SUPERVISORY AUTHORITY, IN ORDER TO REMEDY THE
INFRINGEMENT AND MITIGATE THE POSSIBLE ADVERSE EFFECTS OF THE INFRINGEMENT ........................................... 128

ARTICLE 83(2)(G): THE CATEGORIES OF PERSONAL DATA AFFECTED BY THE INFRINGEMENT ..................................... 129
ARTICLE 83(2)(H): THE MANNER IN WHICH THE INFRINGEMENT BECAME KNOWN TO THE SUPERVISORY AUTHORITY, IN
PARTICULAR WHETHER, AND IF SO TO WHAT EXTENT, THE CONTROLLER OR PROCESSOR NOTIFIED THE INFRINGEMENT .. 131

ARTICLE 83(2)(I): WHERE MEASURES REFERRED TO IN ARTICLE 58(2) HAVE PREVIOUSLY BEEN ORDERED AGAINST THE
CONTROLLER OR PROCESSOR CONCERNED WITH REGARD TO THE SAME SUBJECT-MATTER, COMPLIANCE WITH THOSE
MEASURES ................................................................................................................................................
131
ARTICLE 83(2)(J): ADHERENCE TO APPROVED CODES OF CONDUCT PURSUANT TO ARTICLE 40 OR APPROVED CERTIFICATION
MECHANISMS PURSUANT TO ARTICLE 42 ........................................................................................................
132
ARTICLE 83(2)(K): ANY OTHER AGGRAVATING OR MITIGATING FACTOR APPLICABLE TO THE CIRCUMSTANCES OF THE CASE,
SUCH AS FINANCIAL BENEFITS GAINED, OR LOSSES AVOIDED, DIRECTLY OR INDIRECTLY, FROM THE INFRINGEMENT ........ 132

WHETHER TO IMPOSE AN ADMINISTRATIVE FINE .............................................................................................
134
11 OTHER RELEVANT FACTORS ........................................................................................................1 46
ARTICLE 83(3) GDPR ................................................................................................................................
146
ARTICLE 83(5) GDPR ................................................................................................................................ 152
SUMMARY OF ENVISAGED ACTION ................................................................................................................
157

1. INTRODUCTION

1. This document is a Decision (“the Decision”) of the Data Protection Commission (“the
Commission”) made in accordance with Section 113 of the Data Protection Act 2018 (“the 2018
Act”), arising from an inquiry conducted by the Commission, pursuant to Section 110 of the
2018 Act (“the Inquiry”).

2. The Inquiry concerned a complaint made to the Belgian Data Protection Authority: L'Autorité
de protection des données (the “Belgian DPA“) on 25 May 2018 in respect of the Instagram
service (the “Complaint”). As the Instagram service is provided in connection with Meta
Platforms, formerly the Facebook Group, the Complaint was made in respect of Facebook
Ireland Limited (“Facebook”). Following the completion of the inquiry stage, Facebook passed
a special resolution to change the company name to “Meta Platforms Ireland Limited” (“Meta
Ireland”), effective from 22 December 2021. Insofar as there are any references to “Facebook”
in this Decision, these should be construed to refer to “Meta Ireland”.

3. The Inquiry, which commenced on 20 August 2018, examined whether Meta Ireland, in the
context of the Instagram service, complied with its obligations under the EU General Data
Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the
Council) (“the GDPR”) in respect of the subject matter of a Complaint. For completeness, the
Complaint was made by the non-profit organisation “noyb – European Center for Digital Rights”
(the “Complainant”) on behalf of T. S. A. (“the Data Subject” or “Named Data Subject”). The
Complaint was referred to the Commission by the Belgian Data Protection Authority: L'Autorité
de protection des données (“The Belgian DPA“) on 31 May 2018. In advance of the finalisation
of this Decision, a preliminary version of this document (the "Preliminary Draft“) was circulated
to Meta Ireland and the Complainant to enable them to make submissions on my findings. I
have taken account of any such submissions in finalising this document.

4. This Decision further reflects the binding decision that was made by the European Data
Protection Board (the “Board” or, otherwise, the “EDPB”) pursuant to Article 65(2) of the
GDPR,5 (the “Article 65 Decision”) which directed changes to certain of the positions reflected
in the draft decision that was presented by the Commission for the purposes of Article 60 (the
“Draft Decision”), as detailed further below. The Article 65 Decision will be published on the
website of the Board, in accordance with Article 65(5) of the GDPR, and a copy of same is
attached to this Decision.

5. Further details of procedural matters pertaining to the Inquiry are set out in Schedule 1 to this
Decision.

2. FACTUAL BACKGROUND AND THE COMPLAINT

FACTUAL BACKGROUND

6. Instagram is a global online social network service (the “Instagram Service”) which allows
registered users to communicate with other registered users through messages, audio, video
calls and video chats, and by sending images and video files. It is made available to registered
users without payment. The Instagram service was launched in 2010 and was acquired by Meta
Platforms, Inc., then Facebook, Inc., in 2012; it is now wholly owned by Meta Platforms, Inc.
The Instagram service can be accessed using a standalone mobile phone application, but can
also be viewed as a webpage using a web-browser.

7. To use the Instagram service, a prospective user must create an Instagram account. To create
an Instagram account, a prospective user is required to provide certain information (e.g. name,
email address etc.) and must accept a series of terms and conditions referred to as the Terms
of Use (the “Terms of Use”). When a prospective user accepts the Terms of Use, the terms
contained therein constitute a contract between the (new) user and Meta Ireland in respect of
the Instagram service. It is only on acceptance of the Terms of Use that the individual becomes
a registered Instagram user. An unregistered user – i.e. a user who has not created an Instagram
account and accepted the Terms of Use – has limited access to the Instagram service; while they
can view certain content on the webpage version of an Instagram user’s profile page, they
cannot access the mobile phone Instagram application as it is restricted to registered users.

8. In April 2018, Meta Platforms updated the Terms of Use and related Instagram policies to give
effect to changes it sought to implement to comply with the obligations which would arise when
the GDPR became applicable from 25 May 2018. Obligations introduced by the GDPR include,
inter alia, a requirement for controllers to provide detailed information to users about the
purposes and the legal bases of any processing of personal data. To continue to have full access
to the Instagram service, all registered users were required to accept the updated Terms of Use
prior to 25 May 2018. The “How We Will Handle Disputes” section of the Terms of Use stated:

“If you are a consumer and habitually reside in a Member State of the European Union,
the laws of that Member State will apply to any claim, cause of action, or dispute you have
against us that arises out of or relates to these Terms (‘claim’), and you may resolve your
claim in any competent court in that Member State that has jurisdiction over the claim. In
all other cases, you agree that the claim must be resolved in a competent court in the
Republic of Ireland and that Irish law will govern these Terms and any claim, without
regard to conflict of law provisions”.

9. In May 2018, the updated Terms of Use were brought to the attention of existing Instagram
users by way of a series of information notices and options on the Instagram service, referred
to as an “engagement flow” or “user flow” (for clarity, this Decision will refer to either term as
the “user engagement flow”). The user engagement flow was designed to guide users through
6

the process of accepting the updated Terms of Use. It presented existing users with two
separate information pages entitled “Review and Agree”. 1 The first such information page,
containing the subheading “Changes to How We Manage Data” includes a hyperlink to the full
text of the Data Policy. 2 The purpose of the Data Policy was to outline the information Meta
Platforms – and possibly other entities in the Meta Platforms Group – processes in the context
of the delivery of the Instagram service. 3

Figure 1: “Changes to How We Manage Data” Page

10. On pressing the “next” button on the “Changes to How We Manage Data” page, the user was
brought to the second “Review and Accept” information page. This page required existing users

1
Meta Ireland’s Submissions dated 28 September 2018, at pp. 21 to 23.
2
Meta Ireland’s Submissions dated 28 September 2018, at p. 21.
3
See the Instagram Data Policy annexed to Meta Ireland’s Submissions dated 28 September 2018.
7

to confirm whether he/she were over the age of 18. It also provided a high-level overview of
the changes to the Terms of Use and included a hyperlink to the full text of the updated Terms
of Use. Existing users were then presented with a binary choice: either “Agree to Terms” or
“see other options”. The visual presentation of the options differed; to select the former, the
user was required to press a blue button stating “Agree to Terms” whereas the latter required
the user to select the hyperlinked text “see other options” below the “Agree to Terms” button.
According to the Complaint, the only option available to a user who selected “see other options”
was the deletion of his/her Instagram account.4 Moreover, the updated Terms of Use stated
that a user who continues to use Instagram service will be bound by the new terms. It further
stated that a user who does not wish to be bound by the updated terms could delete his/her
account. 5

Figure 2: Review and Agree Page

OVERVIEW OF THE COMPLAINT

4
Complaint made by NOYB in respect of the Instagram Service dated 25 May 2018 (the “Complaint dated 25 May
2018”), at p. 7.
5
Instagram Terms of Use, revised 19 April 2018, annexed to the Complaint; see subheading “Updating these
Terms”.
8

11. The Complaint was made in the context of Instagram’s updated Data Policy and Terms of Use.
In particular, the Complaint concerned the requirement for existing (registered) users to accept
the updated terms and policies as so to continue to use the Instagram service. In this context,
the Complaint concerns whether there is a legal basis for the processing of personal data of
registered users in the context of the Instagram service. In this vein, the Complaint relates to
the processing of both (i) personal data and (ii) special category data. 6 The Complaint is also
concerned with whether the transparency obligations in the GDPR have been complied with. 7
For clarity, I will summarise each aspect of the Complaint in turn.

Legal Basis of Processing

12. In respect of the legal basis of the processing of personal data, the Complainant alleged that all
processing operations referred to in the Data Policy and Terms of Use must be assumed to be
based on consent due to the requirement that existing users must accept the updated terms
and policies to continue to use the Instagram service. 8 The Complainant further alleged that
existing users were given a binary choice: (1) either accept the Terms of Use and the associated
Data Policy by selecting the “Agree to Terms” button or (2) delete his/her Instagram account. 9
Indeed, the Complainant considered it to be, “clear that consenting to the privacy policy and
terms above is the only way the data subject can maintain access to his account and therefore
be able to use the said services”. 10

13. The Complaint also highlighted processing operations which, in the view of the Complainant,
are explicitly based on consent. 11 According to the Complainant, these include:

• “processing data with special protections (such as your religious views, political views,
who you are “interested in,” or your health, if you share this information in your
Facebook profile fields or Life Events), so we can share with those you choose and
personalise your content”;
• “using data that advertisers and other partners provide us about your activity off of
Facebook Company Products, so we can personalise ads we show you on Facebook
Company Products, and on websites, apps, and devices that use our advertising
services”; and
• “collecting information you allow us to receive through the device-based settings you
enable (such as access to your GPS location, camera or photos), so we can provide the
features and services described when you enable the settings”.12

6
Complaint dated 25 May 2018, at pp. 1-2.
7
Complaint dated 25 May 2018, at p. 3.
8
Complaint dated 25 May 2018, at p. 2-3.
9
Complaint dated 25 May 2018, at p. 7.
10
Complaint dated 25 May 2018, at p. 6.
11
Complaint dated 25 May 2018, at p. 2.
12
Complaint dated 25 May 2018, at pp. 2-3.
9

14. The Complainant has also submitted that consent to certain processing operation is “hidden”
and “seems to pretend that these processing operations would then fall under Article 6(1)(b) of
GDRP [sic]”. 13 In essence, the Complainant alleged that the controller had misled data subjects
into believing that certain processing (the Complaint referred to personalised advertising) was
a contractual obligation. Accordingly, the Complainant submitted that non-core elements of
the Terms of Use must be interpreted as a form of consent. 14

15. Following this, the Complaint outlined the Complainant’s submissions as to why consent cannot
amount to a valid legal basis for the purposes of Article 6(1)(a) GDPR in the context of the
processing at issue. In this regard, the Complaint addressed each component of consent, as
understood in the context of Article 6(1)(a) GDPR, in turn.

16. First, the Complainant submitted that the act of consent was not “freely given” as required by
Article 4(11) and 7(4) GDPR as users were not “offered a genuine and realistic choice to accept
or decline the terms of a service or to decline these terms without detriment”. 15 The
Complainant alleged that the act of consent was not freely given in this context for the following
reasons:

i. There was a “clear imbalance of power” between Meta Ireland (via the Instagram
service), as the controller, and data subjects, as Instagram occupies dominant market
position in “photo sharing services”. In turn, this has given rise to a “network effect”,
i.e. that the service is “a closed and proprietary network, the data subject is factually
forced to join or maintain a profile with the controller”. In the Complainant’s view, this
was further supported by the “lock-in effect” of the Instagram service which occurs
where “data subject uses the services of the controller for years and has invested
substantial time and effort to build a profile on the service … [and] would lose access to
personal information, connections and a very important network for the social, personal
and professional life”. 16

ii. Continued access to Instagram is conditional on the data subject’s consent which
cannot be considered to be freely given in accordance with the requirements set out in
Article 7(4) and Recital 43 GDPR. 17

iii. The consent provided lacked specificity as it is “bundled” with both the Terms of Use
and the Data Policy and thus there is an “all or nothing approach”. 18

13
Complaint dated 25 May 2018, at p. 3.
14
Complaint dated 25 May 2018, at p. 5.
15
Complaint dated 25 May 2018, at p. 9.
16
Complaint dated 25 May 2018, at pp. 9-12.
17
Complaint dated 25 May 2018, at pp. 12-14.
18
Complaint dated 25 May 2018, at pp. 14-15.
10

iv. Data subjects who refused to provide consent in this context suffer detriment as the
“controller has threatened to … discontinue the contract with anyone that does not
agree to the new privacy policy and delete the existing account”. In this regard, the
Complainant further alleged that a data subject may suffer a “secondary disadvantage”
in the form of the “los[s of] a crucial form of social interaction among his peers”. 19

17. In the alternative, the Complainant also argued that the consent was not sufficiently informed
and thus could not be valid. According to the Complaint, “[e]ven if a trained lawyer reads all
the text that the controller provides, he/she can only guess what data is processed, for which
exact purpose and on which legal basis”. 20 In this vein, the Complainant further asserted that
the consent is not specific as it could relate to any of the processing operation detailed in the
Data Policy. 21 Moreover, the Complainant submitted that consent was not distinguishable from
irrelevant material in the Terms of Use and the Data Policy. 22 The Complainant also noted that
the controller could not rely on previous acts of consent in accordance with Recital 177 GDPR. 23

Transparency

18. Notwithstanding the Complainant’s submission that processing must be assumed to be based
on consent, the Complainant alleged that it was unclear which legal basis (if any) applied in
respect of each processing operation as the “controller simply lists all six bases for lawful
processing under Article 6 of the GDPR in its privacy policy without stating exactly which legal
basis the controller relies upon for each specific processing operation”.24 In this regard, it
appears that the Complainant’s argument rested on the premise that the legal basis for every
individual processing operation must be identified and communicated to the data subjects with
specificity.

19. The Complaint also addressed whether the information provided to data subjects satisfies the
transparency requirements of the GDPR. In this regard, the Complainant asserted that the lack
of clarity as to “what data is processed, for which exact purpose and on which legal basis” is
contrary to the transparency and fairness requirements set out in Articles 5(1)(a) and 13(c)
GDPR. 24 The Complainant further alleged that “[a]sking for consent for a processing operation,
when the controller relies in fact on another legal basis is fundamentally unfair, misleading and
non-transparent within the meaning of Article 5(1)(a) of the GDPR”.26

19
Complaint dated 25 May 2018, at pp. 15-16.
20
Complaint dated 25 May 2018, at pp. 16-17.
21
Complaint dated 25 May 2018, at p. 17.
22
Complaint dated 25 May 2018, at p. 17.
23
Complaint dated 25 May 2018, at p. 18.
24
Complaint dated 25 May 2018, at p. 2.
24
Complaint dated 25 May 2018, at pp. 16-17.
26
Complaint dated 25 May 2018, at p. 18.
11

20. In essence, this aspect of the Complaint concerns the transparency requirements set out in the
GDPR, which require controllers to provide detailed information to users at the time when
personal data are obtained, including the provision of information about the purposes of the
processing as well as the legal bases for the processing.

Corrective Powers

21. Finally, I also note that the Complaint outlined several corrective measures which the
Complainant sought to impose in this context. In this regard, the Complainant requested that
the matter is “fully investigated” and the results made available to it. The Complainant further
requested an order prohibiting the relevant processing operations and the imposition of
effective, proportionate and dissuasive fines. 25 At this juncture, I note that the Complainant
may not compel the Commission, or indeed any other supervisory authority, to carry out certain
actions or impose particular corrective powers. Indeed, in this regard, I note that Article 52
GDPR stipulates that each supervisory authority must act with “complete independence” in
discharging its functions under the GDPR. Therefore, while I take account of the parties’
submissions, I am not compelled to act or impose certain corrective powers by virtue of any
such submissions.

SCOPE OF THE COMPLAINT

22. I have carried out my assessment of the scope of the Complaint to the extent that it relates to
specified data processing and specified alleged infringements as outlined in paragraphs 123 –
150 of Schedule 1. A chronology of issues that arose (1) as between the parties and (2) as
between the parties and the Commission in the course of establishing the substantive scope of
the complaint is also included in Schedule 1. Also included in Schedule 1 are details of the
approach I have adopted in concluding those issues raised. In determining the precise
parameters of the scope of the Complaint, I have had regard to the Complaint as a whole and,
in particular, I have taken note of the express statements in the Complaint which seek to define
its scope. I have also had regard to the Investigator’s analysis in respect of the scope of the
Complaint.

23. On his assessment of the Complaint, the Investigator concluded that there were four key issues
to be analysed in the context of the Inquiry. 26 The issues, as identified by the Investigator, are
as follows:

a. Whether the Named Data Subject’s acceptance of the Instagram Terms of Use and/or
Data Policy was to be construed as the provision of consent within the meaning of Articles

25
Complaint dated 25 May 2018, at pp. 18-20.
26
Final Inquiry Report dated 18 January 2021, at para. 90.
12

4(11) and 6(1)(a) GDPR to the processing of personal data described in those documents
– the Investigator’s views 1 and 2 of the Final Report address this issue.

b. Whether Meta Ireland, as the controller, could rely on Article 6(1)(b) GDPR as a lawful
basis for the processing of personal data in respect of the Instagram Terms of Use – the
Investigator’s view 3 of the Final Report addresses this issue.

c. Whether Meta Ireland misrepresented the legal basis for processing personal data in such
a manner that would lead the data subject to believe that any such processing is based
on consent – the Investigator’s view 4 of the Final Report addresses this issue.

d. Whether Meta Ireland failed to provide the requisite information in respect of its legal
basis for processing of personal data in connection with the Terms of Use and/or Data
Policy and thus did not comply with its transparency obligations in this regard – the
Investigator’s views 5, 6, 7, 8, 9, 10 and 11 of the Final Report address this issue.

24. I agree with the Investigator’s summary of the core issues in respect of issues (a) and (b).
However, I take a different view in treating issues (c) and (d) as raising distinct legal issues.

25. Issue (c), as identified by the Investigator, solely addresses the allegation that Meta Ireland has
misrepresented the lawful basis it relies on for processing personal data in connection with the
Instagram service, such that it has misled the data subject to believe that any such processing
is based on consent. By contrast, the Investigator considered issue (d) to be a broader
assessment of whether the Instagram Terms of Use and/or Data Policy complies with the
transparency requirements as set out in Articles 5(1)(a), 12(1) and 13(1)(c) GDPR in the context
of processing carried out on the basis of Article 6(1)(b) GDPR.

26. I am not convinced that there is a legal distinction between these issues. Rather, it is my view
that both issues are components of the same question of whether Meta Ireland has complied
with its transparency requirements in respect of processing carried out on the basis of Article
6(1)(b). More specifically, it is my view that where a controller has not complied with its
transparency requirements, it logically follows that a data subject may be misled, deliberately
or otherwise, as to legal basis of any processing in this context. By contrast, where the
controller has provided sufficient information to data subjects such that the transparency
requirements have been complied with, it cannot be the case that the data subject has been
misled as to the legal basis. The factual question of whether the data subject was misled as to
the legal basis is therefore part of the broader question as to whether there was compliance
with transparency requirements and should not be considered in isolation of this broader issue.

27. In its submissions on the Preliminary Draft, Meta Ireland disagreed with my view that issues (b),
(c) and (d) fell within the scope of the Complaint. 27 In particular, Meta Ireland submitted that:

“an investigation into a specific complaint should abide by the parameters of that
complaint, which here is focused on “forced consent” only, in order to respect the integrity
of the mandate provisions under Article 80 GDPR. Where an investigation is said to be into
allegations raised by a specific complaint, a supervisory authority should confine its
investigation accordingly”. 28

28. I agree with Meta Ireland to some extent that the Complaint primarily outlined concerns as to
“forced consent”, however, I am of the view that the Complaint was not solely limited to
consent. Rather, as I have outlined above, the Complaint concerned the legal basis of the
processing29 and, where Meta Ireland has not sought to rely on consent as the legal basis, it
follows that the Commission is entitled to investigate and consider the legal basis which Meta
Ireland has in fact sought to rely on. In terms of the transparency of the information provided,
I would emphasise that the Complaint explicitly alleges that the information provided on the
legal bases (in the Privacy Policy) is such that data subjects “can only guess what data is
processed, for which exact purpose and on which legal basis. This is inherently non-transparent
and unfair within the meaning of Articles 5(1)(a) and 13(c)”. 30 This clearly concerns the
transparency of the information provided and, accordingly, I am of the view that it falls within
the scope of the Complaint.

29. In its submissions on the Preliminary Draft, the Complainant alleged that the scope of the
Complaint as identified in the Preliminary Draft did “not adequately deal with the issues” raised
by the Complainant and, indeed, did “not even come close” to doing so. 31 As set out in both
this Decision and the attached Schedule 1, the Complaint is clearly limited to the lawfulness of
processing carried out on foot of the “agreement”, i.e. acceptance of the (Meta Ireland) Terms
of Service and/or Instagram Terms of Use. I therefore do not accept that the matters addressed
in the Preliminary Draft did not cover all aspects of the Complaint.

30. I also note that the Complainant’s submissions on the Preliminary Draft also alleged that there
had been a failure by the Commission to fully investigate the relevant facts, in particular in
respect of whether the “agreement” entered into by the individual data subject and Meta
Ireland was for “a consent” or “a contract”. 32 I considered this matter in depth in the
Preliminary Draft. In this respect, I also note the Complainant’s submissions on the Preliminary
Draft call for the Commission to engage in a thorough investigation as to the nature of this

27
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at pp. 4 – 5 (Section 3).
28
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 4, at para. 3.4.
29
For example, see Complaint dated 25 May 2018, at p. 19.
30
Complaint dated 25 May 2018, at p. 16.
31
NOYB’s Submissions on the Preliminary Draft for IN-18-5-5 dated 11 June 2021, at pp. 12-13.
32
NOYB’s Submissions on the Preliminary Draft for IN-18-5-5 dated 11 June 2021, at pp. 11-12.
14

agreement, having regard to the scope of the Complaint, this is, in my view, entirely
unnecessary and would not divulge any new information or serve a useful purpose at this stage.
As is set out in Section 3 below, there is no dispute in relation to the fact that there is a contract
between Meta Ireland and the Complainant or the fact no consent within the meaning of the
GDPR has been provided by the Complainant in concluding the “agreement” in dispute. What
is in dispute, as set out in detail in this Decision and in Schedule 1, is the lawfulness of the
personal data processing and the transparency of the information provided.

31. Following the circulation of the Draft Decision to the supervisory authorities concerned for the
purpose of enabling them to express their views in accordance with Article 60(3) GDPR the
supervisory authorities of Austria, Germany, Finland, France and the Netherlands raised
objections in relation to the Commission’s assessment of the scope of the Complaint, as
summarised above.

32. The EDPB determined, at paragraph 202 of the Article 65 Decision, that the inquiry
underpinning this Decision ought to have included an examination of “[Meta Ireland’s]
processing operations, the categories of data processed (including to identify special
categories of personal data that may be processed), and the purposes they serve”.
Accordingly, the EDPB directed, at paragraph 203 of the Article 65 Decision, the
Commission to commence a new inquiry into these matters. While that direction
cannot be addressed by the Commission in this Decision, the Commission considers it
necessary to note the position, in light of the Commission’s assessment of the scope
of the Complaint (as already recorded above) and for the purpose of ensuring
compliance with its obligation, pursuant to Article 65(6) GDPR, to adopt its final
decision on the basis of the Article 65 Decision. The EDPB further directed the
Commission to remove its proposed conclusion on Finding 1 (as set out in the Draft
Decision). That aspect of matters is addressed at the conclusion of the Commission’s
assessment of Issue 1, below.

33. On the basis of the above, the issues that will be addressed in the Decision are as follows:

• Issue 1 – Whether clicking on the “Agree to Terms” button constitutes or must be
considered consent for the purposes of the GDPR and, if so, whether it is valid consent for
the purposes of the GDPR.
• Issue 2 – Whether Meta Ireland could rely on Article 6(1)(b) GDPR as a lawful basis for
processing of personal data in the context of the Terms of Use and/or Data Policy.
• Issue 3 – Whether Meta Ireland provided the requisite information on the legal basis for
processing on foot of Article 6(1)(b) GDPR and whether it did so in a transparent manner.

3. ISSUE 1 – WHETHER CLICKING ON THE “AGREE TO TERMS” BUTTON CONSTITUTES OR MUST BE CONSENT FOR THE
PURPOSES OF THE GDPR
Introduction

33. As a preliminary issue, I note that Article 6(1)(a) GDPR provides that consent may be a lawful basis
for the processing of personal data. While the legal basis of data processing in the context of the
Instagram service is within the scope of the Complaint (see, Issue 2 below), this first issue is limited
to the narrow assessment of whether the act of clicking the “Agree to Terms” button amounts to
– or must amount to – consent for the purposes of the GDPR.

34. Therefore, in this section of the Decision, I will focus on consent and will assess two interrelated
considerations: first, whether clicking the “Agree to Terms” button actually constitutes consent
for the purposes of the GDPR and, second, whether the act of clicking “Agree to Terms” necessarily
must be considered consent for such purposes. In this respect, I note that Meta Ireland’s position
is that it did not seek to obtain the Data Subject’s consent via acceptance of the Terms of Use for
processing in connection with the Terms of Use. 33

Relevant Provisions

35. As noted above, Article 6(1) GDPR enumerates the lawful bases for processing personal data and
states:

“Processing shall be lawful only if and to the extent that at least one of the following
applies:

(a) the data subject has given consent to the processing of his or her personal data for one
or more specific purposes”.

36. Consent is defined in Article 4(11) GDPR as:

“any freely given, specific, informed and unambiguous indication of the data subject’s
wishes by which he or she, by a statement or by a clear affirmative action, signifies
agreement to the processing of personal data relating to him or her”.

37. Interpretative guidance is found in Recital 32 GDPR which states that consent is an act which
establishes a “freely given, specific, informed and unambiguous indication of the data subject’s
agreement to the processing of personal data relating to him or her, such as by a written
statement, including by electronic means, or an oral statement”. Recital 32 GDPR recognises that
the act of consent may take several forms – for example, ticking an unchecked box, selecting

33
See, inter alia, Meta Ireland’s Submissions dated 22 February 2019, at p. 2, para. 2.5.
16

certain settings or a statement or conduct which “clearly indicates” the data subject’s agreement
– but does not extend to “[s]ilence, pre-ticked boxes or inactivity”.

38. The conditions for valid consent are set out in Article 7 GDPR as follows:

“1. Where processing is based on consent, the controller shall be able to demonstrate that
the data subject has consented to processing of his or her personal data.

3. The data subject shall have the right to withdraw his or her consent at any time.
The withdrawal of consent shall not affect the lawfulness of processing based on consent
before its withdrawal. Prior to giving consent, the data subject shall be informed thereof.
It shall be as easy to withdraw as to give consent.

4. When assessing whether consent is freely given, utmost account shall be taken of
whether, inter alia, the performance of a contract, including the provision of a service, is
conditional on consent to the processing of personal data that is not necessary for the
performance of that contract.”

Whether Clicking “Agree to Terms” Constitutes Consent for the Purposes of the GDPR

39. As outlined above, the Complaint submitted that

“the controller required the data subject to “agree” to the entire privacy policy and the
terms [which] … leads to our preliminary assumption, that all processing operations
described therein are based on consent, or that the controller at least lead the data subject
to belief that all these processing operations are (also) based on Article 6(1)(a) and/or
9(2)(a) of the GDPR”.34

40. The Complaint also alleged that the consent was “forced” and misled data subjects – including the
Named Data Subject – into believing that the processing was required as a contractual obligation. 35
In this regard, the Complainant premised its position on the assertion that Meta Ireland has relied
on a “deceptive design” in respect of the user engagement flow. 36 As the Complainant’s

34
Complaint dated 25 May 2018, at p. 3.
35
Complaint dated 25 May 2018, at pp. 3 -4.
36
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 27
39
Meta Ireland’s Submissions dated 22 February 2019, at para. 1.1.
17

submissions in respect of “misleading data subjects” concern the transparency of the information
provided to data subjects, this will be further considered in the context of Issue 3.

41. Meta Ireland’s position is that not all processing in the context of the Instagram Terms of Use is
based on consent.39 In relation to whether the act of clicking on the “Agree to Terms” button
constitutes consent, Meta Ireland submitted that agreeing to the Instagram Terms of Use amounts
to a contractual agreement and is not an act of consent for the purposes of Article 6(1)(a) GDPR. 37
Meta Ireland further asserted that it “does not in any way seek to ‘infer’ consent from a user to process
personal data based on their agreement to the Terms of Use” and that there is a strict distinction
between accepting the Terms of Use and obtaining consent for the purposes of the GDPR. 38
Moreover, Meta Ireland stated that the “Terms of Use user flow was designed to enable the user
to accept the Terms of Use and enter into a contract with Facebook Ireland [now Meta Ireland]”
and not as a mechanism for obtaining user consent. 39 For completeness, I acknowledge that Meta
Ireland provided information as to the sets of processing operations for which consent is sought
in the context of the Instagram service. 40

42. As regards the individual act of clicking the “Agree to Terms” button, the Investigator stated that
he was

“not satisfied that this form of acceptance of the Data Policy constituted the data subject’s
consent to processing within the meaning of the GDPR, because such an agreement does
not objectively accord with the specific conditions for data protection consent as
prescribed in Article 4(11) GDPR. In particular, this type of acceptance would not be
regarded as freely given or unambiguous consent pursuant to Article 4(11) GDPR in
circumstances where the Data Policy describes many different types of processing,
performed for separate purposes.”. 41

43. In setting out the above to the Parties in the Preliminary Draft, I took the view that Meta Ireland
did not seek to rely on consent in requiring users to select the “Agree to Terms” button in the user
engagement flow but rather that this related to the acceptance of the Terms of Use. In response
to this, in its submissions on the Preliminary Draft dated 4 February 2022, Meta Ireland reaffirmed
its position that “it has not sought consent to the processing of personal data described in the Data
Policy by asking users to agree to the Terms of Use” as the latter is an “entirely distinct document”
from the former. 42

37
Meta Ireland’s Submissions dated 22 February 2019, at paras. 2.6 – 2.7.
38
Meta Ireland’s Submissions dated 22 February 2019, at para. 2.9.
39
Meta Ireland’s Submissions dated 22 February 2019, at para. 3.9.
40
Meta Ireland’s Submissions dated 28 September 2018, at paras. 2.35 - 2.43; Meta Ireland’s Submissions dated 22
February 2019, at paras. 3.10, 3.13; Meta Ireland’s Submissions on the Draft Inquiry Report dated 22 June 2020, at
para. 2.1.
41
Final Inquiry Report dated 18 January 2021, at para. 187.
42
Meta Ireland’s Submissions dated 4 February 2022, at para. 4.1.
18

44. On the contrary, it is the Complainant’s position, as expressed in its submissions on the Preliminary
Draft, that “Facebook never openly ‘sought to rely on consent’”. 43 In particular, the Complainant
sought to rely on the principle of falsa demonstratio, i.e. that the agreement between the Named
Data Subject and Meta Ireland must be interpreted by reference to what “truly intended to be, not
at what it is labeled as”. 44 In this regard, the Complainant sought to rely on the intention of the
parties, the “economic background and the common understanding of the agreement” and the
fact that Meta Ireland had only recently changed the provisions to support this position.

45. While the Complainant’s submissions may have some relevance to the issue of reliance on Article
6(1)(b) GDPR as the lawful basis for the processing (considered in Issue 2 below), it does not appear
to me that this addresses the issues underpinning reliance on Article 6(1)(a) GDPR. Indeed, I am
satisfied that, in requiring registered users to select the “Agree to Terms” button in the user
engagement flow, Meta Ireland was not considering this act to amount to an act of consent. The
user engagement flow relates to acceptance of the Terms of Use. I note in this regard that the
Terms of Use refer to (and indeed contains a link to) the Instagram Data Policy, stating that the
document “explains how we collect, use, and share information across the Facebook Products. It
also explains the many ways you can control your information, including in the Instagram Privacy
and Security Settings”.45 It is clear from the text of the Data Policy that Meta Ireland does not
intend to rely on consent for all data processing in the context of the Instagram service.46 It further
appears that the Parties are in agreement that acceptance of the Terms of Use was not valid
consent for the purposes of the GDPR.

46. For the reasons outlined above, I proposed to conclude that, as a matter of fact, Meta Ireland did
not – and did not seek – to rely on consent as the legal basis for all processing in connection with
the Terms of Use and was satisfied that Meta Ireland considered that selecting the “Agree to
Terms” button represented acceptance of the Terms of Use.

As noted already above, however, the EDPB instructed the Commission (by way of paragraph 203
of the Article 65 Decision) to remove, from its Draft Decision, “its conclusion on Finding 1”. Finding
1 included proposed conclusions on two linked questions, namely: (i) whether Meta Ireland
sought to rely on consent in order to process personal data to deliver the Terms of Service; and
(ii) whether Meta Ireland was legally obliged to rely on consent in order to do so. Given that my
previously proposed conclusion (as noted immediately above) in relation to the first of these
questions is encompassed by the EDPB’s instruction, I make no finding on this first question.

43
NOYB’s Submissions on the Preliminary Draft in IN-18-5-5 dated 11 June 2021, at p. 15.
44
NOYB’s Submissions on the Preliminary Draft in IN-18-5-5 dated 11 June 2021, at p. 15.
45
See the Section entitled “The Data Policy” of the Instagram Terms of Use.
46
In this regard, see Section V entitled “What is our legal basis for processing data?” of the Instagram Data Policy.
19

Whether Meta Ireland must rely on Consent

47. In the course of the Inquiry, the Complainant advanced, what appears to me to be, an additional
and alternative argument in respect of consent. In essence, the Complainant alleged that
processing in connection with the Instagram Terms of Use must be based on consent. In other
words, the Complainant asserted that Article 6(1)(a) – consent of the data subject – could, as a
matter of law, be the only legal basis applicable to processing of personal data in connection with
the Instagram service. It further appears to me that the Complainant also alleged that, as Meta
Ireland did not rely on consent as the lawful basis for such processing, the processing was
therefore to be considered unlawful.

48. In this regard, in its submissions dated 19 August 2020, the Complainant sought to draw a
distinction between contracts on the basis of their subject matter; i.e. between contracts which
are “primarily data processing” and contracts which concern “primarily some other contractual
service”. 47 In drawing this distinction, the Complainant suggested that Article 6(1)(a) GDPR is the
appropriate legal basis for the former category of contracts (i.e. those which primarily concern
data processing) whereas Article 6(1)(b) may be appropriate in respect of latter. The effect of this
position would be that consent would be required to be the default legal basis for agreements
which (primarily) concern data processing activities. I also note that the Complainant asserted
that Article 6(1)(a) was lex specialis as compared to any other legal basis in Article 6 GDPR and
sought to draw a distinction between the “definition of consent” and the “legal conditions for
validity”. 48 If accepted, this approach would imply that there may be a hierarchy of legal bases.

49. The Complainant further stated that it would be “utterly absurd” if consent requirements were
circumvented by controllers presenting “declarations” as “data processing contracts” (such as, the
Terms of Use in this context). 49 In this regard, the Complainant added that there should be a
“systemic interpretation” to create a distinction between Articles 6(1)(a) and 6(1)(b) on the basis
that “[a]llowing the controllers free reign on choosing which legal basis is the most appropriate for
them would go against the intention of the EU legislator and would definitely undermine the
protection of data subjects”. 50 The Complainant further argued that, as the modified parts of the
Terms of Use solely concerned data protection issues, those modifications could not constitute
contractual terms. 51 In this regard, I emphasise that the Commission does not have competence
to consider whether a particular term is valid as a matter of domestic contract law.

50. In his consideration of this matter, the Investigator noted that the Complaint is premised on the
fact that as the Named Data Subject “had to agree to” the updated Terms of Use and Data Policy
in 2018, it followed that “all processing operations” referenced in Terms of Use and Data Policy

47
Complainant’s Submissions dated 19 August 2020, at p. 44.
48
Complainant’s Submissions dated 19 August 2020, at p. 68.
49
Complainant’s Submissions dated 19 August 2020, at p. 48.
50
Complainant’s Submissions dated 19 August 2020, at p. 48.
51
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 44.
20

must be based on consent. 52 It does not appear to me that the Complaint is sensitive to the
distinction between the act of agreeing to a contract (even in circumstances where that contract
concerns the processing of personal data) and the act of providing consent for the purpose of
legitimatising the processing of personal data. It is important to emphasise the EDPB’s view that
these are entirely distinct concepts which “have different requirements and legal consequences”. 53
Indeed, these concepts refer to entirely different legal bases, with different components and all
the consequences that that entails.

51. In the Preliminary Draft, I emphasised that any implication that the GDPR contains a hierarchy of
legal bases is, in my view, inherently problematic and contradicts the wording of the GDPR.
Indeed, it cannot be said that “one ground has normative priority over the others”, and nor does
the text of the GDPR even suggest that there may be a hierarchy of legal bases. 54 This is the
position expressed by the Article 29 Working Group, which, while not strictly speaking legally
binding on the Commission, provides guidance which is illustrative. In respect of the former Article
7 of the Data Protection Directive (i.e. Directive 95/46/EC), which as with Article 6 GDPR concerns
the legal basis of processing, the Article 29 Working Group stated that “the text … does not make
a legal distinction between the six grounds and does not suggest that there is a hierarchy among
them”. 55 This also appears to be the view of the EDPB, as it has stated that the “application of one
of these six bases must be established” [my emphasis]. 56 Moreover, the CJEU, also in the context
of Directive 95/46/EC, held that the obtaining of consent is not a precondition for reliance on
legitimate interests as a legal basis. 57 The effect of this finding is that consent is not considered to
be a necessary or mandatory legal basis where a controller has sought to rely on another legal
basis.

52. In the Preliminary Draft, I noted that the Complainant also relied on Directive 93/13/EEC, i.e. the
Unfair Terms in Consumer Contracts Directive, to support the argument that consent takes
precedence over other legal bases. 58 In particular, the Complainant alleged that, on the basis of
Article 5 thereof, the “terms of service are to be interpreted in the interests of the consumer in the
event of ambiguity”. 59 In this regard, I emphasise that Article 55(1) GDPR limits the competence
of supervisory authorities to that conferred by the GDPR. Therefore, it cannot be said that the

52
Final Inquiry Report dated 18 January 2021, at para. 133.
53
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of
online services to data subjects, at para. 17.
54
C Kuner et al (eds.), The EU General Data Protection Regulation: A Commentary (Oxford 2020), at p. 329.
55
Article 29 Working Group, “Opinion 06/2014 on the notion of legitimate interests of the data controller under
Article 7 of Directive 95/46/EC” (adopted on 9 April 2014), at p. 10.
56
EDPB Guidelines on Consent (adopted 4 May 2020), at paras 121 - 123. I note that the Consent Guidelines are
merely a “slightly updated version” of the Article 29 Working Party Guidelines on consent under Regulation
2016/67959 which were adopted on 10 April 2018, i.e. prior to the date on which the Complaint was made
57
Case 708/18 Asociaţia de Proprietari bloc M5A-ScaraA v TK ECLI:EU:C:2019:1064, at para. 41.
58
Complainant’s Submissions dated 19 August 2020, at p.49.
59
Complainant’s Submissions dated 19 August 2020, at p.49.
21

GDPR implies that supervisory authorities must necessarily – or indeed are competent to - give
effect to concepts provided for in other measures.

53. In its submissions on the Preliminary Draft, Meta Ireland stated that the GDPR does not contain
an “automatic activation of consent as a legal basis” where there is a contractual agreement
between the relevant parties. 60 Meta Ireland also agreed with my view that there is no hierarchy
between the lawful bases under the GDPR. In support of this position, Meta Ireland also referred
to the recent statement of the European Commission that “the six legal bases for the processing
of personal data under the GDPR are equally valid and protective”. 61 For the avoidance of doubt,
I restate my position that no legal basis has primacy over any other and further note that, despite
the arguments initially advanced by the Complainant, in its submissions on the Preliminary Draft,
the Complainant agreed that there is no hierarchy of legal bases under the GDPR. 62

54. Accordingly, on the basis of the above, I am of the view that Article 6(1) GDPR – or indeed any
other provision of the GDPR – does not envisage or require that certain processing based on
particular circumstances must necessarily be based on consent.

55. Where a contract has been entered into between a consumer and an organisation, it may be the
case that the lawful basis is “necessity for the performance of a contract”, provided for in Article
6(1)(b) GDPR. It cannot be said that the fact of agreeing to certain contractual terms necessarily
means that any processing of personal data under such contract is based on consent for the
purposes of the GDPR. As I have stated above, there is an important distinction between the act
of accepting contractual terms and providing consent to data processing, even in circumstances
where the relevant contract is premised on data processing. Reliance on Article 6(1)(b) GDPR turns
on the particular agreement entered into by the parties and where the relevant processing
operation(s) or set(s) of operations are necessary for the performance of that particular
agreement. It cannot be said that the type of contract (in particular when divorced from the
content of the contract) dictates the legal basis. To this, I would add that the EDPB has advised
that where the relevant processing is necessary for the performance of a contract, it is not
appropriate to rely on consent as the legal basis. 63

56. Relying on the Complainant’s distinction between contracts primarily concerning data processing
and contracts relating to other contractual services (which I have described above), the
Complainant alleged that “the intention, purpose and the context of the Instagram Terms of Use
obviously about concern data processing and not a civil law contract” and must be based on

60
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 6, at para 5.2.
61
Letter from Didier Reynders, Member of the European Commission to MEPS Sophie in ‘t Veld, Birgit Sippel, Tineke
Strik and Cornelia Ernst (undated); annexed to Meta Ireland’s Submissions on the Preliminary Draft dated 4 February
2022.
62
NOYB’s Submissions on the Preliminary Draft in IN-18-5-5 dated 11 June 2021, at p. 16.
63
EDPB Guidelines on Consent (adopted 4 May 2020), at para. 31.
22

consent as they could not be considered contractual clauses. 64 In this respect, I am not aware of
any caselaw or authority which suggests that controllers cannot rely, at least in part, on Article
6(1)(b) GDPR as a legal basis for processing personal data simply because their businesses
“primarily” concern data processing. In the absence of any such authority, I cannot read in such
additional conditions and provisos to the GDPR.

57. In response to the Preliminary Draft, the Complainant alleged that “all other legal bases simply do
not ‘fit’ the types of processing in the dispute. There is simply no contract under Article 6(1)(b) …
or legal obligation under Article 6(1)(c) GDPR. So as a matter of logic, Article 6(1)(a) GDPR is simply
the remaining option for auxiliary processing”. 65 This response further affirms my position, as
expressed in the Preliminary Draft, that the substance of the Complainant’s argument concerns
an entirely separate point, namely that Meta Ireland is not entitled to rely on Article 6(1)(b) GDPR
as a lawful basis for processing in the context of the Instagram service. If the Complainant
succeeds in that latter argument, it follows that another legal basis must be relied on and in this
instance, in the Complainant’s view, that legal basis would have to be consent. In my view, this
alternative argument - to the effect that consent is the only remaining possible lawful basis
because no other basis can be used lawfully for this particular agreement – is properly considered
in the context of Issue 2, i.e. whether Meta Ireland is entitled to rely on Article 6(1)(b) GDPR.

58. For completeness, I shall return to and address the Complainant’s assertion that the definition of
consent must be distinguished from the condition of validity.69 Elaborating on this point, the
Complainant sought to rely on Article 7(2) and (4) GDPR. As I have outlined above, Article 7(2)
GDPR states:

“If the data subject’s consent is given in the context of a written declaration which also
concerns other matters, the request for consent shall be presented in a manner which is
clearly distinguishable from the other matters, in an intelligible and easily accessible form,
using clear and plain language. Any part of such a declaration which constitutes an
infringement of this Regulation shall not be binding.”

59. Article 7(4) GDPR states:

“When assessing whether consent is freely given, utmost account shall be taken of
whether, inter alia, the performance of a contract, including the provision of a service, is
conditional on consent to the processing of personal data that is not necessary for the
performance of that contract.”

60. At this juncture, I note that Meta Ireland’s position on this matter (as expressed in its submissions
on the Preliminary Draft) is that “arguments by the Complainant on the ‘conditions for validity’ of

64
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 44.
65
NOYB’s Submissions on the Preliminary Draft in IN-18-5-5 dated 11 June 2021, at p. 16.
69
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 68.
23

consent are entirely irrelevant to the Inquiry because Meta Ireland does not seek to obtain consent
when it obtains contractual agreement from its users to the Terms of Use”.66 I further note that
Meta Ireland does rely on consent for processing data provided by Meta Ireland’s “partners” (i.e.
third parties) about user activity off-Instagram for the purposes of providing personalised
advertising but obtains consent via a distinct user engagement flow and not via acceptance of the
Terms of Use. 67

61. In this respect, it is important to emphasise that Article 7 GDPR concerns the “conditions for
consent” but is only applicable where consent is being relied on as the legal basis for processing.
This was the view of Advocate General Szpunar in Planet49. 68 Article 7 GDPR does not operate as
a free-standing provision which indicates which lawful basis a controller must or indeed should
rely on in a particular context. Rather, the purpose of Article 7 GDPR is to assist with the
determination of whether the “conditions for validity” (to borrow the Complainant’s language)
have been met.

62. I further note that the EDPB Guidelines on Consent consider a number of circumstances in which
“bundling” (or what the Complainant refers to as “forced consent” 69 or “hidden consent” 70) may
occur. 71 For example, this occurs when consent can neither be freely given nor easily withdrawn
because the provision of consent is made part of the terms of a contract, particularly in
circumstances where there is an unequal balance of power between the data controller and the
data subject.76 As with Article 7 GDPR, consideration of bundling is only relevant where the
controller has purported to rely on consent in the first place.

63. Having considered the submissions of the Parties, including the submissions on the Preliminary
Draft, in the Draft Decision, I therefore proposed to conclude that the legal basis for processing of
personal data under the Terms of Use between Meta Ireland and Instagram users, including the
Complainant, does not, as a matter of law, have to be consent under Article 6(1)(a) GDPR and, as a
matter of fact, Meta Ireland does not rely on consent for this purpose and the agreement to the Terms
of Use does not constitute consent for the purposes of the GDPR.

As noted already above, however, the EDPB instructed the Commission (by way of paragraph 203
of the Article 65 Decision) to remove, from its Draft Decision, “its conclusion on Finding 1”. In

66
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 7, at para 5.2.
67
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 7, at para 5.2.
68
Case 673/18 Planet49 GmbH v Bundesverband der Verbraucherzentralen und Verbraucherverbände –
Verbraucherzentrale Bundesverband e.V, (Opinion of AG Szpunar), at para. 97.
69
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 41.
70
Complaint dated 25 May 2018, at p. 3.
71
EDPB Guidelines on Consent (adopted 4 May 2020), at paras. 25 – 41, in particular paras. 26 and 29.
76
EDPB Guidelines on Consent (adopted 4 May 2020), at pp. 6-7.
24

accordance with that instruction, I make no finding on the matters encompassed by the above
assessment of Issue 1.

4 ISSUE 2 - RELIANCE ON 6(1)(B) GDPR AS A LAWFUL BASIS FOR PERSONAL DATA PROCESSING

Introduction

64. As outlined above, the Complainant has submitted that Meta Ireland’s processing of personal data
under the Instagram Terms of Use must, as a matter of law, be based entirely on consent as a legal
basis under the GDPR. The Complainant’s argument also rests on the contention that Meta
Ireland cannot rely on Article 6(1)(b) GDPR to process personal data in order to perform the
Instagram Terms of Use.

Relevant Provisions

65. Pursuant to Article 8 of the EU Charter of Fundamental Rights (the “Charter”):

“1. Everyone has the right to the protection of personal data concerning him or her.

2. Such data must be processed fairly for specified purposes and on the basis of the consent
of the person concerned or some other legitimate basis laid down by law.”

66. Further detail on the principles underpinning the processing of personal data is found in Article 5
GDPR; in particular, Article 5(1)(a) GDPR provides that personal data must be “processed lawfully,
fairly and in a transparent manner in relation to the data subject”.

67. Interpretative guidance is found in Recital 39 GDPR which states that “[a]ny processing of personal
data should be lawful and fair”. Moreover, Recital 40 GDPR provides that:

“In order for processing to be lawful, personal data should be processed on the basis of
the consent of the data subject concerned or some other legitimate basis, laid down by
law, either in this Regulation or in other Union or Member State law.”

68. Article 6(1) GDPR enumerates six lawful bases for processing personal data and states:

“Processing shall be lawful only if and to the extent that at least one of the following applies:
…
(b) processing is necessary for the performance of a contract to which the data subject is
party or in order to take steps at the request of the data subject prior to entering into a
contract…”

69. In this regard, Recital 44 GDPR states:
25

“Processing should be lawful where it is necessary in the context of a contract or the
intention to enter into a contract.”

70. Recital 68 GDPR states:

“… Furthermore, that right [the right to receive personal data] should not prejudice the
right of the data subject to obtain the erasure of personal data and the limitations of that
right as set out in this Regulation and should, in particular, not imply the erasure of
personal data concerning the data subject which have been provided by him or her for the
performance of a contract to the extent that and for as long as the personal data are
necessary for the performance of that contract.”

71. In considering reliance on Article 6(1)(b) as a legal basis for processing, regard must be had, inter
alia to the respective rights of the parties to a contract, as well as Article 16 of the Charter which
provides for the freedom to conduct a business. It states that “[t]he freedom to conduct a business
in accordance with Community law and national laws and practices is recognised.”

Assessment of whether Meta Ireland was entitled to Rely on Article 6(1)(b) GDPR

72. In considering this matter, in the Draft Decision, I first examined the relationship between the
Terms of Use and the Data Policy. This assessment was necessitated by the fact that the Named
Data Subject has alleged that he agreed to the Data Policy by virtue of accepting the updated
Instagram Terms of Use. 72 Having addressed this matter, I then, in the Draft Decision, considered
the more substantive issue of whether Meta Ireland is entitled to rely on Article 6(1)(b) GDPR as
the legal basis underpinning the processing of personal data in connection with the Terms of Use.

Relationship between the Terms of Use and the Data Policy

73. The Complainant alleged that “the controller required the data subject to ‘agree’ to the entire
privacy policy and the terms”; 73 that is, by clicking the “Agree to terms” button, the Complainant
contended that the Named Data Subject agreed to both the Terms of Use and the Data Policy. As
the Investigator noted, the Complainant alleged that “that the data subject consented to
processing described in the Data Policy by clicking on the ‘Next button at the end of the first
information page of the Instagram user engagement flow”. 74 Meta Ireland’s position is that the
selection of the
“Agree to Terms” button does not mean that a data subject has agreed to the Data Policy. 75

72
Complaint dated 25 May 2018, at p. 3.
73
Complaint dated 25 May 2018, at p. 3.
74
Final Inquiry Report dated 18 January 2021, at para. 187, referring to Complainant’s Submissions on the Draft
Inquiry Report dated 19 August 2020, at pp. 42 – 43.
75
Meta Ireland’s Submissions dated 22 February 2019, at p.2, para. 2.5.
26

74. The Investigator was of the view that the Instagram Data Policy was the means by which Meta
Ireland provided information on data processing to Instagram users and was not the means by
which Instagram users provided consent to any such data processing. 76 While the Investigator
noted that the user engagement flow was “ambiguous and unclear” and it “would not be
unreasonable for a person reading the Data Policy information page to conclude that they had, in
some sense, agreed to the Data Policy”, he nonetheless concluded that the Data Policy and Terms
of Use were separate. 77

75. In the Preliminary Draft, I expressed the preliminary view that the acceptance in question was not
an act of consent but, on its terms, constituted acceptance of, or agreement to, a contract i.e. the
Terms of Use. In its submissions on the Preliminary Draft, Meta Ireland agreed with my
assessment in this regard. 78 The Complainant’s submissions on the Preliminary Draft did not
express any further views on this issue.

76. I see no reason to depart from my earlier view. Although the Data Policy was hyperlinked in the
course of the engagement flow (see Figure 1 above), I am not satisfied that the Data Policy was
thereby incorporated into the Terms of Use. The “Agree to Terms” button clearly referred to
acceptance of the “terms” as distinct from the Data Policy (and indeed the Cookies Policy). In this
sense, I agree with Meta Ireland’s view that the Data Policy is an “information document… rather
than being contractual in nature”.84 Indeed, the Data Policy is a document through which Meta
Ireland seeks to comply with particular provisions of the GDPR in relation to transparency, whereas
the Terms of Use is the contract between Meta Ireland and the Instagram user. Meta Ireland relies
on various legal bases for various data processing operations, some of which are based on
contractual necessity. Where the legal basis of contractual necessity is relied on, the contract in
question is the Terms of Use. In my view, the contract in question, and therefore the contract for
which the analysis based on Article 6(1)(b) GDPR must take place, is the Terms of Use only. The
Data Policy is only relevant insofar as it sheds light on the processing operations carried out for
which Meta Ireland relies on Article 6(1)(b) GDPR.

77. The Data Policy itself references a very wide range of processing operations. As noted in Schedule
1, the Complainant sought to direct the Commission to conduct an assessment of all processing
operations carried out by Meta Ireland in the context of the Instagram service. I have explained
why it is not open to a Complainant – who must present a complaint with a reasonable degree of
specificity – to demand such an assessment. While the Complaint refers to various examples of
data processing, e.g. the processing of behavioural data, it does not go so far as to directly link the
Complaint to specific processing operations by reference to an identifiable body of data with any
great clarity or precision. In the circumstances, it is necessary to consider the issue relating to
reliance on Article 6(1)(b) GDPR at the level of principle, and my findings are made on that basis.

76
Final Inquiry Report dated 18 January 2021, at para. 188.
77
Final Inquiry Report dated 18 January 2021, at paras. 186 - 188.
78
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 8, at para. 6.6.
84
Meta Ireland’s Submissions on the Draft Inquiry Report dated 22 June 2020, at p. 16.
27

78. More specifically, insofar as the Complaint refers to particular processing activities, it has a specific
focus on data processed to facilitate behavioural advertising. This will accordingly be the focus of
the analysis in this Decision. In the Draft Decision, in order to ensure that it had a reasonable
degree of specificity, I considered whether Meta Ireland could, in principle, rely on Article 6(1)(b)
GDPR for processing under the Instagram Terms of Use, including and in particular in the context
of behavioural advertising.

Whether Meta Ireland was Entitled to Rely on Article 6(1)(b) GDPR

Positions of the Complainant, Meta Ireland and the Investigator

79. In considering whether Meta Ireland was in fact entitled to rely on Article 6(1)(b) GDPR as the legal
basis for processing in connection with the Terms of Use, it is necessary to delineate the positions
of (i) the Complainant, (ii) Meta Ireland, and (iii) the Investigator.

The Complainant

80. In the Complaint, the Complainant expressed concern that Meta Ireland were seeking to “to
pretend that these processing operations would then fall under Article 6(1)(b) of GDRP [sic]”. 79 In
outlining their understanding of Article 6(1)(b) GDPR, the Complainant relied on the following from
the Opinion 06/2014 of the Article 29 Working Party:

“The provision [now, Article 6(1)(b)] must be interpreted strictly and does not cover
situations where the processing is not genuinely necessary for the performance of a
contract, but rather unilaterally imposed on the data subject by the controller. Also the
fact that some data processing is covered by a contract does not automatically mean that
the processing is necessary for its performance. For example, Article 7(b) [now, Article
6(1)(b)] is not a suitable legal ground for building a profile of the user’s tastes and lifestyle
choices based on his click-stream on a website and the items purchased. … Even if these
processing activities are specifically mentioned in the small print of the contract, this fact
alone does not make them ‘necessary’ for the performance of the contract”. 80

In subsequent submissions, the Complainant expanded upon its understanding of the concept of
“necessity” in data protection law. 81 The Complainant alleged that “processing which is not strictly

79
Complaint dated 25 May 2018, at p. 3.
80
Complaint dated 25 May 2018, at pp. 3 – 4, citing Opinion 06/2014 on the notion of legitimate interests of the
data controller under Article 7 of Directive 95/46/EC, at p. 16,
https://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf.
81
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 65.
28

‘necessary’ for a contract would automatically imply a violation of Article 8 in conjunction with
Article 52(1) of the Charter as it would not pass the necessity test”. 82

81. In the text of the Complaint, the Complainant further stated that Meta Ireland could only rely on
Article 6(1)(b) as a legal basis for processing which concerned a “core element of a social
network”. 83 The Complainant added that, in its view, the sections of the Terms of Use which
concerned “advertisement[s], sponsored content, analysis and improvement of the controller’s
products and alike” were not such “core elements” or a “relevant contractual obligation” and,
accordingly, Meta Ireland could not rely on Article 6(1)(b) GDPR.90 In subsequent submissions, the
Complainant alleged that while the EDPB envisages that Article 6(1)(b) GDPR might be a lawful
basis for processing which occurs for the “personalisation of content”, it could not constitute a
lawful basis where the processing “is not an integral part of using the Service”. 84

82. The Complainant expanded on its position in respect of Article 6(1)(b) GDPR as a legal basis for
processing in subsequent submissions. In this regard, the Complainant relied on the following
statement from the EDPB Guidelines on Article 6(1)(b): “’it is important to determine what the
scope of the contract is and what data would be necessary for the performance of that contract’”. 85
The Complainant alleged that neither the Commission nor the Belgian DPA had conducted such an
exercise. 86 The Complainant also proposed several steps that the Commission should follow in our
assessment of the matter. In particular, the Complainant alleged that the Instagram Terms of Use
should be assessed by reference to Belgian contract law. 87

83. In addition, the Complainant submitted that Meta Ireland did not identify, with specificity, the
“specific processing operations [which] are “necessary” for specific clauses of the contract”. 88
Rather, it is the Complainant’s position that the Commission must first clarify which clauses in the
contract between the Named Data Subject and Meta Ireland are relied on as being objectively
necessary for the performance of the contract. In the Complainant’s view:

“None of these “statements” [in the Instagram Terms of Use] can reasonably be
considered an “obligation” under the applicable provisions of the Belgian Civil Code; they

82
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 65.
83
Complaint dated 25 May 2018, at p. 5.
90
Complaint dated 25 May 2018, at p. 5.
84
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 67, citing the Guidelines
02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online
services to data subjects, version 2.0 (adopted 8 October 2019).
85
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 58.
86
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 58.
87
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at pp. 59 - 60.
88
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 51.
29

are neither enforceable, nor in possession of a specific subject matter that could be
described as a contractual commitment”. 89

The Complainant also considered the individual clauses contained in the Instagram Terms of Use
to be not contractual in nature.97

84. I further note the Complainant’s position that processing under Article 6(1)(b) GDPR could only be
lawful where such processing is in the interests of the data subject. That is, the Complainant
suggested that it is important to “draw a line in order to separate the processing necessary to
provide the services of a social network (e.g. own page, news, photo uploads) from the processing
in the sole interest of Facebook (e.g. advertising, product development)”.98

Meta Ireland

85. In the course of the Inquiry, Meta Ireland submitted that it does not seek to mislead the user by
relying on “hidden” consent in connection with any user’s acceptance of the Terms of Use.90 In
any case, Meta Ireland alleged that “the Complainant has failed to articulate any meaningful
argument that any of the specific processing described in the “The Instagram Service” section of
the Terms of Use cannot be based on Article 6(1)(b)”. 91 In addition, Meta Ireland asserted that
“the concept of what is necessary in the context of Article 6(1)(b) GDPR does not mean that
processing must be strictly essential to the performance of the contract, or the only way to perform
the underlying contract”.101 In this vein, it considered that “the processing which is necessary to
perform the full agreement entered into between the parties can include optional or conditional
elements of contract, and this is a matter for the parties to the contract”. 92 Meta Ireland also did
not consider that the contract must be in the interests of the data subject. 93

The Investigator

86. First, the Investigator did not accept the argument that the acceptance of the Terms of Use
amount to “hidden” consent. 94 Second, the Investigator formed the view that the substance of
the agreement between the parties must be examined but that the term “necessary” “does not
mean that processing must be strictly essential to performance of the contract, or the only way to
perform the underlying contract” but extends to processing which is necessary for the

89
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 60.
97
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 62.
98
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 72.
90
Meta Ireland’s Submissions dated 22 February 2019, at paras. 2.8 – 2.10.
91
Meta Ireland’s Submissions dated 22 February 2019, at para. 2.12. 101
Meta Ireland’s Submissions dated 22 June 2020, at para. 4.2.
92
Meta Ireland’s Submissions dated 22 June 2020, at para. 4.3 [footnotes omitted].
93
Meta Ireland’s Submissions dated 22 June 2020, at para. 4.4.
94
Final Inquiry Report dated 18 January 2021, at para. 223.
30

performance of the entire agreement entered into by the relevant parties. 95 The Investigator was
not convinced that the assessment of the entire agreement implied the identification of “core
functions” of the contract.96 Third, the Investigator was not satisfied that Article 6(1)(b) GDPR was
limited to contracts which were deemed to be in the interests of the data subject. 97 On this basis
of this analysis, the Investigator formed the view that Meta Ireland could rely on Article 6(1)(b)
GDPR as the lawful basis for processing in the context of the Instagram service.

My Consideration of the Issue

87. In considering this issue, I have had regard to the guidance of the EDPB on the processing of
personal data under Article 6(1)(b) GDPR (the “Article 6(1)(b) Guidelines”). 98 Although I emphasise
that the Article 6(1)(b) Guidelines are, strictly speaking, not legally binding and have considered
this issue in high-level, general terms, these guidelines are nonetheless instructive as to the factors
to be taken into account in addressing this issue. I note that the Article 6(1)(b) Guidelines clearly
states that Article 6(1)(b) may be relied on as a legal basis for processing where “the processing in
question must be objectively necessary for the performance of a contract with a data subject”. 99
It is evident from the drafting of Article 6(1)(b) that consideration of the meaning of the term
“contract” within a data protection context is required, as the existence of a contract is a
prerequisite for reliance on Article 6(1)(b) as a legal basis. However, I also consider that an
assessment of the meaning of the terms “necessary” and “performance” within this context is also
required. For completeness and contrary to the Complainant’s submissions on this matter in its
response to the Preliminary Draft, 100 I note that I do not have competence to consider substantive
issues of contract law, 101 and, accordingly, my analysis is limited to the specific contract entered
into by the Named Data Subject and Meta Ireland in respect of the Instagram service.

88. In considering the meaning of “performance” in the context of Article 6(1)(b) GDPR, I first note
that that the precise legal definition of what constitutes performance of a contract is also a matter
primarily determined by the applicable national law. Nonetheless, the recognition by the EDPB
that “processing is necessary in order that the particular contract with the data subject can be
performed” is instructive. 102 In general terms, a contract is performed when each party to that
contract discharges their contractual obligations by reference to the bargain struck between the

95
Final Inquiry Report dated 18 January 2021, at paras. 231 - 232.
96
Final Inquiry Report dated 18 January 2021, at para. 235.
97
Final Inquiry Report dated 18 January 2021, at para. 244.
98
EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, version 2.0 (adopted 8 October 2019).
99
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects, version 2.0 (adopted 8 October 2019) at para. 22.
100
NOYB’s Submissions on the Preliminary Draft in IN-18-5-5 dated 11 June 2021, at pp. 16 - 17.
101
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects, version 2.0 (adopted 8 October 2019) at paras. 9 and 13.
102
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects, version 2.0 (adopted 8 October 2019) at para. 26.
31

parties. It further seems to me that the Article 6(1)(b) Guidelines implicitly endorse an assessment
of performance of those contractual obligations by reference to whether “a requested service can
be provided”. 103 That is, it appears to me that there must be a nexus between the specific
processing operations and the bargain struck as part of the contract. 104

89. An assessment of “performance” is clearly linked to the concept of “necessity” as what is necessary
for the performance of a contract is anything which, if it is did not occur, would mean that the
specific contract entered into would not have been performed. The mere inclusion of a term in a
contract does not necessarily mean that it is necessary for the performance of that contract;
rather, a functional assessment of the specific contract should take place. This has been
recognised by the EDPB; for example, in the Article 6(1)(b) Guidelines, the EDPB indicated that the
fact that a contract mentions or refers to data processing does not necessarily imply that Article
6(1)(b) is engaged. 105 In this regard, I emphasise the EDPB’s view that “controller should be able
to demonstrate how the main subject-matter of the specific contract with the data subject cannot,
as a matter of fact, be performed if the specific processing of the personal data in question does
not occur”. 106

90. It is appropriate to say, at this juncture, that the consideration of what is necessary for the
performance of a contract entails more than a simple assessment of what is or is not written into
the terms of a contract. 107 In the Article 6(1)(b) Guidelines, the EDPB provided guidance on the
interpretation of necessity within the context of data protection law. It remains the case however
that necessity cannot be considered entirely in the abstract, and careful regard must be had for
what is necessary for the performance of the specific contract freely entered into by the parties.
In this regard, I note the EDPB’s view that:

“Where a controller seeks to establish that the processing is based on the performance of
a contract with the data subject, it is important to assess what is objectively necessary
to perform the contract. ‘Necessary for performance’ clearly requires something more
than a
contractual clause” [my emphasis]. 108

103
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects (8 October 2019) at para. 17.
104
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects (8 October 2019) at para. 30.
105
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects (8 October 2019) at para. 27.
106
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects (8 October 2019) at para. 30.
107
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects (8 October 2019) at para. 23.
108
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects (8 October 2019) at para. 27.
32

91. The Article 6(1)(b) Guidelines also set out that controller should:

“demonstrate how the main object of the specific contract with the data subject cannot,
as a matter of fact, be performed if the specific processing of the personal data in question
does not occur. The important issue here is the nexus between the personal data and
processing operations concerned, and the performance or non-performance of the service
provided under the contract.” 109

92. I also note that the term “necessary” must be understood in terms of its independent meaning
within EU law and also within the context and objective of data protection matters. In this regard,
I note that, in Heinz Huber v Bundesrepublik Deutschlan, the CJEU held that “necessity” has “its
own independent meaning” in EU law and “must be interpreted in a manner which fully reflects
the objective of that directive” (in that case, the relevant measure was Directive 95/46/EC, the
predecessor of the GDPR). 110 In my view, this indicates that necessity should be interpreted by
reference to the objectives of the relevant legislative measure, i.e. the GDPR in this context.

93. Moreover, I consider it prudent to emphasise that, in Huber, the CJEU also indicated that it may
be appropriate to consider whether the chosen course of action enables the “legislation to be
more effectively applied”, suggesting that “necessity” does not require the most minimal
processing possible. 111 In this regard, I share the Investigator’s view122 that this implies that a strict
necessity test is not envisaged but rather, the test includes processing beyond the most minimal
to meet the objective where the processing renders a lawful objective “more effective”. 112
However, the EDPB proposes clear limits to this by stating that “merely referencing or mentioning
data processing in a contract is not enough to bring the processing in question within the scope of
Article 6(1)(b).” 113

94. The Article 6(1)(b) Guidelines emphasise that necessity is assessed by reference to the “particular
contract with the data subject”. 114 In this respect, the EDPB have regard to the “core” functions
of the contract; this is reflective of the Complainant’s position that the core functions of the
contract must be determined so as to assess whether the processing is objectively necessary to
perform that contract. 115 In the Draft Decision, I expressed the view that it is correct to define

109
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects (8 October 2019) at para. 30.
110
Case C-524/06 Heinz Huber v Bundesrepublik Deutschland [2008] ECR I-09705 at para. 52.
111
Case C-524/06 Heinz Huber v Bundesrepublik Deutschland [2008] ECR I-09705 at para. 66.
122
Final Inquiry Report dated 18 January 2021, at para. 230(vi).
112
See Case C-524/06 Heinz Huber v Bundesrepublik Deutschland [2008] ECR I-09705 at para. 62.
113
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects, version 2.0 (adopted 8 October 2019) at para. 27.
114
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects, version 2.0 (adopted 8 October 2019) at para. 26.
115
Complaint dated 25 May 2018, at p. 5.
33

necessity by reference to the core functions of the specific contract at issue. I further agreed that
the EDPB is correct that necessity for the purposes of Article 6(1)(b) is determined by reference to
the particular and specific contract 116 that has been entered into by the controller (and/or
processor) and data subject(s). It follows that the approach I had taken in the Draft Decision was
to assess whether the relevant processing operation(s) were necessary to fulfil the particular and
specific contract entered into by the Named Data Subject and Meta Ireland (i.e. the Instagram
Terms of Use).

95. There is an interrelationship between the concepts of “necessary”, “performance” and “contract”
and, accordingly, an assessment of the core functions of a contract cannot be considered in
isolation from those concepts. That is, it would be incorrect to assess, at a general level, whether
the operations are necessary to achieve the objective of a “social network” platform. Rather, the
operations must be necessary to fulfil the core agreement between Meta Ireland and the
Instagram users, reflected in the terms of the precise contract between those parties. Therefore,
I must examine the contract itself and ascertain the core functions of the contract for the purpose
of considering whether the processing operations are necessary to fulfil these functions. In doing
so, I reiterate my previous statement that issues concerning the validity and/or substance of the
contract – as matters of national contract law - are outside the scope of the Commission.
Nonetheless, I share the EDPB’s view that, in my assessment, “regard should be given to the
particular aim, purpose, or objective of the service”. 117 In this sense, I am considering the bargain
that was struck between the parties. I agree that the correct approach is to examine the actual
bargain which has been struck between the parties and determine the core function of the
contract
by reference to this. Therefore, the inclusion of a term which does not relate to the core function
of the contract could not be considered necessary for its performance.

96. In determining the scope of the contract – and, indeed, whether Article 6(1)(b) GDPR is applicable
to the processing at issue – the EDPB recommends considering the following questions:

• What is the nature of the service being provided to the data subject?
• What are its distinguishing characteristics?
• What is the exact rationale of the contract (i.e. its substance and fundamental object)?
• What are the essential elements of the contract?
• What are the mutual perspectives and expectations of the parties to the contract?
How is the service promoted or advertised to the data subject? Would an ordinary user
of the service reasonably expect that, considering the nature of the service, the

116
I note that the EDPB appears to use “particular” and “specific” interchangeably: Guidelines 02/2019 on the
processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data
subjects, version 2.0 (adopted 8 October 2019) at paras. 26 and 30.
117
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the context
of the provision of online services to data subjects, version 2.0 (adopted 8 October 2019) at para. 30.
34

envisaged processing will take place in order to perform the contract to which they
are a party.” 118

97. I note that the Complaint does not specify with precision the processing operation(s) or extent
thereof which the Complainant does not consider necessary for the performance of the contract
between Meta Ireland and Instagram users. Rather, the Complaint stated that operations “like
advertisement, sponsored content, analysis and improvement of the controller’s products” could
not be a “core element of a social network”.130 As I outlined above, there is a difference between
what is necessary for a social network and what is necessary to perform a particular contract.
Nonetheless, in the interests of good faith, I will consider whether the delivery of personalised
advertising (given that the Complainant focusses on these processing operations) is necessary for
the performance of the contract between Meta Ireland and the Named Data Subject.

98. Pursuant to the Terms of Use, the contract between Meta Ireland and Instagram users is for the
following services:

“Offering personalized opportunities to create, connect, communicate, discover, and
share.
…
Fostering a positive, inclusive, and safe environment.
…
Developing and using technologies that help us consistently serve our growing community.
…
Providing consistent and seamless experiences across other Facebook Company Products.
…
Ensuring a stable global infrastructure for our Service.
…
Connecting you with brands, products, and services in ways you care about.
…
Research and innovation.”

I note, at this juncture, the Complainant’s submissions, made in the course of the Inquiry, that the
services outlined above cannot be considered to be “contractual commitments” under Belgian law
as they lack any “enforceable” obligations. 119 To reiterate my position in this regard as outlined
in Schedule 1 to this Decision, in discharging my functions the 2018 Act and/or the GDPR, I would
be acting outside the remit of the powers and functions contained therein if I were to consider
the legality and/or validity of a contract by reference to domestic contract law.

118
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online services to data subjects (8 October 2019) at paras. 32 to 33. 130 Complaint dated 25 May 2018, at p. 5.
119
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at p. 60.
35

99. In the Preliminary Draft, I carried out an analysis of the Terms of Use for the purposes of
ascertaining the core functions of the contract. Despite this analysis, the Complainant alleged
that the Commission “has in no way investigated which specific clauses of the ‘Terms of [Use]’
are used by [Meta Ireland] to justify the specific purpose of its processing, the type of data
processed, and the applicable legal basis”. 120 Given that I considered each aspect of the Terms
of Use which related to personalised advertising, i.e. those which related to the scope of the
Complaint (notwithstanding the fact that the Complaint was not clear in this respect), there is
simply no truth to this assertion. Rather, it appears to me that the Complainant conflated this
issue with the sufficiency of the information provided which is dealt with in Issue 3 below.

100. In respect of the above clauses of the contract between Meta Ireland and Instagram users, I am
satisfied that the first (“Offering personalized opportunities to create, connect, communicate,
discover, and share”) and the sixth (“Connecting you with brands, products, and services in ways
you care about”) clauses concern personalisation. In order to consider the substance of this
clause, it is illustrative to outline the further detail provided in the Terms of Use in respect of
both.

101. In respect of the first clause, the Terms of Use provides the following additional detail:

“People are different. We want to strengthen your relationships through shared
experiences you actually care about. So we build systems that try to understand who and
what you and others care about, and use that information to help you create, find, join,
and share in experiences that matter to you. Part of that is highlighting content, features,
offers, and accounts you might be interested in, and offering ways for you to
experience Instagram, based on things you and others do on and off Instagram” [my
emphasis].

102. The sixth clause of the Terms of Use states:

“We use data from Instagram and other Facebook Company Products, as well as from
thirdparty partners, to show you ads, offers, and other sponsored content that we
believe will be
meaningful to you. And we try to make that content as relevant as all your other
experiences
on Instagram” [my emphasis].

103. I acknowledge the Complainant’s general position that advertising is not necessary in order to
deliver a social network, and that simply placing terms providing for (personalised and/or
targeted) advertising in the contract does not make them necessary. While I accept that this may
be true in some circumstances, I am not satisfied that the fulfilment of both clauses is not

120
NOYB’s Submissions on the Preliminary Draft in IN-18-5-5 dated 11 June 2021, at p. 17.
36

necessary in order to fulfil the specific contract entered into between Meta Ireland and Instagram
users. Indeed, it is Meta Ireland’s position that personalised advertising is one of its “core”
functions. To borrow from the language of the EDPB, it appears to me that personalised
advertising is one of the “distinguishing factors” of Instagram and, as Instagram is promoted as
such, “an ordinary user of the service [would] reasonably expect that, considering the nature of
the service, the envisaged processing will take place in order to perform the contract”. 121

104. In my view, the position of the Complainant seems to go so far as to say that processing will
generally only be necessary for the performance of the contract if not carrying out the processing
would make the performance of the contract impossible. In this regard, it should be noted that
the EDPB states that:

“as a general rule, processing of personal data for behavioural advertising is not necessary
for the performance of a contract for online services. Normally, it would be hard to argue
that the contract had not been performed because there were no behavioural ads. This is
all the more supported by the fact that data subjects have the absolute right under Article
21 to object to processing of their data for direct marketing purposes”. [my emphasis] 122

105. The Article 6(1)(b) Guidelines, while not binding on the Commission, clearly set out a very
restrictive view on when processing should be deemed to be “necessary” for the performance of
a contract, and explicitly refer to personalised advertising as an example of processing that will
usually not be necessary. The use of the qualifier “as a general rule” is important to note. Indeed,
the EDPB has explicitly recognised that there may be some circumstances in which personalised
advertising may well be considered necessary for the performance of a contract. In this respect,
I also note that the EDPB has acknowledged that the “personalisation of content may (but does
not always) constitute an essential or expected element of certain online services”. 123 The core
issue under consideration is whether, having regard the exact terms of the contract, the inclusion
of behavioural advertising as a contractual term makes data processing conditional on the
delivery of a contract, where that processing is not itself necessary to actually deliver the
contract. The counter-argument to this is that behavioural advertising is the core of both Meta
Ireland’s business model and the bargain struck between Meta Ireland and Instagram users and,
accordingly, processing in this regard is necessary to fulfil the contract between Meta Ireland and
the Named Data Subject.

106. In the Preliminary Draft, I expressed a provisional view that, in considering the specific contract
entered into between Meta Ireland and Instagram users, it is made clear, from the first and sixth

121
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the context
of the provision of online services to data subjects, version 2.0 (adopted 8 October 2019) at para. 33.
122
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the context
of the provision of online services to data subjects, version 2.0 (adopted 8 October 2019) at para. 52.
123
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the context
of the provision of online services to data subjects, version 2.0 (adopted 8 October 2019) at para. 54.
37

clauses, that the core of the service offered is premised on the delivery of personalised
advertising. I note that in its submissions on the Preliminary Draft, Meta Ireland stated that the
text of the Terms of Use supports its position that “the delivery of personalised advertising is a
core part of its service to users”. 124 Moreover, Meta Ireland went further and stated that
Instagram users also “understand… that Meta Ireland offers a service that facilitates the creation
of a unique personalised and social online experience for its users, including with respect to
personalised advertising”.125 The Complainant did not expressly consider these specific clauses
in its submissions, either on the Preliminary Draft or during the course of the inquiry.

107. It remains my view that the text of the first and sixth clauses are clear that the core of the service
offered by Meta Ireland is premised on the delivery of personalised advertising. This is
notwithstanding the EDPB’s view that processing cannot be rendered lawful by Article 6(1)(b)
GDPR “simply because processing is necessary for the controller’s wider business model”. 126
Indeed, in considering this contract by reference to the criteria set out in paragraph 33 of the
Article 6(1)(b) Guidelines, further support for my position can be seen. For example, the Terms
of Use describe the Instagram service as being “personalised” and connects users with brands,
including by means of providing “relevant” advertising and content. It is clear that the Instagram
service is advertised as offering a “personalised” experience, including by way of the advertising
it delivers to users.

108. In its submissions on the Preliminary Draft, the Complainant stated that “there is no evidence for
the speculation as to the view of an average data subject on the ‘bargain’”.139 While I accept that
it is not impossible to ascertain the view of every data subject as to the nature of the bargain
struck between that user and Meta Ireland, it is reasonable to assume that the average user
would read the text of the Terms of Use prior to acceptance. As the Instagram service is
advertised (in the Terms of Use) as being predicated on personalised advertising, it is my view
that any reasonable user would understand and expect that this is part of the core bargain that
is being struck with Meta Ireland, albeit I acknowledge that users may prefer that the market
offer alternative choices.
As personalised advertising forms part of the core bargain struck between Meta Ireland and
Instagram users, I am satisfied that any processing necessary for the delivery of such advertising
may fall within the scope of Article 6(1)(b) GDPR.

109. In this regard, while I do consider the processing necessary for the performance of the particular
contract, I am not making a determination as to whether the contract is impossible to perform
in the absence of personalised advertising. In respect of the question as to whether the
“necessity” test requires a threshold of “impossibility”, I have already pointed out, and indeed

124
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 9, at para. 6.8(D).
125
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 9, at para. 6.8(C).
126
Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the context
of the provision of online services to data subjects, version 2.0 (adopted 8 October 2019) at para. 36. 139 NOYB’s
Submissions on the Preliminary Draft in IN-18-5-5 dated 11 June 2021, at pp. 17 - 18.
38

also noted in the Preliminary Draft, that the Article 6(1)(b) Guidelines are not legally binding and
do not necessarily determine the application of the general principles to specific cases. In its
submissions on the Preliminary Draft, the Complainant considered it noteworthy that I
acknowledged that these guidelines were non-binding in nature 127 whereas Meta Ireland shared
the view that they were non-binding. 128

110. Notwithstanding my position that the guidelines are non-binding, it is important to emphasise
that I agree with the majority of the arguments of both the Complainant and the EDPB in relation
to the correct interpretation of Article 6(1)(b) GDPR. However, I do have difficulty with a strict
threshold of “impossibility” in the assessment of necessity. By “impossibility”, I am referring to
the argument put forward that a particular term of a contract (here, behavioural advertising) is
not necessary to deliver an overall service or contract. In particular, I consider that is not correct
to assess necessity as against the delivery of an overall service in the abstract. Rather, as I have
stated above, I consider the appropriate assessment to be one which considers what is necessary
by reference to core function of the particular contract.

111. I accept that either form of assessment will require an element of reasoning in the abstract (in
particular, when considering the mutual perspectives and expectations), I am also of the view
that it is not for an authority such as the Commission, tasked with the enforcement of data
protection law, to make assessments as to what will or will not make the performance of a
contract possible or impossible. Instead, the general principles set out in the GDPR and explained
by the EDPB in the guidelines must be applied. That said, it must be emphasised that these
principles must be applied on a case-by-case basis. While the examples provided in any form of
EDPB guidance are helpful and instructive, they are not necessarily conclusive of the position in
any specific case and indeed do not purport to be. This is particularly the case with the Guidelines
on Article 6(1)(b) GDPR.

112. For completeness, I note that in its submissions on the Preliminary Draft, Meta Ireland expressed
its view as to whether the necessity test encompasses an impossibility threshold. Relying on
Huber, Meta Ireland asserted that the CJEU consider that the “the concept of necessity is fact
sensitive and must be considered in light of the specific circumstances (i.e. the context) of the
processing and the purpose it aims to achieve”. 129 Without prejudice to this position, Meta
Ireland also submitted that were impossibility an aspect of necessity, it would not, in any case,
operate as a “blanket prohibition” on relying on Article 6(1)(b) GDPR as the legal basis for
processing in this context. 130 In essence, it is Meta Ireland’s position that, in the specific context
of the Instagram service, personalised advertising may constitute a distinguishing feature of said
service which is an “exact rationale” and one of the “essential elements of the Terms of Use” for

127
NOYB’s Submissions on the Preliminary Draft in IN-18-5-5 dated 11 June 2021, at p. 19.
128
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at pp. 9 - 10, at para. 6.8(E).
129
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 10, at para. 6.8(F).
130
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at pp. 10 - 11, at para. 6.8(G).
39

which the ordinary user would reasonably expect their personal data to be processed so as to
receive the Instagram service as advertised. 131

113. In the Draft Decision, I noted that, given that it involves a consideration of the specific contract
between the relevant parties, it necessarily follows that any assessment of necessity in this
context must be fact-specific to a certain degree. In the Draft Decision, I also added that, as I do
not consider “impossibility” to form part of a consideration of what is necessary for the
performance of that specific contract, it was not necessary to consider Meta Ireland’s
submissions on this particular point.

114. On the basis of the above, I concluded, in the Draft Decision, that neither Article 6(1)(b) nor any
other provision of the GPDR preclude Meta Ireland from relying on Article 6(1)(b) GDPR as a legal
basis for the delivery of a service based on behavioural advertising of the kind provided for under
the contract between Meta Ireland and its users at issue in this Complaint. In the Draft Decision,
I noted that, as discussed below, other provisions of the GDPR (such as transparency, which I
consider at Issue 3) act to strictly regulate the manner in which this service is to be delivered, and
the information that should be given to users.

115. Having analysed the submissions of the parties in the course of the Inquiry and on the Preliminary
Draft, the terms of the GDPR, and the CJEU jurisprudence and EDPB Guidelines, I found, in the
Draft Decision, that there was no basis for the contention that Meta Ireland is precluded in
principle from relying on Article 6(1)(b) GDPR for the purposes of legitimising the personal data
processing activities involved in the provision of the Instagram service to users, including
behavioural advertising insofar as that forms a core part of the service. It was my view, as
expressed in the Draft Decision, that there is nothing in the GDPR that restricts or prohibits the
use of these terms in the context of processing personal data per se. As has been set out earlier,
and as set out by the Investigator, it is not for the Commission to rule on matters of contract law
and contractual interpretation that extend beyond the remit of data protection law. The lawful
basis under Article 6(1)(b) GDPR simply states that personal data may be processed where it is
necessary for the performance of a contract. In other words and, as I have already set out in my
analysis, the data may be processed if, without such processing, the contract could not be
performed. My view, as expressed in the Draft Decision, was that I was not convinced, for the
reasons set out, that Article 6(1)(b) GDPR goes a step further and excludes all processing unless
the fulfilment of some abstractly discerned purpose would be rendered impossible without that
processing. I was also of the view, as outlined in the Draft Decision, that this application conforms
broadly to significant elements of the interpretation of Article 6(1)(b) GDPR proposed by the
Complainant and by the EDPB.

116. In the Draft Decision, I noted that while I accepted that, as a general rule, the EPDB considers
that processing for online behavioural advertising would not be necessary for the performance
of a contract for online services, in this particular case, having regard to the specific terms of the

131
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at pp. 10 - 11, at para. 6.8(G) – (H).
40

contract and the nature of the service provided and agreed upon by the parties, I concluded that
Meta Ireland may in principle rely on Article 6(1)(b) as a legal basis of the processing of users’
data necessary for the provision of the Instagram service, including through the provision of
behavioural advertising insofar as this forms a core part of that service offered to and accepted
by users.

117. I also noted, in the Draft Decision, that having regard to the scope of the Complaint and this
Inquiry, as described above, this was not to be construed as an indication that all processing
operations carried out on users’ personal data are necessarily covered by Article 6(1)(b) GDPR.

118. Following the circulation of the Commission’s Draft Decision to the supervisory authorities
concerned, for the purpose of enabling them to express their views in accordance with Article
60(3) GDPR, objections to this aspect of matters were raised by the supervisory authorities of
Austria, Germany, Spain, Finland, France, Hungary, the Netherlands, Norway and Sweden each
raised an objection to the finding proposed under this particular heading. Having considered the
merits of those objections, the EDPB determined as follows:

97. The EDPB considers it necessary to begin its assessment on the merits with a general
description of the practice of behavioural advertising carried out in the context of the Instagram
service before determining whether the legal basis of Article 6(1)(b) GDPR is appropriate for
this practice in the present case, based on the Instagram Terms of Use and the nature of its
products and features as described in those terms. The requests for preliminary rulings made
to the CJEU in the cases C-252/21 and C-446/21 to which some of the documents in the file refer
contain helpful descriptions of Meta’s behavioural advertising practices in the context of its
Facebook services . Given that behavioural advertising is also carried out in the context of the
Instagram service, and given the similarities between the two services, relying on the same
Data Policy , the EDPB considers that these cases are also useful in gaining an understanding
of the practice of behavioural advertising in relation to the Instagram service. Furthermore, in
the request for a preliminary ruling in case C-252/21, it is mentioned that if the CJEU answers
the question 7 positively (regarding the competence of a Member State national competition
authority to determine, when assessing the balance of interests whether data processing and
their terms comply with the GDPR) that the questions 3 to 5 must be answered in relation to
data from the use of the group’s Instagram service. In addition, Meta IE makes reference to
both of these requests for preliminary rulings in its submissions, and therefore clearly considers
them relevant to this case .

98. These requests for preliminary rulings mention that Meta IE collects data on its
individual users and their activities on and off its Facebook service via numerous means such
as the service itself, other services of the Meta group including Instagram, WhatsApp and
Oculus, third party websites and apps via integrated programming interfaces such as Facebook
Business Tools or via cookies, social plug-ins, pixels and comparable technologies placed on the
internet user’s computer or mobile device . According to the descriptions provided, Meta IE links
these data with the user’s Facebook account to enable advertisers to tailor their advertising to
Facebook’s individual users based on their consumer behaviour, interests, purchasing power
and personal situation. This may also include the user’s physical location to display content
relevant to the user’s location. Meta IE offers its services to its users free of charge and
generates revenue through this personalised advertising that targets them, in addition to static
advertising that is displayed to every user in the same way.

99. The EDPB considers that these general descriptions signal by themselves the
complexity, massive scale and intrusiveness of the behavioural advertising practice that Meta
IE conducts through the Facebook service, as well as off the Facebook service itself, through
third party websites and apps which are connected to Facebook.com via programming
interfaces (“Facebook Business Tools”), including the Instagram service . Furthermore, among
the aspects described in the Instagram Terms of Use is “Providing consistent and seamless
experiences across other Facebook Company Products.” which involves “shar[ing] technology,
systems, insights, and information-including the information we have about you.” It is therefore
clear that personal data is shared between Facebook companies (”We use data from Instagram
and other Facebook Company Products, as well as from third-party partners, to show you ads
(...)”

100. These are relevant facts to consider to assess the appropriateness of Article 6(1)(b)
GDPR as a legal basis for behavioural advertising and to what extent reasonable users may
understand and expect behavioural advertising when they accept the Instagram Terms of Use
and perceive it as necessary for Meta IE to deliver its service . Accordingly, the EDPB further
considers that the IE SA could have added to its Draft Decision a description of behavioural
advertising that Meta IE conducts through the Instagram service to appropriately substantiate
its reasoning leading to its acceptance of Article 6(1)(b) GDPR as a legal basis for that practice
in accordance with the IE SA’s duty to state the reasons for an individual decision .

101. Notwithstanding the EDPB’s considerations above, the EDPB considers that there is
sufficient information in the file for the EDPB to decide whether the IE SA needs to change its
Draft Decision insofar as it rejects the complainant’s claim that the GDPR does not permit Meta
IE’s reliance on Article 6(1)(b) GDPR to process personal data in the context of its offering of
the Instagram service, based on its Terms of Use.

102. As described above in section 4.1., the IE SA concludes in Finding 2 of its Draft Decision
that the Complainant’s case was not made out that the GDPR does not permit the reliance by
Meta IE on Article 6(1)(b) GDPR in the context of its offering of Terms of Use, neither Article
6(1)(b) GDPR nor any other provision of the GDPR precludes Meta IE from relying on Article
6(1)(b) GDPR as a legal basis to deliver a service, including behavioural advertising insofar as
that forms a core part of the service . The IE SA considers that, having regard to the specific
42

terms of the contract and the nature of the service provided and agreed upon by the parties,
Meta IE

may in principle rely on Article 6(1)(b) GDPR as a legal basis of the processing of users’ data
necessary for the provision of its Instagram service, including through the provision of
behavioural advertising insofar as this forms a core part of its service offered to and accepted
by its users . The IE SA considers the core of the service offered by Meta IE is premised on the
delivery of personalised advertising . The IE SA considers a reasonable user would understand
and expect this having read the Terms of Use . Meta IE supports this conclusion of the IE SA .

103. To assess these claims of the IE SA and Meta IE, the EDPB considers it necessary to
recall the general objectives that the GDPR pursues, which must guide its interpretation,
together with the wording of its provisions and its normative context .

104. The GDPR develops the fundamental right to the protection of personal data found in
Article 8(1) of the EU Charter of Fundamental Rights and Article 16(1) of the TFEU, which
constitute EU primary law . As the CJEU clarified, “an EU act must be interpreted, as far as
possible, in such a way as not to affect its validity and in conformity with primary law as a whole
and, in particular, with the provisions of the Charter. Thus, if the wording of secondary EU
legislation is open to more than one interpretation, preference should be given to the
interpretation which renders the provision consistent with primary law rather than to the
interpretation which leads to its being incompatible with primary law” . In the face of rapid
technological developments and increases in the scale of data collection and sharing, the GDPR
creates a strong and more coherent data protection framework in the Union, backed by strong
enforcement, and built on the principle that natural persons should have control of their own
personal data . By ensuring a consistent, homogenous and equivalent high level of protection
throughout the EU, the GDPR seeks to ensure the free movement of personal data within the
EU . The GDPR acknowledges that the right to data protection needs to be balanced against
other fundamental rights and freedoms, such as the freedom to conduct a business, in
accordance with the principle of proportionality and has these considerations integrated into
its provisions . The GDPR, pursuant to EU primary law, treats personal data as a fundamental
right inherent to a data subject and his/her dignity, and not as a commodity data subjects can
trade away through a contract . The CJEU provided additional interpretative guidance by
asserting that the fundamental rights of data subjects to privacy and the protection of their
personal data override, as a rule, a controller’s economic interests .

105. The principle of lawfulness of Article 5(1)(a) and Article 6 GDPR is one of the main
safeguards to the protection of personal data. It follows a restrictive approach whereby a
controller may only process the personal data of individuals if it is able to rely on one of the
bases found in the exhaustive and restrictive lists of the cases in which the processing of data
is lawful under Article 6 GDPR .

106. The principle of lawfulness goes hand in hand with the principles of fairness and
transparency in Article 5(1)(a) GDPR. The principle of fairness includes, inter alia, recognising
the reasonable expectations of the data subjects, considering possible adverse consequences
processing may have on them, and having regard to the relationship and potential effects of
imbalance between them and the controller .

107. The EDPB agrees with the IE SA and Meta IE that there is no hierarchy between these
legal bases . However, this does not mean that a controller, as Meta IE in the present case, has
45

absolute discretion to choose the legal basis that suits better its commercial interests. The
controller may only rely on one of the legal bases established under Article 6 GDPR if it is
appropriate for the processing at stake . A specific legal basis will be appropriate insofar as the
processing can meet its requirements set by the GDPR and fulfil the objective of the GDPR to
protect the rights and freedoms of natural persons and in particular their right to the protection
of personal data . The legal basis will not be appropriate if its application to a specific processing
defeats this practical effect “effet utile” pursued by the GDPR and Article 5(1)(a) and Article 6
GDPR . These criteria stem from the content of the GDPR and the interpretation favourable to
the rights of data subjects to be given thereto described in paragraph 104 above .

108. The GDPR makes Meta IE, as a data controller for the processing at stake, directly
responsible for complying with the Regulation’s principles, including the processing of data in
a lawful, fair and transparent manner, and any obligations derived therefrom . This obligation
applies even where the practical application of GDPR principles such as those of Article 5(1)(a)
and Article (5)(2) GDPR is inconvenient or runs counter to the commercial interests of Meta IE
and its business model. The controller is also obliged to be able to demonstrate that it meets
these principles and any obligations derived therefrom, such as that it meets the specific
conditions applicable to each legal basis .

109. The first condition to be able to rely on Article 6(1)(b) GDPR as a legal basis to process
the data subject’s data is that a controller, in line with its accountability obligations under
Article 5(2) GDPR, has to be able to demonstrate that (a) a contract exists and (b) the contract
is valid pursuant to applicable national contract laws .

110. Both the IE SA and Meta IE consider that the Terms of Use make up the entire
agreement between the Instagram user and Meta IE and that the Data Policy is simply a
compliance document setting out information to fulfil the GDPR transparency obligations . The
IE SA thus considers that the contract for which the analysis based on Article 6(1)(b) GDPR takes
place, is the Terms of Use .

111. The IE SA and Meta IE argue that the GDPR does not confer a broad and direct
competence to supervisory authorities to interpret or assess the validity of contracts .

112. The EDPB agrees that SAs do not have under the GDPR a broad and general
competence in contractual matters. However, the EDPB considers that the supervisory tasks
that the GDPR bestows on SAs imply a limited competence to assess a contract’s general
validity insofar as this is relevant to the fulfilment of their tasks under the GDPR. Otherwise, the
SAs would see their monitoring and enforcement task under Article 57(1)(a) GDPR limited to
actions such as verifying whether the processing at stake is necessary for the performance of a
contract (Article 6(1)(b) GDPR), and whether a contract with a processor under Article 28(3)
GDPR and data importer under Article 46(2) GDPR includes appropriate safeguards pursuant
to the GDPR. Pursuant to the IE SA’s interpretation, the SAs would thus be obliged to always
consider a contract valid, even in situations where it is manifestly evident that it is not, for
instance because there is no proof of agreement between the two parties, or because the
contract does not comply with its Member State’s rules on the validity, formation or effect of a
contract in relation to a child .

113. As the DE and NL SAs argue, the validity of the contract for the Instagram service
50

between Meta IE and the complainant is questionable, given the strong indications that the
Complainant was unaware of entering into a contract, and (as the IE SA establishes with its
Finding 3 of its Draft Decision) serious transparency issues in relation to the legal basis relied
on. In contract law, as a general rule, both parties must be aware of the substance of the
contract and the obligations of both parties to the contract in order to willingly enter into such
contract.

114. Notwithstanding the possible invalidity of the contract, the EDPB, refers to its previous
interpretative guidance on this matter to provide below its analysis on whether behavioural
advertising is objectively necessary for Meta IE to provide its Instagram service to the user
based on its Terms of Use and the nature of the service .

115. The EDPB recalls that for the assessment of necessity under Article 6(1)(b) GDPR, “[i]t
is important to determine the exact rationale of the contract, i.e. its substance and fundamental
objective, as it is against this that it will be tested whether the data processing is necessary for
its performance” . As the EDPB has previously stated, regard should be given to the particular
aim, purpose, or objective of the service and, for applicability of Article 6(1)(b) GDPR, it is
required that the processing is objectively necessary for a purpose and integral to the delivery
of that contractual service to the data subject .

116. Moreover, the EDPB notes that the controller should be able to justify the necessity of
its processing by reference to the fundamental and mutually understood contractual purpose.
This depends not only on the controller’s perspective, but also on a reasonable data subject’s
perspective when entering into the contract .

117. The IE SA accepts the EDPB’s position that, as a general rule, processing of personal
data for behavioural advertising is not necessary for the performance of a contract for online
services . However, the IE SA considers that in this particular case, having regard to the specific
terms of the contract and the nature of the Instagram service provided and agreed upon by the
parties, Meta IE may in principle rely on Article 6(1)b) GDPR to process the user’s data necessary
for the provision of its service, including through the provision of behavioural advertising
insofar as this forms a core part of that service offered to and accepted by users .

118. The IE SA views behavioural advertising as “the core of both Meta Ireland’s business
model and the bargain struck between Meta Ireland and Instagram users” . In support of this
consideration, the IE SA refers to the ”first and sixth clauses” of “the specific contract entered
into between Meta IE and Instagram users” . The IE SA considers that from the text of these
“clauses” it is “clear that the core of the service offered by Meta Ireland is premised on the
delivery of personalised advertising. ” The IE SA considers that this position is supported by the
fact that “the Terms of Use describe the Instagram service as being ‘personalised’ and connects
users with brands, including by means of providing ‘relevant’ advertising and content.” Based
on this, the IE SA is of the view that “It is clear that the Instagram service is advertised as
offering a 'personalised' experience, including by way of the advertising it delivers to users .”
The IE SA considers that as the Instagram service is “advertised” in its Terms of Use “as being
predicated on personalised advertising (...) any reasonable user would expect and understand

that this is part of the core bargain that is being struck (...)” but acknowledges that “users may
52

prefer that the market offer alternative choices .”

119. On this issue, the EDPB recalls that the concept of necessity has its own independent
meaning under EU law. It must be interpreted in a manner that fully reflects the objective
pursued by an EU instrument, in this case, the GDPR . Accordingly, the concept of necessity
under Article 6(1)(b) GDPR cannot be interpreted in a way that undermines this provision and
the GDPR’s general objective of protecting the right to the protection of personal data or
contradicts Article 8 of the Charter . On the processing of data in the Facebook services,
Advocate General Rantos supports a strict interpretation of Article 6(1)(b) GDPR among other
legal bases, particularly to avoid any circumvention of the requirement for consent . Given the
similarities between the Facebook and Instagram services, as explained above in paragraph 97,
and the fact that this case may concern the legal basis for processing of personal data for the
Instagram service .

120. As the IE SA states in its Draft Decision, “Instagram is a global online social network
service which allows registered users to communicate with other registered users through
messages, audio, video calls and video chats, and by sending images and video files .” Meta IE
promotes among its prospective and current users the perception that the main purpose of the
Instagram service and for which it processes its users’ data is to enable them to share content
and communicate with others. Meta IE presents its Instagram service on its “About” page of its
website as a platform which “give[s] people the power to build community and bring[s] the
world closer together .” At the beginning of its Terms of Use, Meta IE presents its mission for
the Instagram service as “To bring you closer to the people and things you love .” The
description of the aspects of the service includes “Offering personalized opportunities to create,
connect, communicate.”

121. The fact that the Terms of Use do not provide for any contractual obligation binding
Meta IE to offer personalised advertising to the Instagram users and any contractual penalty if
Meta IE fails to do so shows that, at least from the perspective of the Instagram user, this
processing is not necessary to perform the contract . Providing personalised advertising to its
users may be an obligation between Meta IE and the specific advertisers that pay for Meta IE’s
targeted display of their advertisements in the Instagram service to Instagram users, but it is
not presented as an obligation towards the Instagram users.

122. Nor does Meta IE’s business model of offering services, at no monetary cost for the user
to generate income by behavioural advertisement to support its Instagram service make this
processing necessary to perform the contract. Under the principle of lawfulness of the GDPR
and its Article 6, it is the business model which must adapt itself and comply with the
requirements that the GDPR sets out in general and for each of the legal bases and not the
reverse. As the Advocate General Rantos stressed recently in his opinion on Meta IE’s processing
in Facebook, based on Article 5(2) GDPR, it is the controller (Meta IE) in this case who is
responsible for demonstrating that the personal data are processed in accordance with the
GDPR .

123. As the EDPB provided in its guidance, “Assessing what is ‘necessary’ involves a
combined, fact-based assessment of the processing ‘for the objective pursued and of whether
it is less intrusive compared to other options for achieving the same goal’. If there are realistic,

less intrusive alternatives, the processing is not ‘necessary’. Article 6(1)(b) will not cover
processing which is useful but not objectively necessary for performing the contractual service
or for taking

relevant pre-contractual steps at the request of the data subject, even if it is necessary for the
controller’s other business purposes. ”

124. On the question of whether here there are realistic, less intrusive alternatives to
behavioural advertising that make this processing not “necessary” , the EDPB considers that
there are. The AT and SE SAs mention as examples contextual advertising based on geography,
language and content, which do not involve intrusive measures such as profiling and tracking
of users . In his recent opinion on Facebook, Advocate General Rantos also refers to the Austrian
Government’s “pertinent” observation that in the past, Meta IE allowed Facebook users to
choose between a chronological presentation and a personalised presentation of newsfeed
content, which, in his view, proves that an alternative method is possible . By considering the
existence of alternative practices to behavioural advertising that are more respectful of the
Instagram users’ right to data protection, the EDPB, as the Advocate General did in relation to
Facebook users, aims to assess if this processing is objectively necessary to deliver the service
offered, as perceived by the Instagram user whose personal data is processed, and not to
dictate the nature of Meta IE’s service or impose specific business models on controllers, as
Meta IE and the IE SA respectively argue . The EDPB considers that Article 6(1)(b) GDPR does
not cover processing which is useful but not objectively necessary for performing the
contractual service, even if it is necessary for the controller’s other business purposes .

125. The EDPB considers that the absolute right available to data subjects, under Article
21(2)(3) GDPR to object to the processing of their data (including profiling) for direct marketing
purposes further supports its consideration that, as a general rule, the processing of personal
data for behavioural advertising is not necessary to perform a contract. The processing cannot
be necessary to perform a contract if a data subject has the possibility to opt out from it at any
time, and without providing any reason.

126. The EDPB finds that a reasonable user cannot expect that their personal data is being
processed for behavioural advertising simply because Meta IE briefly refers to this processing
in its Instagram Terms of Use (which Meta IE and the IE SA consider as constituting the entirety
of the contract), or because of the “wider circumstances” or “recognised public awareness of
this form of processing” derived from its “widespread prevalence of OBA processing” to which
the IE SA refers . Behavioural advertising, as briefly described in paragraph 98 above, is a set of
processing operations of personal data of great technical complexity, which has a particularly
massive and intrusive nature. In view of the characteristics of behavioural advertising, coupled
with the very brief and insufficient information that Meta provides about it in the Instagram
Terms of Use and Data Policy (a separate document that the IE SA and Meta IE do not even
consider part of the contractual obligations), the EDPB finds it extremely difficult to argue that
an average user can fully grasp it, be aware of its consequences and impact on their rights to
privacy and data protection, and reasonably expect it solely based on the Instagram Terms of
Use. The EDPB recalls its Guidelines 2/2019 on Article 6(1)(b) GDPR, in which it argues that the
expectations of the average data subject need to be consider in light, not only of the terms of
service but also the way this service is promoted to users . Advocate General Rantos expresses
similar doubts where he says in relation to Facebook behavioural advertising practices “I am
curious as to what extent the processing might correspond to the expectations of an average

user and, more generally, what ‘degree of personalisation’ the user can expect from the service
he or she signs up for” and adds in a footnote that he does not “believe that the collection and

use of personal data outside Facebook are necessary for the provision of the services offered as
part of the Facebook profile” .

127. The EDPB notes that the mission of the Instagram service, as expressed in its Terms of
Use, is formulated in a vague and broad manner (“To bring you closer to the people and things
you love.”) When using the Instagram service, a user is primarily confronted with the possibility
of viewing photographs and videos by people or organisations that they follow, as well as
sharing such content with their followers. This is acknowledged by the IE SA which provides the
following description of the Instagram service in its Draft Decision: “Instagram is a global online
social network service which allows registered users to communicate with other registered
users through messages, audio, video calls and video chats, and by sending images and video
files .”

128. Based on the considerations above, the EDPB considers that the main purpose for
which users use Instagram and accept its Terms of Use is to share content and communicate
with others, not to receive personalised advertisements.

129. Meta IE infringed its transparency obligations under Article 5(1)(a), Article 12(1) and
Article 13(1)(c) GDPR by not clearly informing the complainant and other users of the Instagram
Service specific processing operations, the personal data processed in them, the specific
purposes they serve, and the legal basis on which each of the processing operations relies, as
the IE SA concludes in its Draft Decision . The EDPB considers that this fundamental failure of
Meta IE to comply with its transparency obligations contradicts the IE SA’s finding that
Instagram users could reasonably expect online behavioural advertising as being necessary for
the performance of their contract (as described in the Instagram Terms of Use) with Meta IE .

130. The EDPB recalls that “controllers should make sure to avoid any confusion as to what
the applicable legal basis is” and that this is “particularly relevant where the appropriate legal
basis is Article 6(1)(b) GDPR and a contract regarding online services is entered into by data
subjects”, because “[d]epending on the circumstances, data subjects may erroneously get the
impression that they are giving their consent in line with Article 6(1)(a) GDPR when signing a
contract or accepting terms of service” . Article 6(1)(b) GDPR requires the existence, validity of
a contract, and the processing being necessary to perform it. These conditions cannot be met
where one of the Parties (in this case the data subject) is not provided with sufficient
information to know that they are signing a contract, the processing of personal data that it
involves, for which specific purposes and on which legal basis, and how this processing is
necessary to perform the services delivered. These transparency requirements are not only an
additional and separate obligation, as the IE SA seems to imply, but also an indispensable and
constitutive part of the legal basis .

131. The risks to the rights of data subjects derived from this asymmetry of information and
an inappropriate reliance on this legal basis are higher in situations such as in the present case,
in which the Complainant and other Instagram users face a “take it or leave it” situation
resulting from the standard contract pre-formulated by Meta IE and the lack of few alternative
services in the market. The EU legislator has regularly identified and aimed to address with

multiple legal instruments these risks and the imbalance between the parties to consumer
contracts. For example, Directive 93/13/EEC

on unfair terms in consumer contracts mandates, as the transparency obligations under the
GDPR, the use of plain, intelligible language in the terms of the contracts offered to consumers
. This Directive even provides that where there is a doubt about the meaning of a term, the
interpretation most favourable to the consumer shall prevail . Processing of personal data that
is based on what is deemed to be an unfair term under this Directive will generally not be
consistent with the requirement under Article 5(1)(a) GDPR that the processing is lawful and
fair
.

132. Advocate General Rantos concludes in reference to Meta IE that the fact that an
undertaking providing a social network enjoys a dominant position in the domestic market for
online social network for private users “does play a role in the assessment of the freedom of
consent within the meaning of that provision, which it is for the controller to demonstrate,
taking into account, where appropriate, the existence of a clear imbalance of power between
the data subject and the controller, any requirement for consent to the processing of personal
data other than those strictly necessary for the provision of the services in question, the need
for consent to be specific for each purpose of processing and the need to prevent the
withdrawal of consent from being detrimental to users who withdraw it .” In line with the logic
of this argument, the EDPB considers that the dominant position of Meta IE also plays an
important role in the assessment of Meta IE’s reliance on Article 6(1)(b) GDPR for its Instagram
service and its risks to data subjects, especially considering how deficiently Meta IE informs the
Instagram users of the data it strictly needs to process to deliver the service.

133. Given that the main purpose for which a user uses Instagram service is to share and
receive content, and communicate with others , and that Meta IE conditions their use to the
user’s acceptance of a contract and the behavioural advertising they include, the EDPB cannot
see how a user would have the option of opting out of a particular processing which is part of
the contract as the IE SA seems to argue . The users’ lack of choice in this respect would rather
indicate that Meta IE’s reliance on the contractual performance legal basis deprives users of
their rights, among others, to withdraw their consent under Articles 6(1)(a) and 7 and/or to
object to the processing of their data based on Article 6(1)(f) GDPR.

134. The EDPB agrees with the AT, DE, ES, FI, FR, HU, NL, NO and SE SAs that there is a risk
that the Draft Decision’s failure to establish Meta IE’s infringement of Article 6(1)(b) GDPR,
pursuant to the IE SA’s interpretation of it, nullifies this provision and makes lawful theoretically
any collection and reuse of personal data in connection with the performance of a contract with
a data subject . Meta IE currently leaves the complainant and other users of the Instagram
service with a single choice. They may either contract away their right to freely determine the
processing of their personal data and submit to its processing for the obscure, and intrusive
purpose of behavioural advertising, which they can neither expect, nor fully understand based
on the insufficient information Meta IE provides to them. Or, they may decline accepting
Instagram Terms of Use and thus be excluded from a service that enables them to
communicate, share content with and receive content from millions of users and for which there
are currently few realistic alternatives. This exclusion would thus also adversely affect their
freedom of expression and information.

135. This precedent could encourage other economic operators to use the contractual
performance legal basis of Article 6(1)(b) GDPR for all their processing of personal data. There

would be the risk that some controllers argue some connection between the processing of the
personal data of their consumers and the contract to collect, retain and process as much
personal data from their users as possible and advance their economic interests at the expense
of the safeguards for data subjects. Some of the safeguards from which data subjects would be
deprived due to an inappropriate use of Article 6(1)(b) GDPR as legal basis, instead of others
such as consent (Article 6(1)(a) GDPR) and legitimate interest (Article 6(1)(f) GDPR), are the
possibility to specifically consent to certain processing operations and not to others and to the
further processing of their personal data (Article 6(4) GDPR); their freedom to withdraw consent
(Article 7 GDPR); their right to be forgotten (Article 17 GDPR); and the balancing exercise of the
legitimate interests of the controller against their interests or fundamental rights and freedoms
(Article 6(1)(f) GDPR). As a result, owing to the number of users of the Instagram service, the
market power, and influence of Meta IE and its economically attractive business model, the
risks derived from the current findings of the Draft Decision could go beyond the Complainant
and the millions of users of Instagram service in the EEA and affect the protection of the
hundreds of millions of people covered by the GDPR .

136. The EDPB thus concurs with the objections of the AT, DE, ES, FI, FR, HU, NL, NO and SE
SAs to Finding 2 of the Draft Decision in that the behavioural advertising performed by Meta IE
in the context of the Instagram service is objectively not necessary for the performance of Meta
IE’s alleged contract with data users for the Instagram service and is not an essential or core
element of it.

137. In conclusion, the EDPB decides that the Meta IE has inappropriately relied on Article
6(1)(b) GDPR to process the complainant’s personal data in the context of Instagram Terms of
Use and therefore lacks a legal basis to process these data for the purposes of behavioural
advertising. Meta IE has not relied on any other legal basis to process personal data in the
context of the Instagram Terms of Use for the purposes of behavioural advertising. Meta IE has
consequently infringed Article 6(1) GDPR by unlawfully processing personal data. The EDPB
instructs the IE SA to alter its Finding 2 of its Draft Decision which concludes that Meta IE may
rely on Article 6(1)(b) GDPR in the context of its offering of the Instagram Terms of Use and to
include an infringement of Article 6 (1) GDPR based on the shortcomings that the EDPB has
identified.

Finding 2:
On the basis of the above, and as directed by the EDPB further to the Article 65 Decision, I find that Meta
Ireland was not entitled to rely on Article 6(1)(b) GDPR to process the Complainant’s personal data for
the purpose of behavioural advertising in the context of the Instagram Terms of Use.

5 ISSUE 3 – WHETHER META IRELAND PROVIDED THE REQUISITE INFORMATION ON THE LEGAL BASIS FOR
PROCESSING ON FOOT OF ARTICLE 6(1)(B) GDPR AND WHETHER IT DID SO IN A TRANSPARENT MANNER
Introduction

119. Having considered the legal basis of processing in connection with the Instagram service – in
particular, processing for the purposes of delivering behavioural advertising – I will now consider
whether Meta Ireland provided the requisite information as to the legal basis for processing on
foot of Article 6(1)(b) GDPR and whether it did so in a transparent manner, such as to comply with
its transparency obligations under the GDPR.

Relevant Provisions

120. As I stated above, Article 5(1)(a) outlines the principles underpinning data processing and
provides that “[p]ersonal data shall be … processed lawfully, fairly and in a transparent manner in
relation to the data subject”. Pursuant to Article 5(2), responsibility for demonstrating compliance
with Article 5(1) rests with the controller.

121. Recital 39 provides further details as regard the principle of transparency. It states that
processing:

“should be transparent to natural persons that personal data concerning them are
collected, used, consulted or otherwise processed and to what extent the personal data
are or will be processed The principle of transparency requires that any information and
communication relating to the processing of those personal data be easily accessible and
easy to understand, and that clear and plain language be used. That principle concerns, in
particular, information to the data subjects on the identity of the controller and the
purposes of the processing and further information to ensure fair and transparent
processing in respect of the natural persons concerned and their right to obtain
confirmation and communication of personal data concerning them which are being
processed. Natural persons should be made aware of risks, rules, safeguards and rights in
relation to the processing of personal data and how to exercise their rights in relation to
such processing. In particular, the specific purposes for which personal data are processed
should be explicit and legitimate and determined at the time of the collection of the
personal data”.

122. The precise meaning of “transparency” for the purposes of the GDPR is delineated in Recital
58 GDPR. In essence, a controller complies with the transparency principle when the information
it provides to data subject, or indeed the public more generally, is “concise, easily accessible and
easy to understand, and … clear and plain language and, additionally, where appropriate,
visualisation be used.”

123. As detailed in Recital 60 GDPR, there is a strong nexus between the principle of transparency
and the provision of information to data subjects. Indeed, Recital 60 states that:

“The principles of fair and transparent processing require that the data subject be
informed of the existence of the processing operation and its purposes. The controller
67

should provide the data subject with any further information necessary to ensure fair and
transparent processing taking into account the specific circumstances and context in which
the personal data are processed. Furthermore, the data subject should be informed of the
existence of profiling and the consequences of such profiling. Where the personal data are
collected from the data subject, the data subject should also be informed whether he or
she is obliged to provide the personal data and of the consequences, where he or she does
not provide such data.”

124. Article 13 GDPR outlines the information which must be provided to data subjects where
personal data are collected from those data subjects. In particular, Article 13(1)(c) provides that
information as to “the purposes of the processing for which the personal data are intended as well
as the legal basis for the processing” must be provided to the data subject(s) at the time personal
data is obtained.

125. The nature of the extent of information to be provided to data subjects is further described
in Article 12 GDPR. In this regard, Article 12(1) provides that such information must be in a
“concise, transparent, intelligible and easily accessible form, using clear and plain language” but
need not necessarily be in writing. 132 Indeed, pursuant to Article 12(7) GDPR, information
provided in accordance with the controller’s obligations under Article 13 and 14 may be
accompanied by “standardised icons” so as to give an overview of the relevant processing in “an
easily visible, intelligible and clearly legible manner”.

126. There are limited exceptions to the provision of such information. Indeed, Recital 62 GDPR
provides that

“it is not necessary to impose the obligation to provide information where the data subject
already possesses the information, where the recording or disclosure of the personal data
is expressly laid down by law or where the provision of information to the data subject
proves to be impossible or would involve a disproportionate effort”.

127. For completeness, I note that Article 14 GDPR provides detail as to the information to be
provided where personal data has not been obtained from the data subjects themselves. In
essence, this concerns information to be provided to non-users. As the scope of the Complaint
was limited to registered users of the Instagram service, the substantive obligations which arise
under Article 14 will not be considered further for the purposes of this Decision except insofar as
the text of Article 14 may be relevant to the interpretation of the obligations under Articles 12
and 13 GDPR.

Transparency Obligations – General Comments

132
In this regard, Article 12(1) notes the possibility that the information may be provided orally or by other
electronic means.
68

128. In considering transparency obligations, I think it necessary to draw a distinction between the
principles of transparency which are contained in the Article 5 GDPR and the information
requirements contained in Article 12 to 14 GDPR. While the information requirements set out in
Articles 12 to 14 GDPR go towards transparency, and indeed may assist my assessment of whether
the principle of transparency has been discharged by the controller, non-compliance with Article
12 to 14 GDPR does not necessarily imply an infringement of Article 5.

129. Accordingly, I will first consider whether the obligations set out in Article 12 and 13 GDPR have
been complied with. As Article 13 sets out the information that ought to be provided to data
subjects and Article 12 concerns the manner and/or means by which this information is to be
provided, I will first consider whether sufficient information has been provided and then assess
whether any information has been provided in the appropriate manner and/or form. I will
subsequently consider whether the broader transparency principle set out in Article 5 GDPR has
been complied with.

The “Layered” Approach

130. When considering the issues to be considered in the course of this Decision, I set out my
reasons for my disagreement with the Investigator’s distinction between the issue of whether the
Named Data Subject was misled and whether the Instagram Terms of Use and/or Data Policy
complies with the transparency requirements of the GDPR. As I outlined above, it is my view that
a failure by a controller to adhere to the transparency requirements is likely to have the direct
result that the data subject is misled.

131. In considering whether the transparency requirements had been complied with in the context
of the Instagram service, the Investigator adopted a “layered approach” whereby he considered
each “layer” of information in isolation on the basis that each layer must independently comply
with Article 12(1). 133 Meta Ireland did not agree with this approach taken by the Investigator and
submitted that the information provided should be assessed “holistically” as opposed to a
“layerby-layer basis”. 134 According to Meta Ireland, this would otherwise have the effect that it is
required to “provide a disproportionate level of detail within each layer of information”.148

132. The Investigator did not agree with Meta Ireland’s submissions. In this respect, he formed the
view that:

“Article 13(1)(c) GDPR requires the provision of concrete and specific information, not
merely the creation of an overall impression about the controller’s processing activities.

133
Final Inquiry Report dated 18 January 2021, at para. 319.
134
Meta Ireland’s Submissions on the Draft Inquiry Report dated 22 June 2020, at para. 1.5.
148
Meta Ireland’s Submissions on the Draft Inquiry Report dated 22 June 2020, at para. 1.4.
69

Accordingly, in order to assess the layered provision of information by a controller, it is
necessary to consider discrete sources of information independently, in order to arrive at
an overall view as to compliance. There can be no “holistic” conclusion on Facebook’s
compliance with Article 13(1)(c) which is not fundamentally based on an examination of
the actual information provided to the data subject. …
…
The investigator also considers that each distinct layer of information must comply
independently with the requirement of Article 12(1) GDPR regarding the provision of
information ‘in a concise, transparent, intelligible and easily accessible form, using clear
and plain language’”. 135

For completeness, I note that Meta Ireland, in its submissions on the Preliminary Draft, reaffirmed
its position that the “layered” approach, as adopted by the Investigator, was not envisaged in
assessing compliance with the transparency obligations in the GDPR. 136 Rather it is Meta Ireland’s
view that “the sole question is whether cumulatively, the data subject has been provided with the
information required under the GDPR”. 137

133. With respect, as I outlined in the Preliminary Draft, I do not agree that such a layer-by-layer
approach should be adopted in considering whether an entity has complied with their
transparency requirements. While Article 12(1) GDPR concerns the form in which information
should be provided to data subjects, it is focussed on the addressing the potential barriers which
may prevent the information being received and/or understood by the data subject. In this
regard, I note that the reference to “using clear and plain language” in the provision of
information ensures that the data subject is not hindered or otherwise impeded from receiving
the requisite information as a result of an inability to understand technical jargon. Similarly, the
requirement that the information be “concise” operates to prevent information fatigue by the
data subject as a result of the information being contained in a lengthy text.

134. Moreover, Article 12(1) GDPR provides that a controller “shall take appropriate measures to
provide any information referred to in Articles 13 and 14” [my emphasis]. It follows that a
controller’s Article 12 obligations are not considered in isolation from its Articles 13 or 14
obligations; rather, there is an interrelationship between these obligations. Articles 13 and 14
require that certain material must be provided to data subjects and Article 12 sets out the manner
and/or form in which this information is conveyed. There is no suggestion that the information
required by Articles 13 and 14 must be provided in any particular “layer” of information; the
obligation is that the information is provided and is set out in the manner set out in Article 12.

135
Final Inquiry Report dated 18 January 2021, at paras. 318 – 319.
136
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at pp. 11 - 12, at para. 7.2.
137
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at pp. 11 - 12, at para. 7.2.
70

While there is a certain discretion in how this information is provided, an individual “layer” of
information cannot be assessed by reference to Article 12 GDPR in isolation of the information
required by Articles 13 and/or 14 GDPR.

135. Indeed, it is my view that the appropriate manner in which to assess compliance with the
transparency obligations is to first consider whether the requisite information has been provided
before examining whether that information has been provided in the correct form. This does not
mean that a controller’s “layered” approach necessarily complies with Articles 12 and 13; rather,
it remains the case that the information required by Article 13 may not ultimately be set out in
the manner required by Article 12(1) GDPR. It does not follow, however, that this necessitates or
justifies an abstract or isolated assessment of each “layer” of information for compliance with
Article 12(1) GDPR. Accordingly, I will examine the information in a more holistic manner for
compliance with Articles 12 and 13 GDPR.

136. For completeness, I am not expressing any view or preference in respect of the merits of
adopting a “layered” approach. In this regard, I note that the Article 29 Working Party Guidelines
on Transparency (the “Transparency Guidelines”) explicitly recommend that controllers use a
“layered” approach, 138 which was endorsed by the EDPB at its first plenary session. Rather, I am
stating that while the approach taken by the Investigator in examining compliance in a “layer-
bylayer” way was robust and comprehensive, it did not consider the information provided in a
sufficiently holistic way. It is my view that it is not necessary to consider whether each individual
layer is deficient or otherwise on the basis that there will be an infringement of Article 12 if the
layers, viewed cumulatively, lack the information required by Article 13 GDPR.

137. As I noted above, the Investigator adopted a “layer-by-layer” approach in assessing
compliance. While he formed the general view that Meta Ireland did not misled data subjects as
to fact that the processing in connection with the Instagram service was not on the basis of
consent, he was nonetheless of the view that the individual “layers” 139 of information did not
comply with Article 12(1) and 13(1)(c) GDPR. While I note that Meta Ireland contended that the
information provided complied with Article 12(1), 13(1)(c) and 5(1)(a) GDPR, much of the
submissions on the Draft Inquiry Report focussed on Meta Ireland’s disagreement with the
“layered” approach taken by the
Investigator. For the reasons I have outlined above, I will not follow this “layered” approach but

138
See the Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and
adopted on 11 April 2018.
139
In this regard, the Investigator treated the “Data Policy”, the “What is our legal basis for processing data?” section
of the Facebook Data Policy, the Legal Basis Notice published by Facebook Ireland Limited (accessible from the
“Learn more” hyperlink in the “What is our legal basis for processing data?” section of the Facebook Data Policy),
the “Instagram Service” section Instagram’s Terms of Use, the “additional informational resources” accessible from
the Terms of Use, and the “How do we use this information?”, “How do we operate and transfer data as part of our
global services?” and “How do the Facebook Companies work together?” sections of the Facebook Data Policy as
distinct layers for the purposes of his analysis.
71

will consider the information more cumulatively and holistically, referring to the views of the
Complainant, Meta Ireland and the Investigator, as appropriate.

Information provided to the Data Subject in respect of the purposes and/or legal basis of processing

138. As a preliminary point, I note that Meta Ireland confirmed, in submissions dated 28 September
2018, that personal data is collected directly from data subjects in the context of the Instagram
service. 140 Accordingly, Article 13 is relevant. Given that the focus of the Complaint is on whether
Meta Ireland has a lawful basis for processing of personal data in connection with the Instagram
service, I am satisfied that Article 13(1)(c) GDPR – which concerns information in respect of “the
purposes of the processing for which the personal data are intended as well as the legal basis for
the processing” – is of particular relevance.

The Complaint and Meta Ireland’s Submissions and the Views of the Investigator

139. The Complainant alleged that Meta Ireland had “misled” Instagram users on the basis that a user
could not identify “what data is processed, for which exact purpose and on which legal basis” and
was therefore “inherently non-transparent”, contrary to the requirements of Article 13(c)
GDPR. 141 The Complainant also stated that the manner in which the information was provided
by “the controller at least lead the data subject to belief [sic] that all these processing operations
are (also) based on Article 6(1)(a) and/or 9(2)(a) of the GDPR”. 142

140. In the course of the Inquiry, Meta Ireland made extensive submissions in respect of compliance
with Article 13 GDPR. In submissions dated 28 September 2018, Meta Ireland stated that, in its
view, it complied with the information requirements in Article 13(1) and (2) by providing the
relevant information at the time the personal data was collected. 143 Meta Ireland further stated
that the information was provided by way of the user engagement flow and, on a continuous
basis, in the Data Policy. 144

141. In this regard, Meta Ireland further submitted that Article 13(1)(c) GDPR requires controllers to
be transparent as regards the purposes of processing generally as opposed to information as to
the purposes of specific processing operations.159 Moreover, in submissions on the Draft Report,
Meta Ireland emphasised its view that, when implementing the information requirements under
Article

140
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.47.
141
Complaint dated 25 May 2018, at p. 17.
142
Complaint dated 25 May 2018, at p. 3.
143
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.49.
144
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.51.
159
Meta Ireland’s Submissions dated 22 February 2019, at para. 2.2.
72

12 to 14 GDPR, controllers have discretion as to the means and method of the provision of
information. 145

142. The Investigator emphasised that Article 13(1)(c) GDPR states that information concerning both
the purposes of processing and the identification of the relevant legal basis must be provided to
data subjects. 146 However, as the Complainant did not – or, as it submitted, could not - identify
the types of processing which occurred as a result of accepting the Terms of Use, the Investigator
was of the view that only the obligation to provide information as to legal basis for processing is
within the scope of the Complaint. 147

143. In this respect, the Investigator noted that “processing”, interpreted in line with Article 4(2)
GDPR, referred to “operations, or sets of operations, carried out on personal data or sets of
personal data”. 148 In his view, “processing” did not refer to specific processing operations but
referred to the broader concept of a “set of processing operations”. 149 In essence, it was his view
that Article 13(1)(c) has the objective of “ensuring the intelligible provision of information on the
legal basis for separate and distinct types of processing”. 150 The provision of information in
accordance with the requirements of Article 13(1)(c) obliges the controller to (1) “specify the
legal basis in question” and (2) “identify the discrete ‘set of operations’ performed (i.e. the
processing) in connection with that legal basis”. 151

Consideration of the Information to be Provided

144. In considering the obligations under Article 13(1)(c) GDPR, I agree with the Investigator that the
term “processing” should be construed in line with Article 4(2) GDPR. I have set out the full text
of Article 4(2) above. Article 4(2) GDPR clearly provides that, “[f]or the purposes of the GDPR”,
processing refers to “any operations or set of operations”. The clause, “[f]or the purposes of the
GDPR”, clearly implies that where the term “processing” appears in the text of the GDPR, the
definition contained in Article 4(2) is to be used. I further note that, while the text of the GDPR
does not define the term “operation”, Article 4(2) contains a list of examples which illustrate the
type of activities which may constitute an operation. I note that the inclusion of the phrase “such
as” before the list indicates that these examples are not exhaustive. It follows, in my view, that
any action carried out on personal data, including its collection, may constitute an operation.

145
Meta Ireland’s Submissions on the Draft Inquiry Report dated 22 June 2020, at para. 1.4.
146
Final Inquiry Report dated 18 January 2021, at para. 308.
147
Final Inquiry Report dated 18 January 2021, at para. 308.
148
Final Inquiry Report dated 18 January 2021, at paras. 321, 327.
149
Final Inquiry Report dated 18 January 2021, at para. 325.
150
Final Inquiry Report dated 18 January 2021, at para. 326.
151
Final Inquiry Report dated 18 January 2021, at para. 327.
73

145. In this regard, it is also illustrative to consider Recital 60 GDPR which states that “principles of fair
and transparent processing require that the data subject be informed of the existence of the
processing operation and its purposes” [my emphasis]. The Article 29 Working Group also
referred to processing operations in this context, stating:

“Transparency is intrinsically linked to fairness and the new principle of accountability
under the GDPR. It also follows from Article 5.2 that the controller must always be able to
demonstrate that personal data are processed in a transparent manner in relation to the
data subject. Connected to this, the accountability principle requires transparency of
processing operations in order that data controllers are able to demonstrate compliance
with their obligations under the GDPR” [my emphasis]. 152

146. As set out above, Meta Ireland’s position is that the term “processing” for the purposes of Article
13 GDPR does not encompass “processing operations” on the basis that Article 13 refers to
“processing” as opposed to “processing operations”. 153 I did not agree with this position in the
Preliminary Draft. As I outlined in the Preliminary Draft, the definition contained in Article 4(2)
GDPR is that to be applied “[f]or the purposes of the GDPR”. It logically follows that, where the
term processing is used throughout the GDPR, the definition set out in Article 4(2) applies, i.e.
processing should be construed to mean “processing operations or sets of operations”. I would
further add that I also disagree with Meta Ireland’s submission that, as “the word ‘operation’ has
been deliberately omitted from Article 13(1)(c) GDPR, it is not appropriate to read in language
based on Recital 60 GDPR”.169 As I outlined in the Preliminary Draft, an ordinary reading of Article
4(2) GDPR is that the word processing – where it appears in the GDPR – should be construed to
refer to processing as “operations or set of operations”; logically this is applicable to Article
13(1)(c).

147. In response to the Preliminary Draft, Meta Ireland expressed disagreement with my “literal
interpretation” of Article 13(1)(c) GDPR and asserted that its own “interpretation directly tracks
the actual wording of the relevant GDPR provision which stipulates only that two items of
information be provided about the processing (i.e. purposes and legal bases)”.154 In this regard,
Meta Ireland further stated that it

“disagrees with the Commission’s use of Article 4(2) GDPR to interpret Article 13(1)(c)
GDPR to refer to processing operations, particularly where the term “processing
operations” has in fact been used elsewhere in the GDPR but deliberately not used in
Article 13(1)(c) GDPR. The Commission’s view does not adequately explain why the

152
Article 29 Working Group, “Guidelines on transparency under Regulation 2016/679” (adopted on 29 November
2017, as last revised and adopted on 11 April 2018), at para. 2.
153
Meta Ireland’s Submissions on the Draft Inquiry Report dated 22 June 2020, at para. 1.4(E).
169
Meta Ireland’s Submissions on the Draft Inquiry Report dated 22 June 2020, at para. 1.4(F).
154
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 12, at para. 8.2(A).
74

drafters of the GDPR made this distinction (if as the Commission alleges “purposes” and
“processing operations” are one and the same) and justify why the Commission is entitled
to make such a distinction despite the clear wording of the GDPR”. 155

148. In essence, Meta Ireland disagreed that Article 4(2) operates as an interpretive aid in this
context. 156 In particular, Meta Ireland is of the view that “Article 13(1)(c) GDPR identifies only
two specific features of the processing that need to be provided” and, as other subsections of
Article 13 relate to other aspects of processing, it does not follow that the definition of processing
provided for in Article 4(2) GDPR is applicable to any of the subsections of Article 13.173 Meta
Ireland further alleged that it was not the legislator’s intention that the provision be construed
in the manner I proposed157 and that my proposed interpretation of Article 13(1)(c) GDPR is “is
not clear or obvious from the GDPR itself”. 158

149. It appears to me that this argument is premised on the suggestion that, as the various subsections
of Article 13 GDPR require the disclosure to data subjects of specific aspects of the broader
activity or “processing” as defined by Article 4(2) GDPR, such as the identity of a recipient, the
duration of the processing, this implies that the broader definition of “processing” in Article 4(2)
cannot be applicable. I do not share this view. While I note that Article 13 does not specifically
include the word “operation”, it remains my view that Meta Ireland’s position would render the
definition in Article 4(2) meaningless. Indeed, it would be contrary to the express purpose of
Article 4(2) GDPR if the understanding of processing could only include processing operations
where the term “operation” was deliberately included. To consider otherwise would be contrary
to the literal interpretation of Article 4(2) GDPR. I am therefore satisfied that the term
“processing” in Article 13(1)(c) GDPR should be construed to include processing operations or
sets of operations and this is clear from the text of the GDPR.

150. I further note Meta Ireland’s submissions that, as Article 13(1) GDPR includes the phrase “at the
time data is first collected”, it therefore refers only to “prospective processing”. Indeed, Meta
Ireland submitted that, on this basis, Article 13(1)(c) GDPR does not relate to ongoing processing
operations, but is concerned solely with information on “intended processing”.176 Given the
fundamental role which transparency obligations plays in the exercise of data subjects rights, it
cannot be the case that the legislator intended such a narrow approach to the concept of
processing.

155
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 12, at para. 8.2(A).
156
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.2(A).
173
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.2(C).
157
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.2(D) and (E).
158
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.2(G).
176
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.2(B).
75

151. In its submissions on the Preliminary Draft, Meta Ireland also disagreed that there is a
requirement in Article 13(1)(c) to link purposes with individual legal bases or equally to
processing operations or
set of operations. 159 In this vein, Meta Ireland have alleged that my proposed approach does not
further the objectives of the transparency obligations. 160 Indeed, it is Meta Ireland’s position that
the “applicable question is whether the actual obligation imposed by the GDPR has been complied
with, not whether or not an additional category of information or linkage not referenced in GDPR
has also been provided”. 161

152. As I have outlined above, the text of Article 13(1)(c) clearly states that there is a requirement to
provide information as to “the purposes of the processing for which the personal data are
intended as well as the legal basis for the processing”. Its literal meaning is to require controllers
to provide information to data subjects concerning the purposes of the processing and the legal
basis for that processing. In respect of the purposes of processing, I would further add that the
inclusion of the phrase “for which the personal data are intended” in Article 13(1)(c) GDPR
indicates that data controllers should also provide the information so as to enable the data
subject(s) understand, in broad terms, which personal data is – or will be – undergoing
processing, for which processing operations or set of operations and which legal basis is
applicable. It is not the case that purposes and legal bases can simply be cited in the abstract
and detached from the personal data processing they concern. Accordingly, there must be a link
drawn between the purposes and the legal basis to ensure that the data subject has meaningful
information.

153. It is my view that Meta Ireland’s position cannot be reconciled with a literal interpretation of
Article 13(1)(c); nonetheless, for completeness, I have considered whether its position is
nonetheless justified by a systemic reading based on the legislator’s objective and the contents
of the GDPR as a whole. In relation to the argument I have just considered, it is important to
note that transparency, both under the GDPR and in the Article 29 Working Party Guidelines
considered below in this Decision, is directly linked to the principle of accountability under the
GDPR. In order to ensure that actual or intended processing is carried out in an accountable and
transparent manner, the interpretation proposed by Meta Ireland cannot be accepted. Indeed,
the absence of any level of specificity as to what the data controller is doing with the data, and
more fundamentally what data they are processing at all, would render information on the
purposes of this unspecified processing almost useless to a data subject. In the absence of
information on the nature of the data being used and the nature of the processing being carried
out, it would be virtually impossible to exercise data subject rights in an informed manner. Such
an absence of transparency and accountability could not be reconciled with a purposive or
systematic reading of the GDPR.

159
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.3.
160
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.3(B).
161
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.3(C).
76

154. I further note that Meta Ireland cited some of the GDPR’s preparatory materials in support of its
view that the legislator expressly decided to exclude particular information as to processing
operations as part of Article 13. 162 In particular, Meta Ireland sought to rely on the exclusion of
the following: “the existence of certain processing activities and operations for which a personal
data impact assessment has indicated that there may be a high risk”. 163 The decision of the
legislator to not include a requirement to provide such information has no impact on the
applicability of the clear definition of “processing” in Article 4(2) GDPR, and therefore does not
affect the appropriate literal interpretation of Article 13(1)(c) GDPR. In any purposive or
systematic approach to interpreting the provision, the decision not to require information on
processing which the controller itself has found to be high risk does not suggest that the
controller would not otherwise be required to disclose the existence of that processing. It would
simply require a controller to disclose that a data protection impact assessment indicated the
presence of a high risk. This therefore provides no evidence that the legislator excluded in any
way the interpretation of Article 13(1)(c) GDPR being proposed.

155. In considering what constitutes the purposes of processing, it is illustrative to consider the six
interconnected principles which underpin the data protection framework, as set out in Article 5
GDPR. These core principles contained in Article 5 focus on the purpose(s) of the relevant
processing; this is evident as Article 5(1) mandates that personal data are:

“(a) processed lawfully, fairly and in a transparent manner in relation to the data subject
(‘lawfulness, fairness and transparency’);

(b) collected for specified, explicit and legitimate purposes and not further processed
In a manner that is incompatible with those purposes… (‘purpose limitation’);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for
which they are processed (‘data minimisation’);

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken
to ensure that personal data that are inaccurate, having regard to the purposes for
which they are processed, are erased or rectified without delay (‘accuracy’);

(e) kept in a form which permits identification of data subjects for no longer than is
necessary for the purposes for which the personal data are processed… (‘storage
limitation’);

162
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.2(E).
163
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.2(E).
77

(f) processed in a manner that ensures appropriate security of the personal data,
including protection against unauthorised or unlawful processing… (‘integrity and
confidentiality’)” [my emphasis].

156. As set out above, Article 5(1)(b) GDPR sets out the purpose limitation principle. The language
used - in particular, the references to data “collection” and “further processing” – is reflective of
the language used in Article 13(1)(c) GDPR as the introductory passage to Article 13 GDPR
contains a reference to “collection”, and Article 13(1)(c) GDPR itself refers to “the purposes of
the processing for which the personal data are intended”. It therefore can be said that Article 13
GDPR also considers “collection” and “further” processing. For this reason, it is useful to examine
further the requirements and function of the purpose limitation principle enshrined in Article
5(1)(b) GDPR.

157. The Article 29 Working Party has also considered the purpose limitation principle. In this regard,
it has stated:

“When setting out the requirement of compatibility, the Directive does not specifically
refer to processing for the ‘originally specified purposes’ and processing for ‘purposes
defined subsequently’. Rather, it differentiates between the very first processing
operation, which is collection, and all other subsequent processing operations (including
for instance the very first typical processing operation following collection – the storage of
data).

In other words: any processing following collection, whether for the purposes initially
specified or for any additional purposes, must be considered ‘further processing’ and must
thus meet the requirement of compatibility”. 164

158. The effect of this position is to create a distinction between “purpose specification” and
“compatible use”. In respect of “purpose specification”, the Article 29 Working Party stated that:

“[P]ersonal data should only be collected for ‘specified, explicit and legitimate’ purposes.
Data are collected for certain aims; these aims are the ‘raison d’être’ of the processing
operations. As a prerequisite for other data quality requirements, purpose specification
will determine the relevant data to be collected, retention periods, and all other key
aspects of how personal data will be processed for the chosen purpose/s”. 165

164
Article 29 Working Group, “Opinion 03/2013 on Purpose Limitation” (00569/13/EN WP 203) (adopted on 2 April
2013), at p. 21.
165
Article 29 Working Group, “Opinion 03/2013 on Purpose Limitation” (00569/13/EN WP 203) (adopted on 2 April
2013), at pp. 11 – 12.
78

159. In considering the interrelationship between the purpose limitation principle and other
significant principles in the data protection framework, the Article 29 Working Group took the
view that:

“There is a strong connection between transparency and purpose specification. When the
specified purpose is visible and shared with stakeholders such as data protection
authorities and data subjects, safeguards can be fully effective. Transparency ensures
predictability and enables user control”. 166

160. The following position of the Article 29 Working Group is also relevant:

“In terms of accountability, specification of the purpose in writing and production of
adequate documentation will help to demonstrate that the controller has complied with
the requirement of Article 6(1)(b). It would allow data subjects to exercise their rights more
effectively – for example, it would provide proof of the original purpose and allow
comparison with subsequent processing purposes”. 167

161. The Article 29 Working Group also considered the benefits that transparency and accountability
offered to data subjects, in particular, the fact that it enabled data subjects to make more
informed choices. 168 In particular, it is worth noting that:

“processing of personal data has an impact on individuals' fundamental rights in terms of
privacy and data protection. This impact on the rights of individuals must necessarily be
accompanied by a limitation of the use that can be made of the data, and therefore by a
limitation of purpose. An erosion of the purpose limitation principle would
consequently result in the erosion of all related data protection principles”[my
emphasis]. 169

162. Although I note that, strictly speaking, the guidance of the Article 29 Working Party is not binding
on the Commission, it is nonetheless instructive in understanding the substance of the
transparency obligations set out in the GDPR and their interrelationship with the core principles
contained in Article 5 GDPR. It is clear to me from the above that the purpose limitation principle
has an important role to play, both in relation to the empowerment of the data subject, but also

166
Article 29 Working Group, “Opinion 03/2013 on Purpose Limitation” (00569/13/EN WP 203) (adopted on 2 April
2013), at p. 13.
167
Article 29 Working Group, “Opinion 03/2013 on Purpose Limitation” (00569/13/EN WP 203) (adopted on 2 April
2013), at p. 18.
168
Article 29 Working Group, “Opinion 03/2013 on Purpose Limitation” (00569/13/EN WP 203) (adopted on 2 April
2013), at p. 17.
169
Article 29 Working Group, “Opinion 03/2013 on Purpose Limitation” (00569/13/EN WP 203) (adopted on 2 April
2013), at pp. 14 – 15.
79

in relation to underpinning and supporting the objectives of the data protection framework as a
whole under the GDPR.

163. Therefore, when considering what information must be provided in respect of the “purposes” of
any processing operation – for example, as required by Article 13(1)(c) - it seems clear to me that
it is important to consider, among another things, how the quality of information provided may
potentially impact the effective operation of the other data protection principles. This is
particularly the case where the wording of Article 13(1)(c) GDPR maps the approach of Article
5(1)(b) GDPR, i.e. by describing the obligation arising by reference to “collection” and “further”
processing.

164. Given that the data controller must identify the categories of personal data that will be collected
so as to ensure compliance with the requirement to specify “purpose” in accordance with the
purpose limitation principle, it is my view that data subjects must have access to the information
required by Article 13(1)(c) GDPR in conjunction with the category/categories of personal data
being processed. This is necessary to ensure that the data subject is empowered to hold the
controller accountable for compliance with the purpose limitation principle set out in Article
5(1)(b) GDPR. This view is reflected in the Article 29 Working Party guidelines on transparency:

“Transparency, when adhered to by data controllers, empowers data subjects to hold data
controllers and processors accountable and to exercise control over their personal data by,
for example, providing or withdrawing informed consent and actioning their data subject
rights. The concept of transparency in the GDPR is user-centric rather than legalistic and is
realised by way of specific practical requirements on data controllers and processors in a
number of articles”. 170

My View on the Information to be Provided

165. It was on the basis of the above analysis that I expressed the provisional view in the Preliminary
Draft that Article 13(1)(c) GDPR requires that information which specifies and relates to the
purpose(s) of the processing operation(s) or set(s) of operations for which the (specified
category/categories of) personal data are intended is to be provided to data subjects. It was also
my provisional view that this information should be provided in such a way as to ensure that
there is a clear link from:

a. the specified category/categories of personal data to
b. the purpose(s) of the specified processing operation(s)/set(s) of operations to

Article 29 Working Group, “Guidelines on transparency under Regulation 2016/679” (adopted on 29 November
170

2017, as last revised and adopted on 11 April 2018), at para. 4.
80

c. the legal basis which is being relied on to support the specified processing
operation(s)/set(s) of operations.

166. The Complainant agreed with this approach and, in its submissions on the Preliminary Draft,
stated that “[w]ithout such linking, we would simply see generic lists of all data, all purposes and
all legal bases under Article 6(1) GDPR without any indication of the relationships between
them.”. 171

167. Meta Ireland disagreed with this proposed approach and asserted that it was only obliged to
provide specific information on (1) the purposes for the processing it carries out and (2) the legal
bases upon which it relies. 172 In essence, this amounts to a restatement of its position that it is
only required to provide (discrete) information as to the purposes and legal basis of any
processing. Meta Ireland further alleged that my reference to “processing operations” was
“extraneous” as “[b]oth the intended purpose and the legal basis are, conceptually, capable of
being explained and understood without any reference to the practicalities of the processing
operations which will be applied to the personal data”. 173 Moreover, it is Meta Ireland’s position
that my approach does not further the objectives of the transparency obligations nor would it
provide information in “a concise, transparent, intelligible and easily accessible form”. 174

168. As is evident from the assessment below, my view is that the Data Policy and related material
sometimes, on the contrary, demonstrate an oversupply of very high level, generalised
information at the expense of a more concise and meaningful delivery of the essential
information necessary for the data subject to understand the processing being undertaken and
to exercise his/her rights in a meaningful way. Furthermore, while Meta Ireland has chosen to
provide its transparency information by way of pieces of text, there are other options available,
such as the possible incorporation of tables, which might enable Meta Ireland to provide the
information required in a clear and concise manner, particularly in the case of an information
requirement comprising a number of linked elements. The importance of concision cannot
nonetheless be overstated. It is, I think, important to emphasise that while a controller may
provide (additional) information which goes beyond what is required by Article 13(1)(c) GDPR,
that controller must first satisfy the information obligations set out in the GDPR and, second,
ensure that any such additional information does not have the effect of creating information
fatigue or otherwise diluting the effective delivery of the statutorily required information.

169. In the Preliminary Draft, I noted that while Article 13 GDPR – unlike Article 14 – does not expressly
refer to categories of data, it does not follow that there is no obligation to provide information

171
Complainant’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 20.
172
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.3.
173
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.3(B).
174
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.3(B).
193
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.4.
81

as to the category/categories of personal data undergoing processing. Indeed, I expressed the
view that information as to the categories of personal data must also be provided in ensuring
compliance with Article 13 GDPR. Meta Ireland disagreed and asserted that as Article 13 – unlike
Article 14 – did not expressly refer to “categories of personal data and accordingly should not be
read into Article 13(1)(c) GDPR”.193 In this vein, it was Meta Ireland’s position that as:

“Article 14(1)(d) GDPR expressly requires a controller to provide information to the data
subject on the categories of personal data (in circumstances where Article 14 applies) [it]
further reinforces this point - i.e. it is clear from the fact that the concept is referred to in
Article 14(1)(d) GDPR, that the legislators made a deliberate choice not to include this
concept in Article 13(1)(c) GDPR. Indeed, if the Commission’s interpretation was correct
there would have been no need for Article 14(1)(d) GDPR, as Article 14(1)(c) GDPR would
in any event have to be approached on the basis that categories of data needed to be
identified. As such, the Commission’s approach appears to conflict with the statutory
interpretation principle expressio unis est exclusion alterius”. 175

170. I do not agree; rather, it remains my view that that there is an implicit obligation in Article 13 to
provide such information. In support of this position, it is important to first distinguish Article 13
from Article 14. Article 13 concerns circumstances wherein personal data are collected (directly)
from the data subject whereas Article 14 is applicable where the personal data have not been
obtained from the data subject. It logically follows that, as the data subject has provided the
personal data to the controller, that data subject may already know the categories of personal
data and the source of this information where the personal data is collected from that data
subject. However, it is not necessarily the case that, in such circumstances, the categories are
known by the data subject, in particular where metadata or device data is collected from them.
Nonetheless, where personal data are not obtained from the data subject, that data subject will
likely never have knowledge of the categories of personal data.

171. It appears to me to be clear that both Articles 13 and 14 GDPR envisage that, in all circumstances,
the data subject will have information as to the categories of personal data undergoing
processing. As Article 14 GDPR concerns circumstances wherein the personal data has not been
obtained by the data subject and thus the categories are likely to never be known by the data
subject, it explicitly specifies that such information should be provided. On the other hand,
Article 13 does not include this as an explicit requirement as it may be the case that the data
subject who has provided the data may already know this information. In my view, this is the
distinction between the provisions and the clear motivation of the legislator in including the
reference to categories of information in Article 14 GDPR alone.

172. I would further add that the fundamental difference in how the personal data is collected gives
rise to other variations in the information required to be provided. For example, Article 13(2)(e)

175
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.4(C).
82

GDPR requires the controller to inform the data subject as to “whether the provision of personal
data is a statutory or contractual requirement, or a requirement necessary to enter into a
contract, as well as whether the data subject is obliged to provide the personal data and of the
possible consequences of failure to provide such data.” Article 14 GDPR, on the other hand,
contains no such requirement. The rationale for this difference is clear. When this information
is provided prior to the collection of personal data, the data subject is empowered to exercise
control over their personal data. It avoids them being placed in a position where they provide
personal data to the controller on a mistaken understanding as to either the necessity for its
collection, or of the potential consequences of failure to provide it. The provision of such
information would have no purpose if provided to the data subject after the personal data has
been collected, hence its omission from Article 14 GDPR.

173. It is also unclear why a data subject would only be entitled to information concerning the
categories of personal data if the controller has acquired their personal data from another
source. It is further difficult to understand how such a difference in treatment, between two
categories of data subject, could be consistent with the GDPR, particularly where the difference
in treatment concerns a core data subject right. If this were true, a data subject would only be
entitled to this information if the personal data were obtained from a source other than
themselves, but would not if it was obtained from them directly. This entirely arbitrary
distinction is inconsistent with the clear aims of the GDPR to provide a series of universal rights
to all data subjects, grounded on the universal right to data protection in Article 8 of the Charter.
Therefore even if the interpretation advanced in the preceding paragraph were incorrect, Meta
Ireland’s submissions would nonetheless not be supported by a purposive or systematic reading
of the GDPR.

174. Accordingly, I am of the view that Article 13(1)(c) GDPR requires data controllers to provide
information concerning the individual purpose(s) and legal basis by reference to a specified
category/categories of personal data. This is supported by both a literal interpretation of Article
13(1)(c) GDPR, which refers to the purposes for which the personal data are intended, and a more
purposive interpretation as I have considered above. When the purposes and legal basis for
processing are identified, they must be identified by reference to the personal data being
processed or, at a minimum, the broad personal data processing operations to which they relate.
The purposes and legal basis of processing personal data can only be understood by reference to
the processing operations being undertaken. In order for information in this regard to be
meaningful, and to provide data subjects with meaningful information as to whether they wish
to exercise data subject rights, data subjects must be provided with this information. This goes
to the essence of transparency in relation to the processing of personal data. In providing
information on “the purposes of the processing for which the personal data are intended as well
as the legal basis for the processing” for the purposes of Article 13(1)(c) GDPR, the data controller
must do so by reference to the personal data being processed or, at least, the broad personal
data processing operations involved.

175. For completeness, I should note that a controller’s transparency obligations are particularly
pertinent where Article 6(1)(b) GDPR is being relied on as a legal basis for the processing of
personal data. Indeed, in respect of the transparency requirements, I note that the EDPB
Guidelines on Article 6(1)(b) GDPR state “[i]n line with their transparency obligations, controllers
should make sure to avoid any confusion as to what the applicable legal basis is[,] … particularly
… where the appropriate legal basis is Article 6(1)(b)”. 176 I agree with the EDPB’s view that
transparency obligations are particularly pertinent in this context so as to ensure that data
subjects freely exercise their freedom to enter into contracts. In this regard, I also note that the
EDPB provides an example similar to the facts at issue, namely where “data subjects may
erroneously get the impression that they are giving their consent in line with Article 6(1)(a) when
signing a contract or accepting terms of service”. 177

Information provided by Meta Ireland in relation to Processing in accordance with Article 6(1)(b)

176. In considering the information which Meta Ireland provided to users of the Instagram service in
respect of processing in accordance with Article 6(1)(b), the starting point is the Instagram Data
Policy. Section V of the Data Policy specifically concerns the legal basis of processing in
connection with the Instagram service and is entitled “What is our legal basis for processing
data?” In Section V, Meta Ireland specifically sets out its position in respect of contractual
necessity, stating:

“We collect, use and share the data that we have in the ways described above:

• as necessary to fulfill our Facebook Terms of Service or Instagram Terms of Use; …

Learn more about these legal bases and how they relate to the ways in which we process
data”.

For completeness, I note that both the Meta Ireland Terms of Service and the Instagram Terms of
Use are accessible by hyperlink. The clause which invites users to “learn more” also contains a
hyperlink which directs users to an unnamed page which the Investigator termed the “Legal Basis
Notice”. For clarity, I will retain that description of the page. This page is not specific to the
Instagram service but applies across various Meta services. According to the Legal Basis Notice:

“For all people who have legal capacity to enter into an enforceable contract, we process
data as necessary to perform our contracts with you (the Facebook Terms and Instagram
Terms, together, 'the Terms'). We describe the contractual services for which this data
processing is necessary in the “Our Services” section of the Terms, and in the additional

176
EDPB Guidelines on Article 6(1)(b), at para. 20.
177
EDPB Guidelines on Article 6(1)(b), at para. 20.
84

informational resources accessible from the Terms. The core data uses necessary to
provide our contractual services are:

• To provide, personalize, and improve our Facebook Products;
• To promote safety, integrity, and security;
• To transfer, transmit, store, or process your data outside the EEA, including to within
the United States and other countries;
• To communicate with you, for example, on Product-related issues; and
• To provide consistent and seamless experiences across the Facebook Company
Products.

These uses are explained in more detail in our Data Policy, under “How do we use this
information?” and “How do we operate and transfer data as part of our global services?”
and “How do the Facebook Companies work together?” We’ll use the data we have to
provide these services; if you choose not to provide certain data, the quality of your
experience using the Facebook Products may be impacted”.178

177. As with the Instagram Data Policy, the Legal Basis Notice contained hyperlinks to both the
Facebook Terms of Service and the Instagram Terms of Use. It follows that users were invited to
receive further information from these hyperlinks. As the Instagram Terms of Use stated that it
is those Terms of Use which comprise the agreement between the user and Meta Ireland (then
Facebook), the focus on my analysis is on the Instagram Terms of Use. While I note and agree
with the Investigator’s position that the Facebook Terms of Service do not concern Instagram, 179
I would add that the version of the Instagram Terms of Use at the date of the Complaint was not
explicit as regards the non-applicability of the Facebook Terms of Service to the Instagram
service. This is in contrast with more recent versions of the Terms of Use which expressly state
that “[w]hen you create an Instagram account or use Instagram, you agree to these terms. The
Facebook Terms of Service do not apply to this Service”. 180 While I accept on balance that a data
subject is likely to understand that the Facebook Terms of Service were not applicable in this
context, it nonetheless may have been unclear given the hyperlinks to the Facebook Terms of
Service in the Data Policy and Legal Basis Notice; this in turn is relevant for my assessment of the
form in which the information was provided.

178. I also note that users were directed to the “Our Services” section of the Instagram Terms of Use.
While there is no section expressly titled “Our Services” in the Terms of Use, there is a section for
“The Instagram Service”. Taking a broad reading, it appears to me that this is likely the section

178
See the Legal Basis Notice.
179
Final Inquiry Report dated 18 January 2021, at para. 288.
180
See the Instagram Terms of Use, last revised 20 December 2020
https://help.instagram.com/581066165581870?ref=dp last accessed 20 September 2021. 200 Final Inquiry Report
dated 18 January 2021, at para. 358.
85

that the Legal Notice Basis directs users to. Nonetheless, it should be noted that this is not
explicitly made clear and I agree with the Investigator’s view that “[w]hile it is perhaps possible to
discern the controller’s intention in this sentence, the terminology used here is inaccurate, and
could confuse the reader as to the correct source of relevant information”.200 “The Instagram
Service” section of the Terms of Use provides the following information:

“We agree to provide you with the Instagram Service. The Service includes all of the
Instagram products, features, applications, services, technologies, and software that we
provide to advance Instagram's mission: To bring you closer to the people and things you
love. The Service is made up of the following aspects (the Service):

• Offering personalized opportunities to create, connect, communicate, discover,
and share.
People are different. We want to strengthen your relationships through shared
experiences you actually care about. So we build systems that try to understand who
and what you and others care about, and use that information to help you create, find,
join, and share in experiences that matter to you. Part of that is highlighting content,
features, offers, and accounts you might be interested in, and offering ways for you to
experience Instagram, based on things you and others do on and off Instagram.

• Fostering a positive, inclusive, and safe environment.
We develop and use tools and offer resources to our community members that help
to make their experiences positive and inclusive, including when we think they might
need help. We also have teams and systems that work to combat abuse and violations
of our Terms and policies, as well as harmful and deceptive behavior. We use all the
information we have-including your information-to try to keep our platform secure.
We also may share information about misuse or harmful content with other Facebook
Companies or law enforcement. Learn more in the Data Policy [hyperlinked].

• Developing and using technologies that help us consistently serve our growing
community.
Organizing and analyzing information for our growing community is central to our
Service. A big part of our Service is creating and using cutting-edge technologies that
help us personalize, protect, and improve our Service on an incredibly large scale for a
broad global community. Technologies like artificial intelligence and machine learning
give us the power to apply complex processes across our Service. Automated
technologies also help us ensure the functionality and integrity of our Service.

• Providing consistent and seamless experiences across other Facebook Company
Products.
Instagram is part of the Facebook Companies, which share technology, systems,
insights, and information-including the information we have about you (learn more in
86

the Data Policy [hyperlinked])-in order to provide services that are better, safer, and
more secure. We also provide ways to interact across the Facebook Company Products
that you use, and designed systems to achieve a seamless and consistent experience
across the Facebook Company Products.

• Ensuring a stable global infrastructure for our Service.
To provide our global Service, we must store and transfer data across our systems
around the world, including outside of your country of residence. This infrastructure
may be owned or operated by Facebook Inc., Facebook Ireland Limited, or their
affiliates.

• Connecting you with brands, products, and services in ways you care about.
We use data from Instagram and other Facebook Company Products, as well as from
third-party partners, to show you ads, offers, and other sponsored content that we
believe will be meaningful to you. And we try to make that content as relevant as all
your other experiences on Instagram.

• Research and innovation.
We use the information we have to study our Service and collaborate with others on
research to make our Service better and contribute to the wellbeing of our
community”.

179. The Terms of Use also stated that providing the Instagram service “requires collecting and using your
information” and, accordingly, directed users to the Data Policy for information as to how Meta Ireland
“collect, use, and share information across the Facebook Products [hyperlinked]“. The Data Policy outlined
how the information was used in Section II entitled “How do we use this information?” It should be noted
that the Legal Basis Notice also directs users towards this section of the Data Policy. Section II provides
the following information:

“We use the information we have (subject to choices you make) as described below and to
provide and support the Facebook Products and related services described in the Facebook
Terms and Instagram Terms. Here's how:

Provide, personalize and improve our Products.
We use the information we have to deliver our Products, including to personalize features
and content (including your News Feed, Instagram Feed, Instagram Stories and ads) and
make suggestions for you (such as groups or events you may be interested in or topics you
may want to follow) on and off our Products. To create personalized Products that are
unique and relevant to you, we use your connections, preferences, interests and activities
based on the data we collect and learn from you and others (including any data with
special protections you choose to provide where you have given your explicit consent); how
you use and interact with our Products; and the people, places, or things you're connected
87

to and interested in on and off our Products. Learn more about how we use information
about you to personalize your Facebook and Instagram experience, including features,
content and recommendations in Facebook Products; you can also learn more about how
we choose the ads that you see.

• Information across Facebook Products and devices: We connect information about
your activities on different Facebook Products and devices to provide a more tailored
and consistent experience on all Facebook Products you use, wherever you use them.
For example, we can suggest that you join a group on Facebook that includes people
you follow on Instagram or communicate with using Messenger. We can also make
your experience more seamless, for example, by automatically filling in your
registration information (such as your phone number) from one Facebook Product
when you sign up for an account on a different Product.
• Location-related information: We use location-related information-such as your
current location, where you live, the places you like to go, and the businesses and
people you're near-to provide, personalize and improve our Products, including ads,
for you and others. Location-related information can be based on things like precise
device location (if you've allowed us to collect it), IP addresses, and information from
your and others' use of Facebook Products (such as check-ins or events you attend).
• Product research and development: We use the information we have to develop, test
and improve our Products, including by conducting surveys and research, and testing
and troubleshooting new products and features. Face recognition: If you have it turned
on, we use face recognition technology to recognize you in photos, videos and camera
experiences. The face-recognition templates we create are data with special
protections under EU law. Learn more about how we use face recognition technology,
or control our use of this technology in Facebook Settings. If we introduce
facerecognition technology to your Instagram experience, we will let you know first,
and you will have control over whether we use this technology for you.
• Ads and other sponsored content: We use the information we have about you-
including information about your interests, actions and connections-to select and
personalize ads, offers and other sponsored content that we show you. Learn more
about how we select and personalize ads, and your choices over the data we use to
select ads and other sponsored content for you in the Facebook Settings and Instagram
Settings.”.

Provide measurement, analytics, and other business services.
We use the information we have (including your activity off our Products, such as the
websites you visit and ads you see) to help advertisers and other partners measure the
effectiveness and distribution of their ads and services, and understand the types of people
who use their services and how people interact with their websites, apps, and services.
Learn how we share information with these partners.

Promote safety, integrity and security.
We use the information we have to verify accounts and activity, combat harmful conduct,
detect and prevent spam and other bad experiences, maintain the integrity of our
Products, and promote safety and security on and off of Facebook Products. For example,
we use data we have to investigate suspicious activity or violations of our terms or policies,
or to detect when someone needs help. To learn more, visit the Facebook Security Help
Center and Instagram Security Tips.

Communicate with you.
We use the information we have to send you marketing communications, communicate
with you about our Products, and let you know about our policies and terms. We also use
your information to respond to you when you contact us.

Research and innovate for social good.
We use the information we have to conduct and support research and innovation on topics
of general social welfare, technological advancement, public interest, health and
wellbeing. For example, we analyze information we have about migration patterns during
crises to aid relief efforts. Learn more about our research programs”.

Further information is made available to users by way of hyperlinks throughout Section II of the
Terms of Use.

180. As noted above, the Legal Basis Notice outlines the five core data uses which Meta Ireland
considers necessary to provides its contractual services. The Legal Basis Notice advises that
additional information in respect of these uses can be found under the following sections of the
Data Policy:

- “How do we use this information?” (as outlined above);
- “How do we operate and transfer data as part of our global services?”; and -
“How do the Facebook Companies work together?”

181. Section IX of the Data Policy considers “How do we operate and transfer data as part of our
global services?” and states that:

“We share information globally, both internally within the Facebook Companies and
externally with our partners and with those you connect and share with around the world
in accordance with this policy. Information controlled by Facebook Ireland will be
transferred or transmitted to, or stored and processed in, the United States or other
countries outside of where you live for the purposes as described in this policy. These data
transfers are necessary to provide the services set forth in the Facebook Terms and
Instagram Terms and to globally operate and provide our Products to you. We utilize
standard contractual clauses approved by the European Commission and rely on the
89

European Commission's adequacy decisions about certain countries, as applicable, for
data transfers from the EEA to the United States and other countries”.

182. Section IV of the Data Policy concerns “How do the Facebook Companies work together?” and
it states:

“Facebook and Instagram share infrastructure, systems and technology with other
Facebook Companies (which include WhatsApp and Oculus) to provide an innovative,
relevant, consistent and safe experience across all Facebook Company Products you use.
We also process information about you across the Facebook Companies for these
purposes, as permitted by applicable law and in accordance with their terms and policies.
For example, we process information from WhatsApp about accounts sending spam on its
service so we can take appropriate action against those accounts on Facebook, Instagram
or Messenger. We also work to understand how people use and interact with Facebook
Company Products, such as understanding the number of unique users on different
Facebook Company Products.”

Further information as to the entities comprising the “Facebook Company” or “Facebook
Company Products” is accessible by way of hyperlinks.

Whether Meta Ireland Complies with Article 5(1)(a), 12(1) and 13(1)(c) GDPR

183. In the preceding section of this Draft Decision, I have outlined the various sources and
documents by which a data subject may obtain information as to the purposes of the processing
and the legal basis of same. This information is provided in the (i) Instagram Data Policy, (ii) Legal
Basis Notice, (iii) Instagram Terms of Use and (iv) other relevant hyperlinked pages. Moreover,
the information in these sources is rather general in nature. As a preliminary matter, I restate my
position that the information should be considered holistically and not individually “layer-by-
layer”. Accordingly, I will assess the information provided in all such documents/sources.
Nonetheless, the precise means by which the information is accessible in respect of the Instagram
service is disjointed and circular in nature. For example, the Data Policy directs users to the Legal
Basis Notice, which in turn direct users to both the Data Policy and Terms of Use. Furthermore,
as I have noted above, the language used in directing users is confusing and misleading in parts,
in particular where it appears that the Facebook Terms of Service has been conflated with the
Instagram Terms of Use (for example, users are directed to sections which only appear in the
former and not the latter), despite the fact that the former is not applicable to the Instagram
service.

184. In its response to the Preliminary Draft, the Complainant agreed with my approach taken on
this issue, and emphasised that “the most relevant change in Facebook’s position”, in the
Complainant’s view, was the decision to rely on Article 6(1)(b) GDPR for the processing in question

and not consent, following the GDPR taking legal effect, which was contained in the last layer of
information and not displayed more prominently. 181

185. On the other hand, in its response to the Preliminary Draft which provisionally found that the
information was provided in a disjointed manner and that the texts were variations of each other,
Meta Ireland reaffirmed its position that it had provided the requisite information to data subjects
in line with its construction of Article 13(1)(c) GDPR. 182 In particular, Meta Ireland’s view was that
users were “clearly and prominently told that Meta Ireland relies on Article 6(1)(b) GDPR” and
extensive information was provided in the Terms of Use, Data Policy and Legal Basis Notice. 183
Meta Ireland criticised my view on the basis that such overlap was necessary and inevitable and
also highlighted its use of hyperlinks and summaries to make the information more accessible to
users. 184 Indeed, Meta Ireland asserted that my proposed approach did not “appreciate the
positive benefit to users of providing a range of easily accessible tools and explanations,
supplemented by additional detail, with easily-navigable hyperlinks connecting those layers” 185
and precludes users from being overwhelmed with information.206 In this regard, Meta Ireland
also asserted that it provided “user-facing information in as simple a manner as possible, and
[Meta Ireland] has sought to ensure that it can be understood by the average user”. 186 I further
note Meta
Ireland’s assertion that my proposed approach was “excessively prescriptive”. 187

186. First of all, while it remains the case that it is for Meta Ireland to provide accessible
information that is clear and concise for users regardless of their “sophistication”, that does not
detract from the core of the criticism that the disjointed information set out in generalised terms
is divorced from specific processing operations. It is not that the presence of variations of the
same information in several documents is in itself non-compliant, but rather that it is not
compliant when it amounts, in practice, to statements about services and objectives that are not
linked to specified processing operations and which do not provide meaningful information to the
data subject on the core issues identified in Article 13 GDPR. The fact that this disjointed
information is generalised and does not contain the required information (as has been set out
when I addressed the correct interpretation of Article 13(1)(c) GDPR), renders the information as
a whole unhelpful and ultimately inconsistent with Article 13 GDPR.

181
Complainant’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 19.
182
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 8.6 – 8.7.
183
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.8.
184
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 8.11 and 9.7.
185
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.12.
206
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 9.6.
186
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.10.
187
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 9.1 – 9.4.
91

187. While I accept that the Legal Basis Notice provides some information as to the purposes and
legal basis of processing under Article 6(1)(b) GDPR, I am not satisfied that sufficient information
is provided. In particular, I emphasise that the Legal Basis Notice provides a short statement of
the five “core data uses” using “summary bullet points” 188 and describes these using generalised
language. Furthermore, it does not link these core data uses with any specific and/or specified
processing operation(s) or set(s) of operations. While users are directed to specific sections of the
Data Policy (i.e. sections on “How do we use this information?” and “How do we operate and
transfer data as part of our global services?” and “How do the Facebook Companies work
together?”), it does not appear to me that any substantial additional detail and/or information is
provided. It seems that these various sources largely recycle similar generalised information
which focusses on reiterating the aims/goals of the Meta Platforms group in its data processing
activities more broadly, such as personalisation, security, communication and product
development etc. I am not convinced that this necessarily provides sufficient detail as to the
purposes and legal basis of the processing. Indeed, it appears impossible to identify what
processing operations will be carried out in order to fulfil the objectives that are repeated
throughout these documents and the legal basis for such operations. In the absence of such
information, the user is left to guess as to what processing is carried out on what data, on foot of
the specified lawful bases, in order to fulfil these objectives. For the reasons set out above in
relation to the correct interpretation of Article 13(1)(c) GDPR, this is insufficient information.

188. More critical, however, is the fact that these various sources of information do not provide
meaningful additional information on the various processing operation(s) or set(s) of operations
relied on to provide these services. This generalised, repetitive information, in combination with
the circular manner in which the information is made accessible to users, has the effect that Meta
Ireland’s approach lacks clarity and concision, which in turn means it is difficult for users to identify
or have meaningful information as to the processing operation(s) or set(s) of operations that are
or will be grounded on Article 6(1)(b) GDPR or on other legal bases. On this basis, it is my view
that Meta Ireland has not provided meaningful information as to the processing operation(s)
and/or set(s) of operations that occur in the context of the Instagram service, either on the basis
of Article 6(1)(b) GDPR or any other legal basis. Indeed, I would go so far as to say that it is
impossible for the user to identify with any degree of specificity what processing is carried out on
what data, on foot of the specified lawful bases, in order to fulfil these objectives. While I note
that some information is provided in respect of IP addresses and location information, this is
prefaced by qualifiers including “such as” and “things like” which indicates that the information
provided is illustrative rather than concrete in nature. Accordingly, I consider that users have been
deprived of meaningful information which creates further risks of significant confusion as to what
legal basis will be relied upon to ground a specific processing operation or set(s) of operations. It
is on this basis that I am not satisfied that the Data Policy and Legal Basis Information Page satisfy

188
As described by Meta Ireland; see, Meta Ireland’s Submissions on the Draft Inquiry Report dated 22 June 2020, at
para. 8.3.
92

the requirements of Article 13(1)(c) GDPR either individually or cumulatively. Indeed, it could be
said that there is a significant deficit of information made available to data subjects.

189. In assessing whether the information provided is transparent, it is necessary to consider the
form in which the information is provided. In particular, Article 12(1) GDPR requires information
to be provided in a “concise, transparent, intelligible and easily accessible form, using clear and
plain language, in particular for any information addressed specifically to a child.” Meta Ireland
have maintained the position that the “Data Policy is drafted in a way that is both comprehensive
and easy-to-read for our users” and includes links to relevant information. 189 In further
submissions, Meta Ireland reasserted its position that the information was sufficiently accessible
and comprehensive and alleged that:

“A reduction of information or removing convenient hyperlinks to relevant information
would have the effect of reducing overall user understanding and control of the Instagram
service to the detriment of users. Furthermore, it is Facebook Ireland’s view that the use
of examples actually increases the ease of comprehension by contextualising information.
… [A] controller is not prohibited from providing more than the information required by
Article 13(1)(c) GDPR to data subjects. The fact that Facebook Ireland has chosen to do so
should not be held against Facebook Ireland when assessing its compliance (as seems to
be the case in this instance)”. 190

Meta Ireland also alleged that the various sources of information were designed in such a manner
as to enable data subjects to access the information as she/he wished. In this regard, Meta Ireland
stated that “these documents also serve as a key central resource to which data subjects can
quickly and easily return to find more specific information relevant to their needs”. 191 In addition,
Meta Ireland asserted that it “makes appropriate use of a layered format and links and clear
references within the Data Policy, including the Legal Basis Notice”. 192

190. While I accept that a controller has a certain degree of discretion as to the precise manner in
which in the information is provided, I am not persuaded by Meta Ireland’s submissions that the
form of information complied with Article 12(1) GDPR. As I outlined above, the information was
not provided in a concise manner but over the course of several documents which cross-reference
each other in a circular manner. As I have stated above, I do not dispute Meta Ireland‘s assertion
that a layered approach may be an appropriate means by which to convey information for the
purposes of discharging transparency obligations under the GDPR. 193 However, it does not follow
that all layered approaches are compliant with those obligations. Taking into account the circular,

189
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.64.
190
Meta Ireland’s Submission on the Draft Inquiry Report dated 22 June 2020, at para. 9.6.
191
Meta Ireland’s Submission on the Draft Inquiry Report dated 22 June 2020, at para. 9.7.
192
Meta Ireland’s Submission on the Draft Inquiry Report dated 22 June 2020, at para. 10.3.
193
See, for example, Meta Ireland’s Submission on the Draft Inquiry Report dated 22 June 2020, at para. 6.6.
93

disjointed nature of the information provided by Meta Ireland and the generalised, high-level
overview it provided, I am not satisfied that the information was clear and concise. Moreover, I
would add that the language used was not clear or easy to understand as it referred to abstract
objectives and purposes without any connection to specific categories of personal data or
processing operations being undertaken.

191. At this juncture, I also note that I expressed a provisional view in the Preliminary Draft that
the information was also misleading in that the Facebook Terms of Service appear to be conflated
with
the Instagram Terms of Use as references to the former in the Legal Basis Notice arguably
(incorrectly) implied that the Facebook Terms of Service were applicable in the context of the
Instagram service. In response, Meta Ireland stated that, in its view,:

“no such implication arises, particularly considering the expression ‘Terms’ is explicitly
defined in the Legal Basis Notice as referring to ‘the Meta Terms and Instagram Terms,
together, 'the Terms’. The definition also provides the user with a link to the Terms of Use
(as well as a link to the Meta Terms of Service), which clearly inform the user that ‘[t]he
Meta Terms of Service do not apply to this Service’.” 194

While I note Meta Ireland’s position, I do not agree with this position on the basis that “and”, in
contrast to “or” – when used as a connecting word – does not imply alternatives. While Meta
Ireland have stated that the data subject is informed via the Terms of Use that the Facebook Terms
of Service did not apply, this is not, strictly speaking, correct. Indeed, as I outlined above, there is
no reference to the Meta (or Facebook as it was then) Terms of Service in the Terms of Use at the
date of the Complaint. It is only the more recent versions of the Terms of Use which expressly
state that “[w]hen you create an Instagram account or use Instagram, you agree to these terms.
The Facebook Terms of Service do not apply to this Service”. 195 Indeed, in the Terms of Use
applicable at the date of the Complaint, the clause read as follows: “[w]hen you create an
Instagram account or use Instagram, you agree to these terms”.217 I further add that data subjects
were not informed in either the Legal Basis Notice or the Facebook Terms of Service that the latter
did not apply in the context of the Instagram service. Therefore, I remain of the view that the
information was misleading in this manner at the time of the Complaint.

192. I am also concerned by the fact that the layered approach adopted by Meta Ireland
crossreferenced the same small number of documents in a circular manner (e.g. the Data Policy
referring the user to the Legal Basis Notice which in turn redirected the user back to the Data
Policy) as opposed to presenting the user with additional and more detailed information to as to

194
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 9.8.
195
See the Instagram Terms of Use which was last revised on 4 January 2022:
https://help.instagram.com/581066165581870?ref=dp last accessed 29 March 2022. 217 See the Instagram Terms of
Use last revised on 19 April 2018.
94

enable them to better understand the relevant processing. In addition, the substance of the
documents overlapped significantly – including, for example, the five core data uses in the Legal
Basis Notice and “The Instagram Service” section of the Instagram Terms of Use. Given the
similarity of the content and the means by which it is presented, it is difficult to identify whether
additional or more detailed information has been provided when a user moves between
documents. This lack of clarity is further affected by the lack of identification of specific processing
operation(s) or set(s) of operations by Meta Ireland. Indeed, the lack of a single composite text
or clearly layered path does not enable data subjects to quickly and easily understand the full
extent of processing operations that will take place as regards their personal data arising from
their acceptance of the Terms of Use. Given this ambiguity, I agree with the Complainant that
there is a real risk that data subjects may be misled as to the legal basis and/or purpose(s) of the
relevant processing operation(s) and/or set(s) of operations. The alleged “forced consent” and
the dispute surrounding the processing operations being carried out, and the legal bases
underpinning them, are reflective of a broader lack of clarity as regards the link between the
purposes of processing, the lawful bases of processing and the processing operations involved.

193. As a final point, I note Meta Ireland’s submission that the Commission should refrain from
considering Article 13(1)(c) until such time that the statutory appeal in respect of IN-18-2-2
concerning WhatsApp has been resolved. 196 Meta Ireland has not provided any legal basis or
identified any authority for this submission. As this submission has not been substantiated, there
is no basis for which to take such approach.

Article 5(1)(a) GDPR – Principle of Transparency

194. Article 5(1)(a) GDPR concerns the broader principle of transparency. However, it is important
to emphasise that, a finding of non-compliance with Articles 12 – 14 GDPR (or parts thereof) does
not necessarily or automatically imply that there has been an infringement of Article 5(1)(a).
Nonetheless, there is a significant link between these principles. Indeed, transparency is an
expression of the principles of fairness and accountability under the GDPR. In this regard, I note
that transparency is an “overarching obligation under the GDPR” 197 and is a broader expression of
transparency than the specific obligations provided for in Article 12 – 14 GDPR. Accordingly, while
non-compliance with Article 12 – 14 GDPR (or parts thereof) do not necessitate a finding of
noncompliance with Article 5(1)(a), in certain circumstances it is appropriate to find that there has
been an infringement of both the specific transparency obligations and the broader principles of
transparency where the extent of non-compliance with the former is sufficiently extensive to
amount to an overarching infringement of the transparency principle.

196
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 8.5.
197
Article 29 Working Party, Guidelines on transparency under Regulation 2016/679 (last revised and adopted on
11 April 2018), at para. 1.
95

195. In the context of this Decision, there was an assumption on the part of the Complainant that
Meta Ireland – which had primarily relied on consent as its lawful basis for processing prior to the
coming into effect of the GDPR on 25 May 2018 – was relying on GDPR consent, provided by the
means of accepting the updated Terms of Use following the coming into effect of the GDPR, as its
legal basis for processing in the context of the Instagram service. This assumption was premised
on the user engagement flow presented to users which provided them with a number of
opportunities to consent before selecting the final “Agree to Terms” button.

196. While there is no particularised requirement under the GDPR to provide data subjects with
information on an alteration of a legal basis, or to provide information in a particular part of any
such user engagement flow, the lack of clarity on such a fundamental issue underlines the inherent
lack of transparency in the information provided to the data subject. As I noted above, Article
5(1)(a) links transparency to the overall fairness of the activities of a controller by requiring that
personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the
data subject”.

197. In the Preliminary Draft, I expressed a provisional view that Meta Ireland had also infringed
Article 5(1)(a) GDPR in the circumstances of this case. Meta Ireland disagreed with this
approach. 198 In particular, Meta Ireland submitted that (without prejudice to its position that
there was no infringement of the transparency obligations in Articles 12 and 13) it does “not
consider that the circumstances in issue can properly be characterised as ‘sufficiently extensive’ to
demonstrate an infringement of the overarching principle of transparency in Article 5(1)(a)
GDPR”. 199 In support of this position, Meta Ireland noted the Commission’s statement that the
act of acceptance clearly related to the Terms of Use (and not the provision of consent). 200 Meta
Ireland also noted that, were Article 5(1)(a) GDPR to refer to additional obligations other than
those set out in Articles 12 14, “it would be a more expansive principle, holistically encapsulating
transparency, fairness and lawfulness… [and] would arguably be concerned with matters other
than the technical question of whether prescribed items of information have been provided”. 201

198. In this respect, I follow the EDPB’s interpretation of this matter which arose following the
EDPB’s adoption of a binding decision (“the EDPB Decision”) 202 relating to IN 18-12-2, an inquiry
conducted by the Commission into WhatsApp Ireland Limited’s compliance with Articles 12, 13
and 14 GDPR. The EDPB Decision states as follows:

198
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 10.1.
199
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 10.4.
200
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 10.4.
201
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 10.6.
202
https://edpb.europa.eu/system/files/2021-
09/edpb_bindingdecision_202101_ie_sa_whatsapp_redacted_en.pdf.
96

a. “The EDPB notes that the concept of transparency is not defined as such in the GDPR.
However, Recital 39 GDPR provides some elements as to its meaning and effect in the context
of processing personal data. As stated in the Transparency Guidelines, this concept in the
GDPR “is user-centric rather than legalistic and is realised by way of specific practical
requirements on data controllers and processors in a number of articles” 203 . The key
provisions concretising the specific practical requirements of transparency are in Chapter III
GDPR. However, there are other provisions that also realise the transparency principle, for
example, Article 35 (data protection impact assessment) and Article 25 GDPR (data protection
by design and by default), to ensure that data subjects are aware of the risks, rules and
safeguards in relation to the processing, as stated in Recital 39 GDPR 204.
b. The EDPB also notes that transparency is an expression of the principle of fairness in
relation to the processing of personal data and is also intrinsically linked to the principle of
accountability under the GDPR 205. In fact, as noted in the Transparency Guidelines, a central
consideration of the principles of transparency and fairness is that “the data subject should
be able to determine in advance what the scope and consequences of the processing entails”
and should not be taken by surprise about the ways in which their personal data has been
used 206.

c. Thus, it is apparent that, under the GDPR, transparency is envisaged as an overarching
concept that governs several provisions and specific obligations. As stated in the Transparency
Guidelines, “[t]ransparency is an overarching obligation under the GDPR applying to three
central areas: (1) the provision of information to data subjects related to fair processing; (2)
how data controllers communicate with data subjects in relation to their rights under the
GDPR; and (3) how data controllers facilitate the exercise by data subjects of their rights” 207.

d. This being said, it is important to differentiate between obligations stemming from
the
principle of transparency and the principle itself. The text of the GDPR makes this
distinction, by enshrining transparency as one of the core principles under Article 5(1)(a) GDPR
on the one hand, and assigning specific and concrete obligations linked to this principle, on
the other one. The concretisation of a broad principle in specific rights and obligations is not
a novelty in EU law. For example, with regard to the principle of effective judicial protection,
that CJEU has stated that it is reaffirmed in the right to an effective remedy and to a fair
hearing, enshrined in Article 47 of the Charter 208 . Nonetheless, that does not imply that
principles as such cannot be infringed. In fact, under the GDPR the infringement of the basic

203
Footnote from the Article 65 Decision: Transparency Guidelines, paragraph 4.
204
Footnote from the Article 65 Decision: Transparency Guidelines, paragraph 42.
205
Footnote from the Article 65 Decision: Transparency Guidelines, paragraph 2.
206
Footnote from the Article 65 Decision: Transparency Guidelines, paragraph 10.
207
Footnote from the Article 65 Decision: Transparency Guidelines, paragraph 1.
208
Footnote from the Article 65 Decision: Peter Puškár v. Finančné riaditeľstvo Slovenskej republiky and Kriminálny
úrad finančnej správy, (Case C-73/16, judgment delivered 27 September 2017) ECLI:EU:C:2017:725, at para. 59.
97

principles for processing is subject to the highest fines of up to 20.000.000€ or 4% of the annual
turnover, as per Article 83(5)(a) GDPR.

e. On the basis of the above considerations, the EDPB underlines that the principle of
transparency is not circumscribed by the obligations under Articles 12-14 GDPR, although the
latter are a concretisation of the former. Indeed, the principle of transparency is an
overarching principle that not only reinforces other principles (i.e. fairness, accountability),
but from which many other provisions of the GDPR derive. In addition, as stated above, Article
83(5) GDPR includes the possibility to find an infringement of transparency obligations
independently from the infringement of transparency principle. Thus, the GDPR distinguishes
the broader dimension of the principle from the more specific obligations. In other words, the
transparency obligations do not define the full scope of the transparency principle.

f. That being said, the EDPB is of the view that an infringement of the transparency
obligations under Articles 12-14 GDPR can, depending on the circumstances of the case,
amount to an infringement of the transparency principle.
199. As I have outlined in this Issue 3, the deficiencies in the transparency obligations affect and/or
relate to all processing carried out on the basis of Article 6(1)(b) GDPR in the context of the
Instagram service (notwithstanding that I have focussed on processing relating to behavioural
advertising). The deficiencies were such that the Named Data Subject was under the impression
that the relevant processing (including the relevant processing operations and/or set of processing
operations) was based on consent, as had been the case prior to the coming into effect of the
GDPR. As I have further outlined above, this impression and associated assumption was premised
on the user engagement flow presented to users which provided them with a number of
opportunities to consent before selecting the final “Agree to Terms” button. I am of the view that
these deficiencies amount to a significant level of non-compliance by Meta Ireland such that the
Named Data Subject was under the impression that the relevant processing was based on consent
and it is my view that the infringement with the transparency principle is sufficiently extensive to
amount to an overarching infringement of the transparency.

Finding 3:
In relation to processing for which Meta Ireland indicated reliance upon Article 6(1)(b) GDPR, Articles
5(1)(a), 12(1) and 13(1)(c) GDPR have been infringed.

6 WHETHER META IRELAND INFRINGED THE ARTICLE 5(1)(A) PRINCIPLE OF FAIRNESS

200. During the course of the Article 60 consultation period, the Italian SA raised an objection,
requiring the amendment of the Draft Decision to include a finding of the Article 5(1)(a) principle
of fairness. The Commission decided not to follow the objection in circumstances where
compliance with the Article 5(1)(a) principle of fairness was not examined during the course of
this inquiry and, consequently, Meta Ireland was never afforded the opportunity to be heard in
response to a particularised allegation of wrongdoing, as required by Irish and EU law. Accordingly
the Commission referred the objection to the EDPB for determination pursuant to Article 65(1)(a)
GDPR. Having considered the matter, the EDPB determined as follows:

220. In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision
concerning all the matters which are the subject of the relevant and reasoned
objections, in particular whether there is an infringement of the GDPR. The EDPB
considers that the objection found to be relevant and reasoned in this subsection
requires an assessment of whether the Draft Decision needs to be changed insofar as it
contains no finding of infringement of the fairness principle under Article 5(1)(a) GDPR.
When assessing the merits of the objection raised, the EDPB also takes into account
Meta IE’s position on the objection and its submissions.

221. The EDPB takes note of Meta IE’s view that the IT SA objection lacks merit as it goes
beyond the scope of the inquiry . The EDPB also notes that Meta IE links the issue of the
potential infringement of the principle of fairness, raised in the IT SA objection, with the
question of the competence of CSAs or the EDPB to assess the validity of contracts in
the context of Article 6(1)(b) GDPR and, when responding to the merits of the IT SA
objection, Meta IE refers to its submissions on application of Article 6(1)(b) GDPR with
respect to standard form contracts . While taking note of Meta IE’s view on this matter,
the EDPB considers the question of Meta IE’s compliance with the principle of fairness
under Article 5(1)(a) GDPR to be distinct from the question of the choice of the
appropriate legal basis (although a connected one, as explained below) and proceeds
with its respective assessment below.

222. Firstly, the EDPB recalls that the basic principles relating to processing listed in Article
5 GDPR can, as such, be infringed . This is apparent from the text of Article 83(5)(a)
GDPR which subjects the infringement of the basic principles for processing to
administrative fines of up to 20 million euros, or in the case of undertaking, up to 4% of
the total worldwide annual turnover of the preceding financial year, whichever is
higher.

223. The EDPB underlines that the principles of fairness, lawfulness and transparency, all
three enshrined in Article 5(1)(a) GDPR, are three distinct but intrinsically linked and
interdependent principles that every controller should respect when processing
personal data. The link between these principles is evident from a number of GDPR
provisions: Recitals 39 and 42, Article 6(2) and Article 6(3)(b) GDPR refer to lawful and

fair processing, while Recitals 60 and 71 GDPR, as well as Article 13(2), Article 14(2)
and Article 40(2)(a) GDPR refer to fair and transparent processing.

224. On the basis of the above consideration, the EDPB agrees with the IE SA’s view that
“Article 5(1)(a) links transparency to the overall fairness of the activities of a controller” but

100

considers that the principle of fairness has an independent meaning and stresses that an
assessment of Meta IE’s compliance with the principle of transparency does not automatically
rule out the need for an assessment of Meta IE’s compliance with the principle of fairness too.

225. The EDPB recalls that, in data protection law, the concept of fairness stems from the
EU Charter of Fundamental Rights . The EDPB has already provided some elements as to the
meaning and effect of the principle of fairness in the context of processing personal data. For
example, the EDPB has previously opined in its Guidelines on Data Protection by Design and by
Default that “[f]airness is an overarching principle which requires that personal data should not
be processed in a way that is unjustifiably detrimental, unlawfully discriminatory, unexpected
or misleading to the data subject” .

226. Among the key fairness elements that controllers should consider in this regard, the
EDPB has mentioned autonomy of the data subjects, data subjects’ expectation, power
balance, avoidance of deception, ethical and truthful processing . These elements are
particularly relevant in the case at hand. The principle of fairness under Article 5(1)(a) GDPR
underpins the entire data protection framework and seeks to address power asymmetries
between the data controllers and the data subjects in order to cancel out the negative effects
of such asymmetries and ensure the effective exercise of the data subjects’ rights. The EDPB
has previously explained that “the principle of fairness includes, inter alia, recognising the
reasonable expectations of the data subjects, considering possible adverse consequences
processing may have on them, and having regard to the relationship and potential effects of
imbalance between them and the controller”
.

227. The EDPB recalls that a fair balance must be struck between, on the one hand, the
commercial interests of the controllers and, on the other hand, the rights and expectations of
the data subjects under the GDPR . A key aspect of compliance with the principle of fairness
under Article 5(1)(a) GDPR refers to pursuing “power balance” as a “key objective of the
controller-data subject relationship” , especially in the context of online services provided
without monetary payment, where users are often not aware of the ways and extent to which
their personal data is being processed . Consequently, lack of transparency can make it almost
impossible in practice for the data subjects to exercise an informed choice over the use of their
data which is in contrast with the element of “autonomy” of data subjects as to the processing
of their personal data .

228. Considering the constantly increasing economic value of personal data in the digital
environment, it is particularly important to ensure that data subjects are protected from any
form of abuse and deception, intentional or not, which would result in the unjustified loss of
control over their personal data. Compliance by providers of online services acting as controllers
with all three of the cumulative requirements under Article 5(1)(a) GDPR, taking into account
the particular service that is being provided and the characteristics of their users, serves as a
shield from the danger of abuse and deception, especially in situations of power asymmetries.

229. The EDPB has previously emphasised that the identification of the appropriate lawful
basis is tied to the principles of fairness and purpose limitation . In this regard, the IT SA rightly

101

observes that while finding a breach of transparency relates to the way in which information
has been provided to users via the Instagram Terms of Use and Data Policy, compliance with
the

102

103

principle of fairness also relates to “how the controller addressed the lawfulness of the
processing activities in connection with its social networking service” . Thus the EDPB considers
that an assessment of compliance by Meta IE with the principle of fairness requires also an
assessment of the consequences that the choice and presentation of the legal basis entail for
the users of the Instagram service. In addition, that assessment cannot be made in the abstract,
but has to take into account the specificities of the particular social networking service and of
the processing of personal data carried out, namely for the purpose of online behavioural
advertising
.

230. The EDPB notes that in this particular case the breach of Meta IE’s transparency
obligations is of such gravity that it clearly impacts the reasonable expectations of the
Instagram users by confusing them on whether clicking the “Agree to Terms” button results in
giving their consent to the processing of their personal data. The EDPB notes in this regard that
one of the elements of compliance with the principle of fairness is avoiding deception i.e.
providing information “in an objective and neutral way, avoiding any deceptive or manipulative
language or design” .

231. As outlined in the Draft Decision, the Complainant argues that Meta IE relied on “forced
consent” as a result of being led to believe that the legal basis for processing the controller was
relying upon was consent . The Complaint demonstrates the confusion suffered by the
Complainant both due to the (lack of) information presented to Instagram users in the context
of their “agreement” and the circumstances of how the act of “agreement” was sought by
Meta IE . The EDPB considers that the LSA should have taken into account such Meta IE’s
practices in relation to the principle of fairness, regardless of its finding that Meta IE has not
sought to rely on consent in order to process personal data to deliver the Terms of Use .

232. In addition, and as recognised by the LSA itself, further to its assessment of the
information provided concerning processing being carried out in reliance on Article 6(1)(b)
GDPR, “it is impossible for the user to identify with any degree of specificity what processing is
carried out on what data, on foot of the specified lawful bases” . Considering this, in the EDPB’s
view, there are clear indications that Instagram users’ expectations with regard to the
applicable legal basis have not been fulfilled . Therefore, the EDPB shares the IT SA’s concern
that Instagram users are left “in the dark” and considers that the processing by Meta IE cannot
be regarded as ethical and truthful because it is confusing with regard to the type of data
processed, the legal basis and the purpose of the processing, which ultimately restricts the
Instagram users’ possibility to exercise their data subjects’ rights.

233. Furthermore, the EDPB considers that the extensive analysis by the IE SA with regard
to the issue of legal basis and transparency in relation to the processing being carried out in
reliance on Article 6(1)(b) GDPR is closely linked to the issue of compliance by Meta IE with the
principle of fairness. Considering the seriousness of the infringements of the transparency
obligations by Meta IE already identified in the Draft Decision and the related
misrepresentation of the legal basis relied on, the EDPB agrees with the IT SA that Meta IE has
presented its service to the Instagram users in a misleading manner , which adversely affects

104

their control over the processing of their personal data and the exercise of their data subjects'
rights. Therefore, the EDPB is of the opinion that the IE SA’s finding of breach of Article 5(1)(a)
GDPR with regard to the principle of transparency should extend to the principle of fairness
too.

105

234. This is all the more supported by the fact that, in the circumstances of the present
case as demonstrated above , the overall effect of the infringements by Meta IE of the
transparency obligations under Article 5(1)(a), Article 12(1), Article 13(1)(c) GDPR and the
infringement of Article 6(1)(b) GDPR further intensifies the imbalanced nature of the
relationship between Meta IE and the Instagram users brought up by the IT SA objection. The
combination of factors, such as the asymmetry of the information created by Meta IE with
regard to the Instagram service users, combined with the “take it or leave it” situation that they
are faced with due to the lack of alternative services in the market and the lack of options
allowing them to adjust or opt out from a particular processing under the contract with Meta IE,
systematically disadvantages the Instagram service users, limits their control over the processing
of their personal data and undermines the exercise of their rights under Chapter III of the GDPR.

235. Therefore, the EDPB instructs the IE SA to include a finding of an infringement of the
principle of fairness under Article 5(1)(a) GDPR by Meta IE, in addition to the infringement of the
principle of transparency under the same provision, and to adopt the appropriate corrective
measures, by addressing, but without being limited to, the question of an administrative fine for
this infringement as provided for in Section 9 of this Binding Decision.

201. Accordingly, and as directed by the EDPB further to the Article 65 Decision, I find that Meta
Ireland has infringed the principle of fairness pursuant to Article 5(1)(a) GDPR.

Finding 4:
Meta Ireland has infringed the principle of fairness pursuant to Article 5(1)(a) GDPR.

7 SUMMARY OF FINDINGS

ISSUE FINDING

Reliance on Article 6(1)(b) GDPR as the Legal I find that Meta Ireland infringed Article 6(1)
Basis for processing for the purposes of GDPR when it relied when it relied on Article
behavioural advertising in respect of the 6(1)(b) GDPR to process the Complainant’s
Instagram service. personal data for the purpose of behavioural
advertising in the context of its offering of
Terms of Use.

106

Whether Meta Ireland failed to provide I find that Meta Ireland has infringed Articles
necessary information regarding its legal basis 5(1)(a), 12(1) and 13(1)(c) GDPR.
for processing pursuant to acceptance of the
Terms of Use and whether the information set
out was set out in a transparent manner

As raised by the Italian SA by way of its As directed by the EDPB pursuant to the
objection, whether Meta Ireland infringed the Article 65 Decision, I find that Meta Ireland has
Article 5(1)(a) principle of fairness in the infringed the Article 5(1)(a) principle of
context of its approach to the provision of fairness.
information as part of the presentation of its
Terms of Use to the Complainant.

8 DECISION ON CORRECTIVE POWERS

202. I have set out above in sections 3 to 6, pursuant to Section 111(1)(a) of the 2018 Act, the
findings set out above (recording my views and those of the EDPB by way of the Article 65
Decision) that Meta Ireland has infringed Articles 5(1)(a), 12(1) and 13(1)(c) GDPR. As required
by the EDPB pursuant to the Article 65 Decision, I have also found that Meta Ireland has infringed
Article 6(1) GDPR as well as the Article 5(1)(a) principle of fairness.

203. Under Section 111(2) of the 2018 Act, where the Commission makes a decision (in accordance
with Section 111(1)(a)), it must, in addition, make a decision as to whether a corrective power
should be exercised in respect of the controller or processor concerned and, if so, the corrective
power to be exercised. For the reasons set out above and those I will outline below, my view is
that corrective measures should be exercised.

9. ORDER TO BRING PROCESSING INTO COMPLIANCE

205. Article 58(2) GDPR sets out the corrective powers which supervisory authorities may employ in
respect of non-compliance of the GDPR by a controller or processor.

206. My view is that the corrective power provided for in Article 58(2)(d) GDPR, i.e. an order to bring
processing into compliance (the “Order”), should be imposed. This order would, firstly, require
Meta Ireland to bring the Instagram Data Policy and Terms of Use into compliance with Articles
5(1)(a), 12(1) and 13(1)(c) GDPR as regards information provided on: (i) data processed pursuant
to Article 6(1)(b) GDPR as well as (ii) data processed for the purpose of behavioural advertising
in context of the Instagram service, in accordance with the principles set out in this Decision.

107

Meta Ireland has argued that it is neither necessary nor proportionate to make this order. 209 For
the reasons set out above and below, I have concluded that it is necessary and proportionate to
do so.

207. It was proposed in the Preliminary Draft that this should be done within three months of the date
of notification of any final decision. Meta Ireland was of the view that this was not a reasonable
period of time within which to make the necessary changes, as the changes would be
resourceintensive and would require “sufficient lead in time for preparing, drafting, designing
and engineering the relevant changes, conducting and taking account of user testing of the
proposed changes, internal cross-functional engagement as well as of course engagement with
the Commission, and localisation and translation of the information for countries in the European
Region”.232

208. In this respect, I emphasise that Meta Ireland is a large multinational organisation with significant
financial, technological and human resources at its disposal. Moreover, the interim period, prior
to any such rectification to the current lack of information being provided to data subjects, will
involve a serious ongoing deprivation of their rights (as outlined below in Section 10). Moreover,
the Commission has provided specific analysis to Meta Ireland in relation to the correct
interpretation of the provisions in question and the requisite information that is absent from the
relevant user-facing documents. This specificity should negate any need for extensive
engagement with the Commission during the period of implementation, and provides clarity for
Meta Ireland as to what objective its very significant resources should be directed towards in
order to comply with this order. As such, I am not satisfied that it would be impossible or indeed
disproportionate to make an order in these terms, having regard to the importance of the data
subject rights involved, the specificity of the order and Meta Ireland’s resources.

209. I therefore order that the Terms of Use and Data Policy be brought into compliance within three
months commencing on the day following the date of service of the Commission’s final decision.

210. I consider that this order is necessary to ensure that full effect is given to Meta Ireland’s
obligations under Articles 5(1)(a), 12(1), and 13(1)(c) GDPR in light of the infringements outlined
above. The substance of this proposed order is the only way in which the defects pointed out in
this Decision can be rectified, which is essential to the protecting of the rights of data subjects.
It is on this basis that I am of the view that this power should be exercised. I note Meta Ireland’s
disagreement with this position on the basis that it is already voluntarily attempting to alter the
documents to express the views set out in the Preliminary Draft, and would therefore like to
continue using “less onerous means” to ensure compliance. 210

209
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 12.1 -12.2.
232
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 12.4.
210
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 12.2 – 12.3.
234
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 2.4 (and footnote 6).
108

211. Having regard to the non-compliance in this Decision, in my view, such an order is proportionate
and is the minimum order required in order to guarantee that compliance will take place in the
future. The fact that Meta Ireland is already taking steps to bring its information into compliance
suggest that there would be nothing practically onerous about an order to carry out something
that Meta Ireland already intends to carry out. On that basis, I see nothing in these arguments
to suggest a lack of proportionality arises in relation to such an order.

212. As instructed by the EDPB, in paragraph 290 of the Article 65 Decision, this Order would,
secondly, require Meta Ireland to take the necessary action to bring its processing of personal
data for the purposes of behavioural advertising (“the Processing”), in the context of the
Instagram Terms of Use, into compliance with Article 6(1) GDPR in accordance with the
conclusion reached by the EDPB, as recorded at paragraph 137 of the Article 65 Decision within
a period of three months, commencing on the day following the date of service of the
Commission’s final decision. More specifically, in this regard, Meta Ireland is required to take the
necessary action to address the EDPB’s finding that Meta Ireland is not entitled to carry out the
Processing on the basis of Article 6(1)(b) GDPR, taking into account the analysis and views
expressed by the EDPB in Section 4.4.2 of the Article 65 Decision. Such action may include, but
is not limited to, the identification of an appropriate alternative legal basis, in Article 6(1) GDPR,
for the Processing together with the implementation of any necessary measures, as might be
required to satisfy the conditionality associated with that/those alternative legal basis/bases.

213. In its Final Submissions, Meta Ireland submitted as follows:

a. Firstly234, in relation to the matters covered by the term “the Processing” (as defined in
paragraph 212, above, it understood the Commission to refer “specifically to the processing
for the purpose of behavioural advertising carried out by Meta Ireland to-date on the basis of
Article 6(1)(b) GDPR in the context of the Instagram Terms of Use as considered in the Inquiry.”
Meta Ireland noted that, as previously explained in its Article 65 Submissions, it carries out
certain other types of processing for behavioural advertising purposes on the basis of Article
6(1)(a) GDPR. For the avoidance of doubt, I confirm Meta Ireland’s understanding as to the
processing covered by the second limb of the above Order. The term “the Processing”, as
defined in paragraph 212, above, means any processing for behavioural advertising purposes
which was previously carried out in reliance on Article 6(1)(b) GDPR.

b. Secondly, Meta Ireland has submitted 211 that the Commission has discretion as regards the
date of commencement of the compliance period that, as noted above, was determined by
the EDPB. In this regard, Meta Ireland noted that the Article 65 Decision does not require the
Commission to provide that the Order must take effect “on the day following the date of
service of the [Commission’s] final decision”, as suggested. Furthermore, Meta Ireland has

211
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 4.3 and Section 5.
109

submitted 212 that the timeline for compliance, as regards the action required to be taken
pursuant to both limbs of the Order, should run consecutively rather than concurrently.

c. In support of the above submissions, Meta Ireland has estimated that it “will take at least to
implement both compliance orders” by reference to the work that will be required to give
effect to the terms of the Order. This work includes (but is not limited to)

. Meta Ireland has further identified that, once this
work is completed, it will then need to develop and/or update user-facing materials, to the
extent needed to explain these changes to users, including updates to the Data Policy and
other transparency notices.

d. Meta Ireland has further submitted that, if the Order is made in the terms proposed, this
would require it to dedicate its resources to attempting to comply with the Order immediately
and “certainly before the period within which Meta Ireland is entitled to appeal from the final
decision has elapsed.” This, according to Meta Ireland, would seriously “impair and prejudice”
its right to an effective appeal.

214. Having considered the above matters in light of the Article 65 Decision, I do not agree with Meta
Ireland’s submission that the Commission has discretion to delay the activation of any aspect of
the Order. It is clear, from paragraph 290 of the Article 65 Decision that the EDPB considered it
necessary for Meta Ireland to take the remedial action required to address the relevant
infringements “within three months”. While Meta Ireland has correctly identified that the EDPB
has not expressly identified the starting point, the Commission’s view is that it goes without
saying that the starting point has to be the adoption and notification of the Commission’s final
decision, given that this is the earliest date on which the applicable timeline for compliance can
start to run.
Any contrary suggestion would be inconsistent with the need for urgent action that was clearly
indicated to be required in paragraphs 288, 290, 291 of the Article 65 Decision. It would further
render meaningless the EDPB’s consideration of the compliance period in terms of a fixed number
of months (in this case, three).

215. Insofar as Meta Ireland appears to consider it significant that the Commission itself amended the
terms of the existing Order such that the timeline for compliance is now stated to run from the
day following the date of service of the Commission’s final decision, the Commission does not
consider this to be a material amendment of the existing text. The Commission considered it
necessary to add this clarification to address a position whereby there might be any delay
between the date of adoption of this Decision and the date on which this Decision is formally
notified to/served upon Meta Ireland (as has occurred in at least one previous inquiry). The

212
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 4.3 and Section 6.
110

clarification ensures legal certainty, as regards the timelines associated with the Order and Meta
Ireland’s right to a judicial remedy.

216. Finally, as regards the resources that Meta Ireland will need to devote to the matters covered by
the terms of the Order, I note that I have already had regard to the significant financial,
technological and human resources at Meta Ireland’s disposal. Furthermore, I do not agree that
Meta Ireland will need to await the outcome of its efforts to achieve compliance with the second
limb of the Order before it might address the first limb. I note, in this regard, that the first limb
of the Order was present in the Draft Decision (dated 1 April 2022). Meta Ireland was already
aware of the likelihood that it would have to take action to address the shortcomings identified
as part of the analysis that underpinned the findings of infringement of the transparency
provisions (namely Articles 5(1)(a), 12(1) and 13(1)(c) GDPR). In the circumstances, Meta Ireland
has already had time to begin the groundwork required to achieve compliance with its
transparency obligations.

217. For the avoidance of doubt, I am not persuaded by Meta Ireland’s submission that envisaged
date of commencement of the timeline for compliance would “seriously impair and prejudice” its
right to an effective appeal. I note, in this regard, that Meta Ireland has not explained how such
a risk would arise from the timely implementation of the deadline for compliance with the Order.
I further note that matters pertaining to the possible filing of any appeal will likely be dealt with
by Meta Ireland’s internal and external legal advisors as opposed to the “stakeholders” whose
input will be required as part of Meta Ireland’s efforts to achieve compliance with the terms of
the Order. While I anticipate that there will, of course, be overlap in terms of the resources that
might need to devote time to both the required remedial action and matters pertaining to the
possible filing of any appeal, I do not envisage how such overlap would be anywhere near total
such as to give rise to a risk to Meta Ireland’s ability to exercise its right to an effective appeal. I
further note that the compliance deadline extends beyond the limitation periods prescribed for
any application for judicial redress under Irish law. In these circumstances, I am satisfied that
Meta Ireland’s right to pursue judicial redress will not be impaired by the compliance periods
outlined above.

10. ADMINISTRATIVE FINE

218. In accordance with Article 58(2)(i) GDPR, I am permitted to consider the imposition of an
administrative fine, pursuant to Article 83 GDPR, “in addition to, or instead of” the other measures
outlined in Article 58(2), depending on the circumstances of each individual case. Section 115 of
the 2018 Act also provides for this as it permits the Commission to impose an administrative fine
on its own or in combination with any other corrective power specified in Article 58(2) GDPR. I
am therefore satisfied that I am permitted to impose an administrative fine in addition to a
compliance order.

111

219. However, in this regard, I emphasise that I am guided by Article 83(1) GDPR which provides
that the imposition of fines “shall in each individual case be effective, proportionate and
dissuasive”. I further note that, in making the decision as to whether to impose an administrative
fine or indeed the amount of any such fine, I am obliged by Article 83(2) GDPR to have “due
regard” to the eleven criteria set out in Article 83(2). I have considered each of these criteria and
presented my corresponding assessment below. In response to Meta Ireland’s submission that
the impact of each of the criteria in Article 83(2) was insufficiently clear, 213 I have specified
whether I consider each relevant factor to be aggravating, mitigating or neither.

220. I note, at this juncture, that Meta Ireland disagreed that an administrative fine – and indeed,
the amount I have proposed 214 - would be appropriate, necessary and proportionate in this
context.239 I further note Meta Ireland’s position that a reprimand would be more appropriate in
this instance.240 I will address the arguments it has presented in the course of considering the
criteria set out in Article 83(2) GDPR.

221. In the Draft Decision, I considered the imposition of an administrative fine in relation to the
finding of infringement identified at Finding 3 above, namely the finding of infringement of Articles
5(1)(a), 12(1) and 13(1)(c) GDPR in the context of Meta Ireland’s approach to transparency.
Following the circulation of the Draft Decision to the supervisory authorities concerned for the
purpose of enabling them to share their views, in accordance with Article 60(3) GDPR, objections
to the proposed administrative fines were raised by the supervisory authorities of Germany,
France, Italy, the Netherlands and Norway. Having considered those objections, the EDPB
determined as follows:

"344. The EDPB recalls that the consistency mechanism may also be used to promote a consistent
application of administrative fine 215 . A fine should be effective, proportionate and dissuasive, as
required by Article 83(1) GDPR, taking account of the facts of the case 216. In addition, when deciding
on the amount of the fine, the LSA shall take into consideration the criteria listed in Article 83(2)
GDPR.

345. The EDPB responds to Meta IE’s argument that the LSA has sole discretion to determine the
appropriate corrective measures in the event of a finding of infringement above (see Section 8.4.2,
paragraphs 277 -279 as well as footnote 624).

213
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 14.5 – 14.6.
214
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.1.
239
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 13.1.
240
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 13.3.
215
Recital 150 GDPR. EDPB Guidelines on RRO, paragraph 34; EDPB Guidelines on Administrative fines p. 7 (“When
the relevant and reasoned objection raises the issue of the compliance of the corrective measure with the GDPR, the
decision of EDPB will also discuss how the principles of effectiveness, proportionality and deterrence are observed in
the administrative fine proposed in the draft decision of the competent supervisory authority”).
216
EDPB Guidelines on Administrative fines, p. 7; EDPB Guidelines on calculation of fines, paragraphs 132-134.
112

346. The finding in the Draft Decision of a transparency infringement for the processing concerned
still stands. The EDPB recalls that, on substance, no objections were raised on this finding. Meta IE
infringed its general transparency obligations by being unclear on the link between the purposes of
processing, the lawful bases of processing and the processing operations involved 217, irrespective of
the validity of the legal basis relied on for the ‘processing concerned’. It remains the case that, for
the transparency infringements, ‘‘the processing concerned’’ should be understood as meaning all of
the processing operations that Meta IE carries out on the personal data under its controllership for
which Meta IE indicated it relied on Article 6(1)(b) GDPR 218, including for the purposes of behavioural
advertising. This is without prejudice to the fact that Meta IE inappropriately relied on Article 6(1)(b)
GDPR as a legal basis to process personal data for the purpose of behavioural advertising as part of
the delivery of its Instagram service under the Terms of Use. Whether or not Meta IE appropriately
chose its legal basis for processing, the transparency infringement as assessed in the Draft Decision
still stands. Therefore, the IE SA must not modify this description retro-actively in light of the
assessment of the validity of the legal basis, including for the purpose of carrying out any
reassessment of the administrative fines originally proposed by the Draft Decision, as might be
required by this Binding Decision.

347. In light of the objections found relevant and reasoned, the EDPB addresses whether the Draft
Decision proposes a fine for the transparency infringements that is in accordance with the criteria
established by Article 83(2) GDPR and the criteria provided for by Article 83(1) GDPR. In doing this,
the EDPB will first assess the disputes arisen in respect of the analysis of specific criteria under Article
83(2) GDPR performed by the LSA, and then examine whether the proposed fine meets the
requirements of effectiveness, dissuasiveness and proportionality set in Article 83(1) GDPR, including
by affording adequate weight to the relevant factors and to the circumstances of the case.

On any relevant previous infringements by the controller or processor (Article 83(2)(e) GDPR)

348. Article 83(2)(e) GDPR requires supervisory authorities to give due regard to any previous
relevant infringement of the GDPR by the controller or processor as one of the circumstances that
justifies an increase in the basic amount of the fine. As similar reference can be found in Recital 148
GDPR.

349. For the purposes of Article 83(2)(e) GDPR, both previous infringements of the same subject
matter and infringements of a different subject matter but committed in a manner similar to that
under investigation, should be considered as relevant. Furthermore, the EDPB recalls that the scope
of assessment of infringements may include not only previous decisions by the investigating
supervisory authority, but also infringements found by other authorities, provided that they are
relevant to the case under investigation 219.

217
Draft Decision, paragraph 189.
218
Draft Decision, paragraph 210.
219
EDPB Guidelines on Administrative Fines, paragraph 93.
113

350. The EDPB first notes that, contrary to Meta IE’s views 220, substantial similarities exist in the
infringements found by the LSA in its draft decision and in its decision IN-18-12-2 in relation to
WhatsApp Ireland Limited and in which breach of GDPR obligations were established. As rightly
pointed out by the IT SA, the LSA indeed considered in both decisions that the controller had not
provided transparent information on the legal basis and purposes of the processing operations or
sets of processing operations carried out, thereby infringing Article 5(1)(a), Article 12(1) and Article
13(1)(c) GDPR 221.

351. The IT SA contends that, to the extent that Meta IE and WhatsApp Ireland Limited are part of
the same corporate group, the previous decision concerning WhatsApp Ireland Limited “sets a key
precedent in assessing a controller’s repetitive conduct”, as “not only did the controller in question
clearly stick to the same business model in offering its different social networking services, it also
did not change its assessment as to how to manage users’ data with particular regard to its
information and transparency obligations” 222 The IE SA disagrees with this objection, considering
that Article 83(2)(e) GDPR cannot apply in the circumstances of this case insofar as its decision
against WhatsApp Ireland Limited was addressed to a different controller 223.

352. In this respect, the EDPB notes that Meta IE and WhatsApp Ireland Limited are both
subsidiaries of Meta Platforms, Inc. 224 . Nonetheless, the EDPB recalls that the GDPR draws a
distinction between on the one hand the “controller” or “processor” 225, which are responsible for
complying with the rules of the GDPR, and on the other hand the “undertaking” 226 to which the
controller or processor is part of, and that may be found jointly and severally liable for the payment
of the fine253. In this context, Article 83(2)(e) GDPR explicitly refers to the need to consider previous
relevant infringements committed ‘’by the controller or processor’’ (emphasis added).

353. Therefore, the EDPB considers that the Final Decision does not need to refer to the
infringements by WhatsApp Ireland Limited, as established in Decision IN-18-12-2, as an aggravating
factor under Article 83(2)(e) GDPR for the calculation of the fine.

The effectiveness, proportionality and dissuasiveness of the administrative fine (Article 83(1) GDPR)

220
Meta IE Article 65 Submissions, paragraph 10.3. According to Meta IE’s the DPC Final Decision IN-18-12-2 against
WhatsApp Ireland Limited concerns ‘’wholly separate proceeding involving wholly separate allegations and claims’’.
221
DPC Final Decision IN-18-12-2 concerning WhatsApp Ireland Limited, 20 August 2021, paragraphs 496, 591 and
595, available at: https://edpb.europa.eu/system/files/2021-
09/dpc_final_decision_redacted_for_issue _to_edpb_01-09-21_en.pdf ; Draft Decision, p. 71.
222
IT SA Objection, p. 9.
223
Composite Response, paragraph 125. According to the IE SA, this stems directly from the wording of Article
83(2)(e) GDPR, which ‘’expressly states that only relevant previous infringements by the same controller or processor
must be taken into consideration’’.
224
DPC Final Decision IN-18-12-1 concerning WhatsApp Ireland Limited, 20 August 2021, paragraph 872; Draft
Decision, paragraphs 5 and 288.
225
See Art. 4(7)-(8) GDPR.
226
According to Recital 150, ‘’where administrative fines are imposed on an undertaking, an undertaking should be
understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes’’. According to
114

354. With regard to effectiveness of the fines, the EDPB recalls that the objective pursued by the
corrective measure chosen can be to re-establish compliance with the rules, or to punish unlawful
behaviour, or both254. In addition, the EDPB notes that the CJEU has consistently held that a dissuasive
penalty is one that has a genuine deterrent effect. In that respect, a distinction can be made between
general deterrence (discouraging others from committing the same infringement in the future) and
specific deterrence (discouraging the addressee of the fine from committing the same infringement
again)255. Therefore, in order to ensure deterrence, the fine must be set at a level that discourages
both the controller or processor concerned as well as other controllers or processors carrying out
similar processing operations from repeating the same or a similar unlawful conduct. Proportionality
of the fine needs also to be ensured as the measure must not go beyond what is necessary to attain
that objective256. In this respect, the EDPB disagrees with Meta IE’s views that there is no basis to
conclude that the amount of the fine must have a general preventive effect257.

355. The EDPB reiterates that it is incumbent upon the supervisory authorities to verify whether the
amount of the envisaged fines meets the requirements of effectiveness, proportionality and
dissuasiveness, or whether further adjustments to the amount are necessary, considering the entirety
of the fine imposed and all the circumstances of the case, including e.g. the accumulation of multiple
infringements, increases and decreases for aggravating and mitigating circumstances and
financial/socio-economic circumstances258. Further, the EDPB recalls that the setting of a fine is

settled case-law of the CJEU, the term ‘undertaking’ “encompasses every entity engaged in an economic activity,
regardless of the legal status of the entity and the way in which it is financed’’ (see, in this regard, EDPB Binding
Decision 1/2021, paragraph 292).
253
EDPB Binding Decision 1/2021, paragraph 290.
254
EDPB Guidelines on Administrative Fines, p. 6.
255
See, inter alia, C-511/11, Versalis, paragraph94.
256
See Judgement of the General Court of 14 October 2021, MT v Landespolizeidirektion Steiermark, C-231/20, ,
ECLI:EU:C:2021:845, paragraph45 (“the severity of the penalties imposed must […] be commensurate with the
seriousness of the infringements for which they are imposed, in particular by ensuring a genuinely deterrent effect,
while not going beyond what is necessary to attain that objective”).
257
Meta IE Article 65 Submissions, Annex 1, paragraphs, 2.22, 5.16, 7.16, 8.30 and 9.23.
258
EDPB Guidelines on calculation of fines, paragraph 132, and EDPB Guidelines on Administrative Fines, p. 6,
specifying that ”administrative fines should adequately respond to the nature, gravity and consequences of the
breach, and supervisory authorities must assess all the facts of the case in a manner that is consistent and
objectively justified”.

115

not an arithmetically precise exercise 227 , and supervisory authorities have a certain margin of
discretion in this respect 228.

356. The DE, FR, IT, NL, and NO SAs , object to the level of the fine envisaged in the Draft Decision
as they consider the proposed fine not effective, proportionate and dissuasive (Article 83(1)
GDPR) 229.

357. These CSAs argue that the elements of Article 83(2) GDPR are not weighed correctly by the
LSA when calculating the administrative fines in the present case, in light of the requirements
of Article 83(1) GDPR 230 . Specifically, the DE, FR, IT, NL and NO SAs argue that the fine
envisaged in the Draft Decision is not proportionate with IE SA’s findings in relation to the
nature and seriousness of the infringements and the number of data subjects concerned 231.

358. In addition, these CSAs argue that the fine is not effective, proportionate and dissuasive taking
into account the financial position of Meta Platform, Inc. 232.

359. The EDPB takes note of Meta IE’s disagreement with the fine proposed by the IE SA 233 and
their view that the LSA already considers all factors it considered to be relevant to Article 83(2)
GDPR and that ‘’none of the CSAs have created any reasonable doubt as to the validity of the
DPC’s calculation’’ 234.

360. The EDPB notes that in the Draft Decision the IE SA indicates being satisfied the proposed fines
are effective, proportionate and dissuasive, taking into account all the circumstances of the IE
SA’s inquiry 235. The IE SA assessed the different criteria of Article 83(2) GDPR in relation to the
transparency infringements found 236. The IE SA considered the infringements as serious in
nature 237 , and in terms of gravity of the infringements found a significant level of non-

227
See Judgement of the General Court of 22 September 2021, Altice Europe NV v Commission, T 425/18,
ECLI:EU:T:2021:607, paragraph362; Judgement of the General Court of 5 October 2011, Romana Tabacchi v
Commission, Case T-11/06, ECLI:EU:T:2011:560, paragraph266.
228
See, inter alia, judgement of the General Court of 16 June 2011, Caffaro Srl v Commission, T-192/06,
ECLI:EU:T:2011:278, paragraph38. See also EDPB Guidelines on calculation of fines, p. 2.
229
DE SAs Objection, pp. 10-12; FR SA Objection, paragraphs 36-48; IT SA Objection pp. 7-10 ; NL SA Objection,
paragraphs 39-53; NO SA Objection, pp. 9-13;
230
DE SAs Objection, p. 11 ; FR SA Objection, paragraph 47; IT SA Objection pp. 7-8 ; NL SA Objection, paragraph 50;
NO SA Objection, pp. 11-12
231
DE SAs Objection, p. 11; FR SA Objection, paragraph 38 ; IT SA Objection, p. 8 ; NL SA Objection, paragraph 42
and 48; NO SA Objection, p. 12.
232
DE SAs Objection, p. 11 ; FR SA Objection, paragraph 38-40; IT SA Objection, pp. 8 ; NL SA Objection, paragraph
4849; NO SA Objection, pp. 11-12.
233
Meta IE Article 65 Submissions, paragraph 9.1.
234
Meta IE Article 65 Submissions, paragraph 9.3.
235
Draft Decision, paragraphs 255 - 258.
236
Draft Decision, paragraphs 209 - 252.
237
Draft Decision, paragraphs 212 - 215 and 253.
116

compliance 238 . Furthermore, the EDPB underlines that, as established by the IE SA, the
infringements affect a significant number of data subjects 239 and are extensive 240. The EDPB
also observes that the IE SA considered the negligent character of the infringement 241, as well
as the high level of responsibility of Meta IE for the lack of compliance with the GDPR 242 as
aggravating factors under Article 83(2) GDPR. Further, the IE SA qualified the level of damage
suffered by data subjects as significant 243. In addition, the IE SA identified only one mitigating
factor, without indicating, however, whether this should lead to a slight or substantial
reduction of the fine range276.

361. Meta IE argues that reputation costs should also be taken into consideration, citing the IE SA’s
remark on “the significant publicity that a fine in this region will attract” 244. On principle, the
EDPB agrees that reputation costs could be taken into consideration to some extent, if credible
arguments are put forward about the grave detriment that would ensue. Meta IE does not
present such arguments 245. The EDPB is of the view that in this case other incentives would
offset any reputational costs. As far as advertisers are concerned, Meta IE puts forward that
“The personalised nature of the Instagram Service is also the reason why it has been
instrumental in the success of small and medium sized businesses (“SMBs”) worldwide,
including across the EU. Personalisation on social media and other digital technologies,
including the Instagram Service, enables SMBs to compete for customers through “customizing
[sic] products and services, [...] building a unique brand image, tailoring marketing to a specific
audience and developing a strong one-to-one connection with a community of customers’’ 246.
As far as users of the Instagram service are concerned, there are network effects at play which
leads to incentives to join - or not leave - the platform, so as not to be excluded from
participating in discussions, corresponding with and receiving information from others 247.

238
Draft Decision, paragraphs 216 - 217 and 253.
239
Draft Decision, paragraphs 223 - 225 and 253.
240
Draft Decision, paragraph 221.
241
Draft Decision, paragraphs 230-233 and 253.
242
Draft Decision, paragraph 240. The IE SA considers that ‘’Meta Ireland should have been aware of the
appropriate standards – albeit at a general level – and, having made a deliberate decision to present the
information in a manner which fell significant below the standard required, has a high degree of responsibility for
the lack of compliance with the GDPR’’.
243
The IE SA finds it sufficiently shown that “rights have been damaged in a significant manner, given the lack of an
opportunity to exercise data subject rights while being fully informed”, Draft Decision, paragraph 229 276 Draft
Decision, paragraphs 234 - 236.
244
Composite Response, paragraph 119. See Meta IE Article 65 Submissions, Annex 1, paragraphs 2.26, 5.24, 7.20,
8.31.
245
Meta IE states that “even if Meta Ireland or other companies could ever consider that multi-million fines are
negligible from a financial point of view (a statement that is unsubstantiated and disputed), such companies would
obviously be concerned by the reputational cost of such fines.” Meta IE Article 65 Submissions, Annex 1, paragraphs
2.26, 5.24, 7.20, and 8.31.
246
Meta IE Article 65 Submissions, paragraph 6.23.
247
NO SA Objection, p. 5. In the same vein, the FR SA describes Meta IE’s position as quasi-monopolist (FR SA
Objection, paragraph 38).
117

362. According to the DE, FR, and IT SAs, the proposed fine is not consistent with the fine of 225
million euros decided upon by the IE SA in its decision dated 20 August 2021 against WhatsApp
Ireland Limited for the same transparency infringements (breaches of Articles 12 and 13
GDPR) 248.
In particular, the DE SAs point out that ‘’the facts and the seriousness of the infringements in the
two cases are no sufficiently different to justify a difference of 85% in the fine imposed’’ 249. The FR
and IT SAs also compare with the fine of 746 million euros decided by the LU SA in its decision of
15 July 2021 against the company Amazon Europe Core for carrying out behavioural advertising
without a valid legal basis and for transparency infringements (Articles 6, 12 and 13 GDPR) 250.
While the EDPB agrees with both the IE SA and Meta IE that imposing fines requires a case-by-case
assessment under Article 83 GDPR 251, the EDPB notes that the cases cited by the DE, FR and IT SAs
do show marked similarities with the current case, as they both refer to large internet platforms
run by data controllers with multi-national operations and significant resources available to them,
including large, in-house, compliance teams. Moreover, there are similarities with regards to the
nature and gravity of the infringements involved 252. Thus, these cases can give an indication on the
matter.

363. The DE, FR, IT and NO SAs calculate that the envisaged upper limit of the fine range is about
0.03 % 253 of the global annual turnover of Meta Platforms, Inc., which the DE SAs note is about
0.72% of the maximum ceiling provided for in Article 83(5) GDPR 254. For illustrative purposes also,
is the amount of time it would take Meta Platforms, Inc. on average to generate 23 million euros
in turnover in 2020, which was about 2 hours and 33 minutes 255.

248
DE SA Objection, p. 11-12 ; FR SA Objection, paragraph 42 ; IT SA Objection, p.8. The IE SA’s decision in this case
(case IN-18-12-2) is under appeal before the Irish courts.
249
DE SA Objection, p. 12.
250
FR SA Objection, paragraph 43 ; IT SA Objection p.8.
251
Draft Decision, paragraph 219-220 ; Meta IE Article 65 Submissions, pargraphs 2.23, 5.18, 7.17.
252
In this regard, the DE SA points out that in both decisions the IE SA stated that the provisions infringed ‘’go to the
heart of the general principle of transparency and the fundamental right of the individual to protection of his/her
personal data which stems from the free will and autonomy of the individual to share his/her personal data”. DE SA
Objection, p. 11.
253
DE SA Objection, p. 11; FR SA Objection, paragraph 40 ; IT SA Objection, p. 8 ; NO SA Objection, p. 12.
254
DE SA Objection, p. 11.
255
Based on the total annual turnover of 2020 being EUR 79 billion calculated by the NL SA in its objection (NL SA
Objection, paragraph 49) on the basis of the turnover of Meta Platforms, Inc. referred to in the Draft Decision (86
billion dollars). Thus, a fine of EUR 23 million would have taken 2h33 to generate.
256
DE SA Objection, p. 12; IT SA Objection, pp. 8-9 ; NO SA Objection, p. 12 ; FR SA Objection, paragraph 47.
257
NO SA Objection, p. 11.
118

model 258, the risk of this occurring is all the greater292. By bearing the cost of the administrative
fine, the undertaking can avoid bearing the cost of adjusting their business model to one that is
compliant as well as any future losses that would follow from the adjustment.

365. Though the IE SA touches upon the notions of effectiveness, proportionality and
dissuasiveness in relation to the proposed fine 259, there is no justification based on elements specific
to the case to explain the modest fine range chosen. Moreover, the EDPB notes that while the IE SA
takes into consideration the turnover of the undertaking to ensure that the fine it proposed does not
exceed the maximum amount of the fine provided for in Article 83(5) GDPR 260, the IE SA does not
articulate how and to what extent the turnover of this undertaking is considered to ascertain that
the administrative fine meets the requirement of effectiveness, proportionality and
dissuasiveness 261. In this regard the EDPB recalls that, contrary to Meta IE’s views 262, the turnover
of the undertaking concerned is not exclusively relevant for the determination of the maximum fine
amount in accordance with Article 83(4)-(6) GDPR, but should also be considered for the calculation
of the fine itself, where appropriate, to ensure the fine is effective, proportionate and dissuasive in
accordance with Article 83(1) GDPR 263. The EDPB therefore instructs the IE SA to modify its Draft
Decision to elaborate on the manner in which the turnover of the undertaking concerned has been
taken into account for the calculation of the fine.

366. In light of the above, the EDPB considers that the proposed fine does not adequately reflect
the seriousness and severity of the infringements nor has a dissuasive effect on Meta IE. Therefore,
the fine does not fulfil the requirement of being effective, proportionate and dissuasive in
accordance with Article 83(1) and (2) GDPR. In light of this, the EDPB directs the IE SA to set out a
significantly higher fine amount for the transparency infringements identified, in comparison with
the upper limit for the administrative fine envisaged in the Draft Decision. In doing so, the IE SA must
remain in line with the criteria of effectiveness, proportionality, and dissuasiveness enshrined in
Article 83(1) GDPR in its overall reassessment of the amount of the administrative fine.”

222. I have taken account of the above directions of the EDPB in the Article 83(2) assessments set out
below.

223. As noted above, the EDPB, by way of the Article 65 Decision, has also directed me to find that
Articles 6(1) and the Article 5(1)(a) principle of fairness have also been infringed. Pursuant to

258
Draft Decision, paragraphs 102, 221, 227 and 251.
292
NO SA Objection, pp. 11-12.
259
Draft Decision, paragraphs 255 - 258.
260
Draft Decision, paragraph 295.
261
EDPB Guidelines on calculation of fines, paragraph 120.
262
Meta IE Article 65 Submissions, paragraphs 9.8-9.10. In addition, Meta IE’s argument that “[turnover] is not a
relevant consideration when determining the amount of the fine under Article 83(2) GDPR” is not within the scope
of the dispute as no CSAs raised an objection on the consideration of turnover under this provision (Meta IE Article
65 Submissions, paragraphs 9.5-9.8).
263
EDPB Binding Decision 1/2021, paragraphs 405-412.
119

those determinations, the EDPB made further directions, as regards the imposition of additional
administrative fines. In relation to the finding of infringement of Article 6(1) GDPR, the EDPB
directed, first, at paragraph 440 of the Article 65 Decision, as follows:

“Taking into account the nature and gravity of the infringement as well as other aspects in
accordance with Article 83(2) GDPR, the EDPB considers that the IE SA must exercise its power to
impose an additional administrative fine”.

224. At paragraph 468, the EDPB further directed that:

“The EDPB instructs the IE SA to cover the additional infringement of Article 6(1) GDPR with an
administrative fine which is effective, proportionate and dissuasive in accordance with Article 83(1)
GDPR.”

225. As regards the manner in which I should assess the new infringement of Article 6(1) GDPR, the
EDPB instructed as follows:

410. The EDPB concurs that the decision to impose an administrative fine needs to be taken on a
case-by-case basis in light of the circumstances and is not an automatic one. In the case at hand,
however, the EDPB agrees with the reasoning put forward by the AT, DE, FR, NO and SE SAs in their
objections. The EDPB reiterates that lawfulness of processing is one of the fundamental pillars of
the data protection law and considers that processing of personal data without an appropriate
legal basis is a clear and serious violation of the data subjects’ fundamental right to data
protection.

411. Several of the factors listed in Article 83(2) GDPR speak strongly in favour of the imposition
of an administrative fine for the infringement of Article 6(1) GDPR.

The nature, gravity and duration of the infringement (Article 83(2)(a) GDPR)

412. As mentioned above and outlined below, the nature and gravity of the infringement clearly
tip the balance in favour of imposing an administrative fine.

413. With respect to the scope of processing, the EDPB notes the IE SA’s assessment that the
personal data processing carried out by Meta IE on the basis of Article 6(1)(b) GDPR is extensive,
adding that “Meta Ireland processes a variety of data in order to provide Instagram users with a
‘personalised’ experience, including by way of serving personalised advertisements. The
processing is central to and essential to the business model offered [...]’’.

414. In this respect, the EDPB also recalls that the infringement at issue relates to the processing
of personal data of a significant number of people
120

415. Though the damage is very difficult to express in terms of a monetary value, it remains the
case that data subjects have been faced with data processing that should not have occurred (by
relying inappropriately on Article 6(1)(b) GDPR as a legal basis as established in Section 4.4.2). The
data processing in question - behavioural advertising - entails decisions about information that
data subjects are exposed to or excluded from receiving. The EDPB recalls that non-material
damage is explicitly regarded as relevant in Recital 75 and that such damage may result from
situations “where data subjects might be deprived of their rights and freedoms or prevented from
exercising control over their personal data”. Given the nature and gravity of the infringement of
Article 6(1)(b) GDPR,

121

a risk of damage caused to data subjects is, in such circumstances, consubstantial with the finding
of the infringement itself and that the impact on them has to be considered.

The intentional or negligent character of the infringement (Article 83(2)(b) GDPR)

416. The SE SA argues the infringement of Article 6(1)(b) GDPR should be considered
intentional on Meta IE’s part, which is an aggravating factor.

417. The EDPB takes note of Meta IE’s position that it did not act intentionally with the aim to
infringe the GDPR, nor was negligent - but “has relied on what it has consistently considered in
good faith to be a valid legal basis for the purpose of processing of personal data for behavioural
advertising and which now requires escalation to the EDPB for resolution”. Before addressing each
of the elements of this claim, the EDPB first notes that establishing either intent or negligence is
not a requirement for imposing a fine, but deserves “due regard”. Second, contrary to what Meta
IE implies, the mere circumstance that a dispute between the LSA and the CSAs has escalated to
the EDPB does not serve as evidence that a controller acted in good faith with respect to the
disputed issues. First, the dispute arises only (long) after the controller has decided on its course
of action, and therefore cannot inform it. Second, a dispute may simply bring to light that an LSA
has decided to challenge a position commonly held by (a majority of) the CSAs.

418. The EDPB Guidelines on calculation of fines confirm that there are two cumulative
elements on the basis of which an infringement can be considered intentional: the knowledge of
the breach and the willfulness in relation to such act. By contrast, an infringement is
“unintentional” when there was a breach of the duty of care, without having intentionally caused
the infringement.

419. The characterisation of an infringement as intentional or negligent shall be done on the
basis of objective elements of conduct gathered from the facts of the case. It is worth noting the
broad approach adopted with respect to the concept of negligence, since it also encompasses
situations in which the controller or processor has failed to adopt the required policies, which
presumes a certain degree of knowledge about a potential infringement. This provides an
indication that noncompliance in situations in which the controller or processor should have been
aware of the potential breach (in the example provided, due to the lack of the necessary policies)
may amount to negligence.

420. The SE SA argues that Meta IE “has continued to rely on Article 6(1)(b) for the processing,
despite the aforementioned [EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR] – which clearly gives
doubt to the legality of the processing – which were first adopted on 9 April 2019 and made final
on 8 October 2019. The infringement must in all cases be considered intentional from that later
date”.

421. The EDPB recalls that even prior to the adoption EDPB Guidelines 2/2019 on Article 6(1)(b)
GDPR, there were clear indicators that spoke against relying on contract as legal basis. First, in
WP29 Opinion 02/2010 on online behavioural advertising, only consent - as required by Article
5(3) of the ePrivacy Directive - is put forward as possible legal basis for this activity. As Article 6

122

GDPR resembles Article 7 of the Data Protection Directive to a large extent, WP29 Opinion 02/2010
remained a relevant source on this matter for controllers preparing for the GDPR to enter into
application. Second, WP29 Opinion 06/2014 on the notion of legitimate interests explicitly states
that “the fact that some data processing is covered by a contract does not automatically mean that
the processing

123

124

is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building
a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the
items purchased. This is because the data controller has not been contracted to carry out profiling,
but rather to deliver particular goods and services, for example. Even if these processing activities
are specifically mentioned in the small print of the contract, this fact alone does not make them
‘necessary’ for the performance of the contract”.

422. It stems from the above that Meta IE had (or should have had) knowledge about the
infringement of Article 6(1)(b) GDPR. However, this mere element is not sufficient to consider an
infringement intentional, as stated above, since the “aim” or “wilfulness” of the action should be
demonstrated.

423. The EDPB recalls that that having knowledge of a specific matter does not necessarily
imply having the “will” to reach a specific outcome. This is in fact the approach adopted in the
EDPB Guidelines on calculation of fines and WP29 Guidelines on Administrative Fines, where the
knowledge and the “wilfulness” are considered two distinctive elements of the intentionality.
While it may prove difficult to demonstrate a subjective element such as the “will” to act in a
certain manner, there need to be some objective elements that indicate the existence of such
intentionality.

424. The EDPB recalls that the CJEU has established a high threshold in order to consider an act
intentional. In fact, even in criminal proceedings the CJEU has acknowledged the existence of
“serious negligence”, rather than “intentionality” when “the person responsible commits a patent
breach of the duty of care which he should have and could have complied with in view of his
attributes, knowledge, abilities and individual situation”. In this regard, while the EDPB confirms
that a company for whom the processing of personal data is at the core of its business activities is
expected to have sufficient measures in place for the safeguard of personal data, this does not,
however, per se change the nature of the infringement from negligent to intentional.

425. In this regard, the SE SA puts forward that Meta IE based its processing of personalised
advertisement on consent until the GDPR came into force on 25 May 2018, and at this time
switched to relying on Article 6(1)(b) GDPR for the processing in question instead. The timing and
the logistics for this switch suggests this act was done with the intention of circumventing the new
rights of users under Article 6(1)(a) GDPR. The SE SA adds that “[the] proposed finding of
infringement concerning information deficits about the processing, namely on what legal basis it
is based, further supports this conclusion, since it goes to show that Meta Ireland was aware of the
questionable legality of that basis and tried to conceal the infringement to avoid scrutiny by
supervisory authorities and data subjects”.

426. The EDPB considers the timing of the changes made by Meta IE to its Instagram Terms of
Use as an objective element, however this alone does not indicate intention. Around this time
period, many controllers updated their data protection policies. The objection suggests that the
conclusion on intentionality is corroborated by the shortcomings to the transparency obligations.
In the EDPB’s view, the combination of the timing of the change of legal basis with the lack of
transparency is not sufficient to indicate intention either.

125

126

427. Therefore, on the basis of the available information, the EDPB is not able to identify a will
of Meta IE to act in breach of the law as it cannot be concluded that Meta IE intentionally acted to
circumvent its legal obligations.

428. Therefore, the EDPB considers that the arguments put forward by the SE SA do not meet
the threshold to demonstrate the intentionality of the behaviour of Meta IE. Accordingly, the EDPB
is of the view that the Draft Decision does not need to include this element.

429. At the same time, the EDPB notes that, even establishing that the infringement was
committed negligently, a company for whom the processing of personal data is at the core of its
business activities should have in place sufficient procedures for ensuring compliance with the
GDPR.

430. The EDPB does not accept Meta IE’s claim of “good faith”, but is of the view that Meta IE
was certainly seriously negligent in not taking adequate action, within a reasonable time period,
following the adoption of the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR on 9 April 2019.
Even before that date, the EDPB considers there was at the very least negligence on Meta IE’s part
considering the contents of WP29 Opinion 02/2010 on online behavioural advertising and WP29
Opinion 06/2014 on the notion of legitimate interests (see paragraph 421 of this Binding Decision),
which means Meta IE had (or should have had) knowledge about the infringement of Article 6(1)(b)
GDPR, given the fact that processing of personal data is at the core of its business practices, and
the resources available to Meta IE to adapt its practices so as to comply with data protection
legislation.

The degree of responsibility of the controller taking into account technical and organisational
measures implemented pursuant to Articles 25 and 32(Article 83(2)(d) GDPR)

431. The EDPB considers the degree of responsibility of Meta IE’s part to be of a high level, on
the same grounds as set in the Draft Decision with regards to the transparency infringements.

The financial benefit obtained from the infringement (Article 83(2)(k) GDPR)

432. The SE SA argues Meta IE gained financial benefits from their decision to rely on contract
as legal basis for behavioural advertising, rather than obtaining consent from the users of
Instagram. While not providing an estimate of its size, the SE SA considers the existence of financial
benefit sufficiently proven on the basis of “the self-evident fact that Meta Ireland has made
significant financial gain from being able to provide personal advertisement as part of a whole take
it or leave it offer for its social media platform service, as opposed to establishing a separate legal
basis for it. By also being unclear in the information to data subjects, it is a reasonable assumption
that more data subjects have been misled into being subject to the processing, thus increasing the
financial benefits gained by Meta Ireland pursuant to personal advertisement”.

433. As explicitly stated in Article 83(2)(k) GDPR, financial benefits gained directly or indirectly
from the infringement can be considered an aggravating element for the calculation of the fine.
The aim of Article 83(2)(k) GDPR is to ensure that the sanction applied is effective, proportionate
and dissuasive in each individual case.
127

128

129

434. In particular, in view of ensuring fines that are effective, proportionate and deterrent, and
in light of common accepted practice in the field of EU competition law, which inspired the fining
framework under the GDPR, the EDPB is of the view that, when calculating the administrative fine,
supervisory authorities could take account of the financial benefits obtained from the
infringement, in order to impose a fine that aim at “counterbalancing the gains from the
infringement”.

435. When applying this provision, the supervisory authorities must “assess all the facts of the
case in a manner that is consistent and objectively justified”. Therefore, financial benefits from the
infringement could be an aggravating circumstance if the case provides information about profit
obtained as a result of the infringement of the GDPR.

436. In the present case, the EDPB considers that it does not have sufficiently precise
information to evaluate the specific weight of the financial benefit obtained from the
infringement.
437. Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no
effect if they are disproportionally low compared to the benefits obtained with the infringement.
The EDPB considers that the IE SA should ascertain if an estimation of the financial benefit from
the infringement is possible in this case. Insofar as this results in the need to increase the amount
of the fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.

Competitive advantage - other factor (Article 83(2)(k) GDPR)

438. The NO SA identifies an aggravating factor in that “that the unlawful processing of personal
data in all likelihood has contributed to the development of algorithms which may be harmful on
an individual or societal level, and which may have considerable commercial value to [Meta IE].
The algorithms may have contributed to giving [Meta IE] a competitive advantage vis-à-vis its
competitors”.

439. On principle, the EDPB agrees that a competitive advantage could be an aggravating factor
if the case provides objective information that this was obtained as a result of the infringement of
the GDPR. In the present case, the EDPB considers that it does not have sufficiently precise
information to evaluate the existence of a competitive advantage resulting from the infringement.
The EDPB considers that the IE SA should ascertain if an estimation of the competitive advantage
derived from the infringement is possible in this case. Insofar as this results in the need to increase
the amount of the fine proposed, the EDPB requests the IE SA to increase the amount of the fine
proposed.

***

440. Taking into account the nature and gravity of the infringement as well as other aspects in
accordance with Article 83(2) GDPR, the EDPB considers that the IE SA must exercise its power to
impose an additional administrative fine. Also, covering this additional infringement with a fine
would be in line with the IE SA’s (proposed) decision to impose administrative fines in this case for
the transparency infringements relating to processing carried out in reliance on Article 6(1)(b)
GDPR821. The EDPB underlines that, in order to be effective, proportionate and dissuasive, a fine
130

should reflect the circumstances of the case. Such circumstances not only refer to the specific
elements of the infringement, but also those of the controller or processor who committed the
infringement, namely its financial position.

131

226. I have taken account of the above directions of the EDPB in the Article 83(2) assessments set
out below.

227. Finally, in relation to the new finding of infringement of the Article 5(1)(a) GDPR principle of
fairness that was established by the EDPB, the EDPB further directed that:

444. As previously established, the principle of fairness under Article 5(1)(a) GDPR, although
intrinsically linked to the principles of lawfulness and transparency under the same provision, has
an independent meaning. It underpins the whole data protection framework and plays a key role
for securing a balance of power in the controller-data subject relationship.

445. Considering the EDPB’s findings in Section 6.4.2 that Meta IE has not complied with key
requirements of the principle of fairness as defined by the EDPB, namely allowing for autonomy of
the data subjects as to the processing of their personal data, fulfilling data subjects’ reasonable
expectation, ensuring power balance, avoiding deception and ensuring ethical and truthful
processing, as well as the overall effect of the infringement by Meta IE of the transparency
obligations and of Article 6(1) GDPR, the EDPB reiterates its view that Meta IE has infringed the
principle of fairness under Article 5(1)(a) GDPR and agrees with the IT SA that this infringement
should be adequately taken into account by the IE SA in the calculation of the amount of the
administrative fine to be imposed following the conclusion of this inquiry.

446. Therefore, the EDPB instructs the IE SA to take into account the infringement by Meta IE of
the fairness principle enshrined in Article 5(1)(a) GDPR as established above when re-assessing the
administrative fines for the transparency infringements and the determination of the fine for the
lack of legal basis. If, however, the IE SA considers an additional fine for the breach of the principle
of fairness is an appropriate corrective measure, the EDPB requests the IE SA to include this in its
final decision. In any case, the IE SA must take into account the criteria provided for by Article 83(2)
GDPR and ensuring it is effective, proportionate and dissuasive in line with Article 83(1) GDPR.

228. For the avoidance of doubt, I do not consider an additional fine for the breach of the Article
5(1)(a) principle of fairness that was established by the Article 65 Decision to be an appropriate
corrective measure. In this regard, I note that that the Board’s finding of infringement of the
Article 5(1)(a) fairness principle was largely based on the lack of transparency, as regards the
information that was presented to the data subject concerning the processing that would be
carried out further to the Terms of Use (see, for example, paragraphs 224, 225, 228 and 235 of
the Article 65 Decision). The Draft Decision contained separate proposed findings of infringement
of the transparency obligations set out in Articles 5(1)(a), 12(1) and 13(1)(c), together with
corresponding proposals to exercise corrective powers in the form of an administrative fine and
an order to bring processing into compliance. In the circumstances, it is my view that the
imposition of a fine for the finding of infringement of the Article 5(1)(a) fairness principle would
risk punishing Meta Ireland twice for the same wrongdoing.

132

229. From the above starting points, the required assessments, for the purpose of Article 83(2), of
the infringements that were found to have occurred elsewhere in this Decision are set out
immediately below.

230. As a preliminary matter, I note that Article 83(2)(a) refers to the “infringement” as well as the
“processing concerned” and that this criterion requires an assessment by reference to both. In
this regard, it is imperative to consider the meaning of both terms.

The infringements of Articles 5(1)(a), 12(1) and 13(1)(c) GDPR in the context of transparency

231. Read in conjunction with Article 83(3) – (5) GDPR, it is clear that the term “infringement” refers
to an infringement of the GDPR. As outlined above, I have found that Meta Ireland has infringed
Articles 5(1)(a), 12(1) and 13(1)(c) GDPR (the “Transparency Infringements”). Thus, “the
infringement”, for the purpose of my corresponding assessment of the Article 83(2) GDPR
criteria, should be understood (depending on the context in which the term is used) as meaning
an infringement of Articles 5(1)(a), 12(1) and 13(1)(c) GDPR. While I emphasise that each is an
individual and discrete “infringement” of the GDPR, I am proposing to assess all three
infringements simultaneously as all concern transparency and, by reason of their common nature
and purpose, are likely to generate the same, or similar, outcomes in the context of some of the
Article 83(2) GDPR assessment criteria. I will reference the infringements collectively as the
“Transparency Infringements”, unless otherwise indicated to the contrary.

232. The phrase “the processing concerned”, in the context of the Transparency Infringements, should
be understood as meaning all of the processing operations that Meta Ireland carries out in the
context of the Instagram service on the personal data under its controllership for which it
indicated reliance on Article 6(1)(b) GDPR, including for the purposes of behavioural
advertising 264. The within Inquiry was based on an assessment of the extent to which Meta
Ireland had complied with its transparency obligations in the context of a specific Complaint. The
Inquiry examined, inter alia the extent of the information Meta Ireland provided to the
Complainant about processing carried out pursuant to Article 6(1)(b) GDPR. Given the generality
of the Complaint and therefore the Inquiry, the precise parameters of this processing were not
directly relevant to the factual analysis carried out. The phrase “the processing concerned”, in
the context of the Transparency Infringements, therefore refers simply to the processing

264
See para. 346 of the EDPB’s Binding Decision 04/2022 on the dispute submitted by the Irish SA on Meta
Platforms Ireland Limited and its Instagram service (Art. 65 GDPR), adopted 5 December 2022.
133

addressed in the Decision i.e. the processing carried out by Meta Ireland for the purpose of
delivering its Terms of Use, including processing personal data for behavioural advertising.
Notwithstanding the EDPB’s determination
that Meta Ireland is not permitted to rely on Article 6(1)(b) GDPR when processing personal data
for behavioural advertising purposes, I am required (by paragraph 346 of the Article 65 Decision)
to retain the scope of the “processing concerned”, as set out above.

The infringement of Article 6(1) GDPR in the context of processing for behavioural advertising

233. In the context of the infringement of Article 6(1) GDPR that was established by the EDPB in the
Article 65 Decision, the phrase “the processing concerned” should be understood as meaning all
of the processing operations that are carried out by Meta Ireland for the purpose of behavioural
advertising.

234. Taking this as my starting point, I will now assess the Article 83(2)(a) criterion in light of the
particular circumstances of the Inquiry. I note, in this regard, that Article 83(2)(a) comprises: the
nature, gravity and duration of the infringement; the nature, scope or purpose of the processing
concerned; the number of data subjects affected; and the level of damaged suffered by them; as
follows:

Nature, gravity and duration of the infringement

235. In considering the nature of the Transparency Infringements, it must first be highlighted that the
proposed findings of infringement concern data subject rights. As set out in the analysis of Article
13(1)(c) GDPR above, my view is that the right concerned – the right to information – is a
cornerstone of the rights of the data subject. Indeed, the provision of the information concerned
goes to the very heart of the fundamental right of the individual to protection of personal data
which stems from the free will and autonomy of the individual to share their personal data in a
voluntary situation such as this. If the required information has not been provided, the data
subject has been deprived of the ability to make a fully informed decision as to whether they
wish to use a service that involves the processing of their personal data and engages their
associated rights. Furthermore, the extent to which a data controller has complied with its
transparency obligations has a direct impact on the effectiveness of the other data subject rights.
If data subjects have not been provided with the prescribed information, they may be deprived
of the knowledge they need in order to consider exercising one of the other data subject rights.

236. As regards the infringement of Article 5 GDPR, it should be noted that transparency “is an
overarching principle that not only reinforces other principles (i.e. fairness, accountability), but
from which many other provisions of the GDPR derive.” It is therefore clear that failure to comply
with the transparency principle has the potential to undermine other fundamental data
protection principles, including but not limited to the principles of fairness and accountability.

134

237. I further note, in this regard, that Articles 83(4) and (5) GDPR are directed to the maximum fine
that may be imposed in a particular case. The maximum fine prescribed by Article 83(5) GDPR is
twice that prescribed by Article 83(4) GDPR. The infringements covered by Article 83(5) GDPR
include infringements of the data subject’s rights pursuant to Article 12 to 22 GDPR and
infringements of the principles in Article 5 GDPR. It is therefore clear that the legislator
considered the data subject rights and the Article 5 GDPR principles to be particularly significant
in the context of the data protection framework as a whole.

238. In this respect, Meta Ireland have argued that the nature of the Transparency Infringements
amount to a good faith difference of opinion, and represent a new and subjective interpretation
of the GDPR. 265 As part of my assessment of the Article 83(2)(c) GDPR criterion, which requires
consideration of “any action taken by the controller or processor to mitigate the damage suffered
by data subjects”, I note that it would be unfair to criticise Meta Ireland for failing to take action
to mitigate any damage suffered in circumstances where its position was that no infringement
had occurred and, accordingly, no damage had been suffered by data subjects. This does not,
however, do anything to alter the infringement’s objectively serious character.

239. In terms of the nature of the Article 6(1) infringement that was established by the EDPB,
paragraph 410 of the Article 65 Decision records that:

“The EDPB reiterates that lawfulness of processing is one of the fundamental pillars of the data
protection law and considers that processing of personal data without an appropriate legal basis
is a clear and serious violation of the data subjects’ fundamental right to data protection”.

240. In expressing this view, the Board referred to page 10 of the objection raised by the Norwegian
SA, which states, in this regard, that:

“OBA [online behavioural advertising] entails profiling, which inherently constitutes risks for the
data subjects’ integrity. The less transparent the profiling algorithms are, the higher the risk, and
in this case, there is no meaningful, sufficiently detailed information about the functioning of
MPILI’s algorithms available to us.

Furthermore, on the Instagram platform, profiling is used to make decisions by way of automated
means regarding what information the data subjects are exposed to. Important to note is that this
equally means that decisions are taken as regards which information data subjects do not see and
thus are excluded from receiving. The information may inter alia include commercial
advertisements, political advertising, housing postings et cetera, and it may be of a manipulative
nature”.

265
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 13.2. See also para. 14.9.
135

241. In considering the nature and scope of the processing in the context of the analysis leading to the
finding of infringement of Article 6(1) itself, the Board noted, at paragraphs 98 to 100 of the
Article 65 Decision, that:

“…Meta IE collects data on its individual users and their activities on and off its Facebook service
via numerous means such as the service itself, other services of the Meta group including
Instagram, WhatsApp and Oculus, third party websites and apps via integrated programming
interfaces such as Facebook Business Tools or via cookies, social plug-ins, pixels and comparable
technologies placed on the internet user’s computer or mobile device. According to the
descriptions provided, Meta IE links these data with the user’s Facebook account to enable
advertisers to tailor their advertising to Facebook’s individual users based on their consumer
behaviour, interests, purchasing power and personal situation. This may also include the user’s
physical location to display content relevant to the user’s location. Meta IE offers its services to its
users free of charge and generates revenue through this personalised advertising that targets
them, in addition to static advertising that is displayed to every user in the same way.

The EDPB considers that these general descriptions signal by themselves the complexity, massive
scale and intrusiveness of the behavioural advertising practice that Meta IE conducts through the
Facebook service, as well as off the Facebook service itself, through third party websites and apps
which are connected to Facebook.com via programming interfaces (“Facebook Business Tools”),
including the Instagram service. Furthermore, among the aspects described in the Instagram
Terms of Use is “Providing consistent and seamless experiences across other Facebook Company
Products.” which involves “shar[ing] technology, systems, insights, and information-including the
information we have about you.” It is therefore clear that personal data is shared between
Facebook companies (”We use data from Instagram and other Facebook Company Products, as
well as from third-party partners, to show you ads (...)”

These are relevant facts to consider to assess the appropriateness of Article 6(1)(b) GDPR as a legal
basis for behavioural advertising and to what extent reasonable users may understand and expect
behavioural advertising when they accept the Instagram Terms of Use and perceive it as necessary
for Meta IE to deliver its service”.

242. With specific reference to the scope of the processing, paragraph 413 of the Article 65 Decision
records that:

“With respect to the scope of processing, the EDPB notes the IE SA’s assessment that the personal
data processing carried out by Meta IE on the basis of Article 6(1)(b) GDPR is extensive, adding
that “Meta Ireland processes a variety of data in order to provide Instagram users with a
‘personalised’ experience, including by way of serving personalised advertisements. The processing
is central to and essential to the business model offered [...]’”’
136

243. It is therefore clear that the Board considers the Article 6(1) infringement to concern one of the
“fundamental pillars” of the GDPR and the nature and scope of the processing to be extensive,
complex, intrusive and on a massive scale. I further note, in this regard, that paragraph 412 of
the Article 65 Decision indicates that the Board considered the nature of the infringement to be
significant, in the context of its conclusion that an administrative fine ought to be imposed in
relation to the infringement of Article 6(1) GDPR.

244. As regards the gravity of the Transparency Infringements, my findings are such that Meta Ireland
has not provided the required information in the required manner under Article 13(1)(c) GDPR
and has also infringed Articles 12(1) and 5(1)(a) GDPR. This, in my view, represents a significant
level of non-compliance, taking into account the importance of the right to information, the
consequent impact on the data subjects concerned and the number of data subjects potentially
affected (each of which is considered further below). The clear inconsistencies between the
transparency guidelines and the manner in which Meta Ireland attempted to comply with its
obligations makes clear that the Commission’s interpretation is neither new nor subjective. I
would add that I have set out (below) the risks to data subjects in being unable to effectively
exercise their rights by being unable to discern what specific data processing is being done on
what legal basis and for what objective. This is more than sufficient to show the negative impact
that this has had on data subjects and specifically on the Named Data Subject.

245. Meta Ireland have alleged that the Transparency Infringements are “marginal” in their nature
and gravity because the Commission’s interpretation amounts to new and subjective views being
imposed on it. 266 I do not accept that these views are new or subjective. I set out at Section 5
the extent to which this level of compliance is expected by the transparency guidelines, which
are a publicly available document. The clear inconsistencies between the transparency
guidelines and the manner in which Meta Ireland have attempted to comply with its obligations
makes clear that the Commission’s interpretation is neither new nor subjective. The Commission
is carrying out its functions under the GDPR, by interpreting and applying the relevant provisions
of the GDPR to the Complaint before it. I also note Meta Ireland’s argument that no evidence
has been presented of the impact on data subjects from a lack of transparency. 267 In this respect,
I emphasise that this entire Complaint arises from a failure to provide sufficiently transparent
information such that the Named Data Subject could not understand the agreement to the Terms
of Use was not consent in the sense meant in the GDPR. Moreover, I have already set out in
Section 5, the risks to data subjects in being unable to effectively exercise their rights by being
unable to discern what specific data processing is being done on what legal basis and for what

266
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 14.9 – 14.10.
267
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.8.
137

objective. I disagree with Meta Ireland’s submission that this is “purely hypothetical”. 268 This is
more than sufficient to show the negative impact that this has had on data subjects and
specifically on the Named Data Subject.
Given this significant impact, as set out in this Decision, I cannot accept the suggestion from Meta
Ireland that the administrative fine be replaced with a reprimand. 269

246. In terms of the gravity of the Article 6(1) infringement that was established by the EDPB, the
Article 65 Decision does not identify, with any particularisation, the EDPB’s position on the gravity
of the Article 6(1) infringement. I note, however, that paragraph 412 of the Article 65 Decision
indicates that the Board considered the gravity of the infringement to be significant, in the
context of its conclusion that an administrative fine ought to be imposed in relation to the
infringement of Article 6(1) GDPR, stating:

“As mentioned above and outlined below, the nature and gravity of the infringement clearly tip
the balance in favour of imposing an administrative fine”

247. In this regard, I note that infringements of Article 6 are subject to the higher fining threshold set
out in Article 83(5) GDPR. The maximum fine prescribed by Article 83(5) GDPR is twice that
prescribed by Article 83(4) GDPR. This arrangement clearly indicates that the legislator
considered the matters covered by Article 83(5) GDPR to be particularly significant in the context
of the data protection framework as a whole.

248. In terms of the duration of the Transparency Infringements, this complaint-based Inquiry relates
in part to a lack of information provided to the Complainant as regards the lawful basis relied on
and the connection between Article 6(1)(b) GDPR and specific processing operation(s) or set(s)
of operations. The Complaint therefore relates to the transparency of the relevant documents
at the time the Complaint was lodged. In that sense, this Inquiry relates to specific alleged
infringements at a specific point in time, because that is what the Complaint concerns. In
imposing corrective powers however, the GDPR requires that the broader impact of
infringements be considered (as I will set out below in relation to each individual criterion). To
that extent, it is necessary at times to move from the specific to the general.

249. I should, at this juncture, note that the Commission is not required to apply the same approach
across all inquiries, regardless of the differences between such inquiries. In this respect, I
acknowledge Meta Ireland’s submissions on the Preliminary Draft in which Meta Ireland took
issue with various alleged inconsistencies between the approach to factors considered in

268
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.7.
269
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 13.3.
304
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.2.
138

administrative fines in the Preliminary Draft and in other decisions made by the Commission
under the GDPR to date.304 I do not agree that there is any inconsistency in the manner in which
it has assessed the Article 83(2) GDPR criteria. The Commission is not required to apply the same
approach across all inquiries, regardless of the differences between such inquiries.

250. The Commission’s approach to the presence or absence of relevant previous infringements (for
the purpose of the Article 83(2)(e) GDPR assessment) differs, depending inter alia on the contexts
of different types of controllers, particularly as concerns the scale of the processing at issue. In
this regard, the Commission is entitled to take account of whether data controllers or processors
with multi-national operations have significant resources available to them, including large, in-
house, compliance teams. Moreover, such entitles are further likely to be engaged in business
activities that are uniquely dependent on the large-scale processing of personal data. The
Commission’s view is that the size and scale of such entities, the level of dependency on data
processing and the extensive resources that are available to them necessitate a different
approach to the absence of previous relevant infringements. That approach has been reflected
in the decisions that differ in their considerations of particular factors from this one. In the
circumstances, the Commission does not accept that there has been an inconsistency in the
Commission’s approach to determining the quantum of any fine.

251. In relation to the infringement of Article 6(1) that was established by the EDPB, the Article 65
Decision does not contain any indication in relation to the manner in which the Board took
account of the duration of the Article 6(1) infringement. In this respect, I note that the
infringement has occurred since 25 May 2018 and remains ongoing.

Taking into account the nature, scope or purpose of the processing concerned

252. The personal data processing carried out by Meta Ireland in the context of the Instagram service
pursuant to Article 6(1)(b) GDPR is extensive. Meta Ireland processes a variety of data in order
to provide Instagram users with a “personalised” experience, including by way of serving
personalised advertisements. The processing is central to and essential to the business model
offered, and, for this reason, the provision of compliant information in relation to that processing
becomes even more important. This, indeed, may include location and IP address data.

253. In response to my consideration of this matter in the Preliminary Draft, Meta Ireland alleged that
its “difficulty in striking the right balance between presenting sufficient information but in a way
which remains concise, intelligible and accessible” was illustrative of the marginal nature of
noncompliance. 270 I do not consider this to be the case given the extent of non-compliance I
have outlined in Section 5. Meta Ireland also expressed concern that I was considering “a much
wider range of processing” than processing to facilitate behavioural advertising. 271 For the

270
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.11.
271
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.12.
139

avoidance of doubt, I confirm that I have only taken account of processing to facilitate
behavioural advertising.

254. The EDPB’s views, as regards the scope of the processing concerned, in the context of the Article
6(1) infringement have already been recorded at paragraph 242 above.

The number of data subjects affected

255. In submissions dated 28 September 2018, Meta Ireland stated that it “provides the Instagram
service to hundreds of millions of users across the European region”. 272

256. In the context of the Transparency Infringements, I noted, in the Draft Decision, that Meta Ireland
had confirmed that, as of the date of the commencement of the Inquiry, i.e. 31 August 2018, it
had approximately monthly active accounts and, as of December 2021, it had approximately
monthly active users in the European Economic Area. 273 In the Draft Decision, I noted
that, surprisingly, Meta Ireland excluded the number of UK active accounts in these calculations
on the understanding that “such accounts in that territory are not relevant to the Inquiry”. 274 This
understanding is not correct; as the GDPR was applicable in the UK at the date of the Complaint
and it was my view that these accounts are in fact relevant to this Inquiry and must be taken
account.

257. Eurostat, the statistical office of the European Union confirms that, as of 1 January 2020, the
population of the “”EU 27” was approximately 488 million, the population of the UK was
approximately 67 million, the population of Norway was approximately 5 million, and the
populations of Iceland and Liechtenstein were approximately 364,000 and 39,000 respectively. 275

258. By reference to these figures, the total population of the EEA (including the UK) by reference to
the latest available figures is approximately 520 million. While it is not possible, or indeed
necessary, for me to identify the precise number of users affected by the Infringements, it is
useful to have some point of reference in order to consider the extent of EEA data subjects that
are potentially affected by the Transparency Infringements.

259. Paragraph 223 of the Draft Decision noted the confirmation, provided by Meta Ireland that, as at
the date of the commencement of the Inquiry (i.e. 31 August 2018), it had approximately
monthly active users and, as of December 2021, it had approximately monthly
active users in the EEA, excluding the number of UK active accounts.

272
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.8.
273
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.13.
274
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at footnote 117.
275
https://ec.europa.eu/eurostat/tgm/table.do?tab=table&init=1&language=en&pcode=tps00001&plugin=1.
140

260. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, paragraph
414 of the Article 65 Decision records that “the EDPB also recalls that the infringement at issue
relates to the processing of personal data of a significant number of people”

261. In expressing the above view, the Board referred to paragraph 253 of the Draft Decision, which
records that a “significant portion of the population of the EEA seems to have been impacted by
the Infringements”.

262. In this regard, the Board referred to pages 9 and 11 of the objection raised by the German SAs
which references the risks to “hundreds of millions of data subjects within the EU”. The Board
also referred to pages 10 – 11 of the objection raised by the Norwegian SA which, referring to
paragraph 223 of the Draft Decision, states that “the number of data subjects affected in the EEA
amounts to hundreds of millions”.

The level of damage suffered by them

263. In relation to the Transparency Infringements, I note that Recital 75 (which acts as an aid to the
interpretation of Article 24 GDPR, the provision that addresses the responsibility of the
controller), describes the “damage” that can result where processing does not accord with the
requirements of the GDPR:

“The risk to the rights and freedoms of natural persons, of varying likelihood and severity,
may result from personal data processing which could lead to physical, material or
nonmaterial damage, in particular: … where data subjects might be deprived of their rights
and freedoms or prevented from exercising control over their personal data …”

264. As set out above, my findings are such that users have not been provided with the information
in relation to processing pursuant to Article 6(1)(b) GDPR that they are entitled to receive. This
represents, in my view, quite a significant information deficit and one which, by any assessment
of matters, can equate to a significant inability to exercise control over personal data. I have also
pointed out the centrality of the processing to Meta Ireland’s business model in respect of the
Instagram service. This makes it all the more important that information on this processing be
provided in a transparent manner, and makes the implications of it not being provided in such a
manner all the more significant.

265. I further note that the failure to provide all of the prescribed information undermines the
effectiveness of the data subject rights and, consequently, infringes the rights and freedoms of
the data subjects concerned. A core element of transparency is empowering data subjects to
make informed decisions about engaging with activities that cause their personal data to be
processed, and making informed decisions about whether to exercise particular rights, and

141

whether they can do so. This right is undermined by a lack of transparency on the part of a data
controller.

266. Meta Ireland have argued that the above amounts to mere “speculation”.276 I have already set
out in detail in this Decision the risks to data subject rights involved in the denial of transparency,
and indeed provided the concrete example of the breach of the Named Data Subject’s right to
transparency about the use of his personal data. This is more than sufficient to show that rights
have been damaged in a significant manner, given the lack of an opportunity to exercise data
subject rights while being fully informed.

267. In the context of the finding of the infringement of Article 6(1) GDPR that was established by the
EDPB, paragraph 415 of the Article 65 Decision records that:

“Though the damage is very difficult to express in terms of a monetary value, it remains the case
that data subjects have been faced with data processing that should not have occurred (by relying
inappropriately on Article 6(1)(b) GDPR as a legal basis as established in Section 4.4.2). The data
processing in question - behavioural advertising - entails decisions about information that data
subjects are exposed to or excluded from receiving. The EDPB recalls that non-material damage is
explicitly regarded as relevant in Recital 75 and that such damage may result from situations
“where data subjects might be deprived of their rights and freedoms or prevented from exercising
control over their personal data”. Given the nature and gravity of the infringement of Article
6(1)(b) GDPR, a risk of damage caused to data subjects is, in such circumstances, consubstantial
with the finding of the infringement itself.”

268. Paragraph 133 of the Article 65 Decision considers the risks arising from the Article 6(1)
infringement as follows:

“Given that the main purpose for which a user uses Instagram service is to share and receive
content, and communicate with others. The users’ lack of choice in this respect would rather
indicate that Meta IE’s reliance on the contractual performance legal basis deprives users of their
rights, among others, to withdraw their consent under Articles 6(1)(a) and 7 and/or to object to
the processing of their data based on Article 6(1)(f) GDPR 237, and that Meta IE conditions their
use to the user’s acceptance of a contract and the behavioural advertising they include, the EDPB
cannot see how a user would have the option of opting out of a particular processing which is part
of the contract as the IE SA seems to argue”.

269. In paragraph 135 of the Article 65 Decision, the Board further considered that:

276
Facebook Submissions on Preliminary Draft, paragraph 4.13.
142

“Some of the safeguards from which data subjects would be deprived due to an inappropriate use
of Article 6(1)(b) GDPR as legal basis, instead of others such as consent (Article 6(1)(a) GDPR) and
legitimate interest (Article 6(1)(f) GDPR), are the possibility to specifically consent to certain
processing operations and not to others and to the further processing of their personal data
(Article 6(4) GDPR); their freedom to withdraw consent (Article 7 GDPR); their right to be
forgotten (Article 17 GDPR); and the balancing exercise of the legitimate interests of the controller
against their interests or fundamental rights and freedoms (Article 6(1)(f) GDPR).”

270. It therefore appears that the Board considered the infringement to give rise to a risk of loss of
control over, and ability to exercise choice concerning, one’s personal data. This is consistent
with the complainant’s position that the infringement had the effect of negating his consent/free
will. 277

271. I also consider that that the infringement of the Article 5(1)(a) fairness principle may be taken
into account, as required by the Article 65 Decision, under this particular heading. I note, in this
regard, paragraph 229 of the Article 65 Decision, which records the Board’s view that:

“Considering the constantly increasing economic value of personal data in the digital environment,
it is particularly important to ensure that data subjects are protected from any form of abuse and
deception, intentional or not, which would result in the unjustified loss of control over their
personal data. Compliance by providers of online services acting as controllers with all three of the
cumulative requirements under Article 5(1)(a) GDPR, taking into account the particular service that
is being provided and the characteristics of their users, serves as a shield from the danger of abuse
and deception, especially in situations of power asymmetries.”

272. The Board further notes, at paragraphs 233 and 234 of the Article 65 Decision, that:

“the EDPB shares the IT SA’s concern that Instagram users are left “in the dark” and considers that
the processing by Meta IE cannot be regarded as ethical and truthful because it is confusing with
regard to the type of data processed, the legal basis and the purpose of the processing, which
ultimately restricts the Instagram users’ possibility to exercise their data subjects’ rights.

…Considering the seriousness of the infringements of the transparency obligations by Meta IE
already identified in the Draft Decision and the related misrepresentation of the legal basis relied
on, the EDPB agrees with the IT SA that Meta IE has presented its service to the Instagram users

277
See point ii, page 20 of the complaint
143

in a misleading manner429, which adversely affects their control over the processing of their
personal data and the exercise of their data subjects' rights.”

273. The Board’s views highlight the same damage as already identified above, namely the loss of
control over, and ability to exercise choice concerning, one’s personal data.

274. On the basis of the views that have been expressed by the Board, as recorded above, I proposed
to conclude that the infringement of Article 6(1) GDPR falls within the upper range of the scale,
in terms of seriousness, for the purpose of the assessment of the Article 83(2)(a) criterion. In its
Final Submissions, Meta Ireland expressed disagreement with the proposed conclusion and
underlying assessments set out above.

Meta Ireland’s Final Submissions in response to the assessment of the Article 6(1) infringement
for the purpose of Article 83(2), as introduced to this Decision following the adoption of the
Article 65 Decision

275. Following the amendment of the Draft Decision to take account of the EDPB’s Article 65 Decision,
Meta Ireland was invited to exercise its right to be heard in relation to those aspects of the Draft
Decision in relation to which the Commission was required to make a final determination or,
otherwise, to exercise its discretion. Meta Ireland furnished its submissions on these matters
under cover of letter dated 19 December 2022 (“the Final Submissions”).

276. In relation to the nature of the Article 6(1) infringement, Meta Ireland submitted that the EDPB’s
conclusion on this aspect of matters “is not correct and not supported by the evidence,
particularly where (i) the [Commission] itself found Meta Ireland’s reliance on Article 6(1)(b) for
the Behavioural Advertising Processing valid in principle, meaning the infringement found cannot
be said to have been “clear”; and (ii) the Article 65 Decision acknowledges that legal bases are
available under Article 6(1) for the Behavioural Advertising Processing and that there is no
hierarchy between those legal bases”. 278 In this regard, Meta Ireland respectfully urgeed the
Commission not to adopt the EDPB’s flawed arguments with respect to Article 83(2)(a) in light of
a number of “significant errors in the EDPB’s reasoning” that it has identified in its Final
Submissions.

277. In circumstances where the Article 65 Decision is binding upon the Commission, I am not in a
position to act contrary to the views that have been so expressed the EDPB.

278. In relation to the gravity of the infringement, Meta Ireland, firstly, noted that the Article 65
Decision does not articulate any clear reasoning or position with respect to the gravity of the
purported infringement, rendering the assessment of this element meaningless. Meta Ireland

278
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 9.5.
144

further submitted that a “finding in respect of gravity cannot simply be extrapolated from the
fact that the infringement found is subject to a particular fining cap in accordance with Article
83(5), with no reference to the facts”. 279 Meta Ireland submitted that gravity should not be
considered significant or an aggravating factor for the same reasons as those provided in
response to the proposed assessment of the nature of the assessment, as summarised above.

279. As before, the Commission is not in a position to act contrary to the views that have been clearly
expressed by the EDPB in its binding Article 65 Decision. As already acknowledged, the EDPB has
not elaborated on the reasons why it considers the gravity of the Article 6(1) infringement to be
one of the factors that tip the balance in favour of the imposition of a fine. This does not alter,
however, the fact, however, that the EDPB clearly considered the gravity of the Article 6(1)
infringement to be one of the factors that warranted the imposition of a fine. In these
circumstances, it is not open to the Commission to conclude that the gravity of the infringement
is not significant in terms of its impact on the overall assessment of the Article 83(2)(a) criterion.

280. In relation to the duration of the infringement, Meta Ireland submits that duration “should not
be considered an aggravating factor in this particular case”. 280 In the absence of any specific
direction from the EDPB, in this regard, the Commission has not treated this factor as being
significant, in terms of its impact on the overall assessment of the Article 83(2)(a) criterion.

281. In relation to the number of data subjects and the level of damage suffered by them, Meta Ireland
submitted that:

• “the only data subject who is relevant for the purpose of Article 83(2)(a) is the data subject
represented by the Complainant and any consideration of the level of damage suffered is
confined to a consideration of any damage the Complainant may have suffered. No evidence
of any such damage has been adduced in the Inquiry”;

• “even if it is open to the [Commission] to consider whether other data subjects have been
affected and to have regard to any damage suffered by them, there is no evidence whatsoever
in this Inquiry that any other data subjects have suffered any damage”;

• “the [Commission’s] assessment of whether damage has been suffered for the purposes of
Article 83(2)(a) must be based on evidence of damage stemming from the specific
infringement in question (here, the Article 6(1) GDPR infringement). It is not permissible for
the DPC to assume that the Complainant has suffered damage or to base the calculation of
the proposed Article 6(1) fine on “the same damage as already identified” as the basis for the
proposed Article 5(1)(a) fine”;

279
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 9.10.
280
Meta Ireland’s Final Submissions dated 19 December 2022, at paras. 9.14-9.19.
145

• “an alleged “loss of control” should not be equated with damage within the meaning of Article
83(2)(a) GDPR”; and

• “there is no evidence to support the assertion that users experienced a “loss of control”; nor
is there any factual or evidential basis for such a claim. This is especially true considering that
everyone has a choice as to whether they wish to use the Instagram Service in the first place,
and can always deactivate their accounts”. 281

282. In response to the above submissions, it is, firstly, important to note that the Commission is
subject to a binding decision of the EDPB, which includes an assessment of the damage suffered
by data subjects, at paragraph 415 thereof. In the circumstances, it is not open to the
Commission to find that no damage has been suffered. Secondly, the Complainant himself
identified the damage that he alleges he suffered in connection with the matters which formed
the basis for the EDPB’s findings of infringement of Article 6(1) and the Article 5(1)(a) principle of
fairness. Thirdly, as regards the damage suffered by data subjects other than the Complainant,
the matters covered by the findings of infringement are not matters on which any individual user
of the Instagram Service has the power to exercise choice (other than, of course, the choice to
use the Instagram Service or not). Where any individual data subject chooses to use the
Instagram Service, the basic processing that takes place (the subject of the within Inquiry) is the
same as that applied to the personal data of the Complainant. In these circumstances, it cannot
be said that the identified damage suffered, i.e. loss of control over one’s personal data, is limited
to the Complainant alone. For these reasons, it is appropriate for the Commission to take account
of the damage suffered by all user data subjects as part of the Article 83(2) assessment.

283. Having taken account of the Final Submissions, I remain of the view that the infringement of
Article 6(1) GDPR falls within the upper range of the scale, in terms of seriousness, for the
purpose of the assessment of the Article 83(2)(a) criterion.

ARTICLE 83(2)(B): THE INTENTIONAL OR NEGLIGENT CHARACTER OF THE INFRINGEMENT

284. In respect of the character of the Transparency Infringements, I note that the GDPR does not
identify the precise factors that need to be present in order for an infringement to be classified as
either “intentional” or “negligent”. As the Article 29 Working Party considered the meaning of
“character of the infringement” in its “Guidelines on the application and setting of administrative
fines for the purposes of Regulation 2016/679” (the “Article 29 Working Group Fining
Guidelines”), 282 I have had regard to this interpretation in my assessment, notwithstanding the

Meta Ireland’s Final Submissions dated 19 December 2022, at paras. 9.20 – 9.27.
281

Article 29 Working Party, “Guidelines on the application and setting of administrative fines for the purposes of
282

Regulation 2016/679” (adopted on 3 October 2017).
146

fact that these guidelines are non-binding on me. The Article 29 Working Party took the view as
follows:

“In general, “intent” includes both knowledge and wilfulness in relation to the
characteristics of an offence, whereas “unintentional” means that there was no intention
to cause the infringement although the controller/processor breached the duty of care
which is required in the law.
…
Circumstances indicative of intentional breaches might be unlawful processing authorised
explicitly by the top management hierarchy of the controller, or in spite of advice from the
data protection officer or in disregard for existing policies, for example obtaining and
processing data about employees at a competitor with an intention to discredit that
competitor in the market.
…
Other circumstances, such as failure to read and abide by existing policies, human error,
failure to check for personal data in information published, failure to apply technical
updates in a timely manner, failure to adopt policies (rather than simply failure to apply
them)may be indicative of negligence”. 283

In this regard, I further note that, as a general point, an intentional infringement is more severe
than an unintentional infringement. 284

285. In the course of the Complainant’s submissions, the Complainant expressed the view that the
infringements by Meta Ireland were intentional in character. 285 In this vein, the Complainant
alleged that Meta Ireland made a deliberate and calculated decision to present the information in
a particular manner such as to mislead data subjects. I do accept that Meta Ireland made a
deliberate decision to present the information to data subjects in a particular way.

286. However, I am not satisfied, on the evidence available to me, that Meta Ireland made a
particular decision to infringe the GDPR, in particular as regards its transparency obligations. It
appears clear to me that the Article 29 Working Party Fining Guidelines referred to above explicitly
recognise that an intentional breach generally only occurs when there is a deliberate act to
infringe the GDPR. In this regard, I also emphasise that a finding of intentionality is predicated on
knowledge and wilfulness as to the characteristics of an offence. There is no evidence that this is
satisfied in respect of the infringements of Articles 5(1)(a), 12(1) and 13(1)(a) GDPR.

283
Article 29 Working Party, “Guidelines on the application and setting of administrative fines for the purposes of
Regulation 2016/679” (adopted on 3 October 2017) at pp. 11 - 12.
284
Article 29 Working Party, “Guidelines on the application and setting of administrative fines for the purposes of
Regulation 2016/679” (adopted on 3 October 2017) at pp. 11 - 12.
285
For example, see the Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020, at pp. 28 and
43.
147

287. Meta Ireland argued that where it was found to have a “’genuinely held belief’ that it was
adhering to its [transparency] obligations”, it is “unfair” and contrary to the principle of legal
certainty to find that it is negligent. 286 I do not agree; Meta Ireland should have been aware of its
transparency requirements, especially in light of the transparency guidelines, 287 and should have
provided clarity about the precise extent of the processing operations carried out pursuant to
Article 6(1)(b) GDPR.
Meta Ireland further should have ensured that it adhered strictly to its transparency obligations
when choosing the lawful bases on which they rely and should have used these obligations as a
guide as to the information to be conveyed to data subjects. Accordingly, I am satisfied that the
infringements are negligent in character.

288. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB,
paragraphs 418 to 430, inclusive, of the Article 65 Decision record as follows:

“The EDPB Guidelines on calculation of fines confirm that there are two cumulative elements
on the basis of which an infringement can be considered intentional: the knowledge of the
breach and the willfulness in relation to such act. By contrast, an infringement is
“unintentional” when there was a breach of the duty of care, without having intentionally
caused the infringement.

The characterisation of an infringement as intentional or negligent shall be done on the basis
of objective elements of conduct gathered from the facts of the case. It is worth noting the
broader approach adopted with respect to the concept of negligence, since it also
encompasses situations in which the controller or processor has failed to adopt the required
policies, which presumes a certain degree of knowledge about a potential infringement. This
provides an indication that noncompliance in situations in which the controller or processor
should have been aware of the potential breach (in the example provided, due to the lack of
the necessary policies) may amount to negligence.

The SE SA argues that Meta IE “has continued to rely on Article 6(1)(b) for the processing,
despite the aforementioned [EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR] – which
clearly gives doubt to the legality of the processing – which were first adopted on 9 April
2019 and made final on 8 October 2019. The infringement must in all cases be considered
intentional from that later date”.

The EDPB recalls that even prior to the adoption EDPB Guidelines 2/2019 on Article 6(1)(b)
GDPR, there were clear indicators that spoke against relying on contract as legal basis. First,
in WP29 Opinion 02/2010 on online behavioural advertising, only consent - as required by

Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 14.15 – 14.16.
286

Article 29 Working Party, “Guidelines on transparency under Regulation 2016/679” (adopted on 29 November
287

2017; last revised and adopted on 11 April 2018).
148

Article 5(3) of the ePrivacy Directive - is put forward as possible legal basis for this activity.
As Article 6 GDPR resembles Article 7 of the Data Protection Directive to a large extent, WP29
Opinion 02/2010 remained a relevant source on this matter for controllers preparing for the
GDPR to enter into application. Second, WP29 Opinion 06/2014 on the notion of legitimate
interests explicitly states that “the fact that some data processing is covered by a contract
does not automatically mean that the processing is necessary for its performance. For
example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes
and lifestyle choices based on his click-stream on a website and the items purchased. This is
because the data controller has not been contracted to carry out profiling, but rather to
deliver particular goods and services, for example. Even if these processing activities are
specifically mentioned in the small print of the contract, this fact alone does not make them
‘necessary’ for the performance of the contract”.

It stems from the above that Meta IE had (or should have had) knowledge about the
infringement of Article 6(1)(b) GDPR. However, this mere element is not sufficient to consider
an infringement intentional, as stated above, since the “aim” or “wilfulness” of the action
should be demonstrated.

149

The EDPB recalls that that having knowledge of a specific matter does not necessarily imply
having the “will” to reach a specific outcome. This is in fact the approach adopted in the EDPB
Guidelines on calculation of fines and WP29 Guidelines on Administrative Fines, where the
knowledge and the “wilfulness” are considered two distinctive elements of the intentionality.
While it may prove difficult to demonstrate a subjective element such as the “will” to act in a
certain manner, there need to be some objective elements that indicate the existence of such
intentionality.

The EDPB recalls that the CJEU has established a high threshold in order to consider an act
intentional. In fact, even in criminal proceedings the CJEU has acknowledged the existence of
“serious negligence”, rather than “intentionality” when “the person responsible commits a patent
breach of the duty of care which he should have and could have complied with in view of his
attributes, knowledge, abilities and individual situation”. In this regard, while the EDPB confirms
that a company for whom the processing of personal data is at the core of its business activities
is expected to have sufficient measures in place for the safeguard of personal data, this does not,
however, per se change the nature of the infringement from negligent to intentional.

In this regard, the SE SA puts forward that Meta IE based its processing of personalised
advertisement on consent until the GDPR came into force on 25 May 2018, and at this time
switched to relying on Article 6(1)(b) GDPR for the processing in question instead. The timing and
the logistics for this switch suggests this act was done with the intention of circumventing the
new rights of users under Article 6(1)(a) GDPR. The SE SA adds that “[the] proposed finding of
infringement concerning information deficits about the processing, namely on what legal basis it
is based, further supports this conclusion, since it goes to show that Meta Ireland was aware of
the questionable legality of that basis and tried to conceal the infringement to avoid scrutiny by
supervisory authorities and data subjects”

The EDPB considers the timing of the changes made by Meta IE to its Instagram Terms of Use as
an objective element, however this alone does not indicate intention. Around this time period,
many controllers updated their data protection policies. The objection suggests that the
conclusion on intentionality is corroborated by the shortcomings to the transparency obligations.
In the EDPB’s view, the combination of the timing of the change of legal basis with the lack of
transparency is not sufficient to indicate intention either.

Therefore, on the basis of the available information, the EDPB is not able to identify a will of Meta
IE to act in breach of the law as it cannot be concluded that Meta IE intentionally acted to
circumvent its legal obligations.

Therefore, the EDPB considers that the arguments put forward by the SE SA do not meet the
threshold to demonstrate the intentionality of the behaviour of Meta IE. Accordingly, the EDPB is
of the view that the Draft Decision does not need to include this element.

At the same time, the EDPB notes that, even establishing that the infringement was committed
negligently, a company for whom the processing of personal data is at the core of its business
activities should have in place sufficient procedures for ensuring compliance with the GDPR.

150

The EDPB does not accept Meta IE’s claim of “good faith”, but is of the view that Meta IE was
certainly seriously negligent in not taking adequate action, within a reasonable time period,

151

following the adoption of the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR on 9 April 2019. Even
before that date, the EDPB considers there was at the very least negligence on Meta IE’s part
considering the contents of WP29 Opinion 02/2010 on online behavioural advertising and WP29
Opinion 06/2014 on the notion of legitimate interests (see paragraph 421 of this Binding Decision),
which means Meta IE had (or should have had) knowledge about the infringement of Article 6(1)(b)
GDPR, given the fact that processing of personal data is at the core of its business practices, and
the resources available to Meta IE to adapt its practices so as to comply with data protection
legislation”.

289. Paragraph 468 of the Article 65 Decision records the Board’s instruction for the Commission
to have due regard to the “seriously negligent character of the infringement” in determining the
amount of the fine. On the basis of the views that have been expressed by the EDPB, as recorded
above, I proposed to treat this factor as an aggravating factor of significant weight.

290. In its Final Submissions, Meta Ireland disagreed with the above conclusion on the basis of a
range of submissions, all of which challenge the basis for the EDPB’s conclusion. 288 Meta Ireland
submitted that the finding of infringement of Article 6(1) GDPR can “at most be considered
inadvertent, such that this should not be treated as an aggravating factor for the purpose of Article
83(2).” In the alternative, Meta Ireland submitted that the Commission should not afford any
material weight to this factor in light of its “good faith reliance on what it considered to be a valid
legal basis, (b) the errors in the reasoning of the EDPB [as identified]; and (c) the lack of legal
certainty in the interpretation of Article 6(1)(b) GDPR.”

291. Meta Ireland, in its Final Submissions, also sought clarification as to whether I proposed to
characterise this infringement as intentional due to a typographical error in the material furnished
to Meta Ireland to enable it to make its Final Submissions.324 For the avoidance of doubt, I confirm
that this was a typographical error.

292. As already noted, above, the Article 65 Decision is binding upon the Commission. In the
circumstances, it is not open to the Commission to disregard the views that have been clearly
expressed by the EDPB, in relation to the character of the Article 6(1) infringement. In
circumstances where the EDPB has determined the Article 6(1)(b) infringement to be “seriously
negligent” in character, I remain of the view that this classification requires me to treat this factor

288
Meta Ireland’s Final Submissions dated 19 December 2022, at paras. 9.31-9.39.
324
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 9.30.
152

as an aggravating factor of significant weight, notwithstanding Meta Ireland’s Final Submissions
on this point.

ARTICLE 83(2)(C): ANY ACTION TAKEN TO MITIGATE THE DAMAGE TO DATA SUBJECTS

293. Meta Ireland’s position, in the context of the Transparency Infringements, is that it has
discharged its transparency obligations in respect of the Instagram service and, accordingly,
complies fully with the GDPR in this respect. Although, as I have outlined in the course of my
findings, I do not agree with this position, I nonetheless accept on the facts available to me that
this represents a genuinely held belief on Meta Ireland’s part. It follows therefore that there has
not been an effort to mitigate the damage to data subjects as it was Meta Ireland’s position that
data subjects were incurring no such damage. Nonetheless, I am not prepared to find that the
lack of any mitigating action should necessarily be considered an aggravating factor.

294. Meta Ireland argued that my analysis is flawed because it takes no account of the effort made
to comply with the GDPR. 289 However, it is my view that there is no reason why, on the basis of
the transparency guidelines, Meta Ireland could not have taken steps to ensure compliance and
thereby mitigate damage. I am not satisfied that there is any reason why day-to-day compliance
related activities in a large multinational organisation, which is an important legal duty and
commonplace business activity, could be considered a mitigating factor. Taking steps to attempt
to comply with legal obligations is a duty, and has no mitigating impact on a sanction for a breach
of those obligations. This is distinct from any act that might be taken to mitigate specific damage
to data subjects. I am not of course treating this factor as aggravating given that, beyond simply
complying with the GDPR, there are no obvious mitigating steps that could have been taken. It is
on this basis that I treat this factor as neither mitigating nor aggravating.

295. I do, however, take account of and acknowledge Meta Ireland’s willingness to engage in steps
to bring its processing into compliance on a voluntary basis pending the conclusion of this
Inquiry. 290 I consider this to be a mitigating factor and have taken account of this.

296. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, this
aspect of the Article 83(2) assessment was not addressed in the Article 65 Decision. I note that
Meta Ireland’s position, throughout this Inquiry, has been one whereby it considered that it was
entitled to process personal data for behavioural advertising purposes, insofar as that formed a
core part of the Instagram Terms of Use, in reliance on Article 6(1)(b) GDPR. That being the case,
it follows that Meta Ireland could not have been expected to take action “to mitigate the damage
suffered by data subjects” in circumstances where Meta Ireland did not consider any infringement

289
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.18.
290
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.19.
153

to have occurred or any damage to have been suffered by data subjects. In the circumstances,
the Commission proposed to consider this factor to be neither aggravating nor mitigating.

297. In the Final Submissions, Meta Ireland urged me to take account of various mitigating matters
such as the absence of evidence of harm and the fact that various voluntary steps have been taken
to improve transparency for users since the Inquiry has commenced, including as recently as July
2022. I note that I have already addressed Meta Ireland’s submissions concerning the absence of
evidence of harm, as part of the Article 83(2)(a) assessment. In relation to the voluntary changes
that have been made since the date of circulation, to the CSAs, of the Draft Decision, the
Commission is unable to give credit to these changes, as a mitigating factor, without an
assessment of the changes themselves. Given that such an assessment is not possible within the
temporal scope of the within Inquiry, the Commission is unable to treat this matter as a mitigating
factor. Accordingly, I remain of the view that this factor ought to be treated as neither aggravating
nor mitigating.

ARTICLE 83(2)(D): THE DEGREE OF RESPONSIBILITY OF THE CONTROLLER OR PROCESSOR TAKING INTO ACCOUNT
TECHNICAL AND ORGANISATIONAL MEASURES IMPLEMENTED BY THEM PURSUANT TO ARTICLES 25 AND 32

298. In respect of this factor, the Article 29 Working Party Fining Guidelines advise that the following
approach should be taken:

“The question that the supervisory authority must then answer is to what extent the
controller “did what it could be expected to do” given the nature, the purposes or the size
of the processing, seen in light of the obligations imposed on them by the Regulation.
In this assessment, due account should be taken of any “best practice” procedures or
methods where these exist and apply. Industry standards, as well as codes of conduct in
the respective field or profession are important to take into account. Codes of practice
might give an indication as to what is common practice in the field and an indication of
the level of knowledge about different means to address typical security issues associated
with the processing”. 291

299. In this regard, I am satisfied that, on the facts available to me, Meta Ireland held a genuine belief
that its provision of information in respect of processing under Article 6(1)(b) GDPR in the context
of the Instagram service was in compliance with its transparency obligations. Indeed, as I have

Article 29 Working Party, “Guidelines on the application and setting of administrative fines for the purposes of
291

Regulation 2016/679” (adopted on 3 October 2017) at p. 13.
154

outlined above in respect of my analysis of Article 83(2)(b), I am satisfied that Meta Ireland did
not act in a deliberate or knowing manner to infringe the GDPR. In its response to the Preliminary
Draft, Meta Ireland argued that “it is inconsistent and illogical to find that a genuine effort to
achieve compliance, based on a ‘genuine belief’, nevertheless amounts to ‘a high degree of
responsibility’”. 292

300. Meta Ireland is correct that other actions, such as no genuine effort to comply, attract a higher
degree of responsibility, however it does not follow that a genuine belief necessarily implies no
or low responsibility. Indeed, I emphasise that Meta Ireland made a deliberate and knowing
decision to present the information to users in a particular manner. As I have outlined in the
course of my analysis in respect of Issue 3, the provision of information in this regard has fallen
significantly below the standards that are expected of controllers. I note Meta Ireland’s
submission that its compliance should have been assessed as against industry standards. 293 In
this respect, I think it is sufficient to have assessed compliance by reference to the standards set
in the GDPR and expounded on in the transparency guidance.

301. I note, in this regard, that guidance as to the substance of the transparency obligations under the
GDPR was available to Meta Ireland at the date of the Complaint. 294 I am therefore satisfied that
Meta Ireland should have been aware of the appropriate standards – albeit at a general level –
and, having made a deliberate decision to present the information in a manner which fell
significantly below the standard required, has a high degree of responsibility for the lack of
compliance with the GDPR. Accordingly, I consider this to be an aggravating factor in the
determination of any administrative fine.

302. In relation to the finding of infringement of Article 6(1) GDPR that was established by the EDPB,
paragraph 431 of the Article 65 Decision records that:

“The EDPB considers the degree of responsibility of Meta IE’s part to be of a high level, on the same
grounds as set in the Draft Decision with regards to the transparency infringements.”

303. In expressing this view, the Board referred to paragraph 240 of the Draft Decision which states:

“I note, in this regard, that guidance as to the substance of the transparency obligations under
the GDPR was available to Meta Ireland at the date of the Complaint. I am therefore satisfied
that Meta Ireland should have been aware of the appropriate standards – albeit at a general level

292
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.20.
293
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.21.
294
Article 29 Working Party, “Guidelines on transparency under Regulation 2016/679” (adopted on 29 November
2017; last revised and adopted on 11 April 2018).
155

– and, having made a deliberate decision to present the information in a manner which fell
significant below the standard required, has a high degree of responsibility for the lack of
compliance with the GDPR. Accordingly, I consider this to be an aggravating factor in the
determination of any administrative fine.”

304. Footnote 811 of the Article 65 Decision further records that:

“the EDPB notes that the high degree of responsibility of Meta IE for the non-compliance with the
GDPR was considered as an aggravating factor by LSA for the calculation of the fine.”

305. In the circumstances, and based on the above, I proposed to consider this to be an aggravating
factor, of moderately significant weight.

306. In its Final Submissions, Meta Ireland disagreed with the above assessment on the basis that “the
EDPB’s conclusion at para. 431 of the Article 65 Decision that Meta Ireland had a “high level” of
responsibility pursuant to this factor is based on an incomplete analysis and the EDPB fails to
consider any of the relevant subfactors set forth by the Article 29 Working Party Draft
Administrative Fine Guidelines in reaching its conclusion.” 295

307. As already noted above, the EDPB’s Article 65 Decision is binding upon the Commission.
Accordingly, the Commission is not permitted to look behind the EDPB’s views and
determinations. In the circumstances, I remain of the view that this factor ought to be treated
as an aggravating factor, of moderately significant weight.

ARTICLE 83(2)(E): ANY RELEVANT PREVIOUS INFRINGEMENTS BY THE CONTROLLER OR PROCESSOR

308. In the context of the Transparency Infringements, I noted that the Commission has not made
any findings of infringements by Meta Ireland in the context of the Instagram service which could
be considered relevant for my assessment. 296 I note Meta Ireland’s view that this should be
considered a mitigating factor. I do not agree that a lack of any relevant previous infringements
by a controller necessarily constitutes a mitigating factor for the purpose of this assessment. In

295
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 9.48.
296
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.23.
156

this regard, I emphasise that the GDPR has only been in force for a relatively short period of time
and, accordingly, it is not unusual or indeed unexpected that there may be no relevant previous
infringements by the controller. It can therefore be said that a lack of relevant previous
infringement does not necessarily signal a general level of good practice by controller and, on this
basis, I am not prepared to find that a lack of previous relevant infringements is necessarily a
mitigating factor.

309. Meta Ireland compared the lack of mitigation in this regard to a decision of the Commission
on a domestic matter.297 I have already set out my views on these arguments above. Further, the
Article 83(2) GDPR criteria are matters that I must consider when deciding whether to impose an
administrative fine and, if so, the amount of that fine. The Article 83(2) GDPR criteria are not
binary in nature, such that, when assessed in the context of the circumstances of infringement,
they must be found to be either a mitigating or an aggravating factor.

310. Although Meta Ireland has no previous relevant infringements in the context of the Instagram
service, I do not think that this is either a mitigating or aggravating factor for the purposes of my
assessment.

311. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the
Article 65 Decision does not address this aspect of matters. As at the date of circulation of the
Draft Decision, were there no relevant previous infringements by Meta Ireland that fell to be
considered under this particular heading. In the circumstances, the Commission proposed to
consider this factor to be neither mitigating nor aggravating.

312. Meta Ireland, in its Final Submissions, disagreed with the above, instead, urged the
Commission to treat this factor as mitigating, in line with the Commission’s approach in other
(named) inquiries.334 I note, in this regard, that the named inquiries do not concern cross-border
processing.

313. In response to the above, the Commission is not required to apply the same approach across
all of its inquiries. The Commission’s approach to the presence or absence of relevant previous
infringements (for the purpose of the Article 83(2)(e) assessment) differs, depending inter alia on
the contexts of different types of controllers and, in particular, the scale of the processing at issue.
Unlike the position with the smaller-scale domestic inquiries that Meta Ireland has cited as
examples, inquiries into larger internet platforms generally concern data controllers or processors

297
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.24.
334
Meta Ireland’s Final Submissions dated 19 December 2022, at paras. 9.50-9.51.
157

with multi-national operations and significant resources available to them, including large,
inhouse, compliance teams. Such entitles are further likely to be engaged in business activities
that are uniquely dependent on the large-scale processing of personal data. The Commission’s
view is that the size and scale of such entities, the level of dependency on data processing and the
extensive resources that are available to them necessitate a different approach to the absence of
previous relevant infringements. That approach has been reflected in the decisions that have
been cited by Meta Ireland in support of its submission. I note, in this regard, that Meta Ireland’s
submissions do not reference the Commission’s decision in the Twitter (breach notification)
inquiry, nor the Commission’s decision in the WhatsApp (own volition) transparency inquiry, nor
the Facebook (12 breaches) inquiry. The Commission’s approach to the Article 83(2) assessment,
as recorded in these decisions (amongst others), is consistent with that applied to the within
inquiry. Accordingly, I remain of the view that this factor ought to be treated as neither mitigating
nor aggravating.

ARTICLE 83(2)(F): THE DEGREE OF COOPERATION WITH THE SUPERVISORY AUTHORITY, IN ORDER TO REMEDY THE
INFRINGEMENT AND MITIGATE THE POSSIBLE ADVERSE EFFECTS OF THE INFRINGEMENT

314. In considering the degree of cooperation with the supervisory authority, I first note that there
is a general duty on controllers to cooperate under Article 31 GDPR. It is therefore important to
remember that controllers are legally obliged to cooperate in the course of an inquiry and
cooperation is not necessarily a mitigating factor. Indeed, this is also the position set out in the
Article 29 Working Party Fining Guidelines, which state that:

“it would not be appropriate to give additional regard to cooperation that is already
required by law for example, the entity is in any case required to allow the supervisory
authority access to premises for audits/inspections”. 298

In this regard, I emphasise that to decide otherwise would mean that the activities of entities
acting in the ordinary course of adhering to legal duties to cooperate would be considered a
mitigating factor for the purposes of calculating a sanction. It would follow that all controllers
adhering to their legal duties – with the exception of those who act in a deliberately uncooperative
manner – would benefit from a mitigation in sanction. I cannot accept that this was the intention
of the legislator.

315. In the context of the Transparency Infringements, it is Meta Ireland’s position that
cooperation in this matter should be treated as a mitigating factor, and again cites a decision of
the Commission. 299 I once again refer to my analysis on that issue above. This position reflects
the erroneous treatment of the Article 83(2) GDPR factors as binary choices between mitigation

298
Article 29 Working Party, “Guidelines on the application and setting of administrative fines for the purposes of
Regulation 2016/679” (adopted on 3 October 2017) at p. 14.
299
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.25.
158

and aggravation to which I have already referred. I note once again that Meta Ireland is seeking
to voluntarily comply, and note that I have already taken this into account above as a mitigating
factor.

316. In the course of this Inquiry, Meta Ireland have cooperated fully with the Commission as it is
required to do in accordance with the law, Article 31 GDPR in particular. Given that all such
cooperation was in accordance with its legal duties to cooperate, I do not consider such
cooperation to constitute either a mitigating or aggravating factor for the purposes of my
assessment.

317. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the
Article 65 Decision has not addressed this aspect of matters. In the circumstances, I proposed to
consider this factor to be neither mitigating nor aggravating for the same reasons set out in the
Article 83(2)(c) assessment, above.

318. In its Final Submissions, Meta Ireland submitted that I should treat this as a mitigating factor
it light of the fact that it has taken “various voluntary steps to improve transparency for its users
(which the EDPB considers underpins the alleged Article 6(1) infringement) throughout the course
of the Inquiry … and will undertake all efforts to comply with any order issued by the DPC, as
required”. Meta Ireland further submitted that it has “cooperated fully with the DPC throughout
the Inquiry”. 300

319. I have already addressed the reasons why I cannot take account, as a mitigating factor, of any
voluntary steps taken by Meta Ireland following the date of circulation of the Draft Decision to the
CSAs (the steps taken before that date having been deemed, by the EDPB, to be insufficient to be
treated as a mitigating factor). While the Commission recognises that Meta Ireland has
cooperated fully throughout the Inquiry, the Commission notes that Meta Ireland is obliged to do
so by virtue of Article 31 GDPR. Furthermore, and while the Commission acknowledges Meta
Ireland’s commitment to undertake “all efforts to comply with any order” that might be issued
further to this Decision, I again note that Meta Ireland is subject to an obligation to comply with
the terms of the relevant order. In the circumstances, I am unable to take account of such matters
as mitigating factors.

320. Accordingly, I remain of the view that this factor ought to be treated as neither mitigating nor
aggravating.

300
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 9.53.
159

ARTICLE 83(2)(G): THE CATEGORIES OF PERSONAL DATA AFFECTED BY THE INFRINGEMENT

321. In the context of the Transparency Infringements, the lack of transparency concerned broad
categories of personal data in respect of users who sign up to the Instagram service. I accept that
this assessment of data processing in this Inquiry was rather generalised in nature. I further note
that Meta Ireland’s lack of transparency did itself contribute to a lack of clarity as to the precise
categories of personal data relevant for this Inquiry. Nonetheless, given that, on the facts
available to me, there is no evidence that this concerned personal data of a particularly sensitive
nature, I regard this factor as neither aggravating nor mitigating for the purposes of my
assessment. While Meta Ireland have alleged it is unclear what weight has been attached to this
in the calculation of the fine, 301 I think it is clear that in being neither aggravating nor mitigating,
it did not increase or decrease the proposed fining range.

322. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the
Article 65 Decision has not addressed this aspect of matters. I note, however, the “relevant facts”
identified by the Board, in paragraphs 98 of the Article 65 Decision, including in relation to the
personal data concerned, as follows:

“Meta IE collects data on its individual users and their activities on and off its Facebook service via
numerous means such as the service itself, other services of the Meta group including Instagram,
WhatsApp and Oculus, third party websites and apps via integrated programming interfaces such
as Facebook Business Tools or via cookies, social plug-ins, pixels and comparable technologies
placed on the internet user’s computer or mobile device. According to the descriptions provided,
Meta IE links these data with the user’s Facebook account to enable advertisers to tailor their
advertising to Facebook’s individual users based on their consumer behaviour, interests,
purchasing power and personal situation. This may also include the user’s physical location to
display content relevant to the user’s location.”

323. While, as noted already in the Draft Decision, it was neither necessary for the purpose of the
examination of the Complaint, nor possible from an examination of the relevant privacy policy, to
identify the particular categories of personal data undergoing processing, it seems clear that the
Board considered the processing to concern a broad range of categories of personal data. Given
the nature of behavioural advertising, it appears to be beyond dispute that the processing of a
broad range of personal data is required to be carried out to achieve the objectives of behavioural
advertising. In the circumstances, I proposed to consider this to be an aggravating factor of
moderately significant weight.

301
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.26.
160

324. Meta Ireland, in its Final Submissions, submitted that this factor should be considered neutral
in circumstances where the views of the EDPB that form the basis of the Commission’s assessment
under this heading, in turn, rely on “descriptions of processing that are inaccurate and outside the
scope of the Inquiry”. 302

325. As already outlined above, the Article 65 Decision is binding upon the Commission.
Accordingly, it is not open to the Commission to revisit or otherwise look behind the views
expressed and determinations made by the EDPB. In the circumstances, I remain of the view that
this factor ought to be treated as an aggravating factor of moderately significant weight.

ARTICLE 83(2)(H): THE MANNER IN WHICH THE INFRINGEMENT BECAME KNOWN TO THE SUPERVISORY AUTHORITY,
IN PARTICULAR WHETHER, AND IF SO TO WHAT EXTENT, THE CONTROLLER OR PROCESSOR NOTIFIED THE
INFRINGEMENT

326. In the context of the Transparency Infringements, I noted that the subject matter became
known to the Commission due to an Inquiry conducted on foot of the Complaint. The subject
matter did not give rise to any requirement of notification, and I have already acknowledged
several times that the controller’s genuinely held belief is that no infringement is/was occurring.

327. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the
Article 65 Decision has not addressed this particular aspect of matters. As noted above, the
subject matter did not give rise to any requirement of notification, and I have already
acknowledged several times that the controller’s genuinely held belief is that no infringement
is/was occurring. Meta Ireland, by way of its Final Submissions has confirmed its agreement with
the above approach. 303 In the circumstances, I conclude that this factor is neither mitigating nor
aggravating.

328. In the context of the Transparency Infringements, I concluded that this criterion is not applicable.

302
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 9.57.
303
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 9.59.
161

329. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the Article
65 Decision has not addressed this particular aspect of matters. I note that measures have not
previously been ordered against Meta Ireland with regard to the same subject matter. Meta
Ireland, by way of its Final Submissions has confirmed its agreement with the above approach. 304
In the circumstances, I have conclude that this factor is neither mitigating nor aggravating.

ARTICLE 83(2)(J): ADHERENCE TO APPROVED CODES OF CONDUCT PURSUANT TO ARTICLE 40 OR APPROVED
CERTIFICATION MECHANISMS PURSUANT TO ARTICLE 42

330. In the context of the Transparency Infringements, I concluded that this criterion is not applicable.

331. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the Article 65
Decision has not addressed this particular aspect of matters. The Commission proposed to consider
this factor as neither mitigating nor aggravating in circumstances where nothing arises for
assessment under this heading. Meta Ireland, by way of its Final Submissions has confirmed its
agreement with the above approach.305 In the circumstances, I conclude that this factor is neither
mitigating nor aggravating.

ARTICLE 83(2)(K): ANY OTHER AGGRAVATING OR MITIGATING FACTOR APPLICABLE TO THE CIRCUMSTANCES OF THE
CASE, SUCH AS FINANCIAL BENEFITS GAINED, OR LOSSES AVOIDED, DIRECTLY OR INDIRECTLY, FROM THE
INFRINGEMENT

332. In the Preliminary Draft Decision, I considered the following factors in the context of the
Transparency Infringements:

• Meta Ireland does not charge for the Instagram service.

• The subject matter of the Infringements relates directly to the provision of information in
relation to what is, by Meta Ireland’s own admission, its core business model i.e. personalised
advertising provided pursuant to a contract with Instagram users.

• The question is therefore whether a more transparent approach to processing operations
carried out on foot of that contract would represent a risk to Meta Ireland’s business model.
In my view, it would, if existing or prospective users were dissuaded from using the Instagram
service by clearer explanations of the processing operations carried out, and their purposes.

• In my view, the above risk is sufficiently high to justify the conclusion that this lack of
transparency has the potential to have resulted in financial benefits for Meta Ireland.

304
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 9.60.
305
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 9.61.
162

333. Meta Ireland however argued that this does not at all propose a financial risk, and argued that
no evidence of same has been presented. 306 Neither I nor Meta Ireland can know, until the
contingent event has happened, which one of us is correct in our belief as to the likely impact,
on the continued growth of the user base. Given that any general consideration of this is
ultimately involves an element of speculation on both Meta Ireland’s and the Commission’s part,
I consider that this factor is neither aggravating nor mitigating.

334. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, paragraphs
435 to 437 Article 65 Decision, record the EDPB’s views that:

“The EDPB recall that financial benefits from the infringement could be an aggravating
circumstance if the case provides information about profit obtained as a result of the infringement
of the GDPR.

In the present case, the EDPB considers that it does not have sufficiently precise information to
evaluate the specific weight of the financial benefit obtained from the infringement.

Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no effect if
they are disproportionally low compared to the benefits obtained with the infringement. The EDPB
considers that the IE SA should ascertain if an estimation of the financial benefit from the
infringement is possible in this case. Insofar as this results in the need to increase the amount of
the fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.”

335. In a similar view, paragraph 439 of the Article 65 Decision records that:

“On principle, the EDPB agrees that a competitive advantage could be an aggravating factor if the
case provides objective information that this was obtained as a result of the infringement of the
GDPR. In the present case, the EDPB considers that it does not have sufficiently precise information
to evaluate the existence of a competitive advantage resulting from the infringement. The EDPB
considers that the IE SA should ascertain if an estimation of the competitive advantage derived
from the infringement is possible in this case. Insofar as this results in the need to increase the
amount of the fine proposed, the EDPB requests the IE SA to increase the amount of the fine
proposed.”

336. Despite specific requests made by the Commission, during the course of the Article 65
deliberations, no directions have been provided by the EDPB, in its Article 65 Decision, as to the
manner in which the Commission might seek to ascertain an estimation of: (i) the financial benefit

306
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.27.
163

gained from an infringement such as the one under assessment; or (ii) the competitive advantage
derived from the infringement. I note, in this regard, the views previously expressed by the
EDPB 307 that:

“… when deciding on the imposition of corrective measures in general, and fines in particular,
“supervisory authorities must assess all the facts of the case in a manner that is consistent and
objectively justified.”

337. In the absence of directions, the Commission is unable to ascertain an estimation of the matters
identified above. Accordingly, I am unable to take these matters into account for the purpose of
this assessment.

338. As before, the Commission separately notes, under this heading, the Board’s view, as set out in
the Board’s binding decision 1/2021 (paragraphs 409 to 412, inclusive), that the turnover of the
undertaking concerned ought to be taken into account not just for the calculation of the
applicable fining “cap” but also for the purpose of assessing the quantum of the administrative
fine itself. This position is further reflected in the Fining Guidelines 04/2022 (see, for example,
paragraph 49). The Commission’s assessment of the undertaking concerned and the applicable
turnover figure is detailed elsewhere in the Draft Decision. While this is not a matter that can
properly be classified as either mitigating or aggravating, by reference to the circumstances of
the case, I proposed to take the significant turnover of the undertaking concerned into account
when determining the quantum of the proposed fine, as set out below.

339. Meta Ireland, in its Final Submissions, disagreed with the Commission’s proposal to have regard
to the turnover of the undertaking concerned in calculating the amount of the fine. 308 As already
noted above, this requirement was previously determined by the EDPB in binding decision
1/2021 and reiterated in the Article 65 Decision. In the circumstances, it is not open to the
Commission to disregard this requirement. Neither is it open to the Commission to treat “Meta
Ireland alone” as being the relevant “undertaking” for these purposes.

WHETHER TO IMPOSE AN ADMINISTRATIVE FINE

307
Binding decision 1/2021 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding
WhatsApp Ireland under Article 65(1)(a) GDPR, adopted 28 July 2021, paragraph 403.
308
Meta Ireland’s Final Submissions dated 19 December 2022, at paras. 9.63-9.64.
164

The Transparency Infringements

340. I proposed to impose an administrative fine in relation to the Transparency Infringements in
circumstances where:

• The infringements are serious in nature. The lack of transparency goes to the heart of data
subject rights and risks undermining their effectiveness by not providing transparent
information in that regard. While the infringements considered here relate to one lawful
basis, it nonetheless concerns vast swathes of personal data impacting millions of data
subjects. When such factors are considered, it is clear that the infringements are serious in
their gravity.
I have taken this into account when determining, for the purpose of Article 83(2)(a) GDPR,
that the infringements are at the upper end of the scale, in terms of seriousness.

• A significant portion of the population of the EEA seems to have been impacted by the
Infringements. I consider this to be an aggravating factor of significant weight.

• I note in particular the impact a lack of transparency has on a data subject’s ability to be fully
informed about their data protection rights, or indeed about whether in their view they
should exercise those rights. I have taken this into account when determining, for the purpose
of Article 83(2)(a) GDPR, that the infringements are at the upper end of the scale, in terms of
seriousness.

• I have already found that the Infringements were negligent. While I am not calling into
question Meta Ireland’s right to come to a genuine view on this matter, I am taking into
account the failure of an organisation of this size to provide sufficiently transparent materials
in relation to the core of its business model. For the avoidance of doubt, and noting the views
expressed by the EDPB in its Fining Guidelines 04/2022, that “(a)t best, negligence could be
regarded as neutral”, I have taken this into account as a neutral factor.

• I note that the Instagram Data Policy and Terms of Use have been amended, and because this
is an Inquiry into a particular complaint, the documents being considered are no longer
contemporary. Therefore, I am not attaching significant weight to the question of the
duration of the infringement, in circumstances where more recent versions of the relevant
documents are outside the scope of the Inquiry. In the circumstances, and for the avoidance
of doubt, I have taken this into account as a neutral factor.

• The mitigating factor of Meta Ireland’s decision to begin preparation for voluntary compliance
on the basis of the views set out in the Preliminary Draft Decision, pending conclusion of the
Inquiry.

165

341. On the basis of the analysis set out above in respect of the nature, gravity and duration of the
infringements and the potential number of data subjects affected, I have proposed, by way of the
Draft Decision, to impose the following administrative fines:

• In respect of the failure to provide sufficient information in relation to the processing
operations carried out on foot of Article 6(1)(b) GDPR, thereby infringing Articles 5(1)(a) and
13(1)(c) GDPR, I proposed a fine of between €11.5 million and €14 million.

• In respect of the failure to provide the information that was provided on the processing
operations carried out in foot of Article 6(1)(b) GDPR, in a concise, transparent, intelligible
and easily accessible form, using clear and plain language, thereby infringing Articles 5(1)(a)
and 12(1) GDPR, I proposed a fine of between €6.5 million and €9 million.

342. In determining the quantum of the fines proposed above, I took account of the requirement,
set out in Article 83(1) GDPR, for fines imposed to be “effective, proportionate and dissuasive” in
each individual case. My view was that, in order for any fine to be “effective”, it must reflect the
circumstances of the individual case. As already discussed above, the Transparency Infringements
are serious, both in terms of the extremely large number of data subjects potentially affected, the
categories of personal data involved, and the consequences that flow from the failure to comply
with the transparency requirements for users.

343. In order for a fine to be “dissuasive”, it must dissuade both the controller/processor
concerned as well as other controllers/processors carrying out similar processing operations from
repeating the conduct concerned.

344. As regards the requirement for any fine to be “proportionate”, this requires the adjustment
of the quantum of any proposed fine to the minimum amount necessary to achieve the objectives
pursued by the GDPR. My view was that the fines proposed above did not exceed what was
necessary to enforce compliance with the GDPR, taking into account the size of the Instagram user
base, the impact of the Infringements on the effectiveness of the data subject rights enshrined in
Chapter III of the GDPR and the importance of those rights in the context of the GDPR as a whole.

345. Accordingly, my view was that the fines proposed above would, if imposed on Meta Ireland,
be effective, proportionate and dissuasive, taking into account all of the circumstances of the
Inquiry.

346. Further to the circulation of the Draft Decision to the concerned supervisory authorities for
the purpose of enabling them to express their views in accordance with Article 60(3) GDPR,
objections were raised in relation to this aspect of matters by the supervisory authorities of
Germany, France, Italy, the Netherlands and Norway. Having considered the merits of those
objections, the EDPB determined as follows:

166

364. The EDPB agrees with the objections raised that - if the proposed fine was to be imposed
for the transparency infringements - there would be no sufficient special preventive effect
towards the controller, nor a credible general preventive effect. The proposed fine amount,
even where a final amount at the upper limit of the range would be chosen, is not effective,
proportionate and dissuasive, in the sense that this amount can simply be absorbed by the
undertaking as an acceptable cost of doing business. As behavioural advertising is at the core
of Meta IE’s business model, the risk of this occurring is all the greater. By bearing the cost of
the administrative fine, the undertaking can avoid bearing the cost of adjusting their business
model to one that is compliant as well as any future losses that would follow from the
adjustment. 365. Though the IE SA touches upon the notions of effectiveness, proportionality
and dissuasiveness in relation to the proposed fine, there is no justification based on elements
specific to the case to explain the modest fine range chosen. Moreover, the EDPB notes that
while the IE SA takes into consideration the turnover of the undertaking to ensure that the fine
it proposed does not exceed the maximum amount of the fine provided for in Article 83(5)
GDPR, the IE SA does not articulate how and to what extent the turnover of this undertaking is
considered to ascertain that the administrative fine meets the requirement of effectiveness,
proportionality and dissuasiveness. In this regard the EDPB recalls that, contrary to Meta IE’s
views, the turnover of the undertaking concerned is not exclusively relevant for the
determination of the maximum fine amount in accordance with Article 83(4)-(6) GDPR, but
should also be considered for the calculation of the fine itself, where appropriate, to ensure the
fine is effective, proportionate and dissuasive in accordance with Article 83(1) GDPR. The EDPB
therefore instructs the IE SA to modify its Draft Decision to elaborate on the manner in which
the turnover of the undertaking concerned has been taken into account for the calculation of
the fine.

366. In light of the above, the EDPB considers that the proposed fine does not adequately reflect
the seriousness and severity of the infringements nor has a dissuasive effect on Meta IE.
Therefore, the fine does not fulfil the requirement of being effective, proportionate and
dissuasive in accordance with Article 83(1) and (2) GDPR. In light of this, the EDPB directs the IE
SA to set out a significantly higher fine amount for the transparency infringements identified, in
comparison with the upper limit for the administrative fine envisaged in the Draft Decision. In
doing so, the IE SA must remain in line with the criteria of effectiveness, proportionality, and
dissuasiveness enshrined in Article 83(1) GDPR in its overall reassessment of the amount of the
administrative fine.

347. I note that the EDPB agreed with the manner in which the Commission originally assessed the
circumstances of the Transparency Infringement for the purposes of the Article 83(2) criteria. That
being the case, it seems clear that the EDPB’s instruction, above, concerns my view that the
originally proposed fines were effective, proportionate and dissuasive for the purpose of Article
83(1) GDPR. In other words, the focus of the EDPB’s instruction is the quantum of the fines that
were originally proposed by the Article 60 Draft Decision. I note, in this regard, the EDPB’s
instruction that I set out a “significantly” higher fine, in comparison with the upper limit for the

167

originally proposed administrative fines. By way of guidance, the Article 65 Decision records as
follows:

362. According to the DE, FR, and IT SAs, the proposed fine is not consistent with the fine of 225
million euros decided upon by the IE SA in its decision dated 20 August 2021 against
WhatsApp Ireland Limited for the same transparency infringements (breaches of Articles
12 and 13 GDPR). In particular, the DE SAs point out that ‘’the facts and the seriousness of
the infringements in the two cases are no sufficiently different to justify a difference of
85% in the fine imposed’’. The FR and IT SAs also compare with the fine of 746 million euros
decided by the LU SA in its decision of 15 July 2021 against the company Amazon Europe
Core for carrying out behavioural advertising without a valid legal basis and for
transparency infringements (Articles 6, 12 and 13 GDPR). While the EDPB agrees with both
the IE SA and Meta IE that imposing fines requires a case-bycase assessment under Article
83 GDPR, the EDPB notes that the cases cited by the DE, FR and IT SAs do show marked
similarities with the current case, as they both refer to large internet platforms run by data
controllers with multi-national operations and significant resources available to them,
including large, in-house, compliance teams. Moreover, there are similarities with regards
to the nature and gravity of the infringements involved. Thus, these cases can give an
indication on the matter.

363. The DE, FR, IT and NO SAs calculate that the envisaged upper limit of the fine range is
about
0.03 % of the global annual turnover of Meta Platforms, Inc., which the DE SAs note is about
0.72% of the maximum ceiling provided for in Article 83(5) GDPR. For illustrative purposes also,
is the amount of time it would take Meta Platforms, Inc. on average to generate 23 million
euros in turnover in 2020, which was about 2 hours and 33 minutes.

348. On the basis of the instruction and guidance set out above, I have decided to impose
administrative fines as follows:

• In respect of the failure to provide sufficient information in relation to the processing
operations carried out on foot of Article 6(1)(b) GDPR, thereby infringing Articles 5(1)(a) and
13(1)(c) GDPR, I propose a fine of between €70 million and €80 million.

• In respect of the failure to provide the information that was provided on the processing
operations carried out in foot of Article 6(1)(b) GDPR, in a concise, transparent, intelligible and
easily accessible form, using clear and plain language, thereby infringing Articles 5(1)(a) and
12(1) GDPR, I propose a fine of between €60 million and €70 million.

349. I am of the (provisional) view that administrative fines within these ranges would satisfy the
requirement, in Article 83(1) GDPR for any administrative fines imposed to be effective,
proportionate and dissuasive in each individual case. In this regard, I have taken account of:

168

a. The purpose of the fines, which is to sanction the infringements of (i) Articles 12(1), 13(1)(c),
5(1)(a) (and taking into account the infringement of the Article 5(1)(a) fairness principle) and
(ii) Article 6(1) (and taking into account the infringement of the Article 5(1)(a) fairness
principle) that were found to have occurred (by the EDPB in the Article 65 Decision);

b. The requirement for any fine to be effective. In this regard, I note that the fines proposed
above reflect the circumstances of the case, including both the specific elements of the
infringement as well as those elements that relate to the controller which committed the
infringement, namely its financial position (as required by paragraph 414 of the EDPB’s
binding decision 1/2021);

c. The requirement for a genuinely deterrent effect, in terms of discouraging both Meta Ireland
and others from committing the same infringement in the future;

d. The requirement for any fine to be proportionate and to not exceed what is necessary to
achieve the stated objective (as recorded at a., above). I consider that the fines proposed is
proportionate to the circumstances of the case, taking into account the gravity of the
infringements and all of the elements that may lead to an increase (aggravating factors) or
decrease (mitigating factors) of the initial assessment as well as the significant turnover of the
undertaking concerned. It also takes account of the views, assessments and instructions of
the EDPB, as set out in the Article 65 Decision (and incorporated into this Decision, above). It
also takes account of the fact that the fines will be imposed in addition to an order requiring
Meta Ireland to take action to bring its processing into compliance.

Meta Ireland’s Final Submissions in response to the re-assessment of the administrative fines
originally proposed by the Draft Decision, in relation to the Transparency Infringements

350. Meta Ireland, by way of its Final Submissions, has challenged the proposed reassessment of
the fines corresponding to the Transparency Infringements. 309

351. Insofar as the relevant submissions express disagreement with matters that have been
determined by the EDPB or, otherwise, upon which the EDPB has expressed a view, in the Article
65 Decision, that decision is binding upon the Commission. Accordingly, it is not open to the
Commission to disregard or otherwise look behind any views expressed or instructions given by
the EDPB in the Article 65 Decision.

352. Furthermore, insofar as the relevant submissions restate matters that have already been
considered by the Commission (such as Meta Ireland’s view that the Transparency Infringements
are “technical in nature”), I do not propose to engage further with such matters.

309
Meta Ireland’s Final Submissions dated 19 December 2022, at paras. 13.1-14.26.
169

353. Meta Ireland further submitted that the proposed increase is incompatible with Article 83(1)
GDPR. It also notes the inconsistency between the increased fining ranges being proposed and
the Commission’s previously expressed view that the lower fining ranges proposed by the Draft
Decision were effective, proportionate and dissuasive. It is important to bear in mind that the
Commission’s previous view that the proposed fining ranges were effective, proportionate and
dissuasive, has been overtaken by the Article 65 Decision. The EDPB, in that decision, expressed
a range of views and it is not open to the Commission to look behind those views, as appears to
be suggested by Meta Ireland.

354. As regards Meta Ireland’s submissions directed to challenging how the increased fining ranges
might be said to be “effective, proportionate and dissuasive”, 310 I note that these submissions
share a range of common arguments, including:
• Submissions that it is not appropriate for the Commission to take account of Meta Ireland’s
“financial position” and questioning the difference between “financial position” and
“turnover” in circumstances where the Commission previously indicated that it had taken
Meta Ireland’s turnover into account when assessing the quantum of the originally proposed
fining ranges;
• Submissions concerning the level of the increase proposed by the Commission. Meta Ireland
has submitted, in this regard, that the Commission “has proposed an increase well in excess
of the purported instruction of the EDPB “to set out a significantly higher fine amount” in
respect of these alleged infringements”. Meta Ireland has further suggested that: “[i]t
appears (although this is not clear) that the [Commission] was influenced in this regard by the
EDPB’s comments regarding fines imposed by other supervisory authorities in respect of
transparency infringements, namely the WhatsApp and Amazon Decisions. Without engaging
in any factual assessment of these decisions, the EDPB asserts that these cases “show marked
similarities with the current case, as they both refer to large internet platforms run by data
controllers with multi-national operations and significant resources available to them,
including large, in-house, compliance teams. Moreover, there are similarities with regard to
the infringements involved”.

355. As already noted above, the Commission is required, by the Article 65 Decision and Binding
Decision 1/2021, to take account of the turnover of the undertaking concerned when quantifying
the amount of the proposed administrative fine. The Commission did so as part of its original
assessment, however the EDPB, by way of the Article 65 Decision, instructed the Commission to
re-assess quantum on the basis that the proposed amounts were insufficient to satisfy the
requirements of Article 83(1) GDPR. The Article 65 Decision provides at paragraph 364, for
example, that:

“The EDPB agrees with the objections raised that - if the proposed fine was to be imposed for the
transparency infringements - there would be no sufficient special preventive effect towards the

310
Meta Ireland’s Final Submissions dated 19 December 2022, at paras. 14.5-14.26.
170

controller, nor a credible general preventive effect. The proposed fine amount, even where a final
amount at the upper limit of the range would be chosen, is not effective, proportionate and
dissuasive, in the sense that this amount can simply be absorbed by the undertaking as an
acceptable cost of doing business. As behavioural advertising is at the core of Meta IE’s business
model, the risk of this occurring is all the greater. By bearing the cost of the administrative fine,
the undertaking can avoid bearing the cost of adjusting their business model to one that is
compliant as well as any future losses that would follow from the adjustment.” [emphasis added]

356. In the circumstances, it was incumbent on the Commission to re-assess the manner in which
account was previously taken of the turnover of the undertaking concerned. The Commission
notes, in this regard, the very significant turnover of the Meta Platforms, Inc. group of companies
and considers that the increased fining ranges take appropriate account of that significant level of
turnover, as required by the Article 65 Decision. For the avoidance of doubt, however, the
Commission has, first and foremost, addressed its mind to the Article 83 framework when
assessing the questions of whether an administrative fine ought to be imposed and, if so, the
amount of any such fine. That ought to be clear from the detailed analysis of the individual
circumstances of this Inquiry set out in this Section 9. Otherwise, the Commission has re-assessed
the quantum of its originally proposed fines by reference to the instructions and directions
provided by the EDPB in the Article 65 Decision. Any suggestions of comparison with the Amazon
or WhatsApp decisions are without foundation.

357. Having taken account of the Final Submissions, I remain of the views set out in paragraphs
348 and 349, above.

Proposed quantum of fining range - the Article 6(1) GDPR infringement

358. In relation to the infringement of Article 6(1) GDPR that was established by the EDPB in the
Article 65 Decision, my conclusions, further to the Article 83(2) assessment recorded above, are
that:

• The infringement of Article 6(1) GDPR (and taking into account the infringement of the Article
5(1)(a) fairness principle) has been assessed as falling at the upper end of the scale, in terms
of seriousness, for the purpose of Article 83(2)(a).

• The seriously negligent character of the Article 6(1) GDPR infringement ought, in the particular
circumstances of this inquiry, to be taken into account as an aggravating factor of significant
weight.

• The degree of responsibility of the controller is to be treated as an aggravating factor, of
moderately significant weight.

171

• The broad range of categories of personal data affected by the infringement ought to be taken
into account as an aggravating factor of moderately significant weight.

• Otherwise, the assessments of the Article 83(2)(c), 83(2)(e), 83(2)(f), 83(2)(h), 83(2)(i), 83(2)(j)
and 83(2)(k) criteria are to be treated as neither mitigating nor aggravating for the purpose of
the Article 6(1) GDPR infringement.

359. On the basis of the above, I proposed to impose an (additional) administrative fine of an
amount falling within the range of €50 to 60 million, in respect of the infringement of Article 6(1)
GDPR (and taking into account the infringement of the Article 5(1)(a) fairness principle).

360. I expressed the (provisional) view that an administrative fine within this range would satisfy
the requirement in Article 83(1) GDPR for any administrative fine imposed to be effective,
proportionate and dissuasive in each individual case. In this regard, I have taken account of:

a. The purpose of the fine, which is to sanction the infringement of Article 6(1) (and taking into
account the infringement of the Article 5(1)(a) fairness principle) that was found to have
occurred (by the EDPB in the Article 65 Decision);

b. The requirement for any fine to be effective. In this regard, the Commission notes that the
fine proposed above reflects the circumstances of the case, including both the specific
elements of the infringement as well as those elements that relate to the controller which
committed the infringement, namely its financial position (as required by paragraph 414 of
the EDPB’s binding decision 1/2021);

c. The requirement for a genuinely deterrent effect, in terms of discouraging both Meta Ireland
and others from committing the same infringement in the future; and

d. The requirement for any fine to be proportionate and to not exceed what is necessary to
achieve the stated objective (as recorded at a., above). The Commission considers that the
fine proposed is proportionate to the circumstances of the case, taking into account the
gravity of the infringements and all of the elements that may lead to an increase (aggravating
factors) or decrease (mitigating factors) of the initial assessment as well as the significant
turnover of the undertaking concerned. The fine also takes account of the fact that the
(additional) fine will be imposed in addition to an order requiring Meta Ireland to take action
to bring its processing into compliance.

e. I have also taken particular account, in this regard, of the facts that:

i. The EDPB’s finding of infringement of Article 6(1) GDPR was partially based on the
lack of transparency (see, for example, paragraphs 126, 129 and 130 of the Article 65

172

Decision), as regards the information that was presented to the data subject
concerning the processing that would be carried out further to the Terms of Use.

ii. The EDPB’s finding of infringement of Article 5(1)(a) fairness principle was similarly
largely based on the lack of transparency (see, for example, paragraphs 224, 225, 228
and 235 of the Article 65 Decision), as regards the information that was presented to
the data subject concerning the processing that would be carried out further to the
Terms of Use.

iii. As already noted, the Draft Decision contains separate proposed findings of
infringement of the transparency obligations set out in Articles 5(1)(a), 12(1) and
13(1)(c) together with corresponding proposals to exercise corrective powers in the
form of an administrative fine and an order to bring processing into compliance. I
have taken this previous sanction into account when proposing the fining range set
out above so as to avoid the risk of punishing Meta Ireland twice in respect of the
same conduct. This factor necessitated a moderately significant reduction in the fine
that might otherwise have been imposed, notwithstanding the significant turnover
of the undertaking concerned and the outcome of the Article 83(2)(a) assessment, as
recorded above.

361. Meta Ireland, by way of its Final Submissions, disagreed with the above assessments of the
Article 6(1) GDPR infringement. For ease of response, I have summarised the relevant submissions
thematically, as follows:

Discretion of the Commission

362. Under this heading, Meta Ireland submitted, firstly, that “by proposing exponential increases
to the administrative fines in respect of the infringements related to Articles 5, 12, and 13 GDPR,
(which themselves are unsupported, as explained further at sections 12, 13, and 14 below), the
DPC has taken account of the Article 65 Decision and no additional administrative fine is required
or warranted in respect of the infringement of Article 6(1) GDPR”. 311 Meta Ireland noted, in this
regard, that the Article 65 Decision requires the Commission to impose an administrative fine to
“cover” the EDPB’s finding of infringement of Article 6(1) GDPR.

363. It submitted, secondly, that the imposition of a fine for the Article 6(1) infringement while also
substantially increasing the fines for the Transparency Infringements is disproportionate and

311
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 8.1.
173

unnecessary in circumstances where the infringements are based on the same underlying
processing and alleged harm to data subjects. 312

364. Thirdly, it submitted that, just as the Commission has decided not to impose an additional fine
in respect of Article 5(1)(a) (fairness principle) GDPR due to the overlapping nature of the
infringements, it should similarly decide not to impose an additional fine in relation to the Article
6(1) infringement because this would risk punishing Meta Ireland twice for the same
wrongdoing.350 Furthermore, it submitted that it was “particularly inappropriate for the
[Commission] to impose three separate and substantial fines in respect of these infringements,
having regard to the principle of concurrence of laws. It cannot plausibly be maintained that these
infringements are sufficiently distinct to warrant three separate fines in circumstances where the
[Commission] itself considers the conduct constituting the alleged Article 6(1) infringement to be
so similar to the other infringements that it can incorporate significant elements of the fines
assessment by reference”.351

365. The above submissions are premised upon the misunderstanding that the Commission has
discretion, as regards, the imposition of a fine for the Article 6(1) infringement. The Commission,
being subject to a binding decision of the EDPB, has no such discretion. . This is clear from the
Article 65 Decision itself, in particular paragraphs 410 and 411 which state that:

“the EDPB agrees with the reasoning put forward by the [supervisory authorities of Austria,
Germany, France, Norway and Sweden] in their objections. The EDPB reiterates that lawfulness
of processing is one of the fundamental pillars of the data protection law and considers that
processing of personal data without an appropriate legal basis is a clear and serious violation of
the data subjects’ fundamental right to data protection.

Several of the factors listed in Article 83(2) GDPR speak strongly in favour of the imposition of an
administrative fine for the infringement of Article 6(1) GDPR.”

366. In the circumstances, it is clear that the Commission is required to impose an administrative
fine in respect of the finding of infringement of Article 6(1) GDPR that was established by the EDPB
and, when doing so, to take account of the instructions, deliberations and determinations of the
EDPB, as recorded in Section 9.2.4.2.1 of the Article 65 Decision.

367. It is important to note that this instruction (to impose an administrative fine for the Article
6(1) infringement) sits separately to, and alongside, the EDPB’s further instruction that the

312
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 8.1.
350
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 8.2.
351
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 8.4.
174

Commission “set out a significantly higher fine amount” in respect of the Transparency
Infringements that were already proposed by way of the Draft Decision.

368. Finally, as regards the Commission’s decision not to impose a separate administrative fine in
respect of the infringement of the Article 5(1)(a) principle of fairness that was established by the
EDPB, the Article 65 Decision specifically afforded the Commission discretion in relation to the
manner in which this particular infringement might be addressed by way of a corrective power.
This is clear from paragraph 446 of the Article 65 Decision. The inclusion of this express discretion
is in marked contrast with the absence of any similar discretion in relation to the
imposition/increase of administrative fines for the Article 6(1) and Transparency Infringements.

Inadequate Rationalisation

369. Under this heading, Meta Ireland submitted that “the reasoning in the Draft Decision in
respect of the calculation of the fines is inadequate, such that it is impossible to understand how
the proposed fining ranges have been calculated or how the different factors discussed by the DPC
have had an impact on the proposed fine and, as a result, to make meaningful submissions in
respect of same.” 313

370. I do not agree that this is the case. As is evident from the analysis set out above, the
Commission has clearly identified the factors that were considered relevant for the purpose of
each of the individual Article 83(2) assessments. Furthermore, the manner in which the relevant
factors have been taken into account, e.g. as a mitigating or aggravating factor, as well as the
weight that has been attributed to each one has been clearly addressed.

371. This approach is in line with the Commission’s obligation to provide reasons for its decisions.
While the Commission is required to explain how it arrived at the level of a proposed fine, it is not
required to apply such specificity so as to allow a controller or processor to make a precise
mathematical calculation of the expected fine 314.

Incompatibility with Article 83(1) GDPR – Article 6(1)

372. Meta Ireland, by way of its Final Submissions, has submitted that the “proposed fine for the
Article 6(1) infringement – both individually and taken cumulatively with the other significant
administrative fines being proposed in respect of the Transparency Infringements – is inconsistent
with the requirements of Article 83(1) GDPR”. 315

313
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 9.2.
314
See, by analogy, HSBC Holdings plc and Others v Commission, T-105/17, ECLI:EU:T:2019:675, paragraphs 336 –
354.
315
Meta Ireland’s Final Submissions dated 19 December 2022, at paras. 10.1-10.28.
175

373. Meta Ireland further submitted that the proposed fine is “is manifestly excessive and far
higher than the minimum amount necessary to be ‘effective’ and ‘dissuasive’, and is therefore not
‘proportionate’”. 316

374. Meta Ireland, thirdly submitted that the reasoning in the Draft Decision as to why the
administrative fines comply with the requirements of Article 83(1) GDPR is “wholly inadequate”.
Meta Ireland has added, in this regard, that this has undermined its ability to make meaningful
submissions in response to same. 317

375. I note that, in having detailed my views as to the reasons why I consider the proposed fines
to be effective, proportionate and dissuasive, I have followed the directions of the EDPB that were
set out on this particular matter in its Binding Decision 1/2021357. Accordingly, I consider that the
Commission has adequately addressed this aspect of matters.

376. Otherwise, I note that I have already addressed many of the matters raised by Meta Ireland
as part of this aspect of its Final Submissions elsewhere in this Decision. In relation to Meta
Ireland’s submissions concerning the “very onerous compliance order requiring significant
expenditure of resources”, it is important to recall that the objective sought to be achieved by the
compliance order (the remediation of any identified infringements) differs from the objective
sought to be achieved by the imposition of an administrative fine (the sanctioning of any identified
infringements). Furthermore, the “significant expenditure of resources” are the resources of
Meta Ireland itself, which is, as already noted, an entity with significant resources available to it.
In the circumstances, I do not agree that such matters should, in the circumstances of this
particular inquiry, operate to offset the quantum of any proposed fine.

377. Having completed my assessment of whether or not to impose a fine (and of the amount of
any such fine), I must now consider the remaining provisions of Article 83 GDPR, with a view to
ascertaining if there are any factors that might require the adjustment of the proposed fines.

378. Having taken account of the Final Submissions, I remain of the views set out in paragraph 359,
above.

11 OTHER RELEVANT FACTORS

ARTICLE 83(3) GDPR

316
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 10.3.
317
Meta Ireland’s Final Submissions dated 19 December 2022, at para. 10.8.
357
See Binding Decision 1/2021, paragraphs 413 to 416
176

379. In accordance with Article 83(3) GDPR:

“If a controller or processor intentionally or negligently, for the same or linked processing
operations, infringes several provisions of this Regulation, the total amount of the
administrative fine shall not exceed the amount specified for the gravest infringement.”

380. As outlined previously, Meta Ireland’s infringements of Articles 5(1)(a), 13(1)(c), and 12(1) GDPR
all relate to the same processing operations concerning its processing carried out in accordance
with Article 6(1)(b) GDPR.

381. In respect of the interpretation of Article 83(3) GDPR, I am mindful of the Commission’s
obligations of cooperation and consistency in, inter alia, Articles 60(1) and 63 GDPR and,
accordingly, it is necessary to follow the EDPB’s interpretation of Article 83(3) GDPR which arose
following the EDPB Decision relating to IN 18-12-2, an inquiry conducted by the Commission into
WhatsApp Ireland Limited’s compliance with Articles 12, 13 and 14 GDPR. 318

382. The relevant passage of the EDPB Decision is as follows:

“315. All CSAs argued in their respective objections that not taking into account
infringements other than the “gravest infringement” is not in line with their interpretation
of Article 83(3) GDPR, as this would result in a situation where WhatsApp IE is fined in the
same way for one infringement as it would be for several infringements. On the other
hand, as explained above, the IE SA argued that the assessment of whether to impose a
fine, and of the amount thereof, must be carried out in respect of each individual
infringement found and the assessment of the gravity of the infringement should be done
by taking into account the individual circumstances of the case. The IE SA decided to
impose only a fine for the infringement of Article 14 GDPR, considering it to be the gravest
of the three infringements.

316. The EDPB notes that the IE SA identified several infringements in the Draft
Decision for which it specified fines, namely infringements of Article 12, 13 and 14 GDPR,
and then applied Article 83(3) GDPR.

317. Furthermore, the EDPB notes that WhatsApp IE agreed with the approach of
the IE SA concerning the interpretation of Article 83(3) GDPR. In its submissions on the
objections, WhatsApp IE also raised that the approach of the IE SA did not lead to a
restriction of the IE SA’s ability to find other infringements of other provisions of the GDPR
or of its ability to impose a very significant fine. WhatsApp IE argued that the alternative
interpretation of Article 83(3) GDPR suggested by the CSAs is not consistent with the text

318
https://edpb.europa.eu/system/files/2021-
09/edpb_bindingdecision_202101_ie_sa_whatsapp_redacted_en.pdf.
177

and structure of Article 83 GDPR and expressed support for the IE SA’s literal and purposive
interpretation of the provision.

318. In this case, the issue that the EDPB is called upon to decide is how the
calculation of the fine is influenced by the finding of several infringements under Article
83(3) GDPR.

319. Article 83(3) GDPR reads that if “a controller or processor intentionally or
negligently, for the same or linked processing operations, infringes several provisions of
this Regulation, the total amount of the administrative fine shall not exceed the amount
specified for the gravest infringement.”

320. First of all, it has to be noted that Article 83(3) GDPR is limited in its application
and will not apply to every single case in which multiple infringements are found to have
occurred, but only to those cases where multiple infringements have arisen from “the same
or linked processing operations”.

321. The EDPB highlights that the overarching purpose of Article 83 GDPR is to
ensure that for each individual case, the imposition of an administrative fine in respect of
an infringement of the GDPR is to be effective, proportionate and dissuasive. In the view
of the EDPB, the ability of SAs to impose such deterrent fines highly contributes to
enforcement and therefore to compliance with the GDPR.

322. As regards the interpretation of Article 83(3) GDPR, the EDPB points out that
the effet utile principle requires all institutions to give full force and effect to EU law. The
EDPB considers that the approach pursued by the IE SA would not give full force and effect
to the enforcement and therefore to compliance with the GDPR, and would not be in line
with the aforementioned purpose of Article 83 GDPR.

323. Indeed, the approach pursued by the IE SA would lead to a situation where, in
cases of several infringements of the GDPR concerning the same or linked processing
operations, the fine would always correspond to the same amount that would be
identified, had the controller or processor only committed one – the gravest –
infringement. The other infringements would be discarded with regard to calculating the
fine. In other words, it would not matter if a controller committed one or numerous
infringements of the GDPR, as only one single infringement, the gravest infringement,
would be taken into account when assessing the fine.

324. With regard to the meaning of Article 83(3) GDPR the EDPB, bearing in mind
the views expressed by the CSAs, notes that in the event of several infringements, several
amounts can be determined. However, the total amount cannot exceed a maximum limit
prescribed, in the abstract, by the GDPR. More specifically, the wording “amount specified
178

for the gravest infringement” refers to the legal maximums of fines under Articles 83(4),
(5) and (6) GDPR. The EDPB notes that the Guidelines on the application and setting of
administrative fines for the purposes of the Regulation 2016/679 state that the
"occurrence of several different infringements committed together in any particular single
case means that the supervisory authority is able to apply the administrative fines at a
level which is effective, proportionate and dissuasive within the limit of the gravest
infringement". The guidelines include an example of an infringement of Article 8 and
Article 12 GDPR and refer to the possibility for the SA to apply the corrective measure
within the limit set out for the gravest infringement, i.e. in the example the limits of Article
83(5) GDPR.

325. The wording “total amount” also alludes to the interpretation described
above. The EDPB notes that the legislator did not include in Article 83(3) GDPR that the
amount of the fine for several linked infringements should be (exactly) the fine specified
for the gravest infringement. The wording “total amount” in this regard already implies
that other infringements have to be taken into account when assessing the amount of the
fine. This is notwithstanding the duty on the SA imposing the fine to take into account the
proportionality of the fine.

326. Although the fine itself may not exceed the legal maximum of the highest
fining tier, the offender shall still be explicitly found guilty of having infringed several
provisions and these infringements have to be taken into account when assessing the
amount of the final fine that is to be imposed. Therefore, while the legal maximum of the
fine is set by the gravest infringement with regard to Articles 83(4) and (5) GDPR, other
infringements cannot be discarded but have to be taken into account when calculating the
fine.

327. In light of the above, the EDPB instructs the IE SA to amend its Draft Decision
on the basis of the objections raised by the DE SA, FR SA and PT SA with respect to Article
83(3) GDPR and to also take into account the other infringements – in addition to the
gravest infringement – when calculating the fine, subject to the criteria of Article 83(1)
GDPR of effectiveness, proportionality and dissuasiveness.”

383. The impact of this interpretation would be that administrative fine(s) would be imposed
cumulatively, as opposed to imposing only the proposed fine for the gravest infringement. The
only applicable limit for the total fine imposed, under this interpretation, would be the overall
“cap”. By way of example, in a case of multiple infringements, if the gravest infringement was
one which carried a maximum administrative fine of 2% of the turnover of the undertaking, the
cumulative fine imposed could also not exceed 2% of the turnover of the undertaking.

384. Meta Ireland has argued that the above interpretation and application of Article 83(3) GDPR is
incorrect and/or should not be applied because: the EDPB decision is incorrect as a matter of law
179

and is, in any event, not binding on the Commission; even if the decision were binding on the
Commission, it does not require that the Commission impose administrative fines in the manner
proposed; the Commission has not had regard to the criteria of effectiveness, proportionality and
dissuasiveness in Article 83(1) GDPR when determining the total cumulative proposed fine; and
no decision on the correct interpretation of Article 83(3) GDPR should be made prior to the
determination of a pending application by WhatsApp Ireland, pursuant to Article 263 TFEU,
before the General Court of the Court of Justice of the European Union, to annul the EDPB
Decision (“the Annulment Proceedings”). 319

385. In this regard, Meta Ireland submitted that the EDPB Decision is not binding on the Commission.
A number of legal arguments are made in this regard, including that binding decisions of the EDPB
only apply to specific individual cases (as set out in article 65(1) GDPR) 320 and that only the CJEU
can issue binding decisions on matters of EU law. 321 For the avoidance of doubt, the Commission
has not expressed the view, nor does it hold the view, that the EDPB Decision is legally binding
on it in this Inquiry and/or generally. The Commission is nonetheless, in this regard, bound by a
number of provisions of the GDPR and the real question that arises in this context is the extent
to which the Commission should have regard to the EDPB’s approach.

386. The Commission is bound by Article 60(1) GDPR, which states in the imperative that “the lead
supervisory authority shall cooperate with the other supervisory authorities concerned in
accordance with this Article in an endeavour to reach consensus” [emphasis added]. The
Commission is similarly required to cooperate with other supervisory authorities, pursuant to
Article 63 GDPR. Meta Ireland has argued that these obligations relate only to specific cases
where a dispute has arisen. 322 Moreover, it submits that the EDPB’s function in ensuring correct
application of the GDPR is provided for instead in Article 70(1) GDPR, such as through issuing
opinions and guidelines. 323

387. It is not the position of the Commission that the EDPB in and of itself has the power to issue
decisions of general application that bind supervisory authorities. The issue is not the powers or
functions of the EDPB, but rather the legal responsibility of the Commission to the concerned
supervisory authorities, who in themselves happen to be constituent members of the EDPB. In
this regard, assistance is provided in the interpretation of the Commission’s duties under Article
60(1) GDPR by Recital 123, which states that “…supervisory authorities should monitor the
application of the provisions pursuant to this Regulation and contribute to its consistent
application throughout the Union…”. The Commission’s view is that the duty to cooperate and

319
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at section 15.
320
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 15.3.
321
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 15.6.
322
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 15.4
323
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 15.5.
180

ensure consistency that is placed on it by the GDPR would be rendered ineffective were it not to
ensure, to the best of its ability, such interpretations were applied consistently.

388. The alternative scenario, as proposed by Meta Ireland, would result in entrenched
interpretations being consistently advanced by individual supervisory authorities. The
consequence would be inevitable dispute resolution procedures under Article 65 GDPR, and the
issuing of a binding decision once again applying an alternative interpretation to the specific facts
at hand that had already been comprehensively addressed in a previous dispute resolution
procedure. Such a scenario would deprive the duties to cooperate and act consistently of almost
any meaning. In the Commission’s view, such an interpretation would therefore be contrary to
the principle of effet utile. This is, as has been set out, a distinct issue from the legal powers or
functions of the EDPB itself.

389. Meta Ireland asserted that the EDPB Decision “did not direct the [Commission] to impose
separate fines in respect of each infringement and to then add those fines together”, but rather
that the final amount should be considered in accordance with the requirements that the fine be
effective, proportionate and dissuasive pursuant to Article 83(1) GDPR. 324 I further note Meta
Ireland’s submission that overlap between the infringements should be taken into account, in
this regard. 325 It goes on to argue that as there is “…significant – if not complete – overlap
between the infringements”, 326 the fine is contrary to the EU law principles of proportionality, ne
bis in idem and concurrence of laws. 327

390. Meta Ireland further alleged that the “Commission does [sic] engage in any meaningful
assessment of whether the total fine proposed in the Inquiry is “effective, proportionate and
dissuasive” as required by Article 83(1) GDPR”. 328 In essence, it is Meta Ireland’s view that the
proposed fines, either individually or cumulatively, are disproportionate to the circumstances of
the case where Meta Ireland had a differing interpretation of its transparency obligations in good
faith, and Meta Ireland is committed to “engaging with the Commission and dedicating
significant resources to updating its Data Policy to take account of the Commission’s views and
concerns”. 329 I have outlined my views on this matter in the concluding paragraphs of Section
10.

391. Additionally, Meta Ireland has argued that my approach to imposing cumulative fines in this
Inquiry is a “flawed application” of Decision 1/2021 on the basis that “Decision 1/2021 did not
direct the Commission to impose separate fines in respect of each infringement and to then add

324
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 15.11.
325
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 15.12.
326
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 15.13.
327
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 15.12 – 15.14.
328
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 16.4.
329
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 16.5.
181

those fines together”. 330 In particular, Meta Ireland alleged that the “fine being proposed
essentially imposed two fines in [sic]Meta Ireland for what is essentially the same set of facts and
the same alleged infringement” 331 which “is inconsistent with principles regarding the
concurrence of laws”. In response to this, it is my view that the failure to provide required
information, and the failure to set out required information in a transparent manner, are entirely
different wrongs. The legislator has provided for two distinct requirements, and each individual
requirement has been infringed by Meta Ireland. For these reasons, I do not accept this
submission. Similarly, the Commission is not applying a new and retroactive view of wrongdoing
to the conduct in a manner envisaged by principle of concurrence of laws. It is simply determining
the proper interpretation of Article 83(3) GDPR. This has no impact on the Commission’s detailed
consideration of Meta Ireland’s submissions on the separate and more general question of the
appropriate penalty.

392. Meta Ireland also argued that the taking into account of the undertaking’s turnover is incorrect
as a matter of law, as it is not set out as a factor in Article 83(2) GDPR. 332 In this regard, the
Commission relies on its existing analysis of its obligations to cooperate with the concerned
supervisory authorities and apply the GDPR consistently. For the same reasons provided to
support
the Commission’s decision to apply the EDPB Decision’s interpretation of Article 83(3) GDPR in
general, the Commission intends to maintain this consideration of the undertaking’s turnover. In
relation to Meta Ireland’s submissions as to the appropriate turnover to be considered, 333 this is
addressed below.

393. In this Inquiry, the gravest infringement is that of the failure to provide information on data
processing carried out pursuant to Article 6(1)(b) GDPR, in contravention of Articles 5(1)(a) and
13(1)(c) GDPR. The associated maximum possible fine for this infringement under Article 83(5)
GDPR is 4% of the turnover of Meta Platforms, Inc. (as noted above, Instagram is wholly owned
by Meta Platforms, Inc.). It is further to be noted that the EDPB’s Decision, from which I quoted
above, also directed the Commission to take account of the undertaking’s turnover in the
calculation of the fine amounts and I therefore factor that turnover figure below into my
calculations of the individual infringement fining ranges.

394. For the sake of completeness, I note that Meta Ireland reiterated its concerns as part of its Final
Submissions. 374 I have already addressed the subject-matter of those concerns above.

330
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 15.11.
331
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 15.12.
332
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.29.
333
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 14.30.
374
Meta Ireland’s Final Submissions dated 19 December 2022, at paras. 11.1-11.2.
182

ARTICLE 83(5) GDPR

395. Turning, finally, to Article 83(5) GDPR, I note that this provision operates to limit the maximum
amount of any fine that may be imposed in respect of certain types of infringement, as follows:

“Infringements of the following provisions shall, in accordance with paragraph 2, be
subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up
to 4% of the total worldwide annual turnover of the preceding financial year, whichever is
higher:
…
(b) the data subjects’ rights pursuant to Articles 12 to 22; …”

396. In order to determine the applicable fining “cap”, it is first necessary to consider whether or not
the fine is to be imposed on “an undertaking”. Recital 150 clarifies, in this regard, that:

“Where administrative fines are imposed on an undertaking, an undertaking should be
understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those
purposes.”

397. Accordingly, when considering a respondent’s status as an undertaking, the GDPR requires me
to do so by reference to the concept of “undertaking”, as that term is understood in a
competition law context. In this regard, the CJEU has established that:

“an undertaking encompasses every entity engaged in an economic activity regardless of
the legal status of the entity and the way in which it is financed”. 334

398. The CJEU has held that a number of different enterprises could together comprise a single
economic unit where one of those enterprises is able to exercise decisive influence over the
behaviour of the others on the market. Such decisive influence may arise, for example, in the
context of a parent company and its wholly owned subsidiary. Where an entity (such as a
subsidiary) does not independently decide upon its own conduct on the market, but carries out,
in all material respects, the instructions given to it by another entity (such as a parent), this means
that both entities constitute a single economic unit and a single undertaking for the purpose of
Articles 101 and 102 TFEU. The ability, on the part of the parent company, to exercise decisive
influence over the subsidiary’s behaviour on the market, means that the conduct of the

334
Case C-41/90 Höfner and Elser v Macrotron GmbH (23 April 1991), EU:C:1991:161, at para. 21.
183

subsidiary may be imputed to the parent company, without having to establish the personal
involvement of the parent company in the infringement. 335

399. In the context of Article 83 GDPR, the concept of “undertaking” means that, where there is
another entity that is in a position to exercise decisive influence over the controller/processor’s
behaviour on the market, then they will together constitute a single economic entity and a single
undertaking. Accordingly, the relevant fining “cap” will be calculated by reference to the
turnover of the undertaking as a whole, rather than the turnover of the controller or processor
concerned.

400. In order to ascertain whether a subsidiary determines its conduct on the market independently,
account must be taken of all the relevant factors relating to the economic, organisational and
legal links which tie the subsidiary to the parent company, which may vary from case to case. 336

401. The CJEU has, however, established that, where a parent company has a 100% shareholding in a
subsidiary, it follows that: the parent company is able to exercise decisive influence over the
conduct of the subsidiary; and a rebuttable presumption arises that the parent company does in
fact exercise a decisive influence over the conduct of its subsidiary.378

402. The CJEU has also established that, in a case where a company holds all or almost all of the capital
of an intermediate company which, in turn, holds all or almost all of the capital of a subsidiary of
its group, there is also a rebuttable presumption that that company exercises a decisive influence
over the conduct of the intermediate company and indirectly, via that company, also over the
conduct of that subsidiary. 337

403. The General Court has further held that, in effect, the presumption may be applied in any case
where the parent company is in a similar situation to that of a sole owner as regards its power to
exercise a decisive influence over the conduct of its subsidiary. 338 This reflects the position that:

“… the presumption of actual exercise of decisive influence is based, in essence, on the
premise that the fact that a parent company holds all or virtually all the share capital of
its subsidiary enables the Commission to conclude, without supporting evidence, that that
parent company has the power to exercise a decisive influence over the subsidiary without

335
Case C-97/08 P Akzo Nobel and Others v Commission, (10 September 2009) EU:C:2009:536, at paras. 58 – 60.
336
C-490/15 P Ori Martin and SLM v Commission (C-490/15 P 14 September 2016) ECLI:EU:C:2016:678, at para. 60.
378
Case C-97/08 P Akzo Nobel and Others v Commission, (10 September 2009) EU:C:2009:536.
337
Case C-508/11 P Eni v Commission (8 May 2013) EU:C:2013:289, at para. 48.
338
T-206/06 Total and Elf Aquitaine v Commission, (7 June 2011) EU:T:2011:250, at para. 56; T-562/08 Repsol
Lubricantes y Especialidades and Others v Commission (12 December 2014) EU:T:2014:1078, at para. 42; T-413/10
and T-414/10 Socitrel and Companhia Previdente v Commission (15 July 2015) EU:T:2015:500, at para. 204.
184

there being any need to take into account the interests of other shareholders when
adopting strategic decisions or in the day-to-day business of that subsidiary, which does
not determine its own market conduct independently, but in accordance with the wishes
of that parent company … 339”

404. Where the presumption of decisive influence has been raised, it may be rebutted by the
production of sufficient evidence that shows, by reference to the economic, organisational and
legal links between the two entities, that the subsidiary acts independently on the market.

405. It is important to note that “decisive influence”, in this context, refers to the ability of a parent
company to influence, directly or indirectly, the way in which its subsidiary organises its affairs,
in a corporate sense, for example, in relation to its day-to-day business or the adoption of
strategic decisions. While this could include, for example, the ability to direct a subsidiary to
comply with all applicable laws, including the GDPR, in a general sense, it does not require the
parent to have the ability to determine the purposes and means of the processing of personal
data by its subsidiary.

406. As noted above, within the European Region, the Instagram service is provided by a subsidiary of
Meta Platforms, Inc. known as Meta Platforms Ireland Limited (formerly Facebook Ireland
Limited) (referred to as “Meta Ireland” or “Facebook” in this Decision). Meta Ireland’s ultimate
parent is
Meta Platforms, Inc. (formerly Facebook, Inc.). 340 I have had regard to Meta Ireland’s Director’s
Report and Financial Statements for the Financial Year ended 31 December 2020, which are
available from the Companies Registration Office and are dated September 2021. The Director’s
Report and Financial Statements describe the relationship between Meta Ireland and Meta
Platforms, Inc. as follows:

“Facebook Ireland Limited is wholly owned by Facebook International Operations Limited,
a company incorporated in the Republic of Ireland. Its ultimate holding company and
controlling party is Facebook, Inc., a company incorporated in the United States of
America”. 341

407. The Director’s Report and Financial Statement also state the following:

339
Case C-97/08 P Akzo Nobel and Others v Commission EU:C:2009:262 (Opinion of Advocate General Kokott), at
para. 73 cited in Case T-419/14 The Goldman Sachs Group, Inc. v European Commission (12 July 2018)
ECLI:EU:T:2018:445, at para. 51.
340
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at footnote 144.
341
Director’s Report and Financial Statements for Facebook Ireland Limited for the financial year ended 31 December
2020, at p. 3.
185

“At 31 December 2020, the company is a wholly-owned subsidiary of Facebook
International Operations Limited, a company incorporated in the Republic of Ireland, its
registered office being 4 Grand Canal Square, Grand Canal Harbour, Dublin 2.

The ultimate holding company and ultimate controlling party is Facebook, Inc., a company
incorporated in Wilmington, Delaware, United States of America. The ultimate holding
company and controlling party of the smallest and largest group of which the company is
a member, and for which consolidated financial statements are drawn up, is Facebook,
Inc.”. 342

I note, in this connection, that the same position was stated in Meta Ireland’s Directors’ Reports
and Financial Statements for the years ended 31 December 2019 (dated December 2020) and 31
December 2018 (dated November 2019).

408. On this basis, it is my understanding that Meta Ireland is a wholly-owned subsidiary of Facebook
International Operations Limited; Facebook International Operations Limited is wholly owned
and controlled by Meta Platforms, Inc.; and, as regards any intermediary companies in the
corporate chain, between Meta Ireland and Meta Platforms, Inc., it is assumed, by reference to
the statement at Note 24 of the Notes to the Financial Statements (quoted above) that the
“ultimate holding company and controlling party of the smallest and largest group of which [Meta
Ireland] is a member … is Facebook, Inc.”. It is therefore assumed that Meta Ireland, Inc. is in a
similar situation to that of a sole owner as regards its power to (directly or indirectly) exercise a
decisive influence over the conduct of Meta Ireland.

409. It seemed therefore at the time of preparing the Decision, that the corporate structure of the
entities concerned is such that Meta Platforms, Inc. is in a position to exercise decisive influence
over Meta Ireland’s behaviour on the market. Accordingly, I considered that a rebuttable
presumption arose to the effect that Meta Platforms, Inc. does in fact exercise a decisive
influence over the conduct of Meta Ireland on the market.

410. If this presumption is not rebutted, it would mean that Meta Platforms, Inc. and Meta Ireland
constitute a single economic unit and therefore form a single undertaking within the meaning of
Article 101 TFEU. Consequently, the relevant fining “cap” for the purpose of Articles 83(4) and
(5) GDPR, would fall to be determined by reference to the consolidated turnover of the group of
companies headed by Meta Platforms, Inc. Meta Ireland has made submissions in an attempt
to rebut the presumption of decisive influence.

Director’s Report and Financial Statements for Facebook Ireland Limited for the financial year ended 31
342

December 2020, at p. 42 (Note 24).
186

411. In this regard, Meta Ireland submitted that the presumption of decisive influence on the market
does not translate into a data protection context without considering what “behaviour on the
market” means in a data protection context. 343 It argued that this analysis should focus instead
on the entity that has the decision-making capacity in the context of data protection matters,
rather than matters relating to the market in general as is the case in competition law.386 I do
not agree with this assessment for three reasons.

412. First, the suggested approach (involving an assessment of where the decision-making power lies,
in relation to the processing of personal data) is effectively a replication of the assessment that
must be undertaken at the outset of the inquiry process, the outcome of which determines (i)
the party/parties to which the inquiry should be addressed; and (ii) (in cross border processing
cases) the supervisory authority with jurisdiction to conduct the inquiry. Given the consequences
that flow from this type of assessment, it would not be appropriate for this assessment to be
conducted at the decision-making stage of an inquiry.

413. Second, the suggested approach could not be applied equally in each and every case. Where, for
example, the presumption of decisive influence has been raised in the context of a cross-border
processing case where one of the entities under assessment is outside of the EU, an assessment
of that entity’s ability to exercise decisive influence over the respondent’s data processing
activities would likely exceed the scope of Article 3 GDPR. Such a scenario risks undermining the
Commission’s ability to comply with its obligation, pursuant to Article 83(1) GDPR, to ensure that
the imposition of fines, in each individual case, is “effective, proportionate and dissuasive”.

414. Third, “behaviour on the market” has a meaning normally ascribed to it in EU competition law.
In summary, “behaviour on the market” describes how an entity behaves and conducts its affairs
in the context of the economic activity in which it engages. Such behaviour will include matters
such
as the policies and procedures it implements, the marketing strategy it pursues, the terms and
conditions attaching to any products or services it delivers, its pricing structures, etc. I therefore
can see no basis in law, in Meta Ireland’s submissions or otherwise, to deviate from this
wellestablished principle as set out both in the GDPR, other provisions of EU law and the
jurisprudence of the CJEU.

415. Applying the above to Article 83(5) GDPR, I first note that, in circumstances where the fine is
being imposed on an “undertaking”, a fine of up to 4% of the total worldwide annual turnover of
the preceding financial year may be imposed. I note, in this regard, that Meta Platforms, Inc.
reported the generation of revenue in the amount of $117.929billion in respect of the year ended

343
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 17.4.
386
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 17.4.
187

31 December 2021.344 That being the case, I am satisfied that the fine proposed above does not
exceed the applicable fining “cap” prescribed by Article 83(5) GDPR.

SUMMARY OF ENVISAGED ACTION

416. I therefore decide to exercise the following corrective powers:

417. An order is hereby made, pursuant to Article 58(2)(d) GDPR, requiring Meta Ireland to bring
processing into compliance (“the Order”) within a period of three months commencing on the
day following the date of service, on Meta Ireland, of this Decision. More specifically, the Order:

a. firstly, requires Meta Ireland to bring the Data Policy and Terms of Service into compliance
with Articles 5(1)(a), 12(1) and 13(1)(c) GDPR as regards information provided on: (i) data
processed pursuant to Article 6(1)(b) GDPR as well as (ii) data processed for the purposes
of behavioural advertising in the context of the Meta Ireland service, in accordance with
the principles set out in this Decision; and

b. secondly, requires Meta Ireland to take the necessary action to bring its processing of
personal data for the purposes of behavioural advertising (“the Processing”), in the
context of the Instagram Terms of Use, into compliance with Article 6(1) GDPR in
accordance with the conclusion reached by the EDPB, as recorded at paragraphs 132 and
133 of the Article 65 Decision. More specifically, in this regard, Meta Ireland is required
to take the necessary action to address the EDPB’s finding that Facebook is not entitled
to carry out the Processing on the basis of Article 6(1)(b) GDPR, taking into account the
analysis and views expressed by the EDPB in Section 4.4.2 of the Article 65 Decision. Such
action may include, but is not limited to, the identification of an appropriate alternative
legal basis, in Article 6(1) GDPR, for the Processing together with the implementation of
any necessary measures, as might be required to satisfy the conditionality associated with
that/those alternative legal basis/bases.

418. An administrative fine is hereby imposed, pursuant to Articles 58(2)(i) and 83 GDPR, addressed
to Meta Ireland, in the amount of €180 million. For the avoidance of doubt, that fine reflects the
infringements that were found to have occurred, as follows:

a. In respect of the failure to provide sufficient information in relation to the processing
operations carried out in purported reliance on Article 6(1)(b) GDPR, thereby infringing
Articles 5(1)(a) and 13(1)(c) GDPR, a fine in the amount of €70 million is hereby imposed.

Letter dated 28 July 2022 from Meta Ireland to the DPC (in Inquiry IN-20-7-4), referencing financial information
344

which is available at: https://investor.fb.com/investor-news/press-release-details/2022/Meta-Reports-
FourthQuarter-and-Full-Year-2021-Results/default.aspx
188

b. In respect of the failure to provide the information that was provided on the processing
operations carried out in purported reliance on Article 6(1)(b) GDPR, in a concise,
transparent, intelligible and easily accessible form, using clear and plain language, thereby
infringing Articles 5(1)(a) and 12(1) GDPR, a fine in the amount of €60 million is hereby
imposed.

c. In respect of the infringement of Article 6(1) GDPR (and taking into account the
infringement of the Article 5(1)(a) fairness principle), a fine in the amount of €50 million
is hereby imposed.

419. Meta Ireland has the right of an effective remedy as against this Decision, the details of which
have been provided separately.

This Decision is addressed to:

Meta Platforms Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2

Dated the 31st day of December 2022

Decision-Maker for the Commission:

[sent electronically, without signature]

_______________________________________
Helen Dixon
Commissioner for Data Protection

189

Appendix 1 – Schedule 1

1 INTRODUCTION

a. Purpose of this Document

1. This document is the Schedule referred in the Draft Decision. This Schedule forms part of the Decision
and, accordingly, must be read in conjunction with the Decision.

2. For the avoidance of doubt, this Schedule is a proposed integral and operative part of the Decision for
the purposes of Article 60 and 65 GDPR. The previous division of material into two documents is
entirely a structural choice, so as to enable a more exclusive focus on the substantive Complaint in the
main document, while dealing with matters of a more procedural nature in this Schedule. It has been
incorporated into the Decision itself as part of the finalisation process, prior to adoption.

2 CHRONOLOGY, PROCEDURAL AND SCOPE MATTERS PERTAINING TO THE INQUIRY

a. Procedural Background to the Inquiry

3. A complaint was lodged with the Belgian DPA on 25 May 2018, the date on which the GDPR came into
operation, by NOYB, a verein (or association) under Austrian law, in respect of the processing of certain
personal data by Meta Platforms Ireland Limited (“Meta Ireland”), then known as Facebook Ireland
Limited (“Facebook”), 345 in the context of the Instagram service (the “Complaint”). The Complaint was
lodged on behalf of a named Data Subject (the “Named Data Subject” or the “Data Subject”) in
accordance with Article 80 GDPR. In general terms, the Complaint focussed on the requirement that
(existing) registered users must accept the Instagram Terms of Use to access that service. In addition,
the Complaint concerned the transparency of the information provided to Instagram users in respect
of the legal basis of that processing. The Complaint was made against Meta Ireland on the basis that
NOYB considered Meta Ireland to be the data controller in respect of the Instagram service.

4. The Complaint was transferred to the Data Protection Commission (the “Commission”) from the
Belgian DPA on 31 May 2018. The Commission commenced an inquiry into this matter on 20 August
2018.
The Commission designated an investigator (the “Investigator”) to consider the issues raised in the
Complaint and prepare a draft inquiry report (the “Draft Report”) which was issued to the parties on
20 May 2020. Following submissions from the parties, the Investigator also produced a final version
of the inquiry report (the “Final Report”) which was issued to the parties on 18 January 2021. In
considering the matters within this Complaint, I have relied on the facts as determined by the

345
I note in this respect that the Complaint was expressly made against Facebook Ireland Limited as that entity did
not register a change of name to Meta Platforms Ireland Limited until 5 January 2022. Where references are made
to either “Facebook” or “Meta Ireland”, this should be construed as referring to the same legal entity which is
presently known as a “Meta Platforms Ireland Limited”.
190

Investigator in the Final Report. I have also had regard to the Investigator’s views as set out in the
Final Report and the entirety of the file relating to this matter.

5. Taking account of the above, I prepared a preliminary version of this Draft Decision and Schedule (the
“Preliminary Draft”) which set out my provisional views and findings in this matter, as the
decisionmaker, in relation to (i) whether or not an infringement of the GDPR has occurred/is occurring,
and (ii) the envisaged action to be taken by the Commission in respect of same. The Preliminary Draft
was circulated to both NOYB and Meta Ireland (collectively the “Parties”) on 23 December 2021. I
received submissions from both Parties on 4 February 2022 and, in finalising the Draft Decision, I
carefully considered these submissions and amended the Preliminary Draft accordingly.

6. On 1 April 2022, the Draft Decision was submitted by the Commission to other concerned supervisory
authorities (the “CSAs”, each one being a “CSA”) (within the meaning of Article 4(22) GDPR), for their
views, pursuant to Article 60 GDPR. The cross-border processing under examination in this Inquiry
was such that all other EU/EEA supervisory authorities (“SAs, each one being an “SA”) were engaged
as supervisory authorities concerned (“CSAs”) for the purpose of the cooperation process outlined in
Article 60(3) of the GDPR. In response, the following CSAs raised objections to the Draft Decision:

a. The French SA (the “FR SA”) raised an objection on 28 April 2022;
b. The Swedish SA (the “SE SA”) raised an objection on 29 April 2022;
c. The Austrian SA (the “AT SA”) raised an objection on 29 April 2022;
d. The Hungarian SA (the “HU SA”) raised an objection on 29 April 2022;
e. The Finnish SA (the “FI SA”) raised an objection on 29 April 2022;
f. The German SAs (the “DE SAs”) raised an objection, submitted by the Hamburg DPA on 29
April 2022;
g. The Italian SA (the “IT SA”) raised an objection on 29 April 2022;
h. The Norwegian SA (the “NO SA”) raised an objection on 29 April 2022;
i. The Dutch SA (the “NL SA”) raised an objection on 29 April 2022; and
j. The Spanish SA (the “ES SA”) raised an objection on 29 April 2022.

7. In addition, the following comments were exchanged:

a. The Danish SA (the “DK SA”)made a comment on 29 April 2022;
b. The Slovenian SA (the “SI SA”)made a comment on 29 April 2022; and
c. The Hungarian SA (the “HU SA”) made a comment on 29 April 2022.

8. Having considered the matters raised, the Commission, by way of a composite response memorandum
dated 1 July 2022, set out its responses together with the compromise positions that it proposed to
take in response to the various objections and comments. Ultimately, it was not possible to reach
consensus with the CSAs on the subject-matter of the objections and, accordingly, the Commission

191

determined that it would not follow them. That being the case, the Commission referred the
objections
to the Board for determination pursuant to the Article 65(1)(a) dispute resolution mechanism. In
advance of doing so, the Commission invited Meta Ireland to exercise its right to be heard on all of the
material that the Commission proposed to put before the Board. Meta Ireland exercised its right to
be heard by way of its submissions dated 9 August 2022 (the “Article 65 Submissions”). The Board
adopted its Article 65 Decision on 5 December 2022 and notified it to the Commission and all other
CSAs on 8 December 2022. As per Article 65(1), the Board’s decision is binding upon the Commission.
Accordingly, and as required by Article 65(6) of the GDPR, the Commission has now amended its Draft
Decision, by way of this Decision, in order to take account of the Board’s determination of the various
objections from the CSAs which it deemed to be “relevant and reasoned” for the purpose of Article
4(24) of the GDPR. As part of the amendment process, Meta Ireland was invited to exercise its right
to be heard in relation to any matters in relation to which the Commission was required to make a
final determination or, otherwise, exercise its own discretion. Meta Ireland exercised its right to be
heard by way of its submissions furnished under cover of letter dated 19 December 2022 (“the Final
Submissions”).

b. Legal Basis of the Decision

9. The Investigator in this case conducted the Inquiry under section 110 of the Data Protection Act 2018
(the “2018 Act”).

10. The decision-making process for inquiries conducted by the Commission is outlined in section
113(2)(a) of the 2018. Additionally, section 113(3)(a) of the Act requires that the Commission must:
consider the information obtained during the Inquiry; decide whether an infringement is occurring or
has occurred; and if so, decide on the envisaged action (if any) to be taken in relation to the data
controller. This function is performed by me in my role as the decision-maker. In so doing, I have
carried out an independent assessment of all of the materials provided to me by the Investigator.

11. As stated above, the Inquiry was commenced pursuant to section 110 of the 2018 Act. By way of
background in this regard, under Part 6 of the 2018 Act, the Commission has the power to commence
an inquiry on several bases, including on foot of a complaint, or of its own volition.

12. I note that the Investigator, in his consideration of the material gathered during the initial stages of
the Inquiry, was satisfied that Meta Ireland was a data controller in respect of the Instagram service. 346
The Investigator was also satisfied that the Commission was the lead supervisory authority (the “LSA”)
as set out in the GDPR for the purposes of this matter on the basis that (i) Meta Ireland has its main
establishment (for the purposes of the GDPR) in Ireland and (ii) that the processing at issue in the
Complaint constitutes cross-border processing. 347 My consideration of these matters is below.

346
Final Inquiry Report dated 18 January 2021, at paras. 91 – 93.
347
Final Inquiry Report dated 18 January 2021, at paras. 94 – 105.
192

c. Referral by the Belgium DPA

13. The Complaint was transferred to the Commission on the basis that the Commission was likely the LSA
on the basis that (i) the Complaint concerns cross-border processing and (ii) Meta Ireland, as the data
controller for the Instagram service, has its main establishment in Ireland. As I have noted, the
Commission assessed the Complaint and, as the LSA, commenced the Inquiry under section 110 of the
2018 Act on 20 August 2018. The Parties were also notified of the commencement of the Inquiry on
20 August 2018.

d. Status of NOYB

14. As stated above, the Complaint was lodged by NOYB to the Belgian DPA on behalf of the Named Data
Subject. For completeness, I note that the written Complaint provided a Belgian work address for the
Named Data Subject. 348 Pursuant to Article 77 GDPR, an individual may lodge a complaint to any
supervisory authority in respect of processing which that individual considers may amount to an
infringement(s) of the GDPR. 349 In this context, NOYB is acting as a representative of a named
individual in accordance with Article 80 GDPR, which states that:

“The data subject shall have the right to mandate a not-for-profit body, organisation or
association which has been properly constituted in accordance with the law of a Member
State, has statutory objectives which are in the public interest, and is active in the field of
the protection of data subjects’ rights and freedoms with regard to the protection of their
personal data to lodge the complaint on his or her behalf…”

15. For the purposes of assessing compliance with Article 80 GDPR, it is necessary to assess whether NOYB
was a properly constituted not-for-profit body with objectives in the public interest and that was
actively engaged in “the field of the protection of data subject rights”. The Investigator consulted
NOYB’s website (www.noyb.eu) and the Austrian Central Registry of Associations in his assessment of
whether NOYB was a validly constituted non-profit entity. 350 The Investigator confirmed that NOYB
was a “verein” (association) in Austrian law and had been formed prior to the date of the Complaint. 351
He also affirmed that Point 1 of NOYB’s Articles of Association stated that the association’s aims

348
Complaint made by NOYB in respect of the Instagram Service dated 25 May 2018 (the “Complaint dated 25 May
2018”), at para. 1.2.
349
The language of Article 77 GDPR is open-ended in that it appears that there is no explicit limitation as to which
supervisory authority a complaint may be made to. Nonetheless, Article 77 provides examples of appropriate
supervisory authorities, including the supervisory authority in which the individual’s “place of work” is located in.
350
See generally, Final Inquiry Report dated 18 January 2021, at paras. 107 – 110.
351
Final Inquiry Report dated 18 January 2021, at para. 107.
193

included the “protection and promotion of data protection rights, consumer rights, and the right to
freedom of expression” 352 and that NOYB’s website is active in providing commentary and information
on campaigns in respect of data protection matters. 353 On the basis of these factors, he was satisfied
that the criteria set out in Article 80 had been complied with.

16. Having regard to the Investigator’s assessment of this issue and NOYB’s Articles of Association, I am
satisfied that that NOYB appears to be a non-profit body that is validly constituted in Austrian law,
with objectives in the public interest and is active in the field of data protection. Nonetheless, I note
in this regard that a formal determination as to whether NOYB is validly constituted as a matter of
Austrian law is outside the scope of the Commission.

17. It is also necessary to consider whether NOYB has been mandated by the Named Data Subject in
accordance with the requirements set out in Article 80(1) GDPR. First, I note that a document titled
“Assignment of Representation” was annexed to the Complaint.354 This document contains the name,
place of work and signature of the Named Data Subject. While the mandate is undated, it clearly
refers to the subject matter of the Complaint as it states that the Named Data Subject mandates NOYB:

“to represent me in their case against Facebook Ireland Ltd over my forced consent to the
updated privacy policy of Instagram that I clicked on to in May 2018.

In particular, I mandate noyb to present me and enforce my rights, arising in the context
of the aforementioned case, by lodging a complaint before the competent supervisory
authority and to exercise the rights referred to in Articles 77, 78 and 79 of the GDPR on my
behalf, including taking any actions necessary to enforce those rights”.355

18. In submissions on the Draft Report, NOYB stated that it “is not limited in any respect when representing
the complainant [and] … the Complainant confirms that he endorses all submissions provided by noyb
in the course of the present procedure”. 356 While I agree that an entity mandated under Article 80
GDPR has certain discretion in formulating the scope of the initial complaint, I do not accept that the
entity has unlimited powers to determine the direction of the resulting inquiry. Rather, it is my view
that the nature of a mandate for the purposes of Article 80 GDPR cannot be altered post hoc after the
complaint has been launched. .

352
Final Inquiry Report dated 18 January 2021, at para. 109.
353
Final Inquiry Report dated 18 January 2021, at para. 110.
354
See the Assignment of Representation under Article 80(1) of the General Data Protection Directive (GDPR),
annexed to the Complaint.
355
Assignment of Representation under Article 80(1) of the General Data Protection Directive (GDPR), annexed to
the Complaint.
356
NOYB’s Submissions on the Draft Inquiry Report dated 19 August 2020.
194

19. I am satisfied that, on a literal interpretation of the “Assignment of Representation”, NOYB has been
given the authority to represent the Named Data Subject in relation to possible infringement(s) arising
in the context of the updated (i.e. last revised on 19 April 2018) Instagram Terms of Use and/or Data
Policy.

20. For completeness, I note Meta Ireland’s confirmation that the Named Data Subject is a registered user
of the Instagram service. 357 I am therefore satisfied that the processing at issue relates to the Named
Data Subject as required by Article 77 GDPR.

21. Accordingly, on the basis of the above, I am satisfied that NOYB was mandated by the Named Data
Subject in accordance with the requirements of Article 80 GDPR.

e. Procedural Conduct of the Inquiry

22. As set out above, the Inquiry was commenced on 20 August 2018 for the purposes of examining and
assessing the circumstances surrounding the Complaint as referred to the Commission by the Belgian
DPA, with a view to ultimately facilitating a decision under section 113(2)(a) of the Act.

23. The Commission commenced an Inquiry into the matters complained of as it formed the view that one
or more provisions of the GDPR and/or 2018 Act may have been contravened by Meta Ireland in
respect of processing in the context of the Instagram service. 358 The Parties were notified on 20
August 2018 that the Inquiry had been commenced. 359 In the Notice of Commencement issued to
Meta Ireland, the Commission included (1) a series of questions for Meta Ireland and (2) a copy of the
Complaint, explaining that the scope of the Inquiry was limited to same. Following clarification, Meta
Ireland responded to these questions by way of correspondence dated 28 September 2018, including
several appendices.

24. The Investigator contacted NOYB by letter on 23 November 2018 and outlined the scope of the Inquiry.
NOYB responded on 3 December 2018 and outlined a number of procedural concerns, including
allegations of delay and bias on the part of the Commission, a failure of the Commission to respect fair
procedures and disagreements as to the Investigator’s view on the scope of the Complaint. The
Investigator responded to these concerns by letter dated 16 January 2019, strongly refuting these
claims. In addition, a phone call between the Investigator and a representative of NOYB 360 took place
on 26 January 2019 to further address these allegations.

357
See Meta Ireland’s Submissions dated 22 February 2019.
358
Notice of Commencement dated 20 August 2018, at pp. 1 - 2.
359
In respect of the notification to the Complainant, I note that the Commission issued the notification to the Belgian
DPA (as the supervisory authority to which the Complaint was lodged) on 20 August 2018, who in turn informed the
Complainant on 20 September 2018.
360
In this regard, the phone call occurred between the Investigator and a representative from NOYB.
195

25. The Investigator wrote to Meta Ireland on 30 January 2019 to outline his views as to the scope of the
Complaint and afford Meta Ireland the opportunity to provide submissions on the issues raised. This
outline mirrored that which was communicated to NOYB on 23 November 2018. In a response dated
5 February 2019, Meta Ireland raised a number of procedural questions, in particular in respect of the
mechanisms of the Article 60 process and the status of Meta Ireland’s submissions dated 28
September 2018. In this regard, Meta Ireland also sought clarity on the confidentiality of the process
and the extent to which information would be shared with other supervisory authorities.

26. The Investigator responded to Meta Ireland’s procedural questions on 8 February 2019, confirming
that Meta Ireland’s submissions dated 28 September 2018 would be considered but only insofar as
the submissions were relevant to the scope of the Complaint. The Investigator further stated that
Meta Ireland’s queries as to confidentiality would be addressed by way of separate communication.
In an email dated 15 February 2019, Meta Ireland stated that it considered that the majority of its
submissions dated 28 September 2018 fell outside the scope identified by the Investigator. In
addition, Meta Ireland requested an extension of two days for submissions on the issues raised. In
response, by email dated 15 February 2019, the Investigator granted the extension and requested that
Meta Ireland identify, with specificity, the material in the submissions dated 28 September 2018,
which it considered to be out of scope.

27. Meta Ireland sent its second set of submissions on 22 February 2019; this set of submissions related
to the scope as identified by the Investigator. Meta Ireland included a marked-up copy of its
submissions dated 28 September 2018, indicating which aspects of the submissions it considered to
be (1) out of scope and/or (2) confidential.

28. The Investigator provided an update to NOYB on 26 February 2019, informing NOYB that Meta Ireland
had made submissions on 22 February 2019 and that the Commission was presently considering the
confidentiality of same. NOYB replied on 27 February 2019 and expressed concern that Meta Ireland’s
submissions could be considered confidential and to “fundamentally object to any information in this
procedure being shielded from us [as the Complainant]”. NOYB expressed concern that the
submissions would be redacted and sought clarification on the role of the Belgian DPA. In addition,
NOYB proactively offered to sign a non-disclosure agreement. NOYB sought an update on the Inquiry
on 23 March 2019.

29. The Investigator wrote to NOYB on 28 March 2019, outlining the next steps in the inquiry process and
informing NOYB that the material received in the course of the Inquiry would be provided to the
Parties as annexes to the Draft Report. The Investigator provided an update as to the scope of the
Complaint, reiterating the position he expressed in the letter to NOYB on 23 November 2018. In a
short phone call with the Investigator on 1 April 2019, NOYB noted its disagreement as regards the
procedural steps outlined by the Commission.

30. NOYB responded on 19 April 2019 by way of letter. In this response, NOYB expressed concern that
the GDPR “does not foresee the direct engagement with the Data Protection Commission” as the
196

Complaint had been lodged with the Belgian DPA. NOYB further stated that, on their understanding
of fair procedures, the relevant parties must be able to “review the facts that were excluded from the
evidence” and queried whether any information received in the course of the Inquiry could be
considered confidential. In addition, NOYB made further submissions on the scope of the Complaint.

31. The Investigator provided additional information on the next steps (mirroring the information
provided to NOYB on 19 April 2019) to Meta Ireland by way of letter dated 5 June 2019. The
Investigator also informed Meta Ireland that material collected in the course of the Inquiry which was
relevant to the substance of the Complaint would be shared with the Parties when the Draft Report
would be shared with same. He further noted that Meta Ireland would be provided the opportunity
at another date to make submissions in respect of the disclosure of specific information to NOYB.
Meta Ireland wrote to the Commission on 12 June 2019, reaffirming its earlier position that it be
afforded the opportunity to make submissions as to confidentiality and/or commercial sensitivity prior
to any material prepared by Meta Ireland being shared with NOYB.

32. On 24 February 2020, NOYB wrote to the Investigator and raised a number of procedural issues,
including allegations of delay, “unwieldy” procedures and a failure to respect procedural rights by not
sharing the materials with NOYB. The Investigator responded on 23 March 2020 and noted that NOYB
would be afforded the opportunity to make submissions upon circulation of the Draft Report. The
Investigator also provided an update as to the timeline of the Inquiry and outlined the next steps of
same.

33. By letter dated 17 April 2020, the Investigator wrote to Meta Ireland to provide the opportunity for
Meta Ireland to make submissions as to confidentiality over the material furnished in the course of
the Inquiry, in particular, the submissions dated 28 September 2018 and 22 February 2019. Meta
Ireland replied on 24 April 2020.

34. The Draft Report was circulated to the Parties on 20 May 2020. The Investigator also wrote to NOYB
on 20 May 2020 to provide an update on same. NOYB informed the Commission, by way of letter
dated 3 June 2020, that NOYB did not accept the Investigator’s responses in his letter dated 23 March
2020 to be adequate in addressing NOYB’s concerns.

35. Both Parties were granted extensions on the deadline for submissions on the Draft Report.404 Meta
Ireland provided the Investigator with its submissions on 22 June 2020. NOYB made their submissions
on 19 August 2020, emphasising, in the covering email, their concerns as to procedural issues and an
alleged failure by the Commission to provide “all files of the case and all submissions of Facebook”.
NOYB also alleged that the submissions amounted to a “supplemental complaint”.

36. In the interim, on 25 May 2020, NOYB published an “open letter to all DPAs” (the “Open Letter”) which
concerned several of the Commission’s complaint-based inquiries, including this Inquiry. In this letter,
NOYB made a number of serious allegations against the Commission, including allegations of bias and

197

“secret cooperation” between the Commission and Meta Ireland and non-compliance with national

In this regard, Meta Ireland were granted an additional two days. As there was disagreement as to the language
404404

requirements of the Inquiry output (discussed further below), NOYB was given an additional two weeks after
resolution of the disagreement.
procedural law (e.g. access to documents). NOYB also expressed concern with the scope of the
investigation identified in the Draft Report and with the cooperation mechanism provided for the in
GDPR. The EDPB responded to NOYB on 9 June 2020 in which it affirmed that the EDPB was
“committed to find solutions and address the challenges ahead where it lies within our competence”.
In essence, the EDPB noted and accepted the limitations on its competence in this regard.

37. As outlined above, the Final Report was transmitted to the Parties on 18 January 2021. The Parties
were notified of the commencement of decision-making stage on 7 April 2021. The Preliminary Draft
was circulated to the Parties on 23 December 2021. The Preliminary Draft was also transmitted to
the Belgian DPA via the IMI on 23 December 2021.

38. On 29 December 2021, NOYB wrote to the Belgian DPA, copying the Commission, alleging procedural
concerns and requesting (i) sight of all submissions in the Inquiry, (ii) the ability to make submissions
in French and (iii) an oral hearing. The Commission replied to NOYB on 17 January 2022, responding
to these requests.

39. Meta Ireland wrote to the Commission on 4 January 2022 seeking clarification on the confidentiality
of the materials, to which the Commission responded on 5 January 2022. Meta Ireland sought
additional clarification on 7 January 2022. On 27 January 2022, Meta Ireland further contacted the
Commission to request that the inquiry process be paused until the resolution of similar matters
raised in (i) a preliminary reference to the CJEU in respect of C-446/21 Meta Ireland and/or (ii) the
Article 60 process in respect of IN-18-05-05 concerning NOYB and Meta Ireland. Meta Ireland
restated this position in its submissions on the Preliminary Draft dated 4 February 2022 and alleged
that CJEU jurisprudence on this matter precludes the Commission from adopting a decision when
similar matters are pending. 361. Meta Ireland made further submissions on this point by way of letter
dated 16 March 2022. The Commission responded to this request on 1 April 2022.

40. The Commission received submissions from Meta Ireland on 4 February 2022 on the Preliminary
Draft. NOYB also transmitted its submissions on the Preliminary Draft to the Commission on 4
February 2022. In its accompanying cover letter, NOYB restated its allegations of bias and procedural
concerns; in addition, NOYB requested that the submissions it made on the Preliminary Draft in
respect of IN-1805-05 concerning NOYB and Meta Ireland also be considered its submissions for the
purposes of this Inquiry.

3. Procedural Matters arising in the course of the Inquiry

361
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 2.1 – 2.3.
198

41. As I have set out, this is the Decision proposed to be made by the Commission, (at this point, I note
that I am the sole member of the Commission) in accordance with section 113 of the 2018 Act.
Section 113 of the 2018 Act provides as follows:

(2) Where section 109 (4)(a) applies, the Commission shall—

(a) in accordance with subsection (3), make a draft decision in respect of the complaint
(or, as the case may be, part of the complaint) and, where applicable, as to the
envisaged action to be taken in relation to the controller or processor concerned, and

(b) in accordance with Article 60 and, where appropriate, Article 65, adopt its decision in
respect of the complaint or, as the case may be, part of the complaint.

(3) In making a draft decision under subsection (2)(a), the Commission shall, where applicable, have
regard to—

(a) the information obtained by the Commission in its examination of the complaint,
including, where an inquiry has been conducted in respect of the complaint, the
information obtained in the inquiry, and

(b) any draft for a decision that is submitted to the Commission by a supervisory authority
in accordance with Article 56(4).

(4) Where the Commission adopts a decision under subsection (2)(b) to the effect that an
infringement by the controller or processor concerned has occurred or is occurring, it shall,
in addition, make a decision—

(a) where an inquiry has been conducted in respect of the complaint—

(i) as to whether a corrective power should be exercised in respect of the controller or
processor concerned, and

(ii) where it decides to so exercise a corrective power, the corrective power that is to be
exercised,

42. In accordance with section 113, it is for me, as the sole member of the Commission, to: consider the
information obtained in the course of the Inquiry; to decide whether an infringement is occurring or
has occurred; and if so, to decide on the envisaged action in respect of the controller (if any). In so
doing, I will carry out an independent assessment of all of the materials provided to me by the
Investigator.

199

43. Given that the Commission is the lead supervisory authority under Article 56(1) GDPR for the
purposes of the data processing operations at issue, I was obliged under section 113(2) and Article
60(3) GDPR to complete the Draft Decision to be provided to the CSAs, as defined in Article 4(22).

44. As set out above at paragraph 1, this is the Decision, having submitted the Draft Decision under
Article 60(3) GDPR to the CSAs, and having taken account of the Article 65 Decision, as explained in
the text of the Decision itself. The purpose of the Draft Schedule and the Preliminary Draft Decision
were to allow the parties to make any submissions in respect of my provisional findings set out. This
is the finalised version of the Schedule and Decision, as also explained in further detail in the Decision.

4. Decision-Making Process and the Materials Considered

45. The Final Report was transmitted to me on 18 January 2021, together with the Investigator’s file,
containing copies of all correspondence exchanged between the Investigator and the Parties; and
copies of any submissions made by the Parties, including the submissions made by the Parties in
respect of the Investigator’s Draft Report. A letter then issued to the Parties on 7 April 2021 to
confirm the commencement of the decision-making process.

46. As set out above, a Preliminary Draft was circulated to the Parties for their submissions on 23
December 2021. The Parties provided the Commission with any such submissions on 4 February
2022. For the avoidance of doubt, I have had regard to all material contained in the file when
preparing this Draft Decision.

47. A number of preliminary matters must be considered to ascertain whether the Commission is
competent in respect of this Complaint. In this regard, I must be satisfied that Meta Ireland is the
relevant controller for processing in the context of the Instagram service. If so, I must also be satisfied
that the main or single establishment of Meta Ireland is in Ireland (i.e. that the Dublin office of Meta
Ireland is the main or single establishment of Meta Ireland) and that the processing in connection
with the Instagram service is cross-border in nature. In addition, I must also be satisfied that NOYB’s
mandate is valid in accordance with the requirements of Article 80 GDPR.

a. Meta Ireland as Data Controller

48. Pursuant to Article 4(7) GDPR, the term “data controller”:

“means the natural or legal person, public authority, agency or other body which, alone or jointly
with others, determines the purposes and means of the processing of personal data; where the
purposes and means of such processing are determined by Union or Member State law, the
controller or the specific criteria for its nomination may be provided for by Union or Member State
law”.

200

49. The concept of the “controller” is broadly defined362 and encompasses a “functional” or “factual”
test.407 In essence, I must be satisfied that, in the context of the specific processing at issue, Meta
Ireland is “the entity that actually exerts a decisive influence on the purposes and means of the
processing”. 363 In this regard, I also note that the EDPB is of the view that “special attention” must
be given to the controllership assessment when an individual establishment may be processing
personal data within a company group. 364

50. First, I note that the Complaint was made against “Facebook Ireland Ltd.” (now known as “Meta
Platforms Ireland Limited”), located at “4 Grand Canal Square, Grand Canal Harbour, Dublin 2,
Ireland”, as the “operator” of the Instagram application. 365 NOYB thereby identified Facebook (now
Meta Ireland) as the relevant controller for the purposes of this Complaint; this was noted by Meta
Ireland in their submissions dated 28 September 2018. 366

51. In his assessment of the matter, the Investigator was of the view that Meta Ireland was the
appropriate controller in respect of the processing at issue. 367 In this regard, I note that NOYB, in its
submissions dated 19 August 2020 on the Draft Report, reserved its position in respect of
controllership and asserted that “the fact that the complaint is filed against Facebook Ireland does
not mean that the Complainant ‘recognises the entity as the relevant data controller’”. 368

52. In considering the issue of whether Meta Ireland is the controller for the specific processing at issue
in this Complaint, i.e. processing in the context of the Instagram application, I have first considered
whether Meta Ireland is an appropriate entity as outlined in Article 4(7) GDPR. I subsequently
considered whether Meta Ireland could be said to determine the “purposes and means” of
processing the context of the Instagram service.

53. I note that “Facebook Ireland Limited” with the address “4 Grand Canal Square, Grand Canal Harbour,
Dublin 2, Ireland” was registered with the Companies Registration Office (the “CRO”) as a private

362
As recognised by the CJEU: Case C‑272/19 VQ v Land Hessen (ECJ, 9 July 2020), at para. 64. See also EDPB,
Guidelines 07/2020 on the concepts of controller and processor in the GDPR (adopted 7 July 2021), at para 17. 407
EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR (adopted 7 July 2021), at para
21.
363
EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR (adopted 7 July 2021), at para
30.
364
EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR (adopted 7 July 2021), at para
17.
365
Complaint, at p. 1.
366
Meta Ireland’s Submissions dated 28 September 2018, at para. 3.2.
367
Final Inquiry Report dated 18 January 2021, at para. 93.
368
Complainant’s Submissions on the Draft Inquiry Report dated 19 August 2020 at pp. 16 – 17 (see section 1.12).
414
See the Companies Registration Office: https://core.cro.ie/e-commerce/company/495773 (accessed 30 August
2021).
201

company limited by shares on 6 October 2008.414 I further note that, on 5 January 2022, a change of
name from “Facebook Ireland Limited” to “Meta Platforms Ireland Limited” was registered with the
CRO on 5 January 2022 and effective from 22 December 2021. 369 Accordingly, I am satisfied that
Meta Ireland is a legal person as a matter of Irish law. I also am satisfied on the information available
that the Instagram service is provided via Meta Ireland in the EU/EEA and that Instagram does not
exist as an independent entity with separate legal personality from Meta Ireland.

54. With respect to whether Meta Ireland determines the “purposes and means” of processing in the
context of the Instagram service, I have had regard to several factors. First, I note that Meta Ireland
informed the Commission on 25 May 2018 that “Facebook Ireland Limited” is the data controller for
the Instagram service in the EU. 370 Meta Ireland reaffirmed this position in their submissions dated
28 September 2018. 371

55. Instagram’s Data Policy applicable at the date of the date of the Complaint (i.e. the Data Policy last
revised 19 April 2018) states that:

“The data controller responsible for your information is Facebook Ireland, which you can contact
online, or by mail at:

Facebook Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2 Ireland”.372

56. In addition, the Instagram Terms of Use at the date of the Complaint states that “Instagram Service
is one of the Facebook Products, provided to you by Facebook Ireland Limited. These Terms of Use
therefore constitute an agreement between you and Facebook Ireland Limited”. 373

57. As regards the decision-making capacity of Meta Ireland in the context of the Instagram service, I
note that in the submissions dated 28 September 2018, Meta Ireland further stated that:

“Facebook Ireland is the service provider of the Instagram service in the EU and also determines
the purposes and means of processing EU users’ data. It is the only entity with decision-making
power regarding:

369
See the Special Resolution to Change the Company Name (SR862231), available on the Companies Registration
Office: https://core.cro.ie/e-commerce/company/495773 (accessed 14 February 2022).
370
Email from Meta Ireland to the Commission dated 25 May 2018 at 14:35.
371
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.2.
372
Instagram Data Policy (last revised 19 April 2018).
373
See Instagram’s Terms of Service (last revised 19 April 2018).
202

• Setting polices governing how EU user data is processed;
• Deciding whether and how our products that involve processing of user data will be offered
in the EU;
• Controlling the access to and use of EU user data; and
• Handling and resolving data-related inquiries and complaints from EU users of the
Instagram service whether directly or indirectly via regulators”.374

58. On the basis of the above, I am satisfied that Meta Ireland is a controller within the meaning of Article
4(7) GDPR for processing in the context of the Instagram service.

b. Competence of the Commission to Act as the Lead Supervisory Authority

59. In accordance with Article 56(1) GDPR, a supervisory authority is competent to act as the LSA where
the (1) main or single establishment of the controller is located in the same jurisdiction as that
authority and (2) the processing carried out by the controller is cross-border in nature. In assessing
whether the Commission has competence to act as the LSA, I have considered both issues.

Main or Single Establishment of Meta Ireland
60. In determining whether the main or single establishment of Meta Ireland is located in Ireland, I
considered two related issues: first, I considered whether Meta Ireland was a controller in respect of
the processing at issue and, second, if so, whether Meta Ireland has its main or single establishment
in Ireland. In respect of the first consideration, as outlined above in paragraphs 47 – 57. I am satisfied
that Meta Ireland is a controller for the processing of personal data in the context of the Instagram
service.

61. As regards the concepts of main or single establishment, I note that the term “establishment” is not
defined in the substantive provisions of the GDPR. Nonetheless, Recital 22, which acts an
interpretative aid, states that:

“Establishment implies the effective and real exercise of activity through stable arrangements. The
legal form of such arrangements, whether through a branch or a subsidiary with a legal
personality, is not the determining factor in that respect”.

62. In respect of “main establishment”, I note that Article 4(16) GDPR defines a controller’s main
establishment as its place of “central administration in the Union, unless the decisions on the
purposes and means of the processing of personal data are taken in another establishment of the
controller in the Union…”.

63. This is further supported by Recital 36 to the GDPR which provides that

374
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.4.
203

“The main establishment of a controller in the Union should be the place of its central
administration in the Union, unless the decisions on the purposes and means of the processing of
personal data are taken in another establishment of the controller in the Union, in which case that
other establishment should be considered to be the main establishment.”

64. In this regard, I note that the Investigator was satisfied that “the Dublin office of Facebook Ireland
Limited is (at least) a single establishment of the controller in Ireland for the purposes of the GDPR”. 375

65. In submissions dated 28 September 2018, Meta Ireland restated its position that it considers the
Dublin office of Meta Ireland to be the main establishment in respect of processing in the context of
the Instagram service. 376 In this regard, Meta Ireland stated that:

“Facebook Ireland’s Dublin office satisfies both strands of the ‘main establishment’ test set out in
Article 4(16) of the GDPR as it is Facebook Ireland’s place of ‘central administration’ in the Union
and the establishment where ‘decisions on the purposes and means of the processing of personal
data are taken’ in relation to the Instagram service. Facebook Ireland’s governance, structures,
processes, experience and significant resources means that it clearly ‘has the power to have such
decisions implemented’”. 377

66. I also note that Meta Ireland provided extensive detail as to its personnel numbers in the Dublin
office of Meta Ireland and information on the internal structure of Meta Ireland in respect of
delivering the Instagram service. 378 In this regard, Meta Ireland stated:

“Facebook Ireland has more than personnel in its headquarters in Dublin who manage,
among other things, the operations and data processing relating to EU users of Instagram,
including the analysis and fulfilment of those users’ rights, information security including user
information security, engineering, user support, law enforcement response, data protection and
privacy operations and policy and legal teams including, critically, the data protection teams.
Facebook Ireland’s senior decision makers operate in cross-functional teams, which include
representatives from its Legal, Policy, Law Enforcement Response, Community Operations,
Information Security, and Privacy Operations. Many of these teams have designated contact points
for issues related to Instagram EU user data, and some have dedicated personnel now specifically
responsible for those functions supporting the Instagram service in the EU. For example, the
Facebook Ireland data protection legal team and security team both now deal with all relevant
issues relating to Instagram user data in the EU. Each of those teams also now have designated
contact points for Instagram, who are responsible to ensure that all of the functions provided by
those broader teams are leveraged for oversight and management of Instagram EU data. The DPO

375
Final Inquiry Report dated 18 January 2021, at para. 100.
376
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.9.
377
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.9.
378
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.10.
204

and his office provide oversight of these teams and their work. On a daily basis, Facebook Ireland’s
personnel are responsible for managing the personal data of EU users of the Instagram service and
determining the means and purposes of processing this personal data, including collaborating to
formulate Instagram user data processing policies and overseeing the implementation of these
policies in respect of users of the Instagram service in the EU”. 379

67. On the basis of the above, I am satisfied that the Dublin office of Meta Ireland makes decisions as to
the purposes and means of processing in the context of the Instagram service. I further note that
nothing has been brought to my attention to suggest that the position, in this regard, has changed
since I considered it in the context of the preparation of the Preliminary Draft Decision.

68. Accordingly, I am satisfied that the Dublin office of Meta Ireland is the main establishment of Meta
Ireland for the purposes of the GDPR. It is my view that Meta Ireland has its main establishment in
Ireland in respect of the processing at issue in this Complaint.

Cross-Border Processing
69. I note that the Complaint has been transferred from the Belgian DPA to the Commission on the
understanding that the processing at issue is cross-border in nature. Nonetheless, I consider it
necessary, for completeness, to consider the matter.

70. Article 4(23) GDPR defines “cross-border processing” as follows:

“(a) processing of personal data which takes place in the context of the activities of establishments
in more than one Member State of a controller or processor in the Union where the controller or
processor is established in more than one Member State; or
(b) processing of personal data which takes place in the context of the activities of a single
establishment of a controller or processor in the Union but which substantially affects or is likely
to substantially affect data subjects in more than one Member State.”

71. In submissions dated 28 September 2018, Meta Ireland stated that it “provides the Instagram service
to hundreds of millions of users across the European region and in doing so is engaged in cross-border
processing pursuant to Article 4(23) GDPR” and thus processing in this context is cross-border in
nature. 380 Moreover, in both the Instagram Terms of Use and Data Policy applicable at the date of
the Complaint, Meta Ireland stated that the Instagram service is a “Global service” 381 which is

379
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.10.
380
Meta Ireland’s Submissions dated 28 September 2018, at para. 2.8.
381
Instagram Terms of Service (last revised 19 April 2018) under the subheading “Ensuring a stable global
infrastructure for our Service”.
205

provided “around the world”. 382 For completeness, I note that the Investigator was of the view that
processing in the context of the Instagram service was cross-border in nature.

72. On the basis of the above, I am satisfied that the processing of personal data within the context of
the Instagram service is cross-border in nature within the meaning of Article 4(23) GDPR.

Conclusion of the Competence of the Commission to Act as LSA

73. As it appears to me that Meta Ireland has its main establishment in Ireland and that the processing
of personal data in the context of the Instagram service is cross-border in nature, I am satisfied that
the Commission has competence, in accordance with the requirements of Article 56(1) GDPR, to act
as the LSA for the purposes of this Complaint. I further note that nothing has been brought to my
attention to suggest that the position, in this regard, has changed since I considered it in the context
of the preparation of the Preliminary Draft Decision.

c. Issues in respect of Belgian Law

74. Another procedural issue arose which has underpinned NOYB’s submissions in respect of this Inquiry.
In essence, this concerns the issue of which law ought to be applicable in respect of the Complaint.
As outlined above, the Complaint was lodged with the Belgian DPA who subsequently transferred it
to the Commission on the basis that the Commission was the competent authority (i.e. the LSA) in
respect of this Complaint.

75. In submissions dated 19 August 2020, NOYB alleged that, as the Complaint had been lodged in
Belgium and in accordance with the requirements of Belgian law, “Belgian law remains applicable to
the procedure” and the Belgian DPA is the competent authority in respect of this Complaint.429 In
support of this argument, NOYB submitted that the provisions of the relevant Belgian legislation 383
are silent as to whether there is a change in procedure in circumstances wherein a Complaint is
transferred from the Belgian DPA to another authority.431 NOYB further alleged that “[t]he GDPR
does not provide for the cooperation mechanism to deprive complainants from the procedure
applicable in their jurisdiction” and that it would make “little sense” for certain procedural rules 384 to
change after the Complaint has been lodged.433 In essence, NOYB was of the view that, in making a
decision in respect of a Complaint which originated in another Member State, I am bound to apply

382
Instagram Data Policy (last revised 19 April 2018) under the heading “How do we operate and
transfer data as part of our global services” and the subheading “Sharing with Third-Party Partners” 429
NOYB’s Submissions dated 19 August 2020, at p. 7.
383
Articles 55 and 56 of the Belgian Law of 3 December 2017 portant création de l’Autorité de protection des
données. 431 NOYB’s Submissions dated 19 August 2020, at p. 7.
384
In this regard, NOYB specifically refers to “language, deadlines, role of the parties, appeal procedure, scope of the
investigation and of the case, right to be heard”: NOYB’s Submissions dated 19 August 2020, at p. 7. 433 NOYB’s
Submissions dated 19 August 2020, at p. 7.
206

the national administrative and procedural law of that jurisdiction, Belgian law in this particular
case. 385

76. NOYB restated this issue in its submissions on the Preliminary Draft, taking the view that, as the
Complainant was bound by certain procedural laws (i.e. Belgian law in this case), the Complaint
therefore had to be interpreted by the Commission in accordance with that law. 386 It is NOYB’s
position that the Commission should have cooperated with the supervisory authority in which the
Complaint was lodged (i.e. the Belgian DPA) to “properly interpret the Complaint”. 387 I further note
NOYB’s assertion that the Commission “seems to follow an archaic and purely nationalistic idea of
international law” and that is incorrect to find that the Commission “must not interpret complaints,
contracts or other legally relevant matters under the applicable law of another Member State”. 388

77. For the avoidance of doubt, I emphasise that the Commission has cooperated in full with the Belgian
DPA throughout this Inquiry.

78. In relation to the possible application of Belgian law, I note that NOYB has not identified any legal
authority – either in Irish law or EU law – to support this position. Moreover, I have stated above
that I am satisfied that the Commission is the LSA for the purposes of the GDPR. I note that each
Member State is required by Article 51(1) GDPR to “provide for one or more independent public
authorities to be responsible for monitoring the application of this Regulation”. For completeness, I
emphasise that the Belgian DPA has also stated that it considers the Commission to be the LSA for
the purposes of this
Inquiry. 389 I also note Recital 117 GDPR, an interpretive aid to the operative provision, which states
that “Member States should be able to establish more than one supervisory authority, to reflect their
constitutional, organisational and administrative structure” [my emphasis].

79. The 2018 Act governs the establishment of the Commission as a supervisory authority for the
purposes of the GDPR.439 The Commission’s functions are outlined in section 12 of the 2018 Act;

385
NOYB’s Submissions dated 19 August 2020, at p. 8.
386
NOYB’s Submissions on the Preliminary Draft Decision in IN-18-08-05 dated 11 June 2021, at p. 7. For
completeness, while NOYB stated that these submissions are also to be considered the submissions for this Inquiry,
it cannot be the case that the specifics of Austrian law are applicable in this Inquiry as it was lodged with the Belgian
DPA in Belgium.
387
NOYB’s Submissions on the Preliminary Draft Decision in IN-18-08-05 dated 11 June 2021, at p. 7. As with the
footnote above, I have read the references to Austrian law and the Austrian DPA as Belgian law and the Belgian DPA
respectively for the purposes of this Inquiry.
388
NOYB’s Submissions on the Preliminary Draft Decision in IN-18-08-05 dated 11 June 2021, at p. 7. As with the
footnote above, I have read the references to Austrian law and the Austrian DPA as Belgian law and the Belgian DPA
respectively for the purposes of this Inquiry.
389
Email dated 18 January 2022 (16:26) from the Belgian DPA to the Commission.
439
Section 11 of the 2018 Act; see also s. 10 of the 2018 Act.
207

section 12 does not provide that the Commission is competent as regards national administrative or
procedural law other than that in Ireland.

80. The powers of the Commission must be limited to those conferred on it by law. The Commission is
tasked with encouraging, monitoring and enforcing compliance with the GDPR. In that context it is,
like all other public authorities in the State, bound by the administrative law of Ireland and EU law,
including EU law on fair procedures and the European Charter of Fundamental Rights and Freedoms.
Further, as I stated above, Article 56(1) GDPR sets out that “the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be competent to act
as lead supervisory authority”.

81. The Commission therefore derives its legal authority to handle the Complaint from the GDPR and the
2018 Act, and is, in that regard, bound by the legal orders set out above. The Commission is not
bound, nor must it have regard to, the procedural and/or administrative law of Belgium, or of any
other jurisdiction, even in circumstances where a Complaint was initially lodged in that jurisdiction.
Moreover, it seems to me that not only does the national procedural and/or administrative law of
Belgium not bind the Commission, but that any attempt by the Commission to apply such law would
be plainly ultra vires the powers conferred on the Commission by law.

d. Consumer Protection and Competition Authorities

82. The Investigator informed NOYB by letter dated 16 January 2019 that the Commission does not have
competence to investigate matters pertaining to competition or consumer law. 390 Therefore, the
Investigator provided the relevant competition 391 and consumer 392 law authorities with a partially
redacted copy of the Complaint (published on the noyb.eu website) for consideration of matters
which may fall within their competence. 393

83. In submissions on the Draft Report, NOYB expressed “astonishment” that the Commission had
referred matters relating to competition and consumer law to the relevant regulatory authorities. 394
NOYB sought sight of any and all communication in this respect and submitted that the referral to
other regulatory authorities was not appropriate as the Commission had competence to consider the
entirety of the Complaint. 395

390
Letter from the Commission to NOYB dated 16 January 2019, at p. 5.
391
The Irish Competition and Consumer Protection Commission (CCPC), Belgian Competition Authority, and the
European Commission Directorate General for Competition (DG COMP).
392
Irish Competition and Consumer Protection Commission (CCPC), Consumer Protection Division of the Belgian
Federal Public Service Economy, S.M.E.s, Self-employed and Energy, and the European Commission Directorate
General for Justice and Consumers (DG JUST).
393
For further detail, see Final Inquiry Report dated 18 January 2021, at para. 389.
394
NOYB’s Submissions dated 19 August 2020, at p. 15.
395
NOYB’s Submissions dated 19 August 2020, at p. 16.
208

84. In this regard, I emphasise that the Commission’s competence is limited to matters pertaining to data
protection. Accordingly, the Commission cannot consider issues which relate to competition or
consumer law. Therefore, I am satisfied that the Investigator was correct in referring the appropriate
matters to the relevant authorities.

e. The Right to be Heard and Access to the Complete File

85. In the course of the Inquiry, NOYB also submitted that “both parties have to receive all files,
documents and submissions before a DPA to be able to defend their legal positions”. 396 In this regard,
it should also be noted that NOYB has expressed concern that not “all documents were
communicated to noyb”.397 In particular, NOYB requested that “all communication with Facebook
concerning this case (no matter if in writing or orally) were recorded and disclosed to us”.398 This
matter is linked to NOYB’s submission that the Commission is bound to apply Belgian administrative
and procedural law (which I have considered above) as NOYB relies on Belgian law 399 to support the
argument that NOYB, as a party to the procedure, is entitled to access to the entire file in respect of
the Complaint and Inquiry. 400

86. In response to NOYB’s request for access to the complete file, the Investigator correctly informed
NOYB by way of letter dated 16 January 2019 that “there is no statutory right of access to the
complete inquiry file under Irish law” and that the parties to the Complaint would be provided with
the material information and documents as appropriate to ensure the right to be heard. 401 In the
Preliminary Draft, I noted my agreement with the Investigator in this matter.

87. In response to the Preliminary Draft, NOYB wrote to the Belgian DPA on 29 December 2021, alleging
that the Commission “is (again) withholding crucial documents from the complainant and thereby
violates [the] right to good administration including the right to be heard, and the right to access
documents”. 402 Further, in submissions on the Preliminary Draft dated 4 February 2022, NOYB
reiterated these claims and requested “full access to all submissions, exchanges and
documentation”.403 There is no factual basis for this allegation; as the Commission stated by way of
letter dated 17 January 2022, NOYB has been provided with the submissions made by Meta Ireland
on all of the substantive issues in this Inquiry. 404 To this I would add that NOYB has not identified,

396
Letter from NOYB to the Commission dated 3 December 2018, at p. 3.
397
NOYB’s Submissions dated 19 August 2020, at p. 8.
398
NOYB’s Submissions dated 19 August 2020, at p. 8.
399
Article 95(3) of the Belgian Law of 3 December 2017 portant création de l’Autorité de protection des données.
400
NOYB Submissions dated 19 August 2020, at p. 8.
401
Letter from the Commission to NOYB dated 16 January 2019, at p. 5.
402
Letter from NOYB to the Belgian DPA dated 29 December 2021, at p. 1.
403
NOYB’s Submissions dated 4 February 2022, at p. 1.
404
Letter from the Commission to NOYB dated 17 January 2022, at p. 3.
209

with any degree of specificity, which provision of Irish law – or indeed EU law – it relies on to support
its position that it is entitled to full access to the file. Rather, as I have noted above, this argument
appears to be predicated on Belgian law being applicable in the within proceedings.

88. For reasons I have outlined above, it cannot be the case that the Commission is bound to apply
Belgian law. As there seems to me to be no authority to the contrary, I am satisfied that the
Commission furnished NOYB with sufficient information and material to ensure that they could
effectively discharge their right to be heard. It is on this basis that I agree with the Investigator on
this issue and do not propose to consider it further.

f. Language of the Procedure

89. NOYB also expressed concern with the language (i.e. English) in which the Inquiry material was issued
to it, 405 despite the fact that the Complaint lodged with the Belgian DPA contained English, French
and German versions. In essence, NOYB’s position was that, as the Complaint had been lodged with
the Belgian DPA in the French language, any Inquiry output should be in French. As the supervisory
authority in which the Complaint was lodged, the issue of translation of the Inquiry output is a matter
for the Belgian DPA. The Belgian DPA informed NOYB on 8 July 2020 that a French translation of the
Draft Report would not be provided.

90. NOYB also expressed concern about language in the course of the Inquiry. In this regard, NOYB stated
that:

“noyb was required to file the present submissions in English, although the complaint was filed in
French - with an unofficial translation in German and English by noyb for the convenience of the
DPAs involved - despite noyb’s request to the DPAs to receive a translation of the inquiry report in
French before making its submission. This request was denied by both the DPC and the APD on the
basis that some exchanges had already taken place in English with noyb.”.406
91. NOYB further noted that the English version of the Complaint should be considered an “informal”
translation as it was a “machine translation”. 407 NOYB expressed particular concern that the Belgian
DPA chose to conduct the procedure in English and did not translate the inquiry reports into the
language of the Named Data Subject. 408 For completeness, I note that I issued the Preliminary Draft
to both NOYB and the Belgian DPA in English. NOYB made additional submissions on this point.

92. Indeed, by way of letter to the Belgian DPA on 29 December 2021, NOYB expressed concern that the
Preliminary Draft and Schedule were provided in English as “this would cause procedural problems in

405
See, for example, the email from NOYB to the Commission on 19 June 2020 at 18:41.
406
NOYB’s Submissions dated 19 August 2020, at pp. 9 –11.
407
NOYB’s Submissions dated 19 August 2020, at p. 11.
408
NOYB’s Submissions dated 19 August 2020, at p. 11.
210

the case of an appeal before the Belgian courts”. 409 In this respect, I note that NOYB did not identify
with specificity any such “procedural problems”. NOYB also indicated in its submissions on the
Preliminary Draft that this may mean that “this document may not be seen as properly served under
the relevant national legislation”. 410

93. The Commission responded to these allegations on 17 January 2022, reiterating the position that, as
English is the language of the Commission, as LSA, it is also the language of this Inquiry. 411 Moreover,
while the supervisory authority in which the Complaint was first filed may choose to translate any
such documents, the Belgian DPA has decided not to do so in this Inquiry. 412 To this, I would add that
the submissions in respect of the service of documents purport to concern Belgian law which, as I
have outlined above, the Commission is not competent to apply and interpret.

94. In addition, in respect of the claim that the Commission is required to translate any documents it
prepares in the course of an inquiry or decision-making process, I emphasise that, as a public body,
the Commission may only be required to provide official publications in English and/or Irish.
Therefore, it was appropriate that the Commission prepared and transmitted the inquiry reports and
the Preliminary Draft - and indeed this Draft Decision – in English.

g. Allegations of Bias

95. In the letter dated 3 December 2018, NOYB raised a number of procedural concerns with the
Commission. In particular, NOYB made an allegation of bias against the Commission. 413 In this
regard, NOYB cited the rule against bias in Irish law and Belgian law 414 and alleged that the rule had
been infringed in this case as Meta Ireland developed the Terms of Use and Data Policy in the course
of engagement with the Commission’s consultation functions. 415 NOYB did not identify, with
specificity, the legal authority for these rules as a matter of Irish or Belgian law. I further note that
NOYB did not outline the applicable legal test(s) for bias or explain how these tests have been
satisfied in this context.

96. Instead, NOYB alleged that by engaging with Meta Ireland in the course of the consultation functions,
the Commission had given “approval” to Meta Ireland as to the lawfulness of the Terms of Use and
Data Policy. 416 To support this claim, NOYB referred to proceedings before the Vienna Regional Court

409
Letter from NOYB to the Belgian DPA on 29 December 2021, at p. 1.
410
NOYB’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 1.
411
Letter from the Commission to NOYB on 17 January 2022, at p. 3.
412
Letter from the Commission to NOYB on 17 January 2022, at p. 3.
413
Letter from NOYB to the Commission dated 3 December 2018, at p. 2.
414
In this regard, I note that NOYB did not identify with specificity the legal authority for these rules.
415
Letter from NOYB to the Commission dated 3 December 2018, at pp. 2 - 3.
416
Letter from NOYB to the Commission dated 3 December 2018, at p. 1.
211

for Civil Matters in Austria, to which the Commission was not party to. 417 In this regard, NOYB stated
that the consultation process

“does not just raise questions about your claim that you have to “investigate” and “inquire” this
matter – when in fact you have already negotiated with the Facebook Group about these legal and
factual questions between 2017 and 2018, but raises issues about an obvious bias of a decision
maker that has previously approved the criticized mechanism”. 418

97. NOYB did not substantiate this serious allegation of bias with factual evidence that the Commission
approved the Instagram Terms of Use and Data Policy. Rather, as I have already stated, this allegation
of bias is unfounded as there is a functional separation between the Commission’s consultation,
investigative and decision-making functions. It is made clear to all participants who engage in a
consultation exercise(s) with the Commission that such engagement is not an endorsement of GDPR
compliance. 419 The Investigator informed Meta Ireland of this distinction. 420

98. In response to the initial allegations of bias, the Investigator correctly informed NOYB that “[a]t no
time in the course of its engagement with Facebook - or any other organisation which sought to
consult with the DPC in relation to its GDPR preparations - did the DPC approve, jointly develop,
endorse, consent to, or negotiate on the processing operations of Facebook”. 421 The Investigator
further stated that the consultation process only provides “high level feedback” to controllers and
formed part of the Commission’s statutory obligations in promoting awareness of GDPR
obligations. 422 I am satisfied that the Investigator was correct in his assessment of this matter.

99. NOYB made further allegations of bias by the Commission in the Open Letter dated 25 May 2020,
alleging that there was “secret cooperation” between the Commission and Meta Ireland and that
“the DPC has maneuvered [sic] itself into a situation where it is structurally biased because it is
essentially reviewing its own legal advice to Facebook on how to bypass Article 6(1)(a) GDPR”. 423

417
Case 3Cg52/14k at the LGfZRS Wien; according to NOYB, Meta Ireland stated on 20 November 2018 that the
“legal basis for the processing of data under GDPR was developed under extended regulatory involvement by the DPC
in multiple personal meetings between November 2017 and July 2018”: see Letter from NOYB to the Commission
dated 3 December 2018, at pp. 1 - 2.
418
Letter from NOYB to the Commission dated 3 December 2018, at p. 2.
419
NOYB was informed of this fact; see, Letter from the Commission to NOYB dated 16 January 2019, at p. 3.
420
Letter from the Commission to Meta Ireland dated 30 January 2019, at p. 1.
421
Letter from the Commission to NOYB dated 16 January 2019, at p. 3.
422
In this regard, the Investigator correctly stated that the Data Protection Acts 1988 and 2003, the legislative regime
at the time the consultations took place (i.e. in 2017 and 2018), provided for such consultations. This consultation
function is also provided for in the GDPR and 2018 Act: Letter from the Commission to NOYB dated 16 January 2019,
at p. 3.
423
Letter from NOYB to all DPAs dated 25 May 2020, at p. 3.
212

100. NOYB restated its allegations of bias in the submissions on the Draft Report dated 19 August 2020.
Indeed, NOYB stated that:

“Since Facebook’s submission explicitly mentions that the Irish DPC discussed the issues at the core
of the complaint with Facebook in ten sessions (e.g. page 2 of the Facebook submission of 28
September 2018), the problem of bias and lack of independence of the DPA is once again raised.

It is impossible to imagine that a DPA would make use of its corrective powers against a controller
whose behaviour was already discussed and approved by the same authority. We have strong
reservations about the independence of a DPA adopting such practices, which is at odds with
Article 52 GDPR and 43 LAPD).

We do not yet know how the DPC or the APD intend to address this problem and we expressly
reserve the right to appeal any decision that would be adopted by the DPC, given that they have
met with Facebook and discussed the matter in a secret meeting”. 424

101. Following the provision of a copy of the relevant parts of the Preliminary Draft to NOYB on 23
December 2021, NOYB reiterated these allegations of bias. In particular, NOYB referred to
“disclosures” made on its website, noyb.eu, on 4 December 2021 to support its assertion that the
“DPC is biased in relation to the case as it (A) met with Facebook more [sic] at least 10 times between
November 2017 and the coming into force of the GDPR, (B) the DPC then tried to push the consent
bypass into EDPB Guidelines and (C) the DPC then tried to delay the publication of the deadline, once
the EDPB rejected the joint approach of Facebook and the DPC”[footnotes omitted]. 425 NOYB also
alleged that the position I took in the Preliminary Draft “ignores” both (i) its submissions and (ii) the
relevant and reasoned objections made by CSAs in IN-18-05-05 concerning NOYB and Meta
Ireland. 426

102. I will address the latter first. While I accept that, in the Draft Decision, I had taken a similar approach
in IN-18-05-05, this was necessitated by the fact that NOYB submitted a virtually identical complaint
in both inquiries and, when considering similar issues, I must ensure consistency and coherence with
prior decisions. I would further add that, given that both complaints concern the same group of
companies (i.e. Meta Platforms), a degree of similarity is inevitable. Notwithstanding this, I strongly
refute the allegation that I have “ignored” the positions of either NOYB or the CSAs, as expressed in
IN-18-05-05. Indeed, in preparing the Draft Decision, I carefully considered these submissions.

103. In respect of the serious allegation of bias, NOYB also restated its position that the Commission “has
also never provided any evidence, memo or other evidence to substantiate its claims that these
meetings did not have the substance that Facebook alleged before the Austrian courts” to support its

424
NOYB’s Submissions dated 19 August 2020, at p. 16.
425
NOYB’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 1.
426
NOYB’s Submissions on the Preliminary Draft dated 4 February 2022, at p. 2.
213

assertions of bias. 427 NOYB further stated that the Commission should have demanded a correction
from Meta Ireland and implied that the Commission’s failure to do so further supported its
allegations of bias.478 It simply cannot be the case that the Commission’s decision to not “demand a
correction” is indicative of bias by the Commission.

104. For the avoidance of doubt, I confirm that the Commission’s consultation function is distinct from
both its inquiry and decision-making functions. I further emphasise that the consultation functions
are not an endorsement or approval of a controller or processor’s compliance with the GDPR. It is
factually not the case that the Commission endorsed or approved the Instagram Terms of Use and
Data Policy that were in place at the time of the Complaint, or indeed of any other organisation.
Moreover, irrespective of any feedback that may or may not have been provided to Meta Ireland, or
any other organisation, the Commission always emphasises that the consultation function is entirely
distinct from any statutory inquiries, investigations, or decisions of the Commission. I also emphasise
that this decision-making process is also functionally independent of the procedure conducted by the
Investigator that led to the Final Report, just as the statutory inquiries are functionally independent
from any and all consultations with the Commission. The factual premise of the allegation is incorrect
and the test for bias has not been met.

105. I am therefore satisfied that fair procedures have been followed in this and every regard thus far
throughout the Inquiry.

5. Scope of the Complaint

a. Procedural Issues Arising in respect of the Scope of the Complaint

106. As outlined above, the Inquiry is complaint-based and its scope was defined as an examination as to
“whether or not Facebook as data controller for Instagram has discharged its obligations in
connection with the subject matter of the Complaint and determine whether or not any provision(s)
of the Act and/or the GDPR has been contravened by Facebook as data controller for Instagram in
this context”. 428 In this regard, I note that the scope of the Inquiry was defined by reference to the
Complaint. Accordingly, the scope or parameters of the Complaint determined the scope of the
resulting Inquiry.

107. In the course of the Inquiry, a disagreement as to the scope of the Complaint arose between NOYB
and the Investigator, such that NOYB alleged that the right to fair procedures had not been respected.
In a letter dated 3 December 2018, NOYB stated that the Complaint was “obviously not limited to the
issues you [i.e. the Investigator] identified”. 429 While NOYB accepted that the Commission could

427
NOYB’s Submissions on the Preliminary Draft Decision in IN-18-08-05 dated 11 June 2021, at p. 8.
478
NOYB’s Submissions on the Preliminary Draft Decision in IN-18-08-05 dated 11 June 2021, at p. 8.
428
Notice of Commencement of Inquiry dated 20 August 2018, at para. 7.
429
Letter from NOYB to the Commission dated 3 December 2018, at p. 4.
214

prioritise certain aspects of the Complaint, NOYB asserted that “[i]t cannot be the case that a
complaint has “one shot”, while the controller can freely maneuver [sic] in the response and does not
have to expect any further question or counterargument by the complainant”. 430

108. By letter dated 28 March 2018, the Investigator provided further information to NOYB as regards the
scope of the Complaint, noting his view that it “primarily relates to the lawful basis for processing
personal data in connection with the Instagram service”. 431 In this regard, the Investigator
considered the Complaint to concern two issues: first, whether the processing of personal data in
connection with the Instagram Terms of Service and/or Data Policy was consent for the purposes of
Article 6(1)(a) GDPR and Article 9(2)(a); and second, whether such consent was lawful. 432

109. In response, NOYB stated that it “reserve[d] the right to amend our arguments should one of the
controllers seek to depart from the factual or legal premises our complaints were based on”. 433 In
respect of the substantive issues identified by the Investigator, NOYB submitted that the “core issue
is clearly that the much stricter provisions on valid ‘consent’ under GDPR cannot be bypassed by
simply moving the consent element into terms and conditions”. 434 I note, for completeness, that
NOYB raised additional allegations concerning the scope of the Inquiry in the Open Letter on 25 May
2020.

110. In the Draft Report, the Investigator relied on a statement in the Complaint which read:

“For practical reasons, the scope of this complaint is explicitly limited to any processing operations
that are wholly or partly based on Article 6(1)(a) and/or Article 9(2)(a) of the GDPR. Our current
understanding is, that these are used as bases for all processing operations described in the
controller’s privacy policy…” 435436

111. Having outlined the scope, NOYB added that “[n]evertheless, nothing in this complaint shall indicate
that other legal bases the controller may rely on are not equally invalid or may not be equally the
subject of subsequent legal actions.” 437 This qualifying remark, while alluding to the fact that NOYB
may have other views in relation to other legal bases for data processing carried out by Meta Ireland
(within the context of the Instagram service), is evidently not one that describes the character of the
Complaint in question. While such a remark clearly refers to hypothetical positions NOYB may have

430
Letter from NOYB to the Commission dated 3 December 2018, at p. 3.
431
Letter from NOYB to the Complainant dated 28 March 2019, at p. 3.
432
Letter from NOYB to the Complainant dated 28 March 2019, at pp. 3 – 5.
433
Letter from NOYB to the Commission dated 19 April 2019, at p. 2. For completeness, I note that this letter was
drafted in the context of three distinct inquiries which concern similar complaints made by NOYB in respect of three
different processing operations/controllers.
434
Letter from NOYB to the Commission dated 19 April 2019, at p. 2.
435
Final Inquiry Report dated 18 January 2021, at para. 40, referring to the Complaint made on 25 May 2018, at para.
436
.6.
437
Complaint made on 25 May 2018, at para. 1.6.
215

or take in the future, it cannot alter the limiting character of the preceding statement in and of itself.
It instead clarifies that NOYB reserved its position in respect of any other legal bases on which Meta
Ireland may or may not rely.

112. The Investigator, carefully considering the Complaint and taking an objective reading, 438 identified
the following four issues as falling within the scope of the Complaint:

• Issue (a): whether the acceptance of the Terms of Use and/or Data Policy was an act of
consent;
• Issue (b): whether Meta Ireland could lawfully rely on necessity for the performance of a
contract to process data arising out of the data subject’s acceptance of those same
documents;
• Issue (c): Whether Meta Ireland misled and/or misrepresented the legal basis for processing
this data; and
• Issue (d): Whether Meta Ireland failed to provide the necessary information regarding its legal
basis for processing this data.

113. In submissions dated 19 August 2020 on the Draft Inquiry, NOYB asserted that (i) a Complainant could
“adapt” the Complaint as there “is no prohibition on filing new submissions” and (ii), in the
alternative, the contents of those submissions amounted to an “additional supplemental complaint”
as provided for in Article 47 GDPR. 439

114. In response to NOYB’s allegations, Meta Ireland submitted that:

“The Complainant has stated [in the Complaint] ‘the scope of this complaint is explicitly limited to
any processing operations that are wholly or partly based on Article 6(1)(a) and/or Article 9(2)(a)
of the GDPR’. As a result, processing pursuant to section 1 of the Terms of Service [sic] falls outside
of the Complaint and this Inquiry, given it is not based on Article 6(1)(a) or 9(2)(a)”. 440

115. While the Investigator carefully considered these submissions, he did not revise his view as to the
scope of the Complaint. 441 I should also note, in this regard, that Meta Ireland contended that the
scope of the Complaint should be limited to a consideration of processing which is objectively based
on consent. 442 The Investigator found that it was not necessary to engage in a factual “wide-ranging
trawl” of each one of Meta Ireland’s processing operations, but instead to carry out a legal and factual

438
See the Final Inquiry Report dated 19 January 2021, at para. 53.
439
NOYB’s Submissions on the Draft Inquiry Report dated 19 August 2020, at pp. 12 – 13.
440
Meta Ireland’s Submission dated 22 February 2019, at para. 2.12.
441
See the Final Inquiry Report dated 19 January 2021, at para. 86.
442
Meta Ireland’s Submissions on the Draft Inquiry Report dated 22 June 2020, at para. 1.3(D).
216

analysis based on the objective content of the Complaint itself. 443 This was based simply on an
assessment of the content of the Complaint.

116. While I acknowledge that NOYB made additional submissions on the substantive position I expressed
in the Preliminary Draft, 444 it is appropriate, I think, to assess at this juncture whether NOYB’s specific
allegations of procedural unfairness in how this was addressed by the Commission thus far have
merit. In the Open Letter, NOYB alleged (albeit in the context of a related inquiry) that “the
Investigator departed from the applications that were made in accordance with [Belgian] procedural
law and decided to investigate only certain elements of our complaint and to reinterpret our
requests.”495 Taking
a broad reading of NOYB’s submissions on the Preliminary Draft, 445 NOYB restated this concern in
those submissions.

117. I do not agree that this is an accurate or fair representation of what has taken place. As I (and indeed
the Investigator) have set out, Belgian – or any other national law other than Irish law – procedural
law does not apply in respect of the activities and/or functions of the Commission. I therefore, do
not accept that there is, in principle, a procedural defect in limiting the scope of a complaint-based
inquiry to the objective contents of the very Complaint that led the Commission to conduct an
Inquiry. As well as conforming to section 113 of the 2018 Act (set out earlier in this Schedule), this
approach is perfectly logical.

118. NOYB’s arguments in relation to any alleged procedural defects in the manner in which the scope of
the Complaint is to be determined, i.e. by the objective content of the Complaint, are based on
Belgian law, and on the LAPD, in particular. Insofar as that those arguments are based on Belgian
law, for reasons already set out and taking into account the competence of the Commission, the
Commission cannot consider those arguments, save to the extent that they raise issues of either Irish
or EU law.

119. Moreover, the decision to conduct a complaint-based Inquiry arising out of the contents of a
Complaint seems to me to be a perfectly logical approach. The alternative would be an open-ended
procedure, where the content of a “complaint” would crystallise at some unspecified future date.
The inherent problem with such an approach is that it would not amount to an inquiry based on the
Complaint which was lodged with the Commission, but would instead be an inquiry directed by NOYB,
with its subject matter and steps dictated on an evolving and ongoing basis by NOYB. Furthermore,
it is unclear how it could be said that such an approach constitutes a complaint that concerns

443
Final Inquiry Report dated 18 January 2021, at para. 57.
444
See NOYB’s Submissions on the Preliminary Draft in Inquiry-IN-18-05-05 dated 11 June 2021, at pp. 8 – 10.
495
Letter from NOYB to all DPAs dated 25 May 2020, at p. 6.
445
Again, as NOYB have requested for it submissions on the Preliminary Draft in Inquiry-IN-18-05-05 dated 11 June
2021 to be read as its submissions for this Inquiry, there are certain arguments which are not, in a literal sense,
applicable to this Inquiry. In particular, I refer to submissions made on Austrian law in this regard.
217

personal data relating to a complainant. This would presumably only occur once a complainant is
satisfied of receipt of all information they might require, and has been afforded the opportunity to
amend the complaint itself based on the submissions of the other party.

120. The unfairness that could arise from such an approach stems from the fact that it would, in effect,
enable a form of post-hoc amendment to an existing complaint over the course of an indefinite
period of time, which could only come to an end at a time and in a manner of the complainant’s
choosing. This would not only amount to a fundamentally one-sided approach, but would also alter
the character of an inquiry to the extent that it could no longer be described as “complaint-based”,
but rather “complainant-led”. Such a request following a Complaint that the Commission would
consider a series of extremely broad requests to fundamentally alter an inquiry and deviate from the
initial Complaint it had begun to investigate is therefore procedurally problematic. NOYB has pointed
to no legal provision that mandates this, aside from assertions made in relation to Belgian law that
have already been addressed herein.

121. I would add that this also applies to aspects of the Complaint that either reserve NOYB’s position or
express views on hypothetical investigative and/or corrective powers that, in NOYB’s personal view,
the Commission should exercise. I see no breach of fair procedures in considering the Complaint as
a whole in order to determine the exact infringements being alleged. At this juncture, I note that
NOYB may not compel the Commission, or indeed any other supervisory authority, to carry out
certain actions or impose particular corrective powers. Indeed, in this regard, I note that Article 52
GDPR stipulates that each supervisory authority must act with “complete independence” in
discharging its functions under the GDPR. Therefore, while I take account of the parties’ submissions,
I am not compelled to act or impose certain corrective powers by virtue of any such submissions.

122. NOYB, having lodged the Complaint with the Belgian DPA, responded to the Draft Report, which set
out clearly the submissions of Meta Ireland and the Investigator’s views on same. NOYB were also
afforded the opportunity to make submissions on the Preliminary Draft. No suggestion has been
made that the alternative procedure proposed by NOYB is a requirement of Irish law, nor that the
procedure that has been followed in relation to the scope breaches any rules of fair procedures in
Irish law. Moreover, I am unaware of any case law or statutory provisions in Irish law or EU law that
suggests that such an approach is contrary to NOYB’s right to fair procedures, and NOYB has not
referred to any such law in its submissions.

b. Substantive Scope of the Complaint

123. At a general level, this complaint-based Inquiry concerns the requirement under EU data protection
law for any entity collecting and processing personal data to establish “a lawful basis” for the
processing under Articles 6 GDPR. This particular Complaint was lodged by reference to the
Instagram service (for which Meta Ireland is the controller) and its lawful basis for processing user
personal data and “special category” personal data. I have set out, in summary form, the contents
of the Complaint and arguments contained in it at Section 2 of the Draft Decision.
218

Legislative Provisions
124. “Personal data” is defined under Article 4(1) GDPR as:

“any information relating to an identified or identifiable natural person (‘data subject’);
an identifiable natural person is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an identification number, location
data, an online identifier or to one or more factors specific to the physical, physiological,
genetic, mental, economic, cultural or social identity of that natural person”.

125. Moreover, Article 4(13) GDPR defines the “genetic data” referred to above as:

“personal data relating to the inherited or acquired genetic characteristics of a natural
person which give unique information about the physiology or the health of that natural
person and which result, in particular, from an analysis of a biological sample from the
natural person in question”.

126. Article 4(14) GDPR defines “biometric data” as:

“personal data resulting from specific technical processing relating to the physical,
physiological or behavioural characteristics of a natural person, which allow or confirm the
unique identification of that natural person, such as facial images or dactyloscopic data”.

127. Finally, “data concerning health” is defined by Article 4(15) GDPR as:

“personal data related to the physical or mental health of a natural person, including the
provision of health care services, which reveal information about his or her health status”.

128. The other special categories or personal data referred to in Article 9 GDPR are not defined in the
GDPR.

129. As set out above, Article 6 GDPR sets out the lawful bases for the processing of personal data. The
provisions of Article 6 that arise in this complaint-based Inquiry are the first two lawful basis listed in
the Article, in Articles 6(1)(a) and 6(1)(b) GDPR. Article 6(1) GDPR states:

“6. 1 Processing shall be lawful only if and to the extent that at least one of the following
applies:
(a) the data subject has given consent to the processing of his or her personal data for
one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is
party or in order to take steps at the request of the data subject prior to entering into a
contract;
219

(c) processing is necessary for compliance with a legal obligation to which the controller
is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of
another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest
or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the
controller or by a third party, except where such interests are overridden by the interests
or fundamental rights and freedoms of the data subject which require protection of
personal data, in particular where the data subject is a child.
Point (f)f the first subparagraph shall not apply to processing carried out by public
authorities in the performance of their tasks.”

130. A number of conditions for consent are enumerated in Article 7 GDPR:

“1. Where processing is based on consent, the controller shall be able to demonstrate that
the data subject has consented to processing of his or her personal data.

2. If the data subject’s consent is given in the context of a written declaration which also
concerns other matters, the request for consent shall be presented in a manner which is
clearly distinguishable from the other matters, in an intelligible and easily accessible form,
using clear and plain language. Any part of such a declaration which constitutes an
infringement of this Regulation shall not be binding.
3. The data subject shall have the right to withdraw his or her consent at any time. The
withdrawal of consent shall not affect the lawfulness of processing based on consent
before its withdrawal. Prior to giving consent, the data subject shall be informed thereof.
It shall be as easy to withdraw as to give consent.
4. When assessing whether consent is freely given, utmost account shall be taken of
whether, inter alia, the performance of a contract, including the provision of a service, is
conditional on consent to the processing of personal data that is not necessary for the
performance of that contract.”

131. Article 13(c) GDPR requires data controllers to provide information to data subjects on “the purposes
of the processing for which the personal data are intended as well as the legal basis for the
processing”.

132. Article 12(1) GDPR requires that “[t]he controller shall take appropriate measures to provide any
information referred to in Articles 13 and 14…to the data subject in a concise, transparent, intelligible
and easily accessible form, using clear and plain language…”.

My Consideration of the Scope of the Complaint

220

133. The starting point of the Complaint is that in accepting the Instagram Terms of Use (and, allegedly,
its Data Policy), all data processing is purported to have been brought under the lawful basis of
consent for the purposes of Article 6(1)(a) GDPR. This starting point was rejected in Meta Ireland’s
submissions. The Investigator also rejected this and, for the reasons set out below, I too rejected it
in the Draft Decision. This rejection of the foundational premise of the Complaint has inevitably
rendered the overall subject-matter of the Complaint effectively less cohesive.

134. The Complaint also refers to processing of special category data covered by Article 9 GDPR. NOYB’s
submissions on the Draft Report make further arguments in this regard, focussing on (i) the alleged
ability of Instagram to target users on the basis on special category data and (ii) the purported fact
that “messages, pictures, and all interaction data, event invitations or postings from other users
regularly contain special categories of data (e.g. messages on health or sex life and invitations to
political events)”. 446 I expressed the view that, in the Draft Decision, NOYB did not provide sufficient
evidence to substantiate these claims.

135. My view, as expressed in the Draft Decision was that, for the reasons set out above and the additional
reasons set out below where I expressed my views, in the Draft Decision, on the scope of the
Complaint, the Complaint even taken at its height quite clearly only concerned data processing
arising out of the act of acceptance. In the Draft Decision, I expressed the view that NOYB’s central
arguments on “forced consent” were predicated on the assertion by NOYB that the acceptance was
forcing consent to personal data processing for the purposes of the GDPR.

136. On this basis, I did not accept, in the Draft Decision, that the processing of sensitive categories of
personal data on the basis of Article 9 GDPR consent fell within the scope of this Inquiry. I noted, in
the Draft Decision, that there was no evidence that Meta Ireland processes special category data at
all in respect of the Instagram service. As set out in paragraph 32 of the Decision, the EDPB has taken
a different view, in the Article 65 Decision.

137. Having reviewed and considered all of the material submitted by NOYB, I concluded, in the Draft
Decision that the core of the issues raised by NOYB were as follows:

a. Accepting the Instagram Terms of Use offered by Meta Ireland in May 2018 specifically
constituted an act of consent to personal data processing under the GDPR. The precise extent
of the processing complained of is unclear in the Complaint. A particular focus was, however,
placed on both processing in order to deliver behavioural advertising, and on special category
data. NOYB also took issue with any unlawful processing based on this agreement, whatever
that agreement’s legal character might be. 447

446
NOYB’s Submissions on the Draft Inquiry Report dated 19 August 2020, at pp. 34 - 35.
447
NOYB’s Submissions on the Preliminary Draft in Inquiry-IN-18-05-05 dated 11 June 2021, at p. 9.
221

b. NOYB argued that 6(1)(a) GDPR, i.e. consent, is the mandatory, default lawful basis for
personal data processing where there is a contract or agreement primarily concerned with
personal data processing, or where the “declaration of intent” of the parties primarily
concerns data processing. 448

c. Consent under the GDPR is simply an indication of agreement by the data subject according
to NOYB. The necessary attributes of freely given, specific, informed and unambiguous are
merely “conditions for its validity”, but not features of objective “consent”.

d. As an alternative to point (a), Meta Ireland is not entitled to rely on the “necessary for the
performance of a contract” legal basis under Article 6(1)(b) GDPR other than for very limited
processing such as friends lists, photo albums, profiles and news. It therefore cannot rely on
this as an alternative legal basis to consent for the acceptance of the Terms of Use as a whole.
In this regard, NOYB argued that the “purpose” of the contract (in this case, the delivery of a
social media service) must be considered.

e. On the basis of the above, NOYB contended that clicking accept was an attempt by Meta
Ireland to seek consent under the GDPR but did not constitute not valid consent. NOYB
described this as “forced consent”, in that the only choice a user had in May 2018 was to
delete his/her account and stop using the service, and “hidden consent”, in that some of the
description of the Instagram service in the Terms of Use implicitly relies on processing of
personal data.

f. NOYB contended that Meta Ireland leads data subjects to believe that it relies on consent as
lawful basis for personal data processing and/or is not transparent about its lawful bases for
processing personal data.

138. On the other hand, Meta Ireland argued that it forms a contract with its users for the use of its (free)
Instagram service. The Commission observes that this is delivered in the form of a “Click Wrap”
agreement that the user signs up to when clicking “Agree to Terms” on the Terms of Use and it looks
similar to an industry standard format for such agreements. According to Meta Ireland, its intention
was to rely on the legal basis of Article 6(1)(b) GDPR (necessary for the performance of a contract)
for processing carried out on foot of the acceptance of the Terms of Use (and, for other separate
processing, it would rely on other legal bases).

139. In this regard, Meta Ireland claimed that the processing is necessary for the performance of the
contract with the Instagram user. Meta Ireland further alleged that the Instagram Data Policy further
sets out, in more detail, the other legal bases that would be relied on for other processing operations.

448
NOYB’s Submissions on the Preliminary Draft in Inquiry-IN-18-05-05 dated 11 June 2021, at p. 9.
222

Meta Ireland does not agree that it sought to persuade users that consent was the legal basis for all
personal data processing.

140. The Investigator analysed the arguments made by NOYB in the original Complaint submitted. It
seemed to me, when preparing the Draft Decision, that this was a sensible and correct approach.
This was not an “own volition” Inquiry where the Commission was entitled to scope matters of risk
which it decided warranted investigation. While it is normally the role of the Investigator to focus on
the establishment of facts, to set out what elements of the GDPR are engaged against those facts, to
come to a preliminary view on whether there are likely infringements identified which will then be
the subject of further legal analysis and ultimately decision-making by the Commission, this case is
somewhat different.

141. By reference to the above approach, the facts to be established are fairly limited and largely relate
to the wording of the Instagram Terms of Use and Data Policy, in addition to the User Engagement
Flow introduced in May 2018 to guide users through the process of acceptance process. In fact, it
appears
to me that the Investigator ended up devoting time responding to legal and theoretical assertions of
NOYB, such as the argument that consent is a lex specialis and therefore the mandatory legal basis
where a contract primarily concerns personal data processing. Consequently, the Final Report
contains more legal analysis and argument than might otherwise have been the case (relative to a
draft decision). I have considered all of the analysis of the Investigator carefully and, in some
instances, I adopt it and concur with it. In other instances, I reject it, replace it, and explain why.

142. Another feature of the Complaint is a section entitled “Applications”. In this section, NOYB requested
an investigation of a very specific nature, and sets out the corrective powers that NOYB believed
should be imposed i.e. an administrative fine and a prohibition on the “relevant processing
operations”. This section asked that the Commission:

“fully investigates this complaint, by especially using its powers under Article 58(1)(a), (e)
and (f) of the GDPR, to particularly determine the following facts:
(i.) which processing operations the controller engages in, in relation to the personal data
of the data subject,
(ii.) for which purpose they are performed,
(iii.) on which legal basis for each specific processing operation the controller relies on and
(iv.) he/she additionally requests that a copy of any records of processing activities (Article
30 of the GDPR) are acquired.”

143. The right to lodge a complaint with a supervisory authority is governed by Article 77 GDPR. Article
77(1) states how a complaint may be made: “every data subject shall have the right to lodge a
complaint with a supervisory authority…if the data subject considers that the processing of personal
data relating to him or her infringes this Regulation” [emphasis added]. Neither the request above,

223

nor a request to impose specified corrective powers, can be considered to constitute part of a
complaint made in accordance with Article 77(1) GDPR. NOYB does not specify any processing
operations or any alleged infringements of the GDPR in the above request, but simply asks the
Commission to gather information on its behalf. As I have stated above, neither the GDPR nor the
2018 Act confer a particular right on a Complainant to make such a request, nor to specify what
corrective powers should be imposed in circumstances where the supervisory authority is of the view
that an infringement has occurred/is occurring. To the extent that such an approach might be
provided for in Belgian law, I have already set out in detail why I do not accept that such law is
applicable to the exercise of my functions.

144. In those circumstances, it was for the Investigator, and ultimately for me as decision-maker, to carry
out an objective reading of the Complaint. In so doing, I must consider not only the content of the
Complaint, but also the legal framework by which the Commission is bound. It is also necessary that
an inquiry conducted on foot of a complaint must be feasible and workable. According to Article
77(1) GDPR, a complaint should relate to data processing that, in a complainant’s view, infringes the
GDPR. There is a lack of reasonable specificity in the above request in relation to processing
operations or alleged infringements.

145. Any request to investigate all processing, or hypothetical processing, particularly a request of such
an indefinite nature, does not, in my view, conform to the requirements of Article 77 GDPR. Such a
request does not specify any data processing or any alleged infringement, and would result in a
practically unworkable inquiry. Rather than being a complaint about specific processing operations,
the Complaint in this matter has, at times, strayed into the territory of instructing the Commission to
conduct an open-ended inquiry, and to direct that inquiry and the Commission’s resources in a
manner determined by NOYB. It is instead for the Commission to decide on the manner in which a
reasonably specific Complaint is to be investigated.

146. I set out my views as to scope (as outlined above) in the Preliminary Draft. In response, Meta Ireland
submitted that the Complaint was limited to “forced consent” and that the Commission’s analysis
and consideration of this Complaint must accordingly be limited to “forced consent”. 449 In support
of this position, Meta Ireland cited the EDPB’s Guidelines 09/2020 on relevant and reasoned
objections under Regulation 2016/679 which define a complaint-based inquiry as being one which is
“defined by the aspects addressed by the complaint or report”. 450 In essence, it is Meta Ireland’s
position that the Commission ought not have considered matters relating to Article 6(1)(b) GDPR or
Meta Ireland’s compliance with the transparency obligations.

449
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at paras. 3.1 – 3.3.
450
Meta Ireland’s Submissions on the Preliminary Draft dated 4 February 2022, at para. 3.3 citing EDPB’s Guidelines
09/2020 on relevant and reasoned objection under Regulation 2016/679, version 2.0 (adopted on 9 March 2021) at
para. 27.
224

147. The Complaint, as Meta Ireland correctly pointed out, concerns what is referred to as “forced
consent”. In making this Complaint, it is argued that there has been an attempt to mislead on Meta
Ireland’s part. Indeed, the Complaint rests on the allegation that Meta Ireland attempted to mislead
the Complainant and users generally by informing them that they were required to consent to certain
processing in order to remain an Instagram user. Following submissions from Meta Ireland to the
effect that it was not relying on consent but instead the performance of the contract as a legal basis,
NOYB went on to argue that the agreement had the appearance of consent, and that this in itself was
misleading. The Complainant has repeated this argument in the submissions on the Preliminary
Draft. 451

148. In the Draft Decision, I agreed with Meta Ireland to some extent that the Complaint primarily outlined
concerns as to “forced consent”, however, I was of the view that the Complaint was not solely limited
to consent. Rather, as I have outlined above, I expressed the view, in the Draft Decision, that the
Complaint concerned the legal basis of the processing503 and, where Meta Ireland had not sought to
rely on consent as the legal basis, it followed that the Commission was entitled to investigate and
consider the legal basis which Meta Ireland has in fact sought to rely on. In terms of the transparency
of the information provided, I would emphasise that the Complaint explicitly alleged that the
information provided on the legal bases (in the privacy policy) is such that data subjects “can only
guess what data is processed, for which exact purpose and on which legal basis. This is inherently
nontransparent and unfair within the meaning of Articles 5(1)(a) and 13(c)”. 452 I expressed the view,
in the Draft Decision, that this clearly concerned the transparency of the information provided and,
accordingly, I was of the view that it fell within the scope of the Complaint.

149. Accordingly, I was satisfied, as outlined in the Draft Decision, that the Complaint did raise issues
relating to (i) legal basis more generally and (ii) transparency in providing such information.

150. The Decision (incorporating this Schedule) therefore reflects the outcome of my determination on
the matters relating to the procedural and scope issues. The conclusions on scope reflected in this
Schedule 1 must read in conjunction with both Section 2 of this Decision as well as the corresponding
assessment and determination of the scope of the Complaint made by the EDPB in the Article 65
Decision, as summarised at paragraph 32 of the Decision.

451
NOYB’s Submissions on the Preliminary Draft in Inquiry-IN-18-05-05 dated 11 June 2021, at pp. 15 - 19.
503
For example, see Complaint dated 25 May 2018, at p. 19.
452
Complaint dated 25 May 2018, at p. 17.
225

Appendix 2 – The Article 65 Decision

226

Instagram'da Davranışsal Reklamcılığın Hukuki Dayanağı

Türkçe özet

Hukuki mesele

Sonuç

Karar metni