Davranışsal Reklamcılıkta Sözleşme Dayanağı

In the matter of the General Data Protection Regulation

DPC Inquiry Reference: IN-18-5-5

In the matter of LB, a complainant, concerning a complaint directed against Meta Platforms Ireland
Limited (formerly Facebook Ireland Limited) in respect of the Facebook Service

Decision of the Data Protection Commission made pursuant to Section 113 of the Data Protection Act,
2018 and Articles 60 and 65 of the General Data Protection Regulation

Further to a complaint-based inquiry commenced pursuant to Section 110 of the Data Protection Act,
2018

DECISION

Decision-Maker for the Commission:

Helen Dixon
________________________________

Commissioner for Data Protection

Dated the 31st day of December 2022

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland

1. INTRODUCTION AND PROCEDURAL BACKGROUND

PURPOSE OF THIS DOCUMENT

1.1 This document is the Decision (“the Decision”) of the Data Protection Commission (“the
Commission”), made in accordance with Section 113 of the Data Protection Act, 2018 (“the 2018
Act”), arising from an inquiry conducted by the Commission, pursuant to Section 110 of the 2018
Act (“the Inquiry”).

1.2 The Inquiry, which commenced on 20 August 2018, examined whether Meta Platforms Ireland
Limited (formerly Facebook Ireland Limited) (“Facebook”) complied with its obligations under the
EU General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament
and of the Council) (“the GDPR”) in respect of the subject matter of a complaint made by Ms. L.B.
(“the Complainant”). While Facebook Ireland Limited has since changed its name to Meta
Platforms Ireland Limited, with effect from 5 January 2022, the relevant events, for the purpose
of the Inquiry, occurred prior to this name change. In the circumstances, the term “Facebook” is
used throughout this Decision to denote Meta Platforms Ireland Limited, the company formerly
known as Facebook Ireland Limited. Similarly, Facebook, Inc. changed its name to Meta Platforms,
Inc. on 28 October 2021 and any references, within this Decision, to “Facebook, Inc.” should be
understood as meaning Meta Platforms, Inc., the company formerly known as Facebook, Inc.

1.3 The complaint was referred to the Commission by the Austrian Data Protection Authority, Die
Österreichische Datenschutzbehörde (“the Austrian DPA“) on 30 May 2018 (“the Complaint“). In
advance of the preparation of this Decision, a preliminary draft of this document (“the Preliminary
Draft Decision”) was circulated to Facebook and the Complainant’s representative so as to enable
them to make submissions on my provisional findings. The submissions of these parties have been
taken into account in finalising this Decision.

1.4 This Decision further reflects the binding decision that was made by the European Data Protection
Board (the “Board” or, otherwise, the “EDPB”) pursuant to Article 65(2) of the GDPR 1 (the “Article
65 Decision”), which directed changes to certain of the positions reflected in the draft decision
that was presented by the Commission for the purposes of Article 60 of the GDPR (the “Draft
Decision”), as detailed further below. The Article 65 Decision will be published on the website of
the Board, in accordance with Article 65(5) of the GDPR, and a copy of same is attached at
Schedule 2 to this Decision.

1 Binding Decision 3/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its

Facebook service (Art. 65 GDPR), adopted on 5 December 2022
2

1.5 Further details of procedural matters and a chronology pertaining to the Inquiry are set out in
Schedule 1 to this Decision.

2. FACTUAL BACKGROUND AND THE COMPLAINT

FACTUAL BACKGROUND

2.1 Facebook is an online social network and social media platform. In order to access the Facebook
platform, a prospective user must create a Facebook account. To create a Facebook account, a
prospective user is required to accept a series of terms and conditions, referred to by Facebook
as their Terms of Service (the “Terms of Service”). When a prospective user accepts the Terms of
Service, the terms contained therein constitute a contract between the (new) user and Facebook.
It is only on acceptance of the Terms of Service that the individual becomes a registered Facebook
user.

2.2 In April 2018, Facebook updated the Terms of Service to give effect to changes it sought to
implement to comply with the obligations which would arise when the GDPR became applicable
from 25 May 2018. Among the obligations under the GDPR, as under Directive 95/46/EC, was the
fundamental requirement that data controllers have a lawful basis for any processing of personal
data they undertake. Legal bases provided for in the GDPR include consent of the data subject,
necessity for the purposes of the performance of a contract with the data subject or processing
necessary for the purposes of the legitimate interests of the data controller. In addition, under
the GDPR, controllers are required to provide detailed information to users at the time personal
data is obtained in relation to the purposes of any data processing and the legal basis for any such
processing. In essence, there must be a legal basis for each processing operation (of personal
data) and there must be transparency in the communication of such information to individual
users. Prior to the GDPR taking legal effect, no detailed requirement existed for a controller to
explicitly state what legal basis they relied on in processing particular categories of personal data.

2.3 To continue to access the Facebook platform, all users were required to accept the updated Terms
of Service prior to 25 May 2018. The updated Terms of Service were brought to the attention of
existing Facebook users by way of a series of information notices and options on the Facebook
platform, referred to as an “engagement flow” or “user flow”. The engagement flow was
designed to guide users through the processing of deciding whether to accept the updated Terms
of Service. The option to accept the updated “terms” was presented to users at the final stage of
the engagement flow. The final stage of the engagement flow also contained embedded
hyperlinks to the full text of the Terms of Service, the Data Policy and the Cookies Policy. As
referenced in the full text of the Terms of Service, the Data Policy provides information to users
on Facebook’s processing of personal data in respect of the Facebook platform.

2.4 Existing users who were not willing to accept the new terms were advised of the option to delete
their Facebook account. Such users were informed that they could no longer use the Facebook
3

platform without accepting the new terms. Prior to deletion of the account, the users were also
informed of the option to download a copy of their personal data which had undergone
processing by Facebook.

2.5 Users who did continue through the new “engagement flow” were given the opportunity to
consent or not to consent to a number of specific data processing activities, including the use of
facial recognition. Provision of consent for such processing was not presented as a prerequisite
for continuing to use the service. In other words, these were choices the user could make above
and beyond the decision to sign up to the service, and users are free to use the service without
providing consent to this processing.

2.6 Figures 2.1 and 2.2, below, are screenshots of the final stage of the “engagement flow” which
brought an existing user, the Complainant, through the process of accepting the updated Terms
of Service. The screenshots are in German; an English translation can be found below.

Figure 2.1

4

Figure: 2.2

2.7 An English translation (via machine-translation) of the text is as follows:

Figure 2.1: “Please accept our updated Terms of Service to continue using Facebook. We have
updated our Terms of Service to explain in more detail how our service works and what we expect
from all Facebook uses. You can now more easily control your data as well as your privacy and
security settings in the settings. We have also updated our Data Policy and our Cookie Policy. These
now also take into account new features that we are working on and explaining. By clicking "I
agree", you accept the updated Terms of Service. If you do not want to accept the terms of use,
you can find your options under this link.”

Figure 2.2: “If you do not agree, you can no longer use Facebook. You can delete your account and
have the option to download a copy of your information beforehand. Close/Delete Account”.

5

OVERVIEW OF THE COMPLAINT

2.8 The Complaint was made in the context of Facebook’s updated Terms of Service and the
requirement for existing users to accept the new terms to continue to access the Facebook
platform.

2.9 In respect of the updated Terms of Service, the Complainant alleges that she was given a binary
choice: either accept the Terms of Service and the associated Data Policy by selecting the “accept”
button, 2 or delete her Facebook account. The Complainant’s argument is predicated on the Data
Policy being incorporated into the Terms of Service. This claim is disputed by Facebook. 3 The
Complainant further alleges that Facebook relied on “forced consent” to process personal data
on the basis that “the controller required the data subject to agree to the entire privacy policy and
the new terms” 4 and did not give users a genuine choice to decline the updated terms without
suffering detriment.

2.10 In addition, the Complainant alleges that it is unclear which specific legal basis is being relied on
by the controller for each processing operation. Indeed, she argues that “[i]t remains,
nevertheless, unclear which exact processing operations the controller chooses to base on each
specific legal basis” 5 as “[t]he controller simply lists all six bases for lawful processing under Article
6 of the GDPR in its privacy policy without stating exactly which legal basis the controller relies
upon for each specific processing operation.” 6 In connection with this, the Complainant expresses
particular concern with reliance on Article 6(1)(b) GDPR as a legal basis for the processing
operations detailed in the Terms of Services; extracts from the Terms of Service which relate to
these processing operations are found below.

2.11 As the GDPR requires controllers to provide detailed information to users at the time when
personal data are obtained, including the provision of information about the purposes of the
processing as well as the legal bases for the processing, the Complainant argues that this lack of
information breaches the transparency obligations in the GDPR. 7

2.12 In the submissions on the Preliminary Draft Decision made on the Complainant’s behalf, it is
argued that the Commission has “failed to investigate the relevant facts”. 8 As far as it has been

2
For completeness, it should be noted that Facebook disputes the claim that the Data Policy is part of the Terms of
Service.
3
Facebook Submissions on Draft Report, paragraph 7.1(A)
4
Complaint, page 3.
5
Ibid.
6
For completeness, it should be noted that the legal bases for processing of personal data include consent of the
data subject, necessity based on the requirement to fulfil a contract with the data subject or processing based on
the legitimate interests of the data controller. There is no hierarchy as between these legal bases set down in the
GDPR.
7
Ibid, page 6 and paragraph 2.3.4.
8
Complainant Submissions on Preliminary Draft Decision, paragraph 4.1.
6

possible to discern from the submissions, it appears that this assertion is linked to the
Complainant’s contention that the Commission has misconstrued the scope of the Complaint
and/or failed to carry out particular acts or investigative steps that the Complainant has
demanded of the Commission. I address this submission in the consideration of the scope of the
Complaint below and in Schedule 1 to this Decision. In reality, the essential facts relevant to this
Complaint are simple and not in dispute; it is the legal assessment of these facts under the GDPR
that requires determination in this Complaint.

2.13 The sections of the Terms of Service that relate to the data processing complained of are as
follows:

“Our Services:

Our mission is to give people the power to build community and bring the world closer
together. To help advance this mission, we provide the Products and services described
below to you:

Provide a personalized experience for you:
Your experience on Facebook is unlike anyone else's: from the posts,
stories, events, ads, and other content you see in News Feed or our video
platform to the Pages you follow and other features you might use, such
as Trending, Marketplace, and search. We use the data we have - for
example, about the connections you make, the choices and settings you
select, and what you share and do on and off our Products - to
personalize your experience.

Connect you with people and organizations you care about:
We help you find and connect with people, groups, businesses,
organizations, and others that matter to you across the Facebook
Products you use. We use the data we have to make suggestions for you
and others - for example, groups to join, events to attend, Pages to follow
or send a message to, shows to watch, and people you may want to
become friends with. Stronger ties make for better communities, and we
believe our services are most useful when people are connected to
people, groups, and organizations they care about.

Empower you to express yourself and communicate about what matters to you:
There are many ways to express yourself on Facebook and to
communicate with friends, family, and others about what matters to you -
for example, sharing status updates, photos, videos, and stories across
the Facebook Products you use, sending messages to a friend or several

7

people, creating events or groups, or adding content to your profile. We also have
developed, and continue to explore, new ways for people to use
technology, such as augmented reality and 360 video to create and share
more expressive and engaging content on Facebook.

Help you discover content, products, and services that may interest
you:
We show you ads, offers, and other sponsored content to help you
discover content, products, and services that are offered by the many
businesses and organizations that use Facebook and other Facebook
Products. Our partners pay us to show their content to you, and we
design our services so that the sponsored content you see is as relevant
and useful to you as everything else you see on our Products.

Combat harmful conduct and protect and support our community:
People will only build community on Facebook if they feel safe. We
employ dedicated teams around the world and develop advanced
technical systems to detect misuse of our Products, harmful conduct
towards others, and situations where we may be able to help support or
protect our community. If we learn of content or conduct like this, we will
take appropriate action - for example, offering help, removing content,
blocking access to certain features, disabling an account, or contacting
law enforcement. We share data with other Facebook Companies when
we detect misuse or harmful conduct by someone using one of our
Products.

Use and develop advanced technologies to provide safe and
functional services for everyone:
We use and develop advanced technologies - such as artificial
intelligence, machine learning systems, and augmented reality - so that
people can use our Products safely regardless of physical ability or
geographic location. For example, technology like this helps people who
have visual impairments understand what or who is in photos or videos
shared on Facebook or Instagram. We also build sophisticated network
and communication technology to help more people connect to the
internet in areas with limited access. And we develop automated systems
to improve our ability to detect and remove abusive and dangerous
activity that may harm our community and the integrity of our Products.

Research ways to make our services better:
We engage in research and collaborate with others to improve our

8

Products. One way we do this is by analyzing the data we have and
understanding how people use our Products. You can learn more about
some of our research efforts.

Provide consistent and seamless experiences across the Facebook Company Products:
Our Products help you find and connect with people, groups, businesses,
organizations, and others that are important to you. We design our
systems so that your experience is consistent and seamless across the
different Facebook Company Products that you use. For example, we use
data about the people you engage with on Facebook to make it easier for
you to connect with them on Instagram or Messenger, and we enable you
to communicate with a business you follow on Facebook through
Messenger.

Enable global access to our services:
To operate our global service, we need to store and distribute content
and data in our data centers and systems around the world, including
outside your country of residence. This infrastructure may be operated
or controlled by Facebook, Inc., Facebook Ireland Limited, or its affiliates

……………………….

How do we use your information

We use the information we have (subject to choices you make) as described below and to
provide and support the Facebook Products and related services described in the Facebook
Terms and Instagram Terms. Here's how:

Provide, personalize and improve our Products.
We use the information we have to deliver our Products, including to
personalize features and content (including your News Feed, Instagram
Feed, Instagram Stories and ads) and make suggestions for you (such as
groups or events you may be interested in or topics you may want to
follow) on and off our Products. To create personalized Products that are
unique and relevant to you, we use your connections, preferences,
interests and activities based on the data we collect and learn from you
and others (including any data with special protections you choose to
provide where you have given your explicit consent); how you use and
interact with our Products; and the people, places, or things you're
connected to and interested in on and off our Products. Learn more
about how we use information about you to personalize your Facebook

9

and Instagram experience, including features, content and
recommendations in Facebook Products; you can also learn more about
how we choose the ads that you see.

• Information across Facebook Products and devices: We connect
information about your activities on different Facebook Products and
devices to provide a more tailored and consistent experience on all
Facebook Products you use, wherever you use them. For example, we
can suggest that you join a group on Facebook that includes people
you follow on Instagram or communicate with using Messenger. We
can also make your experience more seamless, for example, by
automatically filling in your registration information (such as your
phone number) from one Facebook Product when you sign up for an
account on a different Product.

• Location-related information: We use location-related information such
as your current location, where you live, the places you like to go, and the
businesses and people you're near-to provide, personalize and improve our
Products, including ads, for you and others. Location related information can be
based on things like precise device location (if you've allowed us to collect it), IP
addresses, and information from your and others' use of Facebook Products (such
as check-ins or events you attend).

• Product research and development: We use the information we have
to develop, test and improve our Products, including by conducting
surveys and research, and testing and troubleshooting new products
and features.

• Face recognition: If you have it turned on, we use face recognition
technology to recognize you in photos, videos and camera
experiences. The face-recognition templates we create are data with
special protections under EU law. Learn more about how we use face
recognition technology, or control our use of this technology in
Facebook Settings. If we introduce face-recognition technology to
your Instagram experience, we will let you know first, and you will have
control over whether we use this technology for you.

• Ads and other sponsored content: We use the information we have
about you-including information about your interests, actions and
connections-to select and personalize ads, offers and other sponsored
content that we show you. Learn more about how we select and

10

personalize ads, and your choices over the data we use to select ads
and other sponsored content for you in the Facebook Settings and
Instagram Settings.

Provide measurement, analytics, and other business services.
We use the information we have (including your activity off our Products,
such as the websites you visit and ads you see) to help advertisers and
other partners measure the effectiveness and distribution of their ads
and services, and understand the types of people who use their services
and how people interact with their websites, apps, and services. Learn
how we share information with these partners.

Promote safety, integrity and security.
We use the information we have to verify accounts and activity, combat
harmful conduct, detect and prevent spam and other bad experiences,
maintain the integrity of our Products, and promote safety and security
on and off of Facebook Products. For example, we use data we have to
investigate suspicious activity or violations of our terms or policies, or to
detect when someone needs help. To learn more, visit the Facebook
Security Help Center and Instagram Security Tips.

Communicate with you.
We use the information we have to send you marketing communications,
communicate with you about our Products, and let you know about our
policies and terms. We also use your information to respond to you when
you contact us.

Research and innovate for social good.
We use the information we have (including from research partners we
collaborate with) to conduct and support research and innovation on
topics of general social welfare, technological advancement, public
interest, health and well-being. For example, we analyze information we
have about migration patterns during crises to aid relief efforts. Learn
more about our research programs.”

SCOPE OF THE COMPLAINT

2.14 I have carried out my assessment of the scope of the Complaint to the extent that it relates to
specified data processing and specified alleged infringements of the GDPR. A chronology of issues
that arose in this regard (1) as between the parties and (2) as between the parties and the
Commission in the course of establishing the substantive scope of the Complaint is included in

11

Schedule 1. Also included in Schedule 1 are details of the approach I have adopted in determining
the scope of the Complaint. In determining the precise parameters of the scope of the Complaint,
I have had regard to the Complaint as a whole and, in particular, have taken note of the express
statements in the Complaint which define its scope. I have also had regard to the Investigator’s
analysis in respect of the scope of the Complaint.

2.15 On his assessment of the Complaint, the Investigator concluded that there were four key issues
to be analysed in the context of his Inquiry: 9

a. Whether clicking “accept” on the Terms of Service was to be construed as an act of
consent, or must be an act of consent, to the processing of personal data for the purposes
of the GDPR – the Investigator’s conclusions 1 and 2 of the Final Report address this
issue

b. Whether Facebook could rely on Article 6(1)(b) GDPR as a lawful basis for processing
personal data with respect to its Terms of Service – the Investigator’s conclusion 3 of the
Final Report addresses this issue

c. Whether Facebook misrepresented the legal basis for processing in a manner that caused
the Complainant to believe that consent was relied upon – the Investigator’s conclusions
4 and 10 of the Final Report address this issue

d. Whether Facebook had failed to provide the necessary information regarding its legal
basis for processing in connection with its Terms of Service and Data Policy – the
Investigator’s conclusions 5, 6, 7, 8 and 9 of the Final Report address this issue

2.16 I agree with the Investigator’s summary of the core issues in respect of issues (a) and (b). In
respect of issues (c) and (d), however, I take a different view.

2.17 Issue (c), as identified by the Investigator, solely addresses the allegation that Facebook has
misrepresented the lawful basis relied on in connection with the Terms of Service. I agree that
this issue falls within the scope of the Complaint. Issue (d), however, was treated by the
Investigator as a generalised assessment of whether Facebook’s Data Policy complies with Article
13(1)(c) GDPR as a whole with regard to processing conducted on foot of Article 6(1)(b) GDPR.
This is based on the fact that the Complaint states, in generalised terms, that:

“It remains, nevertheless, unclear which exact processing operations the controller
chooses to base on each specific legal basis under Article 6 and Article 9 of the GDPR.

9
Final Report, paragraph 7.
12

The controller simply lists all six bases for lawful processing under Article 6 of the GDPR in
its privacy policy without stating exactly which legal basis the controller relies upon for
each specific processing operation.” 10

2.18 It is on that basis that the Investigator interpreted the scope of the Complaint as comprising the
allegation that the Data Policy breaches Article 13(1)(c) GDPR. It is crucial, however, to view the
above quotation in the context of the subsequent statement which says:

“In any case, the controller required the data subject to “agree” to the entire privacy policy
and to the new terms.

This leads to our preliminary assumption, that all processing operations described therein
are based on consent, or that the controller at least led the data subject to believe that all
these processing operations are (also) based on Article 6(1)(a) and/or 9(2)(a) of the
GDPR.” 11

2.19 I do not accept that the factual question of whether Facebook “misled” the data subject (i.e. issue
(c)) is a separate legal question from whether Facebook complied with its transparency
obligations in the context of processing allegedly carried out pursuant to Article 6(1)(b) GDPR (i.e.
issue (d)). There is no distinct legal issue raised by the question whether, as a matter of fact, the
Complainant did or did not believe that the processing was based on Article 6(1)(a) GDPR (i.e.
consent) and not on Article 6(1)(b) GDPR (i.e. necessity for the performance of a contract). If
Facebook has breached its transparency obligations, it logically follows that the Complainant will
have been unlawfully “misled”, whether deliberately or otherwise. If Facebook has complied with
its transparency obligations, it cannot be the case that the Complainant was unlawfully misled.
On that basis, my view is that issues (c) and (d) are essentially concerned with the same issue.

2.20 In the submissions on the Preliminary Draft Decision, the Complainant’s representative argues
that the questions answered by the Preliminary Draft Decision do “not even come close” to
covering all aspects of the Complaint. 12 However, it is clear, as set out herein and in Schedule 1,
that this Complaint is limited to allegedly unlawful processing carried out on foot of the
“agreement” i.e. the acceptance of the Terms of Service, and the extent to which the nature of
that agreement was misleading. I therefore do not accept that the questions addressed in the
Preliminary Draft Decision do not cover all aspects of the Complaint.

2.21 The Complainant’s submissions on the Preliminary Draft Decision further argue that there has
been a failure to investigate the relevant facts. It is argued that there is a fundamental

10
Complaint, paragraph 1.3.
11
Ibid page 3.
12
Complainant Submissions on Preliminary Draft Decision, paragraph 4.2.

13

disagreement as to whether the agreement the Complainant has accepted is “a contract” or “a
consent”. 13 This issue was dealt with extensively in the Preliminary Draft Decision and is
determined below in this Decision.

2.22 While the Complainant’s submissions on the Preliminary Draft Decision call for the Commission
to engage in a thorough investigation as to the nature of this agreement, having regard to the
scope of the Complaint, this is, in my view, entirely unnecessary and would not divulge any new
Information or serve a useful purpose at this stage. As is set out in Section 3 below, there is no
dispute in relation to the fact that there is a contract between Facebook and the Complainant or
the fact no consent within the meaning of the GDPR has been provided by the Complainant in
concluding the “agreement” in dispute. What is in dispute, as set out in detail in this Decision and
in Schedule 1, is the lawfulness of the personal data processing and the transparency of the
information provided.

2.23 Following the circulation of the Draft Decision to the supervisory authorities concerned for the
purpose of enabling them to express their views in accordance with Article 60(3) GDPR, the
supervisory authorities of Austria, Germany, France, the Netherlands and Portugal raised
objections in relation to the Commission’s assessment of the scope of the Complaint, as
summarised above.

Having considered those objections, the EDPB determined, at paragraph 197 of the Article 65
Decision, that the inquiry underpinning this Decision ought to have included an examination
of “[Facebook’s] processing operations, the categories of data processed (including to identify
special categories of personal data that may be processed), and the purposes they serve”.
Accordingly, the EDPB directed, at paragraph 198 of the Article 65 Decision, the Commission
to commence a new inquiry into these matters. While that direction cannot be addressed by
the Commission in this Decision, the Commission considers it necessary to note the position,
in light of the Commission’s assessment of the scope of the Complaint (as already recorded
above) and for the purpose of ensuring compliance with its obligation, pursuant to Article 65(6)
GDPR, to adopt its final decision on the basis of the Article 65 Decision. The EDPB further
directed the Commission to remove its proposed conclusion on Finding 1 (as set out in the
Draft Decision). That aspect of matters is addressed at the conclusion of the Commission’s
assessment of Issue 1, below.

2.24 On the basis of the above, the issues that will be addressed in this Decision are as follows:

• Issue 1 – Whether clicking on the “accept” button constitutes or must be considered consent
for the purposes of the GDPR

• Issue 2 – Reliance on Article 6(1)(b) as a lawful basis for personal data processing

13
Ibid, paragraph 4.3.1.
14

• Issue 3 – Whether Facebook provided the requisite information on the legal basis for
processing on foot of Article 6(1)(b) GDPR and whether it did so in a transparent manner.

3 ISSUE 1 – WHETHER CLICKING ON THE “ACCEPT” BUTTON CONSTITUTES OR MUST BE CONSENT FOR THE PURPOSES OF
THE GDPR

WHETHER THE ACCEPTANCE IS CONSENT

3.1 As I have outlined in Section 2, the Complainant alleges that clicking on the “accept” button of the
engagement flow presented to existing users in respect of Facebook’s updated Terms of Service
in April 2018 constituted an act of consent by the data subject for the purposes of Article 6(1)(a)
GDPR. The first question to be considered is whether Facebook, via the updated Terms of Service,
sought to obtain the Complainant’s “consent” for the purposes of processing of personal data
under those Terms of Service. Facebook’s position, as noted above, is that it did not.

3.2 In this regard, I note that the Complainant’s position partly rests on several arguments to the
effect that the design of the engagement flow is “deceptive”. 14 The Complainant expresses
particular concerns in respect of the final stage of the engagement flow and alleges that the
acceptance process is set out in a misleading manner, such that a reasonable user would, and
indeed the Complainant did in fact, believe that they are consenting for the purposes of Article 6
GDPR to data processing rather than simply signing up to a contract. 15 These arguments in relation
to the alleged misleading nature of the user engagement flow will be considered as part of Issue
3 in the context of transparency requirements. This first issue is solely concerned with whether
reliance is placed on the legal basis of consent.

3.3 In this context, I will first consider whether, as a matter of fact, Facebook sought to rely on consent
at all as a legal basis. I will subsequently assess whether, as a matter of law, Facebook was obliged
to seek consent as a legal basis for processing, as the Complainant argues.

3.4 In its submissions on the Draft Report made to the Investigator, the Complainant argues that the
“scope of application” of consent and the “conditions of validity” under the GDPR must be
distinguished. The Complainant further argues that the “scope” of consent is any “expression of
will by which the data subject indicates his consent to the processing of his personal data". 16 The
“conditions of validity” are, in the Complainant’s view, the elements of the definition of consent
set out in Article 4(11) GDPR. The Complainant further argues that “[t]o come up with the crazy
idea that a violation of the conditions of consent automatically leads to the inapplicability of these

14
Complainant Submissions on Final Report, page 16.
15
Ibid, page 11.
16
Ibid, page 40.

15

conditions is a legal shot in the foot.” 17 The Complainant’s position is that there are some
circumstances in which only consent - and no other legal basis - is applicable, and therefore that
there are circumstances where consent must be applicable even if the data controller is not
seeking to rely on consent and the definition in Article 4(11) GDPR is not met. In the Complainant’s
view, this should result in a declaration that the data processing based on consent is unlawful for
want of compliance with these “conditions of validity”.

3.5 Facebook’s position is that “[t]he agreement to enter into a contract is a wholly separate matter
to any form of consent to data processing…”, 18 and that:

“Article 4(11) GDPR is not relevant in this instance as Facebook Ireland is not seeking to
rely on it (and the alternative legal basis sought to be relied on is valid). It is not the case
that all types of processing must be assessed against the formal requirements under
Article 4(11) GDPR. Indeed as the Draft Report acknowledges, consent is merely one of six
possible bases upon which data processing may be legitimised under Article 6 GDPR. It is
Facebook Ireland’s position that an assessment against the formal requirements under
Article 4(11) is only necessary and should only be undertaken where a controller purports
to rely on consent. Put another way, where the controller relies on a different legal basis
for a processing purpose, the analysis as to whether or not the processing is lawful should
be undertaken in respect of the specific requirements for only that legal basis.”

3.6 In light of this confirmation by the data controller that it does not seek to rely on consent in this
context, there can be no dispute that, as a matter of fact, Facebook is not relying on consent as
the lawful basis for the processing complained of. It has nonetheless been argued on the
Complainant’s behalf that Facebook must rely on consent, and that Facebook led the Complainant
to believe that it was relying on consent. It should be acknowledged that Facebook relies on
consent for some personal data processing activities on the platform, which users can provide or
not provide through mechanisms distinct from the initial accepting of the Terms of Service.

3.7 The Investigator expressed the view that:

“…while the GDPR specifies that certain well-defined agreements as to processing (i.e.
consent, as defined by the conditions set out in Article 4(11)) may legitimise processing
under Article 6(1)(a), it does not expressly require that all agreements regarding
processing must be legitimised on this basis.” 19

3.8 Article 4 GDPR, as its title makes clear, sets out a series of definitions applicable under the GDPR
as a whole. Article 4(11) GDPR merely defines consent for the purposes of the GDPR, including for

17
Ibid.
18
Submission 22 February 2019, paragraph 2.6.
19
Final Report, paragraph 129.
16

the purpose of Article 6(1)(a) GDPR and Article 7 GDPR which sets out certain conditions for
consent where it is being relied upon as the legal basis of processing. Article 4(11) GDPR does not,
however, purport to determine the circumstances in which consent may be relied upon as a legal
basis. While consent for the purposes of the GDPR must satisfy the definition in Article 4(11)
GDPR, that provision does not in itself determine the circumstances in which consent may be
relied upon as a legal basis for processing. Any other reading of Article 4(11) GDPR is not
consistent with a systematic reading of the GDPR when it is clear that the legislator intended
Article 4 GDPR to provide definitions. Other definitions, such as that of “controller”, “processor”,
“main establishment” and “cross-border processing” are clearly just that: definitions. In any
event, I am of the view that, in the context of this Complaint, this issue is an academic one. The
key point for the purpose of this Decision is that Facebook never sought to obtain consent from
users through the clicking of “accept” to the Terms of Service.

3.9 I put the views set out above to the Parties in the Preliminary Draft Decision. Facebook submitted
that “the Complainant’s position is legally and factually wrong” and that Facebook “…does not
seek to obtain consent to data processing from users when users are asked to contractually agree
to its Terms of Service”. 20 Moreover, Facebook submits that it:

“…did not request or require the data subject’s consent to processing described in the Data
Policy nor did it seek the data subject’s consent to the processing described in, or otherwise
performed for the purposes of, the Terms of Service, and as a consequence that the data
subject did not in fact consent in this manner”. 21

3.10 This confirms the position set out in the Preliminary Draft Decision: Facebook did not rely on
consent as a legal basis for processing in this context. On this basis, Facebook expressed its
agreement with the provisional finding that “it is not legally obliged to rely on consent in order to
deliver the Terms of Service and endorses the unequivocal decision of the Commission to reject the
[Complainant’s] argument…”. 22

3.11 In contrast, the Complainant’s submissions on the Preliminary Draft Decision argue that the
alleged contract is an example of falsa demonstratio i.e. that Facebook has held out particular
clauses as constituting part of a contract when, as a matter of law, they actually do not. 23 The
Complainant in this regard relies on the perceived intention of the parties, the “economic
background and common understanding”, and the fact that the shift from reliance on consent to
reliance on necessity for the performance of a contract was recent.

20 Facebook Submissions on Preliminary Draft Decision, paragraph 1.7(B). See also paragraph 3.1
21
Ibid, paragraph 3.1.
22
Facebook Submissions on Preliminary Draft Decision, paragraph 4.1.
23
Ibid, 4.4.1.
17

3.12 While this argument may be relevant in the context of reliance on Article 6(1)(b) GDPR – which is
considered as the second issue below – it does not address the essential issue arising for the
purposes of Article 6(1)(a) GDPR. In this case, Facebook is not relying on consent as a legal basis
for processing of personal data under the Terms of Service. Indeed, the parties appear to agree
that acceptance of the Terms of Service is not valid consent for the purposes of the GDPR.

3.13 For these reasons, I proposed, by way of the Draft Decision, to conclude that, as a matter of fact,
Facebook did not rely, or purport to rely, on the Complainant’s consent as a legal basis for the
processing of personal data under the Terms of Service.

As noted already above, however, the EDPB instructed the Commission (by way of paragraph
198 of the Article 65 Decision) to remove, from its Draft Decision, “its conclusion on Finding
1”. Finding 1 included proposed conclusions on two linked questions, namely: (i) whether
Facebook sought to rely on consent in order to process personal data to deliver the Terms of
Service; and (ii) whether Facebook was legally obliged to rely on consent in order to do so.
Given that my previously proposed conclusion (as noted immediately above) in relation to the
first of these questions is encompassed by the EDPB’s instruction, I make no finding on this
first question.

WHETHER THE CONTROLLER MUST RELY ON CONSENT

3.14 Based on a new understanding of this issue that evolved during the course of this Inquiry, the
Complainant made what I consider to be an alternative argument: namely, that Facebook was
legally obliged to rely on consent and that, as Facebook has not done so, the processing was
consequently unlawful.

3.15 In the Complainant’s submissions on the Preliminary Draft Decision, it is denied that the
Complainant advanced such an argument. 24 I have dealt with this point in part in footnote 36 of
Schedule 1. It remains the case that the Complainant has argued that where “the subject matter
of the declaration of intent…is primarily data processing” 25 the appropriate legal basis must derive
from Article 6(1)(a) GDPR, and where the subject matter of the contractual offer “is primarily
some other contractual service”, 26 the legal basis can derive from Article 6(1)(b) GDPR. In my view,
it is difficult to interpret this as anything other than an argument that consent is the only
appropriate legal basis for agreements primarily concerning data processing. This is, to put it
another way, a suggestion that consent is a higher order of legal basis, at least in respect of
agreements that primarily involve data processing. This being so, and for completeness, I will now

24
Complainant Submissions on Preliminary Draft Decision, paragraph 4.4.2.
25
Submissions on Draft Inquiry Report, page 35.
26
Ibid.

18

consider whether consent under Article 6(1)(a) GDPR must be relied on by the controller in this
context.

3.16 The Investigator points out that the Complaint begins by claiming that the data subject “had to
agree to” Facebook’s Terms of Service and Data Policy at the time of the update in April 2018. 27
In my view it is critically important to distinguish between agreeing to a contract (which may
involve processing of personal data) and providing consent to personal data processing
specifically for the purposes of legitimising that personal data processing under the GDPR. As
noted by the EDPB, these are entirely distinct concepts which “have different requirements and
legal consequences”. 28 In particular, these are distinct legal bases for the processing of personal
data under Article 6(1)(a) and 6(1)(b) GDPR, with all the consequences that this entails.

3.17 In this context, it is important to emphasise that GDPR does not set out any form of hierarchy of
lawful bases that can be used for processing personal data, whether by reference to the categories
of personal data or otherwise. 29 There is no question that “one ground has normative priority over
the others”. 30 This position is reflected in the Guidance of the Article 29 Working Party, which,
although not legally binding, is nonetheless instructive in considering this issue. 31 I also note that,
in the context of Directive 95/46/EC, which preceded the GDPR, the Court of Justice of the
European Union (“the CJEU”) has explicitly held that obtaining the data subject’s consent is not a
requirement for reliance on the “legitimate interests” legal basis. 32 The CJEU thereby rejected the
argument that consent was a necessary legal basis in circumstances where the data controller
sought to rely on another legal basis under Article 7 of the Directive. I have been pointed to no
authority which supports the view that there is a particular lawful basis that is intrinsically
preferable over others, or that one legal basis has legal primacy over any other, or that fulfilling
one legal basis is a precondition for fulfilling a separate legal basis. In these circumstances, the
reasoning of the CJEU in respect of Article 7 of Directive 95/46/EC is equally applicable to Article
6 GDPR. Indeed, notwithstanding the thrust of the argument initially advanced, the Complainant’s
submissions on the Preliminary Draft Decision now acknowledge that there is no hierarchy of legal
bases under the GDPR. 33

27
Final Report, paragraph 111, Complaint, Paragraph 1.3.
28
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision
of online. services to data subjects, paragraph 17,
https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines-art_6-1-b-
adopted_after_public_consultation_en.pdf.
29
C Kuner et al eds, The EU General Data Protection Regulation: A Commentary (Oxford 2020), page 329.
30
Ibid.
31
Guidance 06/2014, page 10, at https://ec.europa.eu/justice/article-29/documentation/opinion-
recommendation/files/2014/wp217_en.pdf.
32
Asociaţia de Proprietari bloc M5A-ScaraA v TK Case 708/18, paragraph 41.
33
Complainant Submissions on the Preliminary Draft Decision, paragraph 4.4.2.
19

3.18 For this reason, if and insofar as it arises, I conclude that neither Article 6(1) GDPR nor any
provision of the GDPR requires that the processing of personal data in particular contexts must
necessarily be based on consent under Article 6(1)(a) GDPR.

3.19 In many cases involving a contract between a consumer and an organisation, the lawful basis for
processing of personal data is “necessity for the performance of a contract” under Article 6(1)(b)
GDPR. It cannot be said that the fact of agreeing to certain contractual terms necessarily means
that any processing of personal data under such contract is based on consent for the purposes of
the GDPR. The question of whether a data controller can rely on Article 6(1)(b) GDPR turns on the
terms of the particular contract, and whether the impugned processing operation(s) is/are
necessary in order to bring about the performance of that contract. The nature and content of a
contract freely entered into by two parties cannot, however, introduce a higher category of, or
‘default’, legal basis. Nothing in the GDPR supports the view that there is any such higher category
or default legal basis. 34 I also note in this regard that the EDPB has advised that, in circumstances
in which data processing is necessary to perform a contract, consent is not, in fact, an appropriate
lawful basis on which to rely. 35

3.20 I note, in this regard, that the Complainant has argued that a contract for a service with a social
network “primarily” concerns data processing and on this basis should be based on consent. 36 At
the same time, the Complainant asserts that the data processing in question is in fact not
necessary for the performance of that same contract. I am unaware of any case-law or authority
that suggest that companies cannot rely, at least in part, on Article 6(1)(b) GDPR as a legal basis
for processing personal data simply because their businesses “primarily” concern data processing.

3.21 In truth, the Complainant’s arguments in this respect appear to be made in support of the
separate argument that Facebook cannot rely on Article 6(1)(b) as a lawful basis for processing. If
the Complainant succeeds in that latter argument, it follows that another legal basis must be
relied on and in this instance, in the Complainant’s view, that legal basis would have to be consent.
In my view, this alternative argument – to the effect that consent is the only remaining possible
lawful basis because no other basis can be used lawfully for this particular agreement – is properly
considered in the context of the second issue in the complaint, i.e. whether Facebook is entitled
to rely on Article 6(1)(b) GDPR.

3.22 Finally, I note the Complainant’s reliance on Article 7(2) GDPR, which states:

34
C Kuner et al eds, The EU General Data Protection Regulation: A Commentary (Oxford 2020), page 329.
35
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of
online services to data subjects, paragraph 17, https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines-
art_6-1-b-adopted_after_public_consultation_en.pdf.
36
Submissions on Draft Inquiry Report, page 35.
20

“If the data subject’s consent is given in the context of a written declaration which also
concerns other matters, the request for consent shall be presented in a manner which is
clearly distinguishable from the other matters, in an intelligible and easily accessible form,
using clear and plain language. Any part of such a declaration which constitutes an
infringement of this Regulation shall not be binding.”

3.23 I also note the Complainant’s reliance on Article 7(4) GDPR, which states:

“When assessing whether consent is freely given, utmost account shall be taken of
whether, inter alia, the performance of a contract, including the provision of a service, is
conditional on consent to the processing of personal data that is not necessary for the
performance of that contract.”

3.24 Article 7 GDPR concerns ‘conditions for consent’ and is only relevant for consideration where
consent is being relied upon as the legal basis for processing in the first instance. This was the
view of Advocate General Szpunar in Planet49. 37 Article 7 GDPR is not, in and of itself, indicative
of which lawful basis a controller must or indeed should rely on in a particular context. Instead,
where a controller is relying on consent, Article 7 GDPR assists in determining whether the
‘conditions for validity’ (to use the Complainant’s own language) have been met.

3.25 I further note that the EDPB Guidelines on consent consider a number of circumstances in which
“bundling” (or what the Complainant refers to as “forced consent” or “hidden consent”) may
occur. This occurs when consent can neither be freely given nor easily withdrawn because the
provision of consent is made part of the terms of a contract, particularly in circumstances where
there is an unequal balance of power between the data controller and the data subject. 38 This,
however, only becomes relevant when the controller purports to rely on consent in the first place.

3.26 Having considered the submissions of the parties, including the submissions on the Preliminary
Draft Decision, I proposed to conclude, in the Draft Decision, that the legal basis for processing of
personal data under the Terms of Service between Facebook and its users, including the
Complainant, does not, as a matter of law, have to be consent under Article 6(1)(a) GDPR and, as
a matter of fact, Facebook does not rely on consent for this purpose and the agreement to the
Terms of Service does not constitute consent for the purposes of the GDPR.

As noted already above, however, the EDPB instructed the Commission (by way of paragraph
198 of the Article 65 Decision) to remove, from its Draft Decision, “its conclusion on Finding
1”.

37
Case 673/18 Planet49 GmbH v Bundesverband der Verbraucherzentralen und Verbraucherverbände –
Verbraucherzentrale Bundesverband e.V, (Opinion of AG Szpunar) paragraph 97.
38
Guidelines 05/2020 on consent under Regulation 2016/679:
https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf. Pages 6-7.
21

Accordingly, I make no finding on the matters encompassed by the above assessment of Issue 1.

4 ISSUE 2 - RELIANCE ON ARTICLE 6(1)(B) GDPR AS A LAWFUL BASIS FOR PERSONAL DATA PROCESSING

4.1 As set out above, the Complainant contends that Facebook’s processing of personal data under
the Terms of Service must be based entirely on consent as a legal basis under the GDPR. The
Complainant’s argument also rests on the contention that Facebook cannot rely on Article 6(1)(b)
GDPR to process personal data in order to perform the Terms of Service.

4.2 In considering this issue, I will first address the relationship between the Terms of Service and
the Data Policy. This assessment is necessary as the Complainant argues that she “agreed” to
the Data Policy by accepting Facebook’s updated Terms of Service. Facebook has argued that this
position is not correct. After coming to a conclusion on this matter, I will then consider the
substantive question of whether Facebook is entitled to rely on Article 6(1)(b) GDPR as a lawful
basis for the processing of personal data.

THE RELATIONSHIP BETWEEN THE TERMS OF SERVICE AND DATA POLICY

4.3 The Complainant alleges that in clicking the “accept” button, she agreed to both the Data Policy
and the Terms of Service and that the alleged non-compliance is compounded by the agreement
to both documents. 39 In examining this aspect of the Complaint, the Investigator was of the view
that that the data subject’s formal agreement to the Data Policy was not a component of the
data subject’s contract with Facebook. The Investigator also acknowledged in the Final Report
that the Complainant seems to have conceded that there is no “consent” and therefore no
“agreement” to the Data Policy. 40

4.4 In respect of this matter, the Investigator concluded that, as Facebook has stated that the Terms
of Service “make up this entire agreement” between Facebook and the Facebook user, there is
no explicit indication, in the view of the Investigator, that Facebook intends the separate Data
Policy to be part of that agreement. When Facebook sought agreement to the terms under
dispute in this Inquiry, it invited users to also accept the updated Terms of Service and also
included information on the Data Policy. In the Investigator’s view, this illustrates that the Terms
of Service and the Data Policy are entirely separate. Facebook’s position is that the Data Policy is
simply a compliance document setting out information required by the GDPR, whereas the
contractual document is the Terms of Service. 41

39
Complaint, page 3.
40
Final Report, paragraph 145.
41
Facebook Submissions on Preliminary Draft Decision, paragraphs 5.5 - 5.6.
22

4.5 I note, therefore, the Investigator’s consideration of whether the Complainant was forced to
consent to all of the processing operations set out in the Data Policy. In my view, the acceptance
in question is not an act of consent but, on its terms, constituted acceptance of, or agreement
to, a contract i.e. the Terms of Service. Although the Data Policy was hyperlinked in the final stage
of the engagement flow, I am not satisfied that the Data Policy was thereby incorporated into
the Terms of Service. The “accept” button clearly referred to acceptance of the “terms” as
distinct from the Data Policy (and indeed the Cookies Policy). In my view, the Data Policy is as
Facebook has characterised it:

“While the Terms of Service list Facebook Ireland’s services and obligations, the delivery
and discharge of which require certain processing of personal data, they do not attempt
to comprehensively list Facebook’s Ireland’s processing since the Data Policy does this and
is the primary document to be considered when it comes to Facebook Ireland’s GDPR
obligations under Article 13. The distinct objectives and nature of these documents is
further outlined in Sections 2 and 3 above where we have explained that agreement is
merely sought to the Terms of Service but not for the Data Policy which functions as a
transparency and not a contractual document.” 42

4.6 The Data Policy is a document through which Facebook seeks to comply with particular provisions
of the GDPR in relation to transparency, whereas the Terms of Service is the contract between
Facebook and its user. Facebook relies on various legal bases for various data processing
operations, some of which are based on consent and some of which are based on contractual
necessity. Where the legal basis of contractual necessity is relied on, the contract in question is
the Terms of Service. In my view, the contract in question, and therefore the contract for which
the analysis based on Article 6(1)(b) GDPR must take place, is the Terms of Service only. The Data
Policy is only relevant insofar as it sheds light on the processing operations carried out for which
Facebook relies on Article 6(1)(b) GDPR. It is essentially an explanatory document. After
considering these views, which were set out in the Preliminary Draft Decision, Facebook
expressed agreement with the provisional conclusions of the Commission in this regard. 43 The
Complainant’s submissions on the Preliminary Draft Decision did not express any further views
on this issue.

4.7 The Data Policy itself references a very wide range of processing operations. As noted in Schedule
1, the Complainant sought to direct the Commission to conduct an assessment of all processing
operations carried out by Facebook. I have explained why it is not open to a Complainant – who
must present a complaint with a reasonable degree of specificity – to demand such an
assessment. While the Complaint refers to various examples of data processing, e.g. the
processing of behavioural data, it does not go so far as to directly link the Complaint to specific
processing operations by reference to an identifiable body of data with any great clarity or

42
Submissions on Draft Report, paragraph 7.1(A)
43
Ibid.
23

precision. In the circumstances, it is necessary to consider the issue relating to reliance on Article
6(1)(b) GDPR at the level of principle, and my findings are made on that basis.

4.8 More specifically, insofar as the Complaint refers to particular processing activities, it has a
specific focus on data processed to facilitate behavioural advertising. This will accordingly be the
focus of the analysis in this Decision.

4.9 In order to ensure that this Inquiry has a reasonable degree of specificity, I will therefore consider
whether Facebook can, in principle, rely on Article 6(1)(b) GDPR for processing under the
contract, including and in particular in the context of behavioural advertising.

THE COMPLAINT, THE SUBMISSIONS OF THE PARTIES, AND THE REPORT

4.10 The Complainant argues that Facebook is not entitled to rely on Article 6(1)(b) GDPR, i.e. personal
data processing that is necessary for the performance of a contract, as a legal basis. The
Complainant contends that Facebook could only rely on Article 6(1)(b) GDPR in respect of
processing that is “strictly necessary” to perform the contract, and that such processing must be
linked to “core” functions of the contract. To support this view, the Complainant relies on Opinion
06/2014 of the Article 29 Working Party which recommended that “[t]he contractual necessity
lawful basis must be interpreted strictly and does not cover situations where the processing is not
genuinely necessary for the performance of a contract, but rather unilaterally imposed on the
data subject by the controller”.44

4.11 Specifically, the Complainant argues that the personalisation of posts and communication
features constitutes a “core” element of Facebook’s contract, but that personalised advertising
does not. The Complainant’s position is premised on the idea that there is an identifiable
“purpose” or “core” of each contract which is discernible by reference to the contract as a whole
and the intention of the parties (as opposed to being strictly limited to the text of the contract).
The Complainant is therefore asking that an assessment of the Terms of Service be carried out to
determine what the “core” purpose of the contract is. It would follow from the Complainant’s
position that any processing that is not strictly necessary to fulfil these “core” purposes or
objectives, cannot be carried out on foot of Article 6(1)(b) GDPR.

4.12 The Complainant takes issue with a lack of “differentiation” as between specific clauses or
elements of the contract in the Commission’s approach. 45 The Complainant argues that
“investigation” and “fact finding” should have taken place in order to determine what specific
elements of the contract are used by Facebook to justify specific processing operations. Firstly, it

44
Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive
95/46/EC, page 16, https://ec.europa.eu/justice/article-29/documentation/opinion-
recommendation/files/2014/wp217_en.pdf.
45
Complainant Submissions on Preliminary Draft Decision, paragraph 4.5.2.
24

is clear from the Terms of Service, which is, in the Complainant’s own words, a very descriptive
document, that Facebook intends to provide behavioural advertising as part of its contractual
service. While my view, as set out in Section 5 below, is that there have been significant failings
of transparency in relation to this processing, that does not change this basic fact that behavioural
advertising forms part of the service offered by Facebook. As noted above, the Complaint has a
specific focus on behavioural advertising. On that basis, and having regard to the need for a
reasonable degree of specificity in the presentation and investigation of complaints, it is not
necessary to undertake a comprehensive investigation of each and every processing operation
under the Terms of Service. I also emphasise, as I explain in further detail below, that I intend to
order Facebook to bring its documents into compliance for transparency purposes. Such an order
would vindicate the right of the Complainant and data subjects as a whole to get an answer to
“which specific clauses of the “Terms of Service” are used by Facebook to justify the specific
purpose of its processing, the type of data processed, and the applicable legal basis.” 46 What such
information would not do, is assist in deciding the question of principle as to whether Facebook
can rely on Article 6(1)(b) GDPR in order to provide a service that includes behavioural or targeted
advertising.

4.13 As a preliminary matter, I emphasise that issues of interpretation and validity of national contract
law are not directly within the Commission’s competence. Nonetheless, it is important to note
that the legal concept of a “purpose” or “core” of a contract is one more often found in civil law
jurisdictions. The Commission’s role is in any event limited to interpreting and applying the GDPR
and, in interpreting and applying Article 6(1)(b) GDPR specifically, it must always be borne in mind
that the Commission is not competent to rule directly on matters of national contract law or to
determine questions of the general validity of a contract.

4.14 In this regard, I note that the Complainant explicitly sought to have the Commission investigate
and make findings in respect of contract and consumer law. In the Preliminary Draft Decision I
stated that I agree with the position of the Investigator that this falls outside the remit of a
supervisory authority under the GDPR and is, in any case, the subject of both an Austrian
consumer case against Facebook being pursued by Mr. Schrems, Honorary Chair of noyb, over the
last 6 years, 47 and the Bundeskartellamt case being pursued by that office since 2016. 48 I further
noted that the Investigator correctly drew the Complaint’s attention to the relevant Irish
consumer and competition authorities, which have competence in this regard. I went on to
observe that these legal regimes would be a more appropriate avenue for the Complainant to
ventilate the issues surrounding contract law referred to above.

46
Ibid.
47
Mag. Maximilian Schrems v Facebook Ireland Limited, Case 3 Cg 52/14k-91,
https://noyb.eu/sites/default/files/2020-06/Urteil%20FB_geschw%C3%A4rzt.pdf.
48
See, for example, https://www.lexology.com/library/detail.aspx?g=abb936bc-8f3e-4f82-9266-2b3c591a2517.

25

4.15 In the Complainant’s submissions on the Preliminary Draft Decision, the Complainant took issue
with these provisional conclusions. They were described as “a perversion of justice”, “an insult to
any informed reader”, “a cheap trick”, “simply a lie”, “(at best) too lazy” and “a wilful abuse of
office”, all within the same fifteen lines of text. 49 The Commission rejects, in the strongest terms,
these serious allegations of mala fides, dishonesty and otherwise illegal conduct. Such allegations
go far beyond what is commonly encountered in even the most robustly argued set of submissions
in an adversarial regulatory dispute. They have, moreover, been made without any foundation in
fact or evidence and appear to be based solely on the fact that the there is a difference between
the Complainant’s/the Complainant’s representative’s interpretation of the law and the
interpretation of the law set out in the Preliminary Draft Decision. The fact that the Complainant
and/or the Complainant’s representative have presented their arguments in this way is not
conducive to the proper handling and investigation of Complaints and is to be regretted.

4.16 The Complainant argues that in order to determine the nature of the “agreement”, it is necessary
to fully inquire into the nature and scope of the agreement, and to apply Austrian contract law in
so doing. In making this argument, the Complainant relies on a number of principles of contract
law including Directive 93/13/EC (“the Unfair Terms Directive”). Reliance on the law of contract
and on the Unfair Terms Directive is misplaced. If the Complainant contends that there is no
contract, or that aspects of the Terms of Service do not constitute a lawfully formed contract or
lawful and/or fair terms of the contract, it is open to her to pursue this matter before a relevant
authority or before a court of law. The Commission is not empowered to make decisions as to the
validity of contracts, be they consumer contracts or otherwise and, in particular, it has no
jurisdiction whatsoever to make decisions in respect of Austrian contract law. The Commission is
tasked with interpreting and applying the GDPR. Where the GDPR refers to a contract, the
Commission cannot determine the interpretation and validity of such a contract for the purposes
of the law more generally. The Commission is no more empowered to do this by law than it would
be to declare processing based on compliance with a legal obligation under Article 6(1)(c) GDPR
to be unlawful simply because a complainant would argue that the legal obligation being relied
on was unconstitutional in their country. These are matters for the national courts or such other
bodies as may be conferred with the jurisdiction to make such determinations under domestic
law. Any such decision on the part of the Commission would be ultra vires the 2018 Act, for
reasons explained in detail when I considered the extent of the Commission’s powers earlier in
this Decision. I do not accept that this amounts to “a denial of justice”,50 for the reasons there set
out.

4.17 The Complainant argues that the “Our Services” section of the Terms of Service “are all neutral
factual descriptions. Neither a duty of the user nor a service from Facebook results from the

49
Complainant Submissions on Preliminary Draft Decision, paragraph 4.5.1.
50
Ibid.

26

wording”.51 The Complainant also argues that showing any user advertisements is a “factual
procedure” rather than a contractual obligation or duty. 52 In addition, the Complainant’s
argument endeavours to draw a distinction between “implicit consent”, i.e. some form of
agreement that is implicit or obvious within a contract for services, and “compulsory consent”, i.e.
consent which is made contingent on the acceptance of a contract.53 Applying the narrow
interpretation of Article 6(1)(b) GDPR that is proposed by the Complainant, the argument is that
the processing required to deliver the “factual” services set out in the contract cannot fall within
Article 6(1)(b) GDPR. This rests on the aforementioned distinction drawn by the Complainant
between processing that is strictly necessary to deliver the “core” objectives of the service i.e.
providing a social network, and factual events simply mentioned or described in the contract i.e.
showing advertisements.

4.18 The Complainant has further argued that this “take it or leave it” approach to signing up or
continuing to use Facebook (to use the Complainant’s terminology) in any event does not
constitute processing that is permitted by Article 6(1)(b) GDPR. To assess whether the
Complainant’s interpretation of Article 6(1)(b) GDPR is correct, I must first consider whether the
processing which is carried out on foot of the acceptance of the contract is necessary to perform
that contract. In essence, this requires an assessment of whether the services offered by
Facebook pursuant to the contract are necessary to fulfil the contract’s core functions.

4.19 In advancing the argument that Article 6(1)(b) GDPR can only be relied on to legitimise data
processing that constitutes “a core element of a social network”, 54 the Complainant relies on
guidance of the EDPB. Moreover, the Complainant argues that, inter alia, Facebook has made a
“ridiculous and impractical assertion that advertising (and similar secondary processing) is a core
service.” 55 The Complainant further argues that:

“Other elements which represent the core product of the platform (e.g. the user's page,
exchange of news, contact book, photo uploads) are, according to the public opinion,
certainly the subject of the product "social network" and thus the subject of the contract
- irrespective of the designation in the clauses.”

4.20 The Complainant is therefore of the view that this particular interpretation should be applied to
the circumstances of the Complaint by conducting an assessment as to what constitutes the
“core” of the contract between the user and Facebook. The argument is that any services (such
as, in the Complainant’s view, advertising and “secondary processing”) which do not form part of

51
Submissions on Draft Report, paragraph 2.1.2
52
Ibid, paragraph 2.1.7.
53
Ibid, Paragraph 3.4.3.6.
54
Complaint, page 4.
55
Complainant Submission on Draft Report, paragraph 2.1.6.
27

the activities which are strictly necessary to fulfil the core objective of the contract cannot be
rendered lawful by Article 6(1)(b) GDPR.

4.21 Put very simply, the Complainant is advancing a narrow and purpose-based interpretation of
Article 6(1)(b) GDPR, that argues that the data processing should be the least invasive processing
possible in order to fulfil the objective of the contract (here, what the overall contract sets out to
do, rather than only what the contract says). In contrast, Facebook is advancing a broader
interpretation that facilitates a certain degree of contractual freedom in relation to how broad
the data processing might be, provided that the processing is in fact necessary to perform a term
of the specific contract. Facebook argues that it is entitled to rely on Article 6(1)(b) GDPR to deliver
services in a contract even if that processing is not the most minimal processing available to it in
order to deliver the service being provided.

4.22 Facebook argues that there is no basis to contend that Facebook, in clearly relying on a contract
with the user, has attempted to mislead the user and to “infer” consent from a user. Facebook’s
position is that the condition of necessity for contractual performance “does not mean that
processing must be essential to the performance of the contract, or the only way to perform the
underlying contract”. 56 Facebook emphasises that, rather than being required to use the most
minimal processing possible in order to perform the contract, contractual freedom must allow the
parties to exercise a certain element of agency in coming to an agreement, even where that
agreement might involve the delivery of a service primarily using data processing. Facebook’s
position is therefore that the Complainant’s interpretation (and proposed application) of the
GDPR is incorrect and excessively narrow, insofar as the contract between Facebook and its users
are concerned.

4.23 Facebook also argues that there is an absence of meaningful rationale in the Complaint as to why
any of the elements of its service described in Section 1 of its Terms of Service cannot be based
on Article 6(1)(b) GDPR. It submits that “Article 6(1)(b) forms part of the right to data protection,
it is not a derogation or limitation on the right. It operates as a safeguard by explaining the
circumstances in which the personal data can be processed”.57 Facebook’s position is that the
Commission should apply a broader interpretation of Article 6(1)(b) GDPR, such that processing
that is necessary to deliver a contract can be lawful irrespective of whether the specific processing
is essential, or the most minimal way, to deliver the service. In relation to targeted behavioural
advertising specifically, Facebook argues that:

“Beyond ensuring the continued financing of the provision and development of the Service,
which is itself of significant benefit to users (as the Complaint explicitly recognises), the
data processing activities undertaken by Facebook Ireland primarily enable Facebook
Ireland to provide its personalised services to users (including curating individual’s News

56
Submissions on Draft Report, paragraph 4.2.
57
Submission on Draft Report 29 July 2019, paragraph 4.2.
28

Feed, the content they see, connections suggested, advertising and other commercial
content, shortcuts suggested and elements of the features they can enjoy). This is itself
the core of the Service and one of the principal reasons why users value the Service over
and above the services provided by Facebook Ireland’s competitors.” 58

4.24 The Investigator acknowledged the difficulties in interpreting contractual necessity in vacuo,
where there is limited harmonisation of contract law at European level and where the Commission
is not competent to rule on matters of contract law. 59 The Investigator expressed particular
doubts about applying a test based on what is necessary to fulfil the core functions/objectives of
a contract given the lack of certainty surrounding it. 60 The Investigator concluded that the concept
of necessity in Article 6(1)(b) GDPR “includes processing which is necessary to perform the full
agreement entered into between the parties, including optional or conditional elements of
contract.”. 61

4.25 The Investigator’s position is in contrast to that of the Complainant, which is that “necessity”
should be assessed strictly by reference to its meaning as an element in the proportionality test
in applying Article 52(1) of the European Charter of Fundamental Rights and Freedoms (“the
Charter”), i.e. that the measure be strictly necessary in order to fulfil the objective.

WHETHER FACEBOOK CAN RELY ON ARTICLE 6(1)(B) GDPR

4.26 In coming to a conclusion on this matter in the Preliminary Draft Decision, I had regard to the
Guidelines of the EDPB on processing for online services based on Article 6(1)(b) GDPR. While
these Guidelines are not strictly binding and address this issue in general terms, they are
nonetheless instructive in considering this issue. The Guidelines state in clear terms that “the
processing in question must be objectively necessary for the performance of a contract with a data
subject”.62 In my view, this turns on a consideration of what is meant by the concepts of
“performance, “necessity” and “contract” as understood in the context of data protection law
and the application of these concepts to the specific contract relied upon for the purposes of
Article 6(1)(b) GDPR. This remains my view in the context of this Decision.

4.27 It is, in my view, important to have regard not just to the concept of what is “necessary”, but also
to the concept of “performance”. The EDPB has stated that the controller should ensure “that
processing is necessary in order that the particular contract with the data subject can be

58
Submissions on Draft Report, paragraph 1.4.
59
Final Report, page 47.
60
Ibid, page 48.
61
Ibid, paragraph 203.
62
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of
online services to data subjects https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines-art_6-1-b-
adopted_after_public_consultation_en.pdf, paragraph 22.

29

performed.” 63 A contract is performed when each party discharges their contractual obligations
as has been agreed by reference to the bargain struck between the parties. It follows that what is
“necessary” for the performance of a contract is anything that, if it did not take place, would mean
the specific contract had not been performed. In this regard, I note that the mere inclusion of a
term in a contract does not necessarily mean that it is necessary to perform the particular
contract. This understanding is consistent with the EDPB Guidance which states that the
processing will be necessary for the performance of a contract if “the main subject-matter of the
specific contract with the data subject cannot, as a matter of fact, be performed if the specific
processing of the personal data in question does not occur”. 64 It remains the case however that
necessity cannot be considered entirely in the abstract, and careful regard must be had for what
is necessary for the performance of the specific contract freely entered into by the parties.

4.28 The EDPB states that there is:

“…a distinction between processing activities necessary for the performance of a contract,
and terms making the service conditional on certain processing activities that are not in
fact necessary for the performance of the contract. ‘Necessary for performance’ clearly
requires something more than a contractual condition” [my emphasis]. 65

4.29 The Guidelines also set out that controller should:

“demonstrate how the main object of the specific contract with the data subject cannot,
as a matter of fact, be performed if the specific processing of the personal data in question
does not occur. The important issue here is the nexus between the personal data and
processing operations concerned, and the performance or non-performance of the service
provided under the contract.” 66

4.30 On the question of necessity, I note that the EDPB has stated that the meaning of necessity as
understood in EU law must be considered when having regard to a provision of EU law, including
data protection law. 67 This is an uncontroversial statement. I also note that in Heinz Huber v
Bundesrepublik Deutschland, the CJEU held in the context of Directive 95/46 that necessity is an
existing principle of EU law that must be interpreted in a manner that “reflects the objective of
that directive”. 68 It is important to highlight, as the Investigator has, 69 that in the same case the

63
Ibid, paragraph 26.
64
Ibid, paragraph 30.
65
Guidelines 2/2019, paragraph 27.
66
Ibid, paragraph 30.
67
Ibid, paragraph 23.
68
Case C‑524/06, Heinz Huber v Bundesrepublik Deutschland, 18 December
2008, para. 52.
69
Final Report, paragraph 202(vi).

30

CJEU held that processing beyond the most minimal to meet the objective will still meet the
necessity test if it renders a lawful objective “more effective”. 70 However, the EDPB proposes clear
limits to this by stating “merely referencing or mentioning data processing in a contract is not
enough to bring the processing in question within the scope of Article 6(1)(b).” 71

4.31 The EDPB Guidelines assess necessity by reference to the “core” function of the contract. This is
supportive of the Complainant’s position that the “core” functions of a contract must be assessed
in order to determine what processing is objectively necessary in order to perform it. I agree with
this assessment for the reasons set out by the EDPB. In this vein, I would add that necessity is to
be determined by reference to the particular contract as between the parties. Indeed, the
question to be asked is whether the processing operation(s) is/are is necessary to fulfil the
“specific” 72 or “particular” 73 contract with the data subject. This is the view taken by the EDPB
and, as Article 6(1)(b) GDPR clearly refers to the specific contract between a data controller and
a data subject, I am in agreement with the EDPB in this regard.

4.32 In accordance with the EDPB Guidelines, the processing in question must be more than simply the
processing of personal data which is referenced in the terms of the contract. Rather, it must be
necessary in order to fulfil the clearly stated and understood objectives or “core” of the contract.
The “core functions” cannot, however, be considered in isolation from the meaning of
“performance”, the meaning of “necessity” as set out above, and the content of the specific
contract in question. The question is therefore not what is necessary to fulfil the objectives of “a
social network” in a general sense, but what is necessary to fulfil the core functions of the
particular contract between Facebook and Facebook users. In order to carry out this assessment,
it is therefore necessary to consider the contract itself.

4.33 I recall my earlier statement that matters of national contract law are outside the scope of the
Commission. 74 Nonetheless, for the purposes of data protection law, I note that the EDPB
indicates that, in such an assessment, “regard should be given to the particular aim, purpose, or
objective of the service”. 75 In my view, when examining what constitutes a “contract” for the
purposes of Article 6(1)(b) GDPR, the term “contract” does not necessarily refer to the entirety of
the (written) agreement between the parties. Rather, I agree that the correct approach is to
examine the actual bargain which has been struck between the parties and determine the core

70
Huber v Deutschland, paragraph 62.
71
Guidelines 2/2019, paragraph 27.
72
Ibid, paragraph 30.
73
Ibid, paragraph 26.
74
In this regard, I also note that national contract law of individual Member States applies various standards to
determine when a contract will be deemed to be performed, what contractual terms can be breached without the
entire contract being deemed to be breached, and indeed how something can be deemed a “term” in the first place.
75
Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of
online services to data subjects https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines-art_6-1-b-
adopted_after_public_consultation_en.pdf, paragraph 30.
31

function of the contract by reference to this. Therefore, the inclusion of a term which does not
relate to the core function of the contract could not be considered necessary for its performance.

4.34 As an aid to deciding whether Article 6(1)(b) GDPR is an appropriate lawful basis, and in particular
in considering the scope of the relevant contract, the EDPB suggests asking:

• “What is the nature of the service being provided to the data subject?
• What are its distinguishing characteristics? What is the exact rationale of the contract
(i.e. its substance and fundamental object)?
• What are the essential elements of the contract?
• What are the mutual perspectives and expectations of the parties to the contract?
• How is the service promoted or advertised to the data subject? Would an ordinary
user of the service reasonably expect?” 76

4.35 In considering this particular issue in the context of the Complaint, it is necessary to identify the
“core” functions of the contract between Facebook and Facebook users. At this point, I note that
the Complaint itself does not specify with any great precision the extent of the processing (or
indeed the processing operation(s)) that the Complainant believes is not necessary for the
purposes of performing the Terms of Service. The Complainant has however made extensive
submissions arguing that the serving of behavioural advertising specifically is not necessary in
order to fulfil the “core function” of a social network. As a result, for the purposes of this
Complaint, I propose to focus on this element of the Terms of Service.

4.36 The contract between Facebook and Facebook users is divided into the following headings:

• “To Provide a Personalised Experience for you”;
• “Connect you with people and organizations you care about”;
• “Empower you to express yourself and communicate about what matters to you”;
• “Help you discover content, products, and services that may interest you”;
• “Combat harmful conduct and protect and support our community”;
• “Use and develop advanced technologies to provide safe and functional services for
everyone”; and
• “Enable global access to our services”.

4.37 The first term in the Terms of Service, under the heading “To Provide a Personalised Experience
for you”, states that:

“from the posts, stories, events, ads, and other content you see in News Feed or our video
platform to the Pages you follow and other features you might use, such as Trending,

76
Ibid, paragraph 33.
32

Marketplace, and search. We use the data we have – for example, about the connections
you make, the choices and settings you select, and what you share and do on and off our
Products – to personalize your experience” [my emphasis].

4.38 As well as the provision relating to advertisements at the beginning of the Terms of Service already
set out, I note that under the heading “Help you discover content, products, and services that may
interest you”, the contract states “[w]e show you ads, offers and other sponsored content to help
you to discover content, products and services…”.

4.39 The Complainant however argues that such advertising referred to in this term is not necessary in
order to deliver a social network, and that simply placing these terms in the contract does not
make them necessary. Both of these statements may be true, but it does not follow that fulfilling
these terms is not necessary in order to fulfil the specific contract with Facebook. To do that, to
use the language of the EDPB, it is necessary to consider “the nature of the service being offered
to the data subject”. Facebook’s argument is essentially that personalised advertising constitutes
the “core” of its service, and would therefore be the Facebook service’s “distinguishing
characteristics” (to use the language of the EDPB). 77 The Facebook service is clearly “promoted
[and] advertised” 78 as being one that provides personalised advertisements, and in my view, a
reasonable user would be well-informed, based on public debate of these issues in the media
among other matters, that this is the very nature of the service being offered by Facebook and
contained within the contract.

4.40 However, the position of the Complainant seems to go so far as to say that processing will
generally only be necessary for the performance of the contract if not carrying out the processing
would make the performance of the contract impossible. Moreover, the position of the EDPB is
that:

“as a general rule, processing of personal data for behavioural advertising is not necessary
for the performance of a contract for online services. Normally, it would be hard to argue
that the contract had not been performed because there were no behavioural ads. This is
all the more supported by the fact that data subjects have the absolute right under Article
21 to object to processing of their data for direct marketing purposes.” 79

4.41 The Guidelines, while not binding on the Commission, clearly set out a very restrictive view on
when processing should be deemed to be “necessary” for the performance of a contract, and
explicitly refer to personalised advertising as an example of processing that will usually not be
necessary. As the terms of the guidance makes clear, this is, however, a general rather than an

77
Ibid, paragraph 33.
78
Ibid.
79
Ibid, paragraph 52 (emphasis added).

33

absolute rule. I note the EDPB has also acknowledged that “personalisation of content may (but
does not always) constitute an essential or expected element of certain online services”. 80 The core
area of dispute in applying Article 6(1)(b) GDPR is therefore whether – by reference to the terms
of the specific contract – the inclusion of behavioural advertising makes data processing
conditional on the delivery of a contract, where that processing is not itself necessary to actually
deliver the contract. The counter-argument is that such advertising, being the core of Facebook’s
business model and the core of the bargain being struck by Facebook users and Facebook, is
necessary to perform the specific contract between Facebook and the Complainant.

4.42 Appling the principles set out above to the particular circumstances of this case, it seems to me
that the core of the Facebook model, particularly in circumstances where users do not pay for the
service, is an advertising model. 81 The EDPB has, of course, set out that processing cannot be
rendered lawful by Article 6(1)(b) GDPR “simply because processing is necessary for the
controller’s wider business model”.82 The core of the service, however, as set out in the specific
contract with the data subject in this case, clearly includes (and indeed appears to be premised
upon) the provision of personalised advertising.

4.43 This analysis is reinforced when one answers the specific questions posed at paragraph 33 of the
EDPB Guidelines set out above. The nature of the service being offered to Facebook users is set
out in the first line of the Terms of Service: a personalised service that includes advertising.
Moreover, a distinguishing feature of the Facebook service (that, I think it might be fair to say, the
Complainant and Facebook would both agree on) is that it is a service funded by personalised
advertising. As the core of the bargain between the parties, this advertising therefore appears to
be part of the substance and fundamental object of the contract. It is, in fact, the core element of
the commercial transaction as between Facebook and Facebook users. It follows that this is a
commercially essential element of the contract. As this information is both clearly set out and
publicly available, it is difficult to argue that this is not part of the mutual expectations of a
prospective user and of Facebook. Finally, it is clear that the service is advertised (and widely
understood) as one funded by personalised advertising, and so any reasonable user would expect
and understand that this was the bargain being struck, even if they might prefer that the market
would offer them better alternative choices. I therefore expressed the view, in the Preliminary
Draft (and Draft) Decision, that the answers to the questions proposed by the EDPB did not
support the Complainant’s argument in respect of Article 6(1)(b) GDPR in the context of the
contract concluded between Facebook and the Complainant at issue in this Complaint.

80
Ibid, paragraph 54.
81
E.g. Facebook Submissions on the Draft Report, paragraph 6.3(C) and Facebook Submissions on Preliminary Draft
Decision, paragraph 5.8(C).
82
Ibid, paragraph 36.

34

4.44 In the submissions on the Preliminary Draft Decision, the Complainant argues that this analysis
amounts to speculation.83 While making the argument that the legal analysis must be based on
“hard evidence” rather than “views”, the only evidence put forward by the Complainant is her
own statement and a Gallup poll referenced in the Complaint. The Complainant goes on to suggest
that “we might as well ask the Oracle of Delphi what data subjects really know or think and what
economics really play out in a contractual relationship.” 84 While I have had due regard to the
matters put forward by the Complainant in support of the Complaint I am obliged to consider all
of the evidence before me and I am also entitled to take notice of matters in the public domain.
In any event, in this specific context, it is primarily by reference to the contract itself that the
question of reliance on Article 6(1)(b) GDPR must be assessed. Having regard to the clear terms
of the contract, targeted advertising forms a core element of Facebook’s business model and
transaction with users.

4.45 The Complainant’s submissions on the Preliminary Draft Decision go on to describe the “data for
service narrative” as “economically illiterate”, “clearly way too simplistic”, “deeply alarming” and
an “ancient industry lobbyist narrative”. 85 In support of these assertions, it is argued that each
visit to Facebook involves spending time, “the most important online currency on Facebook”. The
submissions further argue that Facebook can only profit from advertising because users provide
relevant content to other users with no remuneration.

4.46 The fact that a user spending additional time on a platform is more lucrative for Facebook does
nothing to rebut the argument that targeted advertising lies at the core of the agreement. The
more time a user spends engaging with the platform, the more advertisements they will be
exposed to and the more data they will provide. Indeed, even if one uncritically accepts this
argument, it may be regarded as reinforcing the conclusion that the core of the business model is
the provision of data on personal activity to facilitate targeted advertising. The fact that intra-user
activity enables profit does not alter where those profits come from, or the nature of the
agreement and what is necessary in order to perform it. It is clear that the Complainant regards
this state of affairs as being unfair and/or unbalanced. Whether it is or it is not, this does not alter
the fact that the service in question is provided to users on this very basis.

4.47 I have already pointed out that the Guidelines are non-binding and do not determine the
application of the general principles to specific cases. I agree with the majority of the arguments
of both the Complainant and the EDPB in relation to the correct interpretation of Article 6(1)(b)
GDPR. 86 However, I have difficulty with a strict threshold of “impossibility” in the assessment of
necessity. By “impossibility”, I am referring to the argument put forward that a particular term of

83
Complainant Submissions on Preliminary Draft Decision, paragraph 4.5.3.
84
Ibid.
85
Ibid.
86
While in the submissions on the Preliminary Draft Decision the Complainant takes issue with my approach to the
EDPB Guidelines, the Complainant has made no additional arguments beyond those already set out about why this
legally cannot or should not be done: Complainant Submissions on the Preliminary Draft Decision, paragraph 4.5.5.
35

a contract (here, behavioural advertising) is not necessary to deliver an overall service or contract.
In particular, I consider that is not correct to assess necessity as against the delivery of an overall
service in the abstract. Rather, as I have stated above, I consider the appropriate assessment to
be one which considers what is necessary by reference to core function of the particular contract.

4.48 While I accept that either form of assessment will require an element of reasoning in the abstract
(in particular, when considering the mutual perspectives and expectations), I am also of the view
that it is not for an authority such as the Commission, tasked with the enforcement of data
protection law, to make assessments as to what will or will not make the performance of a
contract possible or impossible. Instead, the general principles set out in the GDPR and explained
by the EDPB in the Guidance must be applied. These principles must be applied on a case-by-case
basis. While the examples provided in the EDPB Guidance are helpful and instructive, they are not
conclusive of the position in any specific case and indeed do not purport to be.

4.49 Even if, contrary to my view, the appropriate standard in assessing Article 6(1)(b) GDPR was one
of impossibility rather than necessity simpliciter, Facebook has submitted that “…it would be
impossible to provide the Facebook service in accordance with the Terms of Service without
providing personalised advertising”. 87 While it does not consider that this would be the correct
interpretation of the law, it considers that this standard would nonetheless be met under the
Terms of Service.

4.50 While I remain of the view that Article 6(1)(b) GDPR cannot be interpreted as meaning that, unless
it is impossible to perform the contract without particular acts or operations of data processing,
such processing is not necessary for the performance of the contract, this argument underlines
the extent to which targeted advertising forms a core part of the contract between Facebook and
its user.

4.51 Based on the above considerations, I proposed to conclude, in the Draft Decision, that neither
Article 6(1)(b) nor any other provision of the GPDR precluded Facebook from relying on Article
6(1)(b) GDPR as a legal basis to for the delivery of a service based on behavioural advertising of
the kind provided for under the contract between Facebook and its users at issue in this
Complaint. As discussed below, I further expressed the view that other provisions of the GDPR
(such as transparency, which I consider at Issue 3) act to strictly regulate the manner in which this
service is to be delivered, and the information that should be given to users.

4.52 Having analysed the submissions of the parties, the terms of the GDPR, and the jurisprudence and
EDPB Guidelines, I proposed, by way of the Draft Decision, to find that there was no basis for the
contention that Facebook is precluded in principle from relying on Article 6(1)(b) GDPR for the
purposes of legitimising the personal data processing activities involved in the provision of its
service to users, including behavioural advertising insofar as that forms a core part of the service.

87
Ibid, paragraph 5.8(G).
36

There is nothing in the GDPR that restricts or prohibits the use of these terms in the context of
processing personal data per se. As has been set out earlier, and as set out by the Investigator, it
is not for the Commission to rule on matters of contract law and contractual interpretation that
extend beyond the remit of data protection law. The lawful basis under Article 6(1)(b) GDPR
simply states that personal data may be processed where it is necessary for the performance of a
contract. In other words and, as I have already set out in analysis, the data may be processed if,
without such processing, the contract could not be performed. I am not convinced, for the reasons
set out, that Article 6(1)(b) GDPR goes a step further and excludes all processing unless the
fulfilment of some abstractly discerned purpose would be rendered impossible without that
processing. I also expressed the view, in the Draft Decision, that this application conforms broadly
to significant elements of the interpretation of Article 6(1)(b) GDPR proposed by the Complainant
and by the EDPB.

4.53 While I accepted that, as a general rule, the EPDB considers that processing for online behavioural
advertising would not be necessary for the performance of a contract for online services, in this
particular case, having regard to the specific terms of the contract and the nature of the service
provided and agreed upon by the parties, I proposed to conclude that Facebook may in principle
rely on Article 6(1)(b) as a legal basis of the processing of users’ data necessary for the provision
of its service, including through the provision of behavioural advertising insofar as this forms a
core part of that service offered to and accepted by users.

4.54 Having regard to the scope of the Complaint and this Inquiry, as described above, I added that
this proposed conclusion was not to be construed as an indication that all processing operations
carried out on users’ personal data are necessarily covered by Article 6(1)(b) GDPR.

4.55 Following the circulation of the Commission’s Draft Decision to the supervisory authorities
concerned, for the purpose of enabling them to express their views in accordance with Article
60(3) GDPR, objections to this aspect of matters were raised by the supervisory authorities of
Austria, Germany, France, Italy, the Netherlands, Norway, Poland, Portugal and Sweden. Having
considered the merits of those objections, the EDPB determined as follows:

94. The EDPB considers it necessary to begin its assessment on the merits with a general
description of the practice of behavioural advertising carried out in the context of the
Facebook service before determining whether the legal basis of Article 6(1)(b) GDPR is
appropriate for this practice in the present case, based on the Facebook Terms of Service and
the nature of its products and features as described in those terms. The requests for
preliminary rulings made to the CJEU in the cases C- 252/21 88 and C-446/21 89 to which some

88
C-252/21 Oberlandesgericht Düsseldorf request, pp.6-7.
89
C-446/21 Austrian Oberster Gerichtshof request paragraphs 2-3, 6-13, 15-23.

37

of the documents in the file refer 90 contain helpful descriptions of Meta IE’s behavioural
advertising practices in the context of its Facebook service.

95. These requests for preliminary rulings mention that Meta IE collects data on its individual
users and their activities on and off its Facebook social network service via numerous means
such as the service itself, other services of the Meta group including Instagram, WhatsApp and
Oculus, third party websites and apps via integrated programming interfaces such as Facebook
Business Tools or via cookies, social plug-ins, pixels and comparable technologies placed on
the internet user’s computer or mobile device. According to the descriptions provided, Meta
IE links these data with the user’s Facebook account to enable advertisers to tailor their
advertising to Facebook’s individual users based on their consumer behaviour, interests,
purchasing power and personal situation. This may also include the user’s physical location to
display content relevant to the user’s location. Meta IE offers its services to its users free of
charge and generates revenue through this personalised advertising that targets them, in
addition to static advertising that is displayed to every user in the same way.

96. The EDPB considers that these general descriptions signal by themselves the complexity,
massive scale and intrusiveness of the behavioural advertising practice that Meta IE conducts
through the Facebook service. These are relevant facts to consider to assess the
appropriateness of Article 6(1)(b) GDPR as a legal basis for behavioural advertising and to what
extent reasonable users may understand and expect behavioural advertising when they accept
the Facebook Terms of Service and perceive it as necessary for Meta IE to deliver its service 91.
Accordingly, the EDPB further considers that the IE SA could have added to its Draft Decision a
description of behavioural advertising that Meta IE conducts through the Facebook service to
appropriately substantiate its reasoning leading to its acceptance of Article 6(1)(b) GDPR as a
legal basis for that practice in accordance with the IE SA’s duty to state the reasons for an
individual decision 92.

97. In the same vein, the EDPB also finds that the content of the Gallup Institute poll, which
the Complainant’s representative requested and subsequently submitted to the IE SA in its

90
See for instance the references to these requests for a preliminary ruling in the AT SA Objection p.9 and Meta IE’s
Article 65 Submissions, p.14.
91
In the same vein, the Advocate General also provides a description of behavioural advertising in its Opinion on the
case C-252/21 Oberlandesgericht Düsseldorf request, see Opinion of the Advocate General on 20 September 2022),
ECLI:EU:C:2022:704, paragraphs 9 and 10.
92
See EDPB Guidelines on Article 65(1)(a) GDPR, paragraph 84 and EDPB Guidelines 02/2022 on the application of
Article 60 GDPR (Version 1.0, Adopted on 14 March 2022), paragraph 111 (stating: “[…] every decision that is aimed
at legal consequences needs to include a description of relevant facts, sound reasoning and a proper legal assessment.
These requirements essentially serve the purpose of legal certainty and legal protection of the parties concerned.
Applied to the area of data protection supervision this means that the controller, processor and complainant should
be able to acknowledge all the reasons in order to decide whether they should bring the case to trial. Having regard
to the decision making process within the cooperation mechanism, CSAs likewise need to be in the position to decide
on possibly taking actions (e.g. agree to the decision, provide their views on the subject matter)”). See also by analogy
Judgement of the Court of Justice of 26 November 2013, Kendrion NV v European Commission, C-50/12 P,
ECLI:EU:C:2013:771, paragraph 42.

38

submission of 20 November 2019, could have been part of the facts of the Draft Decision 93.
This poll provides a supplementary and useful indication on the perspective of Facebook users,
which helps assessing whether they could expect being subject to behavioural advertising as
part of a contract. The results of the poll allege, inter alia, that only 1.6% to 2.5% of the 1.000
respondents 94, who are Facebook users, understood the request to accept the Facebook Terms
of Service to be a “contract” that provides them with a contractual right to personalised
advertisement. The IE SA acknowledges the Complainant’s submission of this poll in its Draft
Decision but seemingly dismisses it by focusing primarily on what it considers as primary
sources of factual evidence (primarily, the Facebook Terms of Service) and “matters in the
public domain” 95. Conversely, Meta IE seems to attach importance to this poll. Meta IE
engaged an expert to produce a report (the “Vanhuele Report”) that Meta IE appends to Annex
2 of its pre-Article 65 submission to point to what Meta IE considers “serious flaws” in the
report containing the poll and allege that the Complainant misinterpreted its results 96.

…

101. The GDPR develops the fundamental right to the protection of personal data found in
Article 8(1) of the EU Charter of Fundamental Rights and Article 16(1) of the TFEU, which
constitute EU primary law 97. As the CJEU clarified, “an EU act must be interpreted, as far as
possible, in such a way as not to affect its validity and in conformity with primary law as a whole
and, in particular, with the provisions of the Charter. Thus, if the wording of secondary EU
legislation is open to more than one interpretation, preference should be given to the
interpretation which renders the provision consistent with primary law rather than to the
interpretation which leads to its being incompatible with primary law” 98. In the face of rapid
technological developments and increases in the scale of data collection and sharing, the GDPR
creates a strong and more coherent data protection framework in the Union, backed by strong
enforcement, and built on the principle that natural persons should have control of their own
personal data 99. By ensuring a consistent, homogenous and equivalent high level of protection
throughout the EU, the GDPR seeks to ensure the free movement of personal data within the
EU 100. The GDPR acknowledges that the right to data protection needs to be balanced against
other fundamental rights and freedoms, such as the freedom to conduct a business, in
accordance with the principle of proportionality 101 and has these considerations integrated
into its provisions. The GDPR, pursuant to EU primary law, treats personal data as a

93
An informal translation of the presentation of this Study, dated November 2019, as provided by the Complainant’s
representative through its public website, may be found here: https://noyb.eu/sites/default/files/2020-
05/Gallup_Facebook_EN.pdf (Date of consultation 21 November 2022).
94
According to the poll “Austrians that are active online, age 14 and older”.
95
Draft Decision, paragraph 4.44; Composite Response, paragraph 83.
96
Meta IE Article 65 Submissions, footnote 132, p.75, and Annex 2.
97
Recitals 1 and 2 GDPR.
98
Judgement of the Court of Justice of 21 June 2022, Ligue des droits humains v. Conseil des ministres, C-817/19,
ECLI:EU:C:2022:491, (hereinafter ‘C-817/19 Ligue des droits humains'), paragraph 86; and Judgement of the Court of
Justice of 2 February 2021, Consob, C-481/19, ECLI:EU:C:2021:84, paragraph 50 and the case-law cited.
99
Article 1(1)(2) and Recital 6 and 7 GDPR.
100
Article 1(3) and Recitals 9,10 and 13 GDPR.
101
Recital 4 GDPR.

39

fundamental right inherent to a data subject and his/her dignity, and not as a commodity data
subjects can trade away through a contract 102. The CJEU provided additional interpretative
guidance by asserting that the fundamental rights of data subjects to privacy and the
protection of their personal data override, as a rule, a controller’s economic interests 103.

102. The principle of lawfulness of Article 5(1)(a) and Article 6 GDPR is one of the main
safeguards to the protection of personal data. It follows a restrictive approach whereby a
controller may only process the personal data of individuals if it is able to rely on one of the
basis found in the exhaustive and restrictive lists of the cases in which the processing of data
is lawful under Article 6 GDPR 104.

103. The principle of lawfulness goes hand in hand with the principles of fairness and
transparency in Article 5(1)(a) GDPR. The principle of fairness includes, inter alia, recognising
the reasonable expectations of the data subjects, considering possible adverse consequences
processing may have on them, and having regard to the relationship and potential effects of
imbalance between them and the controller 105.

104. The EDPB agrees with the IE SA and Meta IE that there is no hierarchy between these legal
bases 106. However, this does not mean that a controller, as Meta IE in the present case, has
absolute discretion to choose the legal basis that suits better its commercial interests. The
controller may only rely on one of the legal basis established under Article 6 GDPR if it is
appropriate for the processing at stake 107. A specific legal basis will be appropriate insofar as
the processing can meet its requirements set by the GDPR 108 and fulfil the objective of the
GDPR to protect the rights and freedoms of natural persons and in particular their right to the
protection of personal data. The legal basis will not be appropriate if its application to a specific
processing defeats this practical effect “effet utile” pursued by the GDPR and its Article 5(1)(a)
and Article 6 GDPR 109. These criteria stem from the content of the GDPR 110 and the

102
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 54.
103
Judgement of the Court of Justice of 13 May 2014, Google Spain SL, C-131/12, ECLI:EU:C:2014:317, paragraphs
97 and 99.
104
Judgement of the Court of Justice of 11 December 2019, TK v Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18,
ECLI:EU:C:2019:1064, (hereinafter ‘C-708/18 TK v Asociaţia de Proprietari'), paragraph 37.
105
See, recital 39 GDPR and EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 11 and 12.
106
Draft Decision paragraph 3.16 and Meta IE's Article 65 Submissions paragraph 5.12.
107
As mentioned in the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 18, the identification of the
appropriate lawful basis is tied to the principles of fairness and purpose limitation. It will be difficult for controllers
to comply with these principles if they have not first clearly identified the purposes of the processing, or if processing
of personal data goes beyond what is necessary for the specified purposes. See also Section 6 of this Binding Decision
on the potential additional infringement of the principle of fairness.
108
C-708/18 TK v Asociaţia de Proprietari, paragraph 37.
109
See C-524/06 Huber, paragraph 52 on the concept of necessity being interpreted in a manner that fully reflects
the objective of Directive 95/46). On the importance of considering the practical effect (effet utile) sought by EU law
in its interpretation, see also for instance: C-817/19 Ligue des droits humains, paragraph 195; and Judgement of the
Court of Justice of 17 September 2002, Muñoz and Superior Fruiticola, C-253/00, ECLI:EU:C:2002:497, paragraph 30.
110
Art. 1(1)(2) and (5) GDPR.

40

interpretation favourable to the rights of data subjects to be given thereto described in
paragraph 101 above.

105. The GDPR makes Meta IE, as a data controller for the processing at stake, directly
responsible for complying with the Regulation’s principles, including the processing of data in
a lawful, fair and transparent manner, and any obligations derived therefrom 111. This
obligation applies even where the practical application of GDPR principles such as those of
Article 5(1)(a) and Article (5)(2) GDPR is inconvenient or runs counter to the commercial
interests of Meta IE and its business model. The controller is also obliged to be able to
demonstrate that it meets these principles and any obligations derived therefrom, such as that
it meets the specific conditions applicable to each legal basis 112.

106. The first condition to be able to rely on Article 6(1)(b) GDPR as a legal basis to process the
data subject’s data is that a controller, in line with its accountability obligations under Article
5(2) GDPR, has to be able to demonstrate that (a) a contract exists and (b) the contract is
valid pursuant to applicable national contract laws 113.

107. Both the IE SA and Meta IE consider that the Facebook Terms of Service make up the
entire agreement between the Facebook user and Meta IE and that the Data Policy is simply a
compliance document setting out information to fulfil the GDPR transparency obligations 114.
The IE SA thus considers that the contract for which the analysis based on Article 6(1)(b) must
take place, is the Facebook Terms of Service only 115.

108. The IE SA and Meta IE argue that the GDPR does not confer a broad and direct competence
to supervisory authorities to interpret or assess the validity of contracts 116. In its Draft Decision,
the IE SA noted that the Complainant explicitly sought to have it investigate and make findings
in respect of contract and consumer law. The IE SA noted that this falls outside of the remit of
a supervisory authority under the GDPR and are instead within the competence of the relevant
consumer and competition authorities 117.

109. The EDPB agrees that SAs do not have under the GDPR a broad and general competence
in contractual matters. However, the EDPB considers that the supervisory tasks that the GDPR
bestows on SAs imply a limited competence to assess a contract’s general validity insofar as
this is relevant to the fulfilment of their tasks under the GDPR. Otherwise, the SAs would see
their monitoring and enforcement task under Article 57(1)(a) GDPR limited to actions such as
verifying whether the processing at stake is necessary for the performance of a contract
(Article 6(1)(b) GDPR), and whether a contract with a processor under Article 28(3) GDPR and
data importer under Article 46(2) GDPR includes appropriate safeguards pursuant to the GDPR.

111
Art. 5 (2) GDPR “Principle of accountability” of data controllers; see also C-252/21 Oberlandesgericht Düsseldorf
request, Opinion of the Advocate General on 20 September 2022, ECLI:EU:C:2022:704, paragraph 52.
112
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 26.
113
Binding Decision 2/2022, paragraph 84.
114
Draft Decision, paragraphs 4.4 to 4.6.
115
Draft Decision, paragraph 4.6.
116
Composite Response, paragraph 45; Meta IE Article 65 Submissions, paragraph 6.43.
117
Draft Decision, paragraph 4.14.

41

Pursuant to the IE SA’s interpretation, the SAs would thus be obliged to always consider a
contract valid, even in situations where it is manifestly evident that it is not, for instance
because there is no proof of agreement between the two parties, or because the contract does
not comply with its Member State’s rules on the validity, formation or effect of a contract in
relation to a child 118.

110. As the DE and NL SAs 119 argue, the validity of the contract for the Facebook service
between Meta IE and the Complainant is questionable given the strong indications that the
Complainant was unaware of entering into a contract, and (as the IE SA establishes with its
Finding 3 of its Draft Decision) serious transparency issues in relation to the legal basis relied
on. In contract law, as a general rule, both parties must be aware of the substance of the
contract and the obligations of both parties to the contract in order to willingly enter into such
contract.

111. Notwithstanding the possible invalidity of the contract, the EDPB refers to its previous
interpretative guidance on this matter 120 to provide below its analysis on whether behavioural
advertising is objectively necessary for Meta IE to provide its Facebook service to the user
based on its Facebook Terms of Service and the nature of the service.

112. The EDPB recalls 121 that for the assessment of necessity under Article 6(1)(b) GDPR, “[i]t
is important to determine the exact rationale of the contract, i.e. its substance and
fundamental objective, as it is against this that it will be tested whether the data processing is
necessary for its performance” 122. As the EDPB has previously stated, regard should be given
to the particular aim, purpose, or objective of the service and, for applicability of Article 6(1)(b)
GDPR, it is required that the processing is objectively necessary for a purpose and integral to
the delivery of that contractual service to the data subject 123.

113. Moreover, the EDPB notes that the controller should be able to justify the necessity of its
processing by reference to the fundamental and mutually understood contractual purpose.
This depends not only on the controller’s perspective, but also on a reasonable data subject’s
perspective when entering into the contract 124.

114. The IE SA accepts the EDPB’s position 125 that, as a general rule, processing of personal
data for behavioural advertising is not necessary for the performance of a contract for online
services 126. However, the IE SA considers that in this particular case, having regard to the
specific terms of the contract and the nature of the Facebook service provided and agreed
upon by the parties, Meta IE may in principle rely on Article 6(1)(b) GDPR to process the user’s

118
Art. 8(3) GDPR.
119
DE SAs Objection, p.4 and NL SA Objection, paragraph 30.
120
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR.
121
See Binding Decision 2/2022, paragraph 89.
122
WP29 Opinion 06/2014 on the notion of legitimate interests, p. 17.
123
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 30.
124
See Binding Decision 2/2022, paragraph 90.
125
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 52.
126
Draft Decision, paragraph 4.53.

42

data necessary for the provision of its service, including through the provision of behavioural
advertising insofar as this forms a core part of that service offered to and accepted by users.

115. The IE SA views behavioural advertising as a “core”, “fundamental” and “commercially
essential” element of the contract and the commercial transaction between Meta IE and the
Facebook users 127. In support of this consideration, the IE SA refers to the information provided
in the Facebook Terms of Service under the headings: “Provide a personalized experience for
you” and “Help you discover content, products, and services that may interest you” 128. The
information provided includes reference to ads and includes the statement that “[w]e use the
data we have … to personalize your experience”. The IE SA further notes that the nature of the
service being offered to Facebook users is set out in the first line of the Facebook Terms of
Service, 129 which reads textually: “Provide a personalized experience for you:”. The IE SA
considers that it is clear that the Facebook service is advertised (and widely understood) as
one funded by personalised advertising and so, that any reasonable user would expect and
understand and that this was the “bargain being struck, even if they [the users] might prefer
that the market would offer them better alternative choices” 130.

116. On this issue, the EDPB recalls that the concept of necessity has its own independent
meaning under EU law. It must be interpreted in a manner that fully reflects the objective
pursued by an EU instrument, in this case, the GDPR 131. Accordingly, the concept of necessity
under Article 6(1)(b) GDPR cannot be interpreted in a way that undermines this provision and
the GDPR’s general objective of protecting the right to the protection of personal data 132 or
contradicts Article 8 of the Charter. On the processing of data in the Facebook service,
Advocate General Rantos supports a strict interpretation of the Article 6(1)(b) GDPR among
other legal basis, particularly to avoid any circumvention of the requirement for consent 133.

117. Meta IE promotes among its prospective and current users the perception that the main
purpose the Facebook service serves and for which it processes its users’ data is to enable
them to communicate with others. Meta IE presents its Facebook service in its landing website
as a platform enabling users to “connect with friends and the world around you on Facebook”
and at the beginning of its Facebook Terms of Service 134 as being its mission “to give people
the power to build community and bring the world closer together. To help advance this

127
Draft Decision, paragraphs 4.42, 4.43, 4.53, 4.55 and Finding 2.
128
Draft Decision, paragraphs 4.36 to 4.38.
129
Draft Decision, paragraph 4.43.
130
Draft Decision, paragraph 4.43.
131
See paragraph 101 above on the principles guiding the interpretation of the GDPR and is provisions. The CJEU also
stated in Huber that that “what is at issue is a concept [necessity] which has its own independent meaning in
Community law and which must be interpreted in a manner which fully reflects the objective of that Directive,
[Directive 95/46], as laid down in Article 1(1) thereof”. C-524/06 Huber, paragraph 52.
132
Art. 1(2) GDPR.
133
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
paragraph 51. (The EDPB refers to the Advocate General’s Opinion in its Binding Decision as an authoritative source
of interpretation to underline the EDPB’s reasoning on the processing of data in the Facebook service, without
prejudice to the case-law that the CJEU may create with its future judgments on the Cases C-252/21 and C-446/21).
134
Which the IE SA Meta IE consider as constituting the entire contract with the Facebook users (see paragraph 101).

43

mission, we provide the Products and services described below to you: (...)” which include in
consecutive headings “Connect you with people and organizations you care about: (...)”;
“Empower you to express yourself and communicate about what matters to you: (...)” and
“Help you discover content, products and services that may interest you: (...)”.

118. The fact that the Facebook Terms of Service 135 do not provide for any contractual
obligation binding Meta IE to offer personalised advertising to the Facebook users and any
contractual penalty if Meta IE fails to do so shows that, at least from the perspective of the
Facebook user, this processing is not necessary to perform the contract. Providing personalised
advertising to its users may be an obligation between Meta IE and the specific advertisers that
pay for Meta IE’s targeted display of their advertisements in the Facebook service to Facebook
users, but it is not presented as an obligation towards the Facebook users.

119. Nor does Meta IE’s business model of offering services, at no monetary cost for the user
to generate income by behavioural advertisement to support its Facebook service, among
others, make this processing necessary to perform the contract. Under the principle of
lawfulness of the GDPR and its Article 6, it is the business model which must adapt itself and
comply with the requirements that the GDPR sets out in general and for each of the legal bases
and not the reverse. As the Advocate General Rantos stressed recently in his opinion on Meta
IE’s processing in Facebook, based on Article 5(2) GDPR, it is the controller (Meta IE in this case)
who is responsible for demonstrating that the personal data are processed in accordance with
the GDPR 136.

120. As the EDPB provided in its guidance 137 assessing what is “necessary” involves a combined,
fact-based assessment of the processing “for the objective pursued and of whether it is less
intrusive compared to other options for achieving the same goal”. If there are realistic, less
intrusive alternatives, the processing is not “necessary”. Article 6(1)(b) GDPR will not cover
processing that is useful but not objectively necessary for performing the contractual service
or for taking relevant pre-contractual steps at the request of the data subject, even if it is
necessary for the controller’s other business purposes.

135
The Facebook Terms of Service as formulated in one-sided terms as follows: “These Terms govern your use of
Facebook and the products, features, apps, services, technologies, and software we offer (the Facebook Products or
Products), except where we expressly state that separate terms (and not these) apply.” While under Section 1 of the
Terms of Service Facebook announces that it “provides” the following services, Section 3 of the Terms of Service is
overwritten with “Your Commitments to Facebook and Our Community”. While Facebook itself only “offers” various
services, it makes clear that the Terms of Service unilaterally impose duties and obligations on the user. Otherwise,
the user may face suspension or termination of her/his account pursuant to Section 4.2 of the Terms of Service. No
(contractual) sanctions appear to apply in the event that Meta IE fails to provide or poorly performs one or more of
these services.
136
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, paragraph 52.
137
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 25.

44

121. On the question of whether here there are realistic, less intrusive alternatives to
behavioural advertising that make this processing not “necessary” 138, the EDPB considers that
there are. The AT, PL and SE SAs mention as examples contextual advertising based on
geography, language and content, which do not involve intrusive measures such as profiling
and tracking of users 139. In his recent opinion on Facebook, Advocate General Rantos also
refers to the Austrian Government’s “pertinent” observation that in the past, Meta IE allowed
Facebook users to choose between a chronological presentation and a personalised
presentation of newsfeed content, which, in his view, proves that an alternative method is
possible 140. By considering the existence of alternative practices to behavioural advertising
that are more respectful of the Facebook users’ right to data protection, the EDPB, as the
Advocate General, aims to assess if this processing is objectively necessary to deliver the
service offered, as perceived by the Facebook user whose personal data is processed, and not
to dictate the nature of Meta IE’s service or impose specific business models on controllers, as
Meta IE and the IE SA respectively argue 141. The EDPB considers that Article 6(1)(b) GDPR does
not cover processing which is useful but not objectively necessary for performing the
contractual service, even if it is necessary for the controller’s other business purposes 142.

122. The EDPB considers that the absolute right available to data subjects, under Article
21(2)(3) GDPR to object to the processing of their data (including profiling) for direct marketing
purposes further supports its consideration that, as a general rule, the processing of personal
data for behavioural advertising is not necessary to perform a contract. The processing cannot
be necessary to perform a contract if a subject has the possibility to opt out from it at any time,
and without providing any reason.

123. The EDPB finds that a reasonable user cannot expect that their personal data is being
processed for behavioural advertising simply because Meta IE briefly refers to this processing
in the Facebook Terms of Service (which Meta IE and the IE SA consider as constituting the
entirety of the contract), or because of the “wider circumstances” or “recognised public
awareness of behavioural advertising” derived from its “widespread prevalence” to which the
IE SA refers 143. Behavioural advertising, as briefly described in paragraph 95 above, is a set of
processing operations of personal data of great technical complexity, which has a particularly
massive and intrusive nature. In view of the characteristics of behavioural advertising, coupled

138
In Schecke, the CJEU held that, when examining the necessity of processing personal data, the legislature needed
to take into account alternative, less intrusive measures. Judgement of the Court of Justice of 9 November
2010, Volker und Markus Schecke GbR, Joined Cases C-92/09 and C-93/09, ECLI:EU:C:2010:662, (hereinafter ‘Case C-
92/09 and C-93/09 Schecke’), paragraph 52. This was repeated by the CJEU in the Rīgas case where it held that “As
regards the condition relating to the necessity of processing personal data, it should be borne in mind that
derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly
necessary”. Judgement of the Court of Justice of 4 May 2017, Valsts policijas Rīgas reģiona pārvaldes Kārtības
policijas pārvalde v Rīgas pašvaldības SIA ‘Rīgas satiksme’, C-13/16, ECLI:EU:C:2017:336, paragraph 30.
139
AT SA Objection; pp.4-5, PL SA Objection, p.2; SE SA Objection, p.3.
140
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, footnote 80.
141
Meta IE Article 65 Submissions, paragraph 6.33 and Composite Response, paragraph 71.
142
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 25.
143
Composite Response, paragraphs 67 and 68.

45

with the very brief and insufficient information that Meta provides about it in the Facebook
Terms of Service and Data Policy (a separate document that the IE SA and Meta IE do not even
consider part of the contractual obligations), the EDPB finds it extremely difficult to argue that
an average user can fully grasp it, be aware of its consequences and impact on their rights to
privacy and data protection, and reasonably expect it solely based on the Facebook Terms of
Service. The EDPB recalls its Guidelines 2/2019 in which it argues that the expectations of the
average data subject need to be consider in light, not only of the terms of service but also the
way this service is promoted to users 144. Advocate General Rantos expresses similar doubts
where he says in relation to Facebook behavioural advertising practices “I am curious as to
what extent the processing might correspond to the expectations of an average user and, more
generally, what ‘degree of personalisation’ the user can expect from the service he or she signs
up for” 145 and adds in a footnote that he does not “believe that the collection and use of
personal data outside Facebook are necessary for the provision of the services offered as part
of the Facebook profile” 146.

124. Based on the considerations above, the EDPB considers that the main purpose for which
users use Facebook and accept the Facebook Terms of Service is to communicate with others,
not to receive personalised advertisements.

125. Meta IE infringed its transparency obligations under Article 5(1)(a), Article 12(1)
and Article 13(1)(c) GDPR by not clearly informing the Complainant and other users of the
Facebook service’s specific processing operations, the personal data processed in them, the
specific purpose they serve, and the legal basis on which each of the processing operations
relies, as the IE SA concludes in its Draft Decision 147. The EDPB considers that this fundamental
failure of Meta IE to comply with its transparency obligations contradicts the IE SA’s finding 148
that Facebook users could reasonably expect online behavioural advertising as being necessary
for the performance of their contract (as described in the Facebook Terms of Service) with
Meta IE.

126. The EDPB recalls that “controllers should make sure to avoid any confusion as to what the
applicable legal basis is” and that this is “particularly relevant where the appropriate
legal basis is Article 6(1)(b) GDPR and a contract regarding online services is entered into by
data subjects”, because “[d]epending on the circumstances, data subjects may erroneously get
the impression that they are giving their consent in line with Article 6(1)(a) GDPR when signing
a contract or accepting terms of service” 149. Article 6(1)(b) GDPR requires the existence, validity
of a contract, and the processing being necessary to perform it. These conditions cannot be met
where one of the Parties (in this case the data subject) is not provided with sufficient
information to know that they are signing a contract, the processing of personal data that it

144
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 57.
145
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, paragraph 56.
146
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, footnote 81.
147
Draft Decision, paragraphs 5.70, 5.71 and Finding 3.
148
Draft Decision, paragraphs 4.43, 4.44, 4.51, 4.53, Finding 2.
149
Binding Decision 01/2021, paragraph 214 and EDPB Guidelines 2/2019 on Article 6(1)(b), paragraph 20

46

involves, for which specific purposes and on which legal basis, and how this processing is
necessary to perform the services delivered. These transparency requirements are not only an
additional and separate obligation, as the IE SA seems to imply 150, but also an indispensable
and constitutive part of the legal basis.

127. The risks to the rights of data subjects derived from this asymmetry of information and
an inappropriate reliance on this legal basis are higher in situations such as in the present case,
in which the Complainant and other Facebook users face a “take it or leave it” situation
resulting from the standard contract pre-formulated by Meta IE and the lack of few alternative
services in the market. The EU legislator has regularly identified and aimed to address with
multiple legal instruments these risks and the imbalance between the parties to consumer
contracts. For example, Directive 93/13/EEC on unfair terms in consumer contracts 151
mandates, as the transparency obligations under the GDPR, the use of plain, intelligible
language in the terms of the contracts offered to consumers152. This Directive even provides
that where there is a doubt about the meaning of a term, the interpretation most favourable
to the consumer shall prevail 153. Processing of personal data that is based on what is deemed
to be an unfair term under this Directive will generally not be consistent with the requirement
under Article 5(1)(a) GDPR that the processing is lawful and fair 154.

128. Advocate General Rantos concludes in reference to Meta IE that the fact that an
undertaking providing a social network enjoys a dominant position in the domestic market for
online social networks for private users “does play a role in the assessment of the freedom of
consent within the meaning of that provision, which it is for the controller to demonstrate,
taking into account, where appropriate, the existence of a clear imbalance of power between
the data subject and the controller, any requirement for consent to the processing of personal
data other than those strictly necessary for the provision of the services in question, the need
for consent to be specific for each purpose of processing and the need to prevent the
withdrawal of consent from being detrimental to users who withdraw it” 155. In line with the
logic of this argument, the EDPB considers that the dominant position of Facebook also plays
an important role in the assessment of Meta IE’s reliance on Article 6(1)(b) GDPR for its
Facebook service and its risks to data subjects, especially considering how deficiently Meta IE
informs the Facebook users of the data it strictly needs to process to deliver the service.

129. Given that the main purpose for which a user uses the Facebook service is to communicate
with others 156, and that Meta IE conditions its use to the user’s acceptance of a contract and
the behavioural advertising it includes, the EDPB cannot see how a user would have the option

150
Draft Decision, paragraph 4.51.
151
A contractual term that has not been individually negotiated is unfair under the Directive 93/13/EEC “if, contrary
to the requirement of good faith, it causes a significant imbalance in the parties’ rights and obligations arising under
the contract, to the detriment of the consumer”, see Art. 3(1) Directive 93/13/EEC.
152
Art. 4(2) and Art. 5 Directive 93/13/EEC.
153
Art. 5 Directive 93/13/EEC.
154
EDPB Guidelines on Article 6(1)(b)GPDR, footnote 10.
155
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, Conclusion, paragraph 78(4).
156
See paragraphs 117-118 and 122-124.

47

of opting out of a particular processing which is part of the contract as the IE SA seems to
argue 157. The users’ lack of choice in this respect would rather indicate that Meta IE’s reliance
on the contractual performance legal basis deprives users of their rights, among others, to
withdraw their consent under Article 6(1)(a) GDPR and Article 7 GDPR and/or to object to the
processing of their data based on Article 6(1)(f) GDPR.

130. The EDPB agrees with the AT, DE, FR, IT, NL, NO, PL, PT, and SE SAs 158 that there is a risk
that the Draft Decision’s failure to establish Meta IE’s infringement of Article 6(1)(b) GDPR,
pursuant to the IE SA’s interpretation of it, nullifies this provision and makes lawful
theoretically any collection and reuse of personal data in connection with the performance of
a contract with a data subject. Meta IE currently leaves the Complainant and other users of
the Facebook service with a single choice. They may either contract away their right to freely
determine the processing of their personal data and submit to its processing for the obscure
and intrusive purpose of behavioural advertising, which they can neither expect, nor fully
understand based on the insufficient information Meta IE provides to them. Or, they may
decline accepting the Facebook Terms of Service and thus be excluded from a service that
enables them to communicate with millions of users and for which there are currently few
realistic alternatives. This exclusion would thus also adversely affect their freedom of
expression and information.

131. This precedent could encourage other economic operators to use the contractual
performance legal basis of Article 6(1)(b) GDPR for all their processing of personal data. There
would be the risk that some controllers argue some connection between the processing of the
personal data of their consumers and the contract to collect, retain and process as much
personal data from their users as possible and advance their economic interests at the expense
of the safeguards for data subjects. Some of the safeguards from which data subjects would
be deprived due to an inappropriate use of Article 6(1)(b) GDPR as legal basis, instead of others
such as consent 6(1)(a) GDPR and legitimate interest 6(1)(f) GDPR, are the possibility to
specifically consent to certain processing operations and not to others and to the further
processing of their personal data (Article 6(4) GDPR); their freedom to withdraw consent
(Article 7 GDPR); their right to be forgotten (Article 17 GDPR); and the balancing exercise of
the legitimate interests of the controller against their interests or fundamental rights and
freedoms (Article 6(1)(f) GDPR). As a result, owing to the number of users, market power, and
influence of Meta IE and its economically attractive business model, the risks derived from the
current findings of the Draft Decision could go beyond the Complainant and the millions of
users of Facebook service in the EEA and affect the protection of the hundreds of millions of
people covered by the GDPR.

132. The EDPB thus concurs with the objections of the AT, DE, FR, IT, NL, NO, PL, PT and SE
SAs 159 to Finding 2 of the Draft Decision in that the behavioural advertising performed by Meta

157
Composite Response, paragraph 69.
158
AT SA Objection, pp.5-6; DE SAs Objection, pp.9-10; FR SA Objection, paragraphs 35-37; IT SA Objection, pp.5- 7; NL
SA Objection, paragraphs 27, 35-36; NO SA Objection, p.7; PL SA Objection, p.2; PT SA Objection, paragraphs 63-64;
SE SA Objection, p.5.
159
AT SA Objection, pp. 1-2; DE SAs Objection, pp. 2 and 10; FR SA Objection, paragraphs 5-15 ; IT SA Objection, pp
1-7; NL SA Objection, paragraphs 4, 25-36; NO SA Objection, pp.1-2; PL SA Objection, pp. 1-2 ; PT SA Objection,
paragraphs 65-68; SE SA Objection, pp. 2-3.
48

IE in the context of the Facebook service is objectively not necessary for the performance of
Meta IE’s alleged contract with data users for the Facebook service and is not an essential or
core element of it.

133. In conclusion, the EDPB decides that Meta IE has inappropriately relied on Article 6(1)(b)
GDPR to process the Complainant’s personal data in the context of the Facebook Terms of
Service and therefore lacks a legal basis to process these data for the purpose of behavioural
advertising. Meta IE has not relied on any other legal basis to process personal data in the
context of the Facebook Terms of Service for the purpose of behavioural advertising. Meta IE
has consequently infringed Article 6(1) GDPR by unlawfully processing personal data. The EDPB
instructs the IE SA to alter its Finding 2 of its Draft Decision, which concludes that Meta IE may
rely on Article 6(1)(b) GDPR in the context of its offering of the Facebook Terms of Service, and
to include an infringement of Article 6(1) GDPR based on the shortcomings that the EDPB has
identified.

4.56 On the basis of the above, and as directed by the EDPB further to the Article 65 Decision, I find
that Facebook was not entitled to rely on Article 6(1)(b) GDPR to process the Complainant’s
personal data for the purpose of behavioural advertising in the context of the Facebook Terms of
Service.

Finding 2: I find that Facebook was not entitled to rely on Article 6(1)(b) GDPR to process the
Complainant’s personal data for the purpose of behavioural advertising in the context of the Facebook
Terms of Service.

5 ISSUE 3 – WHETHER FACEBOOK PROVIDED THE REQUISITE INFORMATION ON THE LEGAL BASIS FOR PROCESSING ON
FOOT OF ARTICLE 6(1)(B) GDPR AND WHETHER IT DID SO IN A TRANSPARENT MANNER

5.1 Processing of personal data, including transparency requirements of the GDPR, are governed by
the overarching principles set out in Article 5 GDPR, which provides that:

“1. Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject
(‘lawfulness, fairness and transparency’);

(b) collected for specified, explicit and legitimate purposes and not further processed In a
manner that is incompatible with those purposes; further processing for archiving
purposes in the public interest, scientific or historical research purposes or statistical
purposes shall, in accordance with Article 89(1), not be considered to be incompatible with
the initial purposes (‘purpose limitation’);

49

(c) adequate, relevant and limited to what is necessary in relation to the purposes for
which they are processed (‘data minimisation’);

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken
to ensure that personal data that are inaccurate, having regard to the purposes for which
they are processed, are erased or rectified without delay (‘accuracy’);

(e) kept in a form which permits identification of data subjects for no longer than is
necessary for the purposes for which the personal data are processed; personal data may
be stored for longer periods insofar as the personal data will be processed solely for
archiving purposes in the public interest, scientific or historical research purposes or
statistical purposes in accordance with Article 89(1) subject to implementation of the
appropriate technical and organisational measures required by this Regulation in order to
safeguard the rights and freedoms of the data subject (‘storage limitation’);

(f) processed in a manner that ensures appropriate security of the personal data, including
protection against unauthorised or unlawful processing and against accidental loss,
destruction or damage, using appropriate technical or organisational measures (‘integrity
and confidentiality’).

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph
1 (‘accountability’).”

5.2 Recital 58 of the GDPR, which serves as an aid to interpretation, states:

“The principle of transparency requires that any information addressed to the public or to
the data subject be concise, easily accessible and easy to understand, and that clear and
plain language and, additionally, where appropriate, visualisation be used.

Such information could be provided in electronic form, for example, when addressed to
the public, through a website.

This is of particular relevance in situations where the proliferation of actors and the
technological complexity of practice make it difficult for the data subject to know and
understand whether, by whom and for what purpose personal data relating to him or her
are being collected, such as in the case of online advertising.

Given that children merit specific protection, any information and communication, where
processing is addressed to a child, should be in such a clear and plain language that the
child can easily understand.”

50

5.3 Article 12(1) GDPR provides for the general manner in which information required by the
transparency provisions of the GDPR should be set out:

“The controller shall take appropriate measures to provide any information referred to in
Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to
processing to the data subject in a concise, transparent, intelligible and easily accessible
form, using clear and plain language, in particular for any information addressed
specifically to a child. The information shall be provided in writing, or by other means,
including, where appropriate, by electronic means. When requested by the data subject,
the information may be provided orally, provided that the identity of the data subject is
proven by other means.”

5.4 Article 13 GDPR enumerates specific categories of information that must be provided to data
subjects by data controllers in order to comply with transparency obligations:

“1. Where personal data relating to a data subject are collected from the data subject, the
controller shall, at the time when personal data are obtained, provide the data subject with all of
the following information:

(a) the identity and the contact details of the controller and, where applicable, of the
controller’s representative;

(b) the contact details of the data protection officer, where applicable;

(c) the purposes of the processing for which the personal data are intended as well as the
legal basis for the processing;

(d) where the processing is based on point (f) of Article 6(1), the legitimate interests
pursued by the controller or by a third party;

(e) the recipients or categories of recipients of the personal data, if any;

(f) where applicable, the fact that the controller intends to transfer personal data to a
third country or international organisation and the existence or absence of an adequacy
decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or
the second subparagraph of Article 49(1), reference to the appropriate or suitable
safeguards and the means by which to obtain a copy of them or where they have been
made available.

51

2. In addition to the information referred to in paragraph 1, the controller shall, at the time when
personal data are obtained, provide the data subject with the following further information
necessary to ensure fair and transparent processing:

(a) the period for which the personal data will be stored, or if that is not possible, the
criteria used to determine that period;

(b) the existence of the right to request from the controller access to and rectification or
erasure of personal data or restriction of processing concerning the data subject or to
object to processing as well as the right to data portability;

(c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the
existence of the right to withdraw consent at any time, without affecting the lawfulness
of processing based on consent before its withdrawal;

(d) the right to lodge a complaint with a supervisory authority;

(e) whether the provision of personal data is a statutory or contractual requirement, or a
requirement necessary to enter into a contract, as well as whether the data subject is
obliged to provide the personal data and of the possible consequences of failure to provide
such data;

(f) the existence of automated decision-making, including profiling, referred to in Article
22(1) and (4) and, at least in those cases, meaningful information about the logic involved,
as well as the significance and the envisaged consequences of such processing for the data
subject.

3. Where the controller intends to further process the personal data for a purpose other than that
for which the personal data were collected, the controller shall provide the data subject prior to
that further processing with information on that other purpose and with any relevant further
information as referred to in paragraph 2.

4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the
information.”

5.5 In its Transparency Guidelines, which have been adopted by the EDPB, the Article 29 Working
Party found that:

“A central consideration of the principle of transparency outlined in these provisions is
that the data subject should be able to determine in advance what the scope and

52

consequences of the processing entails and that they should not be taken by surprise at a
later point about the ways in which their personal data has been used.” 160

5.6 In the Complaint, the Complainant alleges that Facebook’s updated Terms of Service and the
hyperlinked Data Policy, together with the mode of acceptance (namely, clicking an “accept”
button) of the Terms of Service, created the conditions which led to the belief “that all these
processing operations” were based on consent under 6(1)(a) GDPR. 161 The Investigator therefore
examined whether it could be alleged that the Complainant was led to believe this was the case.

5.7 The Complainant argues that there was a lack of clarity in respect of the data processing which
was carried out on foot of the alleged “forced consent” to the Terms of Service. Indeed, the
Complaint states that “[e]ven if a trained lawyer reads all the text that the controller provides,
he/she can only guess what data is processed, for which exact purpose and on which legal basis.
This is inherently non-transparent and unfair within the meaning of Articles 5(1)(a) and 13(c).” 162
Furthermore, the Complainant argues that:

“The controller has in fact relied on a number of legal grounds under Article 6(1) of the
GDPR, but has given the data subject the impression, that he solely relies on consent, by
requesting the data subject to agree to the privacy policy (see above). Asking for consent
to a processing operation, when the controller relies in fact on another legal basis is
fundamentally unfair, misleading and non-transparent within the meaning of Article
5(1)(a) of the GDPR.”

5.8 The Complainant asserts that the clicking of “accept” on the Terms of Service generated the belief
that the processing was based on consent. In my view, this is surprising, given the common nature
of such “click wrap” contractual agreements utilised by most, if not all, online platforms.
Nonetheless, the Complainant outlined and provided the Commission with an affidavit (sworn
statement) sworn by the data subject, which stated that the “overall impression” created by the
“accept” button was that the data subject was providing their consent within the meaning of
Article 6(1)(a) GDPR. It is stated that the data subject did not read the Legal Basis Information
Page prior to agreeing to the Terms of Service. The Complainant raised a number of other
additional points relating to the engagement flow, including its design, which according to the
Complainant was intended to cause “user fatigue” and also an alleged difficulty in navigating to
the Legal Basis Information Page.

5.9 In this way, inherent in this Complaint is the argument that the legal basis relied on by Facebook
for processing personal data in accordance with the acceptance of the Terms of Service is unclear.

160
Article 29 Working Party Guidelines on transparency under Regulation 2016/679, page 7, paragraph 10,
https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227.
161
Complaint, page 3.
162
Ibid, paragraph 2.3.1.
53

Article 5(1)(a) GDPR sets out the requirement that, at a general level, personal data must be
processed in a transparent manner. More specific transparency requirements are contained in
Articles 12 and 13 GDPR. In particular, Article 13(1)(c) GDPR requires that “the purposes of the
processing for which the personal data are intended as well as the legal basis for processing” must
be made clear to a user. Article 12(1) GDPR sets out that this information required by Article 13
GDPR must be provided in a clear and transparent manner. Article 13 GDPR therefore prescribes
the information which must be provided to the data subject whereas Article 12(1) GDPR sets out
the way in which this information should be provided.

5.10 Given the Complaint’s focus on the alleged “forced consent” and on processing carried out on
foot of the acceptance of the Terms of Service, I confined the transparency analysis in the
Preliminary Draft Decision to questions relating to information on the lawful basis for processing
data arising from that acceptance. It follows that, as well as Article 5(1)(a) GDPR, Article 13(1)(c)
GPDR must be considered, as well as the accompanying requirement that the information
required by that latter provision be set out in accordance with Article 12(1) GDPR. As I have
already found that, to the extent specific processing operations are complained of, Facebook
sought to rely on Article 6(1)(b) GDPR, the central focus of this Decision in respect of this issue is
compliance with Article 13(1)(c) GDPR in the context of that lawful basis.

5.11 In its submissions on the Draft Report, the Complainant further detailed her objections in relation
to transparency by arguing that “there is also no clear statement which data are processed for
which purposes under the legal basis of Article 6(1)(b) GDPR”, 163 and that “[t]he only document
Facebook puts forward to prove the complainant's alleged information about the alleged change
of legal basis is the hard-to-find sub-sub-page on "legal basis", which is anything but an easily
accessible form”. 164

THE “LAYERED” APPROACH

5.12 I have already set out the reasons for my disagreement with the Investigator’s use of a distinction
between the question of whether the data subject was misled and the broader question of
whether the Data Policy complies with the transparency provisions of the GDPR. The obligation
for a controller to comply with these transparency provisions constitutes, in and of themselves,
the entirety of the Complainant’s right not to be misled under the GDPR.

5.13 When the Investigator considered compliance with the transparency requirements in this context,
he adopted a “layered” approach. That is to say, each “layer” of the documents in question were
assessed in isolation for their individual compliance before a final “cumulative” view was
expressed. Facebook disagreed with this approach, arguing that “[t]he GDPR contains no such

163
Submissions on Final Report, paragraph 2.4.1.3.
164
Ibid, paragraph 3.4.3.1.1.

54

concept of distinct layers and does not require a layered approach. Controllers are obliged to take
appropriate measures to provide information to data subjects and are permitted to achieve this in
ways they consider appropriate”. 165

5.14 The Investigator disagreed with Facebook’s submissions, and expressed the view that:

“in order to assess the layered provision of information, it is first necessary to consider the
discrete information sources separately, in order to arrive at an overall view. Accordingly,
the following assessment of primary, secondary and tertiary sources of information
provided by Facebook is not premised on “separatist approach”, rather, it constitutes a
comprehensive assessment of the manner in which information has been provided to the
data subject. The investigator also considers that, where a controller adopts a layered
approach to the provision of information, each layer must comply independently with the
requirement of Article 12(1) GDPR regarding the provision of information”. 166

5.15 I respectfully disagree with the premise of the Investigator’s reasons for adopting this approach.
Article 12(1) GDPR is directed to ensuring, insofar as possible, that the data subject receives the
information that is “provided” by the data controller. It does this by reference to the potential
barriers that could operate to prevent the information from being received by the data subject.
The requirement, for example, for the data controller to use “clear and plain language” when
“providing” the information helps to ensure that the data subject is not hindered in receiving the
information because of an inability to understand complicated or technical jargon. Similarly, the
requirement for the data controller to “provide” the information in a “concise” manner helps to
ensure that the data subject is not hindered in receiving the information as a result of information
fatigue caused by the incorporation of the information into a long and rambling piece of text.

5.16 Article 12(1) GDPR, however, clearly deals with “any information referred to in Articles 13 and 14
and any communication under Articles 15 to 22 and 34” [my emphasis]. Therefore, compliance
with this provision can only be assessed by reference to the provision of information mandated
by Articles 13 and 14 GDPR as appropriate; it is not a requirement applied generally to every single
piece of information provided to the data subject concerning data processing. There is no
requirement that the information mandated by Article 13(1)(c) GDPR be contained in any
particular “layer” of information; there is simply a requirement that the information be provided,
and that the information be set out in the manner required by Article 12(1) GDPR. Therefore, each
individual “layer” cannot be assessed by reference to Article 12(1) GDPR independently of the
information required by Article 13(1)(c) GDPR.

5.17 Given that a controller is free to choose not to put particular information in a particular layer, it
must follow that Article 12(1) GDPR cannot be used as a basis for assessing each layer

165
Submissions 22 February 2019, paragraph 5.9.
166
Final Report, paragraphs 297-298.
55

independently. It may well be the case that something about the “layered” approach taken by a
controller could ultimately mean the information required by Article 13(1)(c) GDPR is not set out
in the manner required by Article 12(1) GDPR. That in itself, however, is not a justification for an
isolated and/or abstract assessment of each individual layer, without reference to other layers,
for compliance with Article 12(1) GDPR. On that basis, while the Investigator’s view on the issue
of infringements was expressed by reference to each individual layer before finally arriving at a
separate view in relation to the documents as a whole, I propose to approach the assessment
strictly by reference to the requirements of Articles 12(1) and 13(1)(c) GDPR. Once the
information has been provided and has been provided in a compliant manner, it does not matter
whether a controller has achieved the objective by the use of layering, nor does it matter what
precisely is contained in each layer.

5.18 For the avoidance of doubt, I am not expressing any particular view on the merits or otherwise of
controllers adopting a layered approach. Moreover, I am conscious that a layered approach for
the provision of information on online services has been explicitly endorsed by the Article 29
Working Party Guidelines (and, in turn, endorsed by the EDPB). 167 I am instead expressing a view
on the appropriate manner in which to assess the compliance of any such layered information
with Articles 12 and 13 GDPR. In my view, while the Investigator’s analysis was robust and
comprehensive, the consideration of the documents was not sufficiently holistic, insofar as
individual layers were initially assessed for compliance without reference to the information or
documents as a whole.

5.19 In addition, I should add that a cumulative assessment of the information provided and the
manner in which the information is provided must always be carried out, irrespective of whether
the Investigator was correct to also assess each layer individually, or whether Facebook was
correct to argue that the individual layers should not be considered in this manner. In
circumstances where the layered documents, when considered cumulatively, lack the information
required by Article 13 GDPR or are not set out in a manner compliant with Article 12 GDPR, it
matters not whether any individual layer is deficient or otherwise; there would still be an
infringement of the provision.

5.20 The Investigator was of the general view that the “Legal Basis Information Page” (a term used by
the Investigator for an unnamed page linked to the Data Policy and Terms of Service) is
transparent about Facebook’s reliance on Article 6(1)(b) GDPR, and that therefore it was
transparent that data would be processed on that basis arising out of acceptance of the Terms of
Service.168 The Investigator went on to express a number of views to the effect that Articles 12(1)
and 13(1)(c) GDPR were being infringed on the basis that each “layer” of information failed to set

167
Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on
11 April 2018.
168
Final Report, Paragraph 256.

56

out specific processing operations (or sets of operations), their individual purpose, and the lawful
basis being relied on for each. Facebook’s position is that Article 13(1)(c) GDPR “does not require
a controller to provide this information in relation to specific processing operations, rather, it
requires transparency in relation to the processing purposes.” 169 Facebook further argues that the
definition of “processing” in Article 4(2) GDPR, i.e. an “operation or sets of operations”, cannot
be used to circumvent, what they say is, the clear intention of the legislator to use the term
“processing” instead of “processing operations”, when the latter appears in the text of the GDPR
over fifty times. 170 I consider this argument in more detail below.

5.21 Many of the points of dispute that characterise the submissions of Facebook on the Draft Report
and the contents of the Final Report relate to the dispute as to the appropriateness of assessing
compliance with reference to each individual “layer” of information. I have set out my view in that
regard already. I also note that, in its submissions on the Preliminary Draft Decision, Facebook
expressed agreement with this conclusion, and maintained that the relevant consideration “is
whether, cumulatively, the data subject has been provided with the information required under
the GDPR.” 171 Therefore I will now proceed to consider whether, in my view, Facebook has been
transparent with the Complainant (and therefore with data subjects in general) in relation to
processing for which it indicated reliance on Article 6(1)(b) GDPR. I will make further reference to
the Reports and the submissions of the parties when considering that issue.

THE EXTENT OF THE OBLIGATION IN ARTICLE 13(1)(C) GDPR

5.22 In the Investigator’s view, Article 13(1)(c) requires a data controller to set out a description of the
processing operation or sets of operations undertaken by the controller to fulfil that purpose, and
the legal basis relied on by the controller in order to carry out that processing operation or sets
of operations. His view is that “the obligation under Article 13(1)(c) requires the provision of two
types of information to the data subject: (i) information which specifies the lawful basis for
processing, and (ii) information which describes the processing associated with that lawful
basis”. 172 Facebook’s view on the matter is that there is no such specific obligation for “the legal
basis being mapped to the purpose of processing”. 173 Facebook argues that the legal bases and
purposes can be set out in a manner that does not necessarily link one to the other.

5.23 Article 4(2) GDPR, which deals with interpretation, states that:

“’processing’ means any operation or set of operations which is performed on personal
data or on sets of personal data, whether or not by automated means, such as collection,

169
Submissions of 22 February 2019, paragraph 2.2.
170
Submissions on the Draft Report (September 2019), paragraph 5.5.
171
Submissions on the Preliminary Draft Decision, paragraph 7.1.
172
Final Report, paragraph 283.
173
Submissions on the Final Report, paragraph 5.13.
57

recording, organisation, structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure or destruction.” [emphasis
added]

5.24 I also note that Recital 60 states that “principles of fair and transparent processing require that
the data subject be informed of the existence of the processing operation and its purposes”. The
Article 29 Working Party has opined that:

“Transparency is intrinsically linked to fairness and the new principle of accountability
under the GDPR. It also follows from Article 5.2 that the controller must always be able to
demonstrate that personal data are processed in a transparent manner in relation to the
data subject. Connected to this, the accountability principle requires transparency of
processing operations in order that data controllers are able to demonstrate compliance
with their obligations under the GDPR.” 174

5.25 Facebook has sought to argue that the absence of a specific reference to processing “operation”
in Article 13(1)(c) GDPR means that the obligation to provide information to data subjects does
not necessitate an approach whereby the prescribed information is provided by reference to
individual processing operation(s). In the Preliminary Draft Decision, I did not agree with this
position. The Preliminary Draft Decision set out that Article 4(2) GDPR clearly identifies that the
definitions set out in that provision are “for the purposes of” the GDPR and that there is no
limitation on the application of the prescribed definitions, either within Article 4 GDPR or in the
context of other individual provisions of the Regulation. For this reason, the Preliminary Draft
Decision expressed the view that an argument premised on a suggestion that the definition of
“processing” should only be applied to those provisions that incorporate specific reference, within
its own text, to an “operation” or “operations”, was legally unsustainable based on a literal
interpretation of the GDPR.

5.26 I note that the Investigator agreed with Facebook’s argument that Article 13(1)(c) GDPR requires
a data controller to provide information in relation to the purpose(s) of the processing in
conjunction with the corresponding legal basis for processing. However, the phrase “for which the
personal data were intended”, suggests that the data controller should also provide this
information in such a way that enables the data subject to understand which personal data
are/will be processed, for what processing operation and by reference to which legal basis, at
least in broad terms.

5.27 In expressing disagreement with the proposed literal interpretation of Article 13(1)(c) GDPR set
out in the Preliminary Draft Decision, Facebook submitted that “Facebook Ireland’s interpretation

174
Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on
11 April 2018.
58

directly tracks the actual wording of the relevant GDPR provision which stipulates only that two
items of information be provided about the processing (i.e. purposes and legal bases). It says
nothing about processing operations.” 175 Facebook submitted that because, in its view, Article
13(1) GDPR applies “at the time data is collected”, it therefore refers only to “prospective
processing”. It submits that, on this basis, Article 13(1)(c) GDPR does not relate to ongoing
processing operations, but is concerned solely with information on “intended processing”. 176
Facebook’s position is therefore that Article 13(1)(c) GDPR is future-gazing or prospective only in
its application and that such an interpretation is supported by a literal reading of the GDPR.

5.28 Facebook argues that, despite the provision of a clear definition of “processing” in Article 4(2)
GDPR, Article 13(1)(c) GDPR sets out:

“only two specific features of the processing that need to be provided. Article 13(1)(c)
GDPR does not require disclosure, for example, of various other aspects of processing
referenced in Article 4(2) GDPR, namely, the intended nature of the processing, or the
intended form in which the data will be processed, or the intended duration of the
processing, which is separately required and addressed by Article 13(2)(a) GDPR. Similarly,
another aspect of processing – namely, the identity of any recipient – is explicitly included
under Article 13(1)(e) GDPR, but the same is not done as regards the specifying of
processing operations. As such, the generic definition of “processing” in Article 4(2) GDPR
is not relevant to the analysis of what Article 13(1)(c) GDPR requires.” 177

5.29 Facebook’s argument above is premised on the suggestion that the various provisions of Article
13 GDPR require the disclosure to data subjects of specific aspects of the broader activity or
“processing” as defined by Article 4(2) GDPR, such as the identity of a recipient, the duration of
the processing, etc. Facebook makes the point that nothing in Article 13 requires it to specify if
storage, transmission or dissemination, for example, are the forms of processing engaged. That is
correct. However, what Article 13 does clearly require is that the purposes and legal bases must
be specified in respect of the intended processing. Purposes and legal bases cannot simply be cited
in the abstract and detached from the personal data processing they concern.

5.30 As Facebook’s position cannot be reconciled with a literal reading of the GDPR, for completeness,
it is necessary to consider whether its position is nonetheless justified by a systemic reading based
on the legislator’s objective and the contents of the GDPR as a whole. Firstly in relation to the
argument I have just dealt with, it is important to note that transparency, both under the GDPR
and in the Guidelines that are to be considered in this Decision, are directly linked to the principle
of accountability under the GDPR. In order to ensure that actual or intended processing is carried
out in an accountable and transparent manner, the interpretation proposed by Facebook cannot

175
Submissions on the Preliminary Draft Decision, paragraph 8.2(A).
176
Ibid, paragraph 8.2(B).
177
Ibid, paragraph 8.2(C).
59

be accepted. Firstly, the absence of any level of specificity as to what the data controller is doing
with the data, and more fundamentally what data they are processing at all, would render
information on the purposes of this unspecified processing almost useless to a data subject. In
the absence of information on the nature of the data being used and the nature of the processing
being carried out, it would be nigh on impossible to exercise data subject rights in an informed
manner. Such an absence of transparency and accountability could not be reconciled with a
purposive or systematic reading of the GDPR.

5.31 Facebook goes on to provide examples of previous drafts of the GDPR where the legislator
considered requiring additional material in Article 13 GDPR, including “the existence of certain
processing activities and operations for which a personal data impact assessment has indicated
that there may be a high risk”. 178 The decision of the legislator not to include a requirement to
provide such information has no impact on the applicability of the clear definition of “processing”
in Article 4(2) GDPR, and therefore does not affect the appropriate literal interpretation of Article
13(1)(c) GDPR. In any purposive or systematic approach to interpreting the provision, the decision
not to require information on processing which the controller itself has found to be high risk does
not suggest that the controller would not otherwise be required to disclose the existence of that
processing. It would simply require a controller to disclose that a data protection impact
assessment indicated the presence of a high risk. This therefore provides no evidence that the
legislator excluded in any way the interpretation of Article 13(1)(c) GDPR being proposed.

5.32 Article 5(1)(b) GDPR states that personal data shall be “collected for specified, explicit and
legitimate purposes and not further processed in a manner that is incompatible with those
purposes”, and Article 5(1)(c) GDPR states that the data shall be “limited to what is necessary in
relation to the purposes for which they are processed” [emphasis added]. The core principles
clearly focus quite closely on the purposes for processing (defined, by Article 4(11) GDPR, as
“processing operations or sets of operations). While Article 5 GDPR lays down six different
principles, those principles are interconnected and operate, in combination, to underpin the
GDPR as a whole.

5.33 Considering the purpose limitation principle, I note that this principle identifies the obligations
which arise by reference to the terms “collection” and “further” processing. This is very similar to
the language of Article 13(1)(c) GDPR, as the introductory passage to Article 13 GDPR contains a
reference to “collection”, and Article 13(1)(c) GDPR itself refers to “the purposes of the processing
for which the personal data are intended”. It therefore can be said that Article 13 GDPR also
considers “collection” and “further” processing. For this reason, it is useful to examine further the
requirements and function of the purpose limitation principle enshrined in Article 5(1)(b) GDPR.

5.34 The Article 29 Working Party has provided Guidance that states:

178
Ibid, paragraph 8.2(E).
60

“When setting out the requirement of compatibility, the Directive does not specifically
refer to processing for the ‘originally specified purposes’ and processing for ‘purposes
defined subsequently’. Rather, it differentiates between the very first processing
operation, which is collection, and all other subsequent processing operations (including
for instance the very first typical processing operation following collection – the storage
of data).

In other words: any processing following collection, whether for the purposes initially
specified or for any additional purposes, must be considered ‘further processing’ and must
thus meet the requirement of compatibility”

5.35 This introduces a distinction between “purpose specification” and “compatible use”. In relation
to specifying the purpose for which data is collected, the Article 29 Working Party stated that:

“[P]ersonal data should only be collected for ‘specified, explicit and legitimate’ purposes.
Data are collected for certain aims; these aims are the ‘raison d’être’ of the processing
operations. As a prerequisite for other data quality requirements, purpose specification
will determine the relevant data to be collected, retention periods, and all other key
aspects of how personal data will be processed for the chosen purpose/s.”

5.36 In considering the purpose limitation principle, i.e. compatible use, it was set out that:

“There is a strong connection between transparency and purpose specification. When the
specified purpose is visible and shared with stakeholders such as data protection
authorities and data subjects, safeguards can be fully effective. Transparency ensures
predictability and enables user control.”

5.37 It was further stated that:

“In terms of accountability, specification of the purpose in writing and production of
adequate documentation will help to demonstrate that the controller has complied with
the requirement of Article 6(1)(b). It would allow data subjects to exercise their rights
more effectively – for example, it would provide proof of the original purpose and allow
comparison with subsequent processing purposes.”

5.38 The Article 29 Working Party also emphasised the benefits to the data subject from such
transparency and accountability, by enabling them to make informed choices. While I note that
the guidance of the Article 29 Working Party is not binding on the Commission, it nevertheless is
instructive in the understanding of transparency obligations and their relationship with the
overarching principles enshrined in Article 5 GDPR. It is clear to me from the above that the
purpose limitation principle has an important role to play, both in relation to the empowerment

61

of the data subject, but also in relation to underpinning and supporting the objectives of the data
protection framework as a whole under the GDPR.

5.39 I am therefore of the view that, when considering what information must be provided in relation
to the “purposes” of any processing operation, such as by way of Article 13(1)(c) GDPR, it is
important, amongst other things, to consider how the quality of information provided may
potentially impact the effective operation of the other data protection principles. This is
particularly the case where the wording of Article 13(1)(c) GDPR maps the approach of Article
5(1)(b) GDPR, i.e. by describing the obligation arising by reference to “collection” and ‘further’
processing.

5.40 The data controller must identify the categories of personal data that will be collected if they are
to comply with the requirement to specify “purpose” in accordance with the purpose limitation
principle. I am of the view that having access to the information required by Article 13(1)(c) GDPR
in conjunction with the category/categories of personal data being processed is essential if the
data subject is to be empowered to hold the data controller accountable for compliance with the
Article 5(1)(b) GDPR purpose limitation principle. The Article 29 Working Party reflects this
approach in the Transparency Guidelines, by saying:

“Transparency, when adhered to by data controllers, empowers data subjects to hold data
controllers and processors accountable and to exercise control over their personal data
by, for example, providing or withdrawing informed consent and actioning their data
subject rights. The concept of transparency in the GDPR is user-centric rather than
legalistic and is realised by way of specific practical requirements on data controllers and
processors in a number of articles.” 179

5.41 For this reason, I expressed the view in the Preliminary Draft Decision that the information
provided must set out: the purpose(s) of the specified processing operation/set of processing
operations for which the (specified category/specified categories of) personal data are intended,
and the legal basis being relied upon to support the processing operation/set of operations. In
that information, there should be a clear link between the specified category/categories of data,
the purpose(s) of the specified operation(s), and the legal basis being relied on to support the
specified operation(s). In submissions on the Preliminary Draft Decision, the Complainant agreed
with this position and that “[w]ithout such linking, we would simply see generic lists of all data, all
purposes and all legal bases under Article 6(1) GDPR without any indication of the relationships
between them.”. 180

179
Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, as last revised and adopted on
11 April 2018.
180
Complainant Submissions on Preliminary Draft Decision, page 20.
62

5.42 However, Facebook disagreed with this analysis. To set out the position simply, Facebook argues
that it is only obliged to provide specific information on (1) the purposes for the processing it
carries out and (2) the legal bases upon which it relies. This amounts to simply setting out its own
purposes and the legal bases upon which it relies for the collection and processing of personal
data in order to fulfil those objectives. Its position is that two pieces of information are required
and, in addition, it argues that there is no requirement for the individual purposes to be linked
with individual legal bases.

5.43 Facebook submits that such a “third limb” is not necessary. It submits that purpose and legal basis
are “conceptually, capable of being explained and understood without any reference to the
practicalities of the processing operations”. It further submits that the provision of information
on processing operations would in fact not aid transparency. In this regard, it also reiterates
arguments already addressed above in relation to the alleged absence of a requirement under
Article 13(1)(c) GDPR to specify processing operations. 181 Facebook specifically argues that it
would be “very difficult to achieve in ways that are “concise” and “intelligible”, as required under
Article 12(1) GDPR. This supposed requirement would therefore be intrinsically unlikely to assist
data subjects or further the purposes behind the GDPR’s transparency regime” 182

5.44 As is evident from the assessments that follow, my view is that the Data Policy and related
material sometimes, on the contrary, demonstrate an oversupply of very high level, generalised
information at the expense of a more concise and meaningful delivery of the essential information
necessary for the data subject to understand the processing being undertaken and to exercise
his/her rights in a meaningful way. Furthermore, while Facebook has chosen to provide its
transparency information by way of pieces of text, there are other options available, such as the
possible incorporation of tables, which might enable Facebook to provide the information
required in a clear and concise manner, particularly in the case of an information requirement
comprising a number of linked elements. The importance of concision cannot be overstated
nonetheless. Facebook is entitled to provide additional information to its users above and beyond
that required by Article 13 and can provide whatever additional information it wishes. However,
it must first comply with more specific obligations under the GDPR, and then secondly ensure that
the additional information does not have the effect of creating information fatigue or otherwise
diluting the effective delivery of the statutorily required information. That is simply what the
GDPR requires.

5.45 In support of the argument that the Commission’s interpretation of Article 13(1)(c) GDPR is
incorrect, Facebook also refers to Article 14(1)(d) GDPR:

“14(1)(d) GDPR expressly requires a controller to provide information to the data subject
on the categories of personal data (in circumstances where Article 14 applies) further

181
Ibid, paragraph 8.3.
182
Ibid, paragraph 8.2(F).
63

reinforces this point - i.e. it is clear from the fact that the concept is referred to in Article
14(1)(d) GDPR, that the legislators made a deliberate choice not to include this concept in
Article 13(1)(c) GDPR. Indeed, if the Commission’s interpretation was correct there would
have been no need for Article 14(1)(d) GDPR, as Article 14(1)(c) GDPR would in any event
have to be approached on the basis that categories of data needed to be identified. As
such, the Commission’s approach appears to conflict with the statutory interpretation
principle expressio unis est exclusio alterius” 183

5.46 In addressing this argument, it is important to underline the fundamental differences between
Articles 13 and 14 GDPR. The first fundamental difference between Articles 13 and 14 GDPR is
that Article 13 GDPR is expressly stated to apply in circumstances where “personal data are
collected from the data subject”. Article 14 GDPR, on the other hand, only applies in circumstances
where personal data have been obtained from a source(s) other than the data subject. The second
fundamental difference is that the information prescribed by Article 13 GDPR must be provided
to the data subject “at the time when personal data are obtained”. The information prescribed by
Article 14, however, can only be provided after the personal data has been collected.

5.47 These fundamental differences give rise to variations in the information required to be provided
pursuant to Article 13 GDPR, on the one hand, and the information required to be provided
pursuant to Article 14 GDPR, on the other. Firstly, Article 13(2)(e) GDPR requires the controller to
inform the data subject as to “whether the provision of personal data is a statutory or contractual
requirement, or a requirement necessary to enter into a contract, as well as whether the data
subject is obliged to provide the personal data and of the possible consequences of failure to
provide such data.” Article 14 GDPR, on the other hand, contains no such requirement. The
rationale for this difference is clear. When this information is provided prior to the collection of
personal data, the data subject is empowered to exercise control over their personal data. It
avoids them being placed in a position where they provide personal data to the controller on a
mistaken understanding as to either the necessity for its collection, or of the potential
consequences of failure to provide it. The provision of such information would have no purpose
if provided to the data subject after the personal data has been collected, hence its omission from
Article 14 GDPR.

5.48 Secondly, Article 14(1)(d) GDPR requires that the data subject to be provided with information as
to the “categories of personal data concerned” while Article 14(2)(f) GDPR requires the provision
of information as to the source “from which the personal data originate”. These requirements are
notably absent from Article 13. The rationale for these omissions is clear by reference to the
exemption to the obligation to provide information set out in Articles 13(4) and Article 14(5)(a)
GDPR. These exemptions provide that the controller’s obligation to provide the specified
information “shall not apply where and insofar as the data subject already has the information”.

183
Ibid, paragraph 8.4(C).
64

Therefore, both of these transparency provisions clearly envisage that they need not apply where
the data subject has the information in question.

5.49 In some cases where personal data has been collected from the data subject, the data subject
may already know the categories of personal data and the source of this information, because it
is the data subject that has provided the personal data to the controller. Equally, however, some
collection directly from the data subject is less obvious to the data subject for example where
metadata or device data is collected from them. The data subject will, however, likely never have
this knowledge if the data have been collected in the circumstances envisaged by Article 14 GDPR.
It is therefore envisaged by both Articles 13 and 14 GDPR that in all circumstances, the data
subject will have this information. In the case of Article 14 GDPR, the personal data has not been
obtained by the data subject, and so Article 14 GDPR specifies that additional information should
be provided. In the case of Article 13 GDPR, it may be the data subject who will have provided the
data, and so the data subject may already know this information. In my view, this is the distinction
between the provisions and the clear motivation of the legislator in including these categories of
information in Article 14 GDPR alone.

5.50 Furthermore, it is unclear why a data subject would only be entitled to this information if the
controller has acquired their personal data from another source. It is further difficult to
understand how such a difference in treatment, between two categories of data subject, could
be consistent with the GDPR, particularly where the difference in treatment concerns a core data
subject right. If this were true, a data subject would only be entitled to this information if the
personal data were obtained from a source other than themselves, but would not if it was
obtained from them directly. This entirely arbitrary distinction is inconsistent with the clear aims
of the GDPR to provide a series of universal rights to all data subjects, grounded on the universal
right to data protection in Article 8 of the Charter. Therefore even if the interpretation advanced
in the preceding paragraph were incorrect, Facebook’s submissions would nonetheless not be
supported by a purposive or systematic reading of the GDPR.

5.51 In any event, Facebook’s submissions operate on the assumption that, as has been quoted above,
Article 14(1)(d) GDPR would not be necessary if the Commission’s interpretation of Article 13(1)(c)
GDPR were applied mutatis mutandis to Article 14(1)(c) GDPR. This conflates the information the
Commission’s interpretation requires i.e. the “processing operations or sets of operations”, and
the information required by Article 14(1)(d) GDPR, i.e. “categories of personal data”.

5.52 My view is Article 13(1)(c) GDPR therefore does require what has been described as the “third
link” in this chain: the relevant information for the purposes of Article 13(1)(c) GDPR must be
provided by reference to the processing operations themselves. This is supported both by a literal
reading of the provision, having regard to the definition in Article 4(2) GDPR, and the systematic
reading I have just set out above. This provision specifically refers to the purposes for which the
personal data are intended. When the purposes and legal basis for processing are identified, they

65

must be identified by reference to the personal data being processed or, at a minimum, the broad
personal data processing operations to which they relate. The purposes and legal basis of
processing personal data can only be understood by reference to the processing operations being
undertaken. In order for information in this regard to be meaningful, and to provide data subjects
with meaningful information as to whether they wish to exercise data subject rights, data subjects
must be provided with this information. This goes to the essence of transparency in relation to
the processing of personal data. In providing information on “the purposes of the processing for
which the personal data are intended as well as the legal basis for the processing” for the purposes
of Article 13(1)(c) GDPR, the data controller must do so by reference to the personal data being
processed or, at least, the broad personal data processing operations involved.

INFORMATION PROVIDED BY FACEBOOK IN RELATION TO PROCESSING IN ACCORDANCE WITH ARTICLE 6(1)(B) GDPR

5.53 The starting point in assessing this information provided by Facebook is the Data Policy. Facebook
itself asserts that this is the document it uses to comply with the transparency obligations under
Article 13(1)(b) GDPR. In the Data Policy, there is a section entitled “What is our legal basis for
processing data?”. The section dealing with contractual necessity is as follows:

“We collect, use and share the data that we have in the ways described above:

• as necessary to fulfil our Facebook Terms of Service or Instagram Terms of Use”

5.54 I note at this point that the Data Policy contains a hyperlink where users can “Learn more about
these legal bases and how they relate to the ways in which we process data”. This hyperlink is
found at the end of the section partly quoted above, which lists processing carried out pursuant
to each lawful basis under the GDPR. As I have set out in Section 2, this hyperlink directs Facebook
users to an unnamed page that the Investigator terms the “Legal Basis Information Page”. For
clarity, I retain this definition. This page sets out that:

“For all people who have legal capacity to enter into an enforceable contract, we process data
as necessary to perform our contracts with you (the Facebook Terms and Instagram Terms,
together, 'the Terms'). We describe the contractual services for which this data processing is
necessary in the “Our Services” section of the Terms, and in the additional informational
resources accessible from the Terms. The core data uses necessary to provide our contractual
services are:

• To provide, personalize, and improve our Facebook Products;
• To promote safety, integrity, and security;
• To transfer, transmit, store, or process your data outside the EEA, including to within the
United States and other countries;
• To communicate with you, for example, on Product-related issues; and
66

• To provide consistent and seamless experiences across the Facebook Company Products.

These uses are explained in more detail in our Data Policy, under “How do we use this
information?” and “How do we operate and transfer data as part of our global services?” and
“How do the Facebook Companies work together?” We’ll use the data we have to provide
these services; if you choose not to provide certain data, the quality of your experience using
the Facebook Products may be impacted.”

5.55 It is clear from the above that Facebook users are invited to receive more information from other
hyperlinked sources. In relation to the “Terms of Service” hyperlink, it directs users to the
relatively lengthy Terms of Service which includes several other hyperlinks, including a hyperlink
to the Data Policy. Users are also directed to the “Our Services” section of the Terms of Service,
which sets out the following:

“Our mission is to give people the power to build community and bring the world closer
together. To help advance this mission, we provide the Products and services described
below to you:

Provide a personalized experience for you:
Your experience on Facebook is unlike anyone else's: from the posts,
stories, events, ads, and other content you see in News Feed or our video
platform to the Pages you follow and other features you might use, such
as Trending, Marketplace, and search. We use the data we have - for
example, about the connections you make, the choices and settings you
select, and what you share and do on and off our Products - to
personalize your experience.

Connect you with people and organizations you care about:
We help you find and connect with people, groups, businesses,
organizations, and others that matter to you across the Facebook
Products you use. We use the data we have to make suggestions for you
and others - for example, groups to join, events to attend, Pages to follow
or send a message to, shows to watch, and people you may want to
become friends with. Stronger ties make for better communities, and we
believe our services are most useful when people are connected to
people, groups, and organizations they care about.

Empower you to express yourself and communicate about what matters to you:
There are many ways to express yourself on Facebook and to
communicate with friends, family, and others about what matters to you -
for example, sharing status updates, photos, videos, and stories across

67

the Facebook Products you use, sending messages to a friend or several
people, creating events or groups, or adding content to your profile. We also have
developed, and continue to explore, new ways for people to use
technology, such as augmented reality and 360 video to create and share
more expressive and engaging content on Facebook.

Help you discover content, products, and services that may interest
you:
We show you ads, offers, and other sponsored content to help you
discover content, products, and services that are offered by the many
businesses and organizations that use Facebook and other Facebook
Products. Our partners pay us to show their content to you, and we
design our services so that the sponsored content you see is as relevant
and useful to you as everything else you see on our Products.

Combat harmful conduct and protect and support our community:
People will only build community on Facebook if they feel safe. We
employ dedicated teams around the world and develop advanced
technical systems to detect misuse of our Products, harmful conduct
towards others, and situations where we may be able to help support or
protect our community. If we learn of content or conduct like this, we will
take appropriate action - for example, offering help, removing content,
blocking access to certain features, disabling an account, or contacting
law enforcement. We share data with other Facebook Companies when
we detect misuse or harmful conduct by someone using one of our
Products.

Use and develop advanced technologies to provide safe and
functional services for everyone:
We use and develop advanced technologies - such as artificial
intelligence, machine learning systems, and augmented reality - so that
people can use our Products safely regardless of physical ability or
geographic location. For example, technology like this helps people who
have visual impairments understand what or who is in photos or videos
shared on Facebook or Instagram. We also build sophisticated network
and communication technology to help more people connect to the
internet in areas with limited access. And we develop automated systems
to improve our ability to detect and remove abusive and dangerous
activity that may harm our community and the integrity of our Products.

Research ways to make our services better:

68

We engage in research and collaborate with others to improve our
Products. One way we do this is by analyzing the data we have and
understanding how people use our Products. You can learn more about
some of our research efforts.

Provide consistent and seamless experiences across the Facebook Company Products:
Our Products help you find and connect with people, groups, businesses,
organizations, and others that are important to you. We design our
systems so that your experience is consistent and seamless across the
different Facebook Company Products that you use. For example, we use
data about the people you engage with on Facebook to make it easier for
you to connect with them on Instagram or Messenger, and we enable you
to communicate with a business you follow on Facebook through
Messenger.

Enable global access to our services:
To operate our global service, we need to store and distribute content
and data in our data centers and systems around the world, including
outside your country of residence. This infrastructure may be operated
or controlled by Facebook, Inc., Facebook Ireland Limited, or its affiliates.”

5.56 In addition, users are directed to the “How do we use this information” section of the Data Policy.
It sets out the following:

“We use the information we have (subject to choices you make) as described below and
to provide and support the Facebook Products and related services described in the
Facebook Terms and Instagram Terms. Here's how:

Provide, personalize and improve our Products.
We use the information we have to deliver our Products, including to
personalize features and content (including your News Feed, Instagram
Feed, Instagram Stories and ads) and make suggestions for you (such as
groups or events you may be interested in or topics you may want to
follow) on and off our Products. To create personalized Products that are
unique and relevant to you, we use your connections, preferences,
interests and activities based on the data we collect and learn from you
and others (including any data with special protections you choose to
provide where you have given your explicit consent); how you use and
interact with our Products; and the people, places, or things you're
connected to and interested in on and off our Products. Learn more
about how we use information about you to personalize your Facebook

69

and Instagram experience, including features, content and
recommendations in Facebook Products; you can also learn more about
how we choose the ads that you see.

• Information across Facebook Products and devices: We connect
information about your activities on different Facebook Products and
devices to provide a more tailored and consistent experience on all
Facebook Products you use, wherever you use them. For example, we
can suggest that you join a group on Facebook that includes people
you follow on Instagram or communicate with using Messenger. We
can also make your experience more seamless, for example, by
automatically filling in your registration information (such as your
phone number) from one Facebook Product when you sign up for an
account on a different Product.

• Location-related information: We use location-related information such
as your current location, where you live, the places you like to go, and the businesses
and people you're near-to provide, personalize and improve our Products, including
ads, for you and others. Location related information can be based on things like
precise device location (if you've allowed us to collect it), IP addresses, and
information from your and others' use of Facebook Products (such as check-ins or
events you attend).

• Product research and development: We use the information we have
to develop, test and improve our Products, including by conducting
surveys and research, and testing and troubleshooting new products
and features.

• Face recognition: If you have it turned on, we use face recognition
technology to recognize you in photos, videos and camera
experiences. The face-recognition templates we create are data with
special protections under EU law. Learn more about how we use face
recognition technology, or control our use of this technology in
Facebook Settings. If we introduce face-recognition technology to
your Instagram experience, we will let you know first, and you will have
control over whether we use this technology for you.

• Ads and other sponsored content: We use the information we have
about you-including information about your interests, actions and
connections-to select and personalize ads, offers and other sponsored
content that we show you. Learn more about how we select and

70

personalize ads, and your choices over the data we use to select ads
and other sponsored content for you in the Facebook Settings and
Instagram Settings.

Provide measurement, analytics, and other business services.
We use the information we have (including your activity off our Products,
such as the websites you visit and ads you see) to help advertisers and
other partners measure the effectiveness and distribution of their ads
and services, and understand the types of people who use their services
and how people interact with their websites, apps, and services. Learn
how we share information with these partners.

Promote safety, integrity and security.
We use the information we have to verify accounts and activity, combat
harmful conduct, detect and prevent spam and other bad experiences,
maintain the integrity of our Products, and promote safety and security
on and off of Facebook Products. For example, we use data we have to
investigate suspicious activity or violations of our terms or policies, or to
detect when someone needs help. To learn more, visit the Facebook
Security Help Center and Instagram Security Tips.

Communicate with you.
We use the information we have to send you marketing communications,
communicate with you about our Products, and let you know about our
policies and terms. We also use your information to respond to you when
you contact us.

Research and innovate for social good.
We use the information we have (including from research partners we
collaborate with) to conduct and support research and innovation on
topics of general social welfare, technological advancement, public
interest, health and well-being. For example, we analyze information we
have about migration patterns during crises to aid relief efforts. Learn
more about our research programs.”

5.57 Facebook users are invited, by way of various hyperlinks, to receive further information on the
matters set out above.

5.58 Facebook users are also invited, in the Legal Basis Information Page detailing processing based on
Article 6(1)(b) GDPR, to consider the sections of the Data Policy entitled “How do we operate and

71

transfer data as part of our global services” and How do the Facebook Companies work together?”
The former states as follows:

“We share information globally, both internally within the Facebook Companies and
externally with our partners and with those you connect and share with around the world
in accordance with this policy. Information controlled by Facebook Ireland will be
transferred or transmitted to, or stored and processed in, the United States or other
countries outside of where you live for the purposes as described in this policy. These data
transfers are necessary to provide the services set forth in the Facebook Terms and
Instagram Terms and to globally operate and provide our Products to you. We utilize
standard contractual clauses approved by the European Commission and rely on the
European Commission's adequacy decisions about certain countries as applicable for data
transfers from the EEA to the United States and other countries”

5.59 The latter states as follows:

“Facebook and Instagram share infrastructure, systems and technology with other
Facebook Companies (which include WhatsApp and Oculus) to provide an innovative,
relevant, consistent and safe experience across all Facebook Company Products you use.
We also process information about you across the Facebook Companies for these
purposes, as permitted by applicable law and in accordance with their terms and policies.
For example, we process information from WhatsApp about accounts sending spam on its
service so we can take appropriate action against those accounts on Facebook, Instagram
or Messenger. We also work to understand how people use and interact with Facebook
Company Products, such as understanding the number of unique users on different
Facebook Company Products.”

WHETHER FACEBOOK COMPLIES WITH ARTICLES 5(1)(A), 12(1) AND 13(1)(C) GDPR

5.60 As set out above, the information in the Legal Basis information Page and associated sections of
the referenced Data Policy is provided by way of a summary in the Legal Basis Information Page,
which directs users to various other documents and texts. The approach taken is somewhat
disjointed in that the “summary” of the “core data uses” has been set out in expressly generalised
terms, divorced from specific processing operations. If the user wishes to learn more, they must
view the Terms of Service and also review the sections of the Data Policy to which they are
directed. When all of the available information has been accessed, it becomes apparent that the
texts provided are variations of each other, in that they re-iterate the goals and objectives of
Facebook in carrying out data processing (for example, personalisation, communication, analytics,
product improvement, etc.) rather than elaborating on this or providing information concerning
processing operations. This approach lacks clarity and concision, and makes it difficult for the user
to access meaningful information as to the processing operations that will be grounded on Article

72

6(1)(b) GDPR or on other legal bases. In my view, insufficient detail has been provided in relation
to the processing operations carried out both in general and on the basis of Article 6(1)(b) GDPR
specifically. Such an approach deprives the user of meaningful information and further risks
causing significant confusion as to what legal basis will be relied upon to ground a specific
processing operation.

5.61 In response to the Preliminary Draft Decision, the Complainant agreed with the approach taken
on this issue, and emphasised that “the most relevant change in Facebook’s position”, in the
Complainant’s view is that the decision to rely on Article 6(1)(b) GDPR for the processing in
question and not consent, following the GDPR taking legal effect, was contained in the last layer
of information and not displayed prominently. 184

5.62 In response to the Preliminary Draft Decision, which provisionally found that the information was
provided in a disjointed manner and that the texts were variations of each other, Facebook
submitted that it “…maintains that the manner in which it has discharged its obligation under
Article 13(1)(c) GDPR is entirely appropriate and compliant with the GDPR.” 185 In particular, its
position is that the documents have been structured so as to present the information in as simple
a manner as possible. It also argues that the presence of information in separate hyperlinked
pages that at times contains cross-over “has been provided in a context where data subjects often
wish to periodically seek out information of interest to them instead of digesting the entirety of
these documents at once”. 186 It further defends the use of similar (but varied) text in the Data
Policy to the Terms of Service on the grounds that they are distinct documents with distinct
purposes, and that “[t]he use of summary bullet points, instead of reproducing the relevant text
from the Terms of Service in full makes the information more accessible to users regardless of their
online or legal sophistication.” 187

5.63 I do not accept these arguments. First of all, while it remains the case that it is for Facebook to
provide accessible information that is clear and concise for users regardless of their
“sophistication”, that does not detract from the core of the criticism that the disjointed
information set out in generalised terms is “divorced from specific processing operations”. 188 It is
not that the presence of variations of the same information in several documents is of itself non-
compliant, but rather that it is not compliant when it amounts, in practice, to statements about
services and objectives that are not linked to specified processing operations and which do not
provide meaningful information to the data subject on the core issues identified in Article 13
GDPR. The fact that this disjointed information is generalised and does not contain the required
information (as has been set out when I addressed the correct interpretation of Article 13(1)(c)

184
Complainant Submissions on Preliminary Draft Decision, page 19.
185
Ibid, paragraph 8.10.
186
Ibid.
187
Ibid, paragraph 8.11(A).
188
Paragraph 5.60 above.
73

GDPR), renders the information as a whole unhelpful and ultimately inconsistent with Article 13
GDPR.

5.64 Put simply, it impossible to identify what processing operations will be carried out in order to fulfil
the objectives that are repeated throughout the documents and the legal basis for such
operations. In the absence of such information, the user is left to guess as to what processing is
carried out on what data, on foot of the specified lawful bases, in order to fulfil these objectives.
For the reasons set out above in relation to the correct interpretation of Article 13(1)(c) GDPR,
this is insufficient information.

5.65 I note that some minimal information is provided in relation to the processing that will be carried
out, notably in relation to location information and IP addresses. I note, however, that this is
prefaced by “such as”, and describes location-based information as “things like…” These are, in
my view, clear examples of the open-ended language that is not conducive to the provision of
information in a transparent manner. Moreover, it is unclear for what purpose this personal data
is used, and indeed to what extent any such data might be (however minimally) processed to fulfil
the objectives of the contractual relationship between Facebook and a user, and to what extent
the processing of such data is based on another legal basis such as consent.

5.66 Article 12(1) GDPR requires information to be provided in a “concise, transparent, intelligible and
easily accessible form, using clear and plain language, in particular for any information addressed
specifically to a child.” The information that has been provided by Facebook is disjointed, and
requires users to move in and out of various sections of the Data Policy and Terms of Service. I
note that Facebook argues that “[c]ritically, it is the Data Policy and the Legal Basis Information
Page which are the means by which Facebook Ireland satisfies the requirements of Article 13(1)(c)
GDPR (as explained above) – not the Terms of Service”. 189 As I have set out, however, I am not
satisfied that the Data Policy and Legal Basis Information Page satisfy the requirements of Article
13(1)(c) GDPR either individually or cumulatively.

5.67 Facebook argues that it met the requirements of Article 12(1) GDPR and that:

“the GDPR allows considerable discretion for the controller as to the mode of compliance,
taking into account its interests as well as those of data subjects its likely better
understanding of both its services and its users, and; in particular allowing for a balancing
of thoroughness with concision, intelligibility and accessibility. The obligation is not to
provide information in a way that a particular supervisory authority (or anyone else)
considers to be the best or preferred manner, but to do so in a way that meets an objective
threshold standard.” 190

189
Submissions on Draft Report, paragraph 7.1(A).
190
Ibid, paragraph 9.3.
74

5.68 There is no doubt but that a controller has a certain amount of discretion as to the mode of
compliance. Neither is there any question of a supervisory authority’s “preferred manner” having
any bearing on compliance with Article 12(1) GDPR, or any other provision. Rather it falls to the
supervisory authority to assess compliance with the relevant provisions of the GDPR. In this case,
there has been a failure to provide information in a concise manner in light of the failings
associated with the disjointed and generalised nature of the documents in question. The
information is neither concise nor transparent, and the language is neither clear nor plain, instead
being expressed by reference to abstract objectives and purposes without any connection to
specific categories of personal data or processing operations being undertaken.

5.69 Furthermore, it is concerning that, even if a user actively sought out the additional information
that is available by way of the various links from the Terms of Service, the user would be presented
with variations of information previously furnished rather than further and more detailed
information that would enable the user to better understand the processing involved. By way of
example, there is significant overlap between the information set out in the “How do we use this
information” section of the Data Policy and the contents of the “Our Services” section of the
Terms of Service. Similarly, the summary of “core uses” set out in the section of the Legal Basis
Information Page that deals with Article 6(1)(b) GDPR contains a sub-set of the information
provided in the “Our Services” section of the Terms of Service. The way in which the information
has been spread out on multiple subsections and has been drafted in similarly worded (and
hyperlinked) text means that a user could easily overlook any new elements available within the
linked text. It is not the case that a user would be presented with more detailed information once
they go to the pages they are directed to; the information made available is similar in both
substance and appearance to the information that is available both in the primary text and other
hyperlinked texts. The submissions of Facebook on the Preliminary Draft Decision, as set out
above, defend this practice. However, in my view, the varied sophistication of users is not a
sufficient excuse to provide information that is, as I have set out, variations of the same thing
rather than information that gradually becomes more detailed. This issue is compounded by the
absence of information on processing operations themselves. Even the most sophisticated user
would struggle to understand the purposes of the processing for which the personal data are
intended as well as the legal basis for the processing in this context.

5.70 I emphasise that the Investigator, in preparing the Final Report, carried out a highly detailed and
thorough analysis of the documents set out above and how they interrelate. While I have adopted
a different approach, in not considering each “layer” in the abstract, I am equally convinced that
the requisite information is neither present nor set out in a transparent manner. Moreover, I am
of the view that, where this is the case on a cumulative reading of all of the documents (a matter
on which I am in clear agreement with the Investigator), in this instance, nothing of substance
turns on the question of whether an individualised assessment of each “layer” should be carried
out.

75

5.71 I am of the view that the criticisms in the Complaint have merit to the extent that the information
provided was not to the standard of clarity required by the GDPR. The way in which the relevant
information has been presented requires the user to seek out the additional texts made available
by way of the various hyperlinks. There is no single composite text or layered route available to
the user such as would allow them to quickly and easily understand the full extent of processing
operations that will take place as regards their personal data arising from their acceptance of the
Terms of Service. Each additional layer presents the user with similar information to that already
provided as well as some new information which is not easy to identify, as the language used is
similar to the information that has been provided before. The user should not have to work so
hard to access the prescribed information; nor should there be ambiguity as to whether all
sources of information have been exhausted. This gives rise to real risks, such as those articulated
by the Complainant, that there will be confusion as to what legal basis is being relied on for what
processing operation(s). That is precisely what seems to have happened in the context of this
Complaint, and is one of the main factual themes running through this entire Inquiry.

5.72 Information on the specific processing operations (necessarily including the data processed) that
will be carried out for the purposes specified and by reference to the lawful bases specified (the
latter two being currently, in my view, set out in a disjointed manner) should have been provided
to the data subject. To the extent that this information was provided at all, it was not clearly linked
with a specific purpose or lawful basis, and was described in an ambiguous manner (such as in my
analysis of the information on location-based data above).

5.73 The alleged “forced consent” and the dispute surrounding the processing operations being carried
out, and the legal bases underpinning them, are reflective of a broader lack of clarity as regards
the link between the purposes of processing, the lawful bases of processing and the processing
operations involved. Article 13(1)(c) GDPR requires that this information be set out, and Article
12(1) GDPR requires that this same information be set out in a particular manner.

5.74 Finally, in its submission on the Preliminary Draft Decision, Facebook took issue with a proposed
finding of an infringement of Article 5(1)(a) GDPR. In particular, Facebook argued that there
cannot be an automatic infringement of Article 5(1)(a) GDPR simply because Articles 12(1) and
13(1)(c) GDPR have been infringed, or in the alternative that nothing further has occurred beyond
the infringements to merit a finding of an infringement of Article 5(1)(a) GDPR. 191

5.75 The Commission does not consider that an infringement of Article 5(1)(a) GDPR necessarily or
automatically flows from findings of infringement under Articles 12 and/or 13 GDPR.
Nevertheless, there is an important link between these provisions.

191
Facebook Submissions on Preliminary Draft Decision, section 10.
76

5.76 By way of elaboration, at the core of this Complaint lies an assumption on the Complainant’s part
that Facebook, which relied largely on consent as a matter of data protection law for the
processing in question up to the coming into effect of the GDPR, was still relying on GDPR consent
for the acceptance of the Terms of Service following the coming into effect of the GDPR. It has
been submitted that this assumption was compounded by the engagement flow which presented
users with a number of opportunities to consent, before the final “I agree”.

5.77 While there is no particularised requirement under the GDPR to provide data subjects with
information on an alteration of a legal basis, or to provide information in a particular part of any
such engagement flow, the lack of clarity on such a fundamental issue underlines the inherent
lack of transparency in the information provided to the data subject. Article 5(1)(a) links
transparency to the overall fairness of the activities of a controller by requiring that personal data
shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject”. 192
Having regard to the findings made above, it is appropriate for the Commission to make a finding
that Facebook has also infringed Article 5(1)(a) GDPR in the circumstances of this case.

Finding 3: In relation to processing for which Facebook indicated reliance upon Article 6(1)(b) GDPR,
Articles 5(1)(a), 12(1) and 13(1)(c) have been infringed.

Additional Issue: Whether Facebook infringed the Article 5(1)(a) GDPR principle of fairness

5.78 During the course of the Article 60 consultation period, the Italian SA raised an objection to the
Draft Decision, the purpose of which was to require the amendment of the Draft Decision to
include a new finding of infringement of the Article 5(1)(a) principle of fairness. The Commission
decided not to follow the objection in circumstances where compliance with the Article 5(1)(a)
principle of fairness was not examined during the course of this inquiry and, consequently,
Facebook was never afforded the opportunity to be heard in response to a particularised
allegation of wrongdoing, as required by Irish and EU law. Accordingly the Commission referred
the objection to the EDPB for determination pursuant to Article 65(1)(a) GDPR. Having considered
the matter, the EDPB determined as follows:

219. The EDPB underlines that the principles of fairness, lawfulness and transparency, all three
enshrined in Article 5(1)(a) GDPR, are three distinct but intrinsically linked and interdependent
principles that every controller should respect when processing personal data. The link
between these principles is evident from a number of GDPR provisions: Recitals 39 and 42,
Articles 6(2) and 6(3)(b) GDPR refer to lawful and fair processing, while Recitals 60 and 71
GDPR, as well as Articles 13(2), 14(2) and 40(2)(a) GDPR refer to fair and transparent
processing.

192
C Kuner et al eds, The EU General Data Protection Regulation: A Commentary (Oxford 2020), pages 314-315.

77

220. On the basis of the above consideration, the EDPB agrees with the IE SA’s view that
“Article 5(1)(a) links transparency to the overall fairness of the activities of a controller” 193 but
considers that the principle of fairness has an independent meaning and stresses that an
assessment of Meta IE’s compliance with the principle of transparency does not automatically
rule out the need for an assessment of Meta IE’s compliance with the principle of fairness too.

221. The EDPB recalls that, in data protection law, the concept of fairness stems from the EU
Charter of Fundamental Rights 194. The EDPB has already provided some elements as to the
meaning and effect of the principle of fairness in the context of processing personal data. For
example, the EDPB has previously opined in its Guidelines on Data Protection by Design and
by Default that “Fairness is an overarching principle which requires that personal data should
not be processed in a way that is unjustifiably detrimental, unlawfully discriminatory,
unexpected or misleading to the data subject” 195.

222. Among the key fairness elements that controllers should consider in this regard, the EDPB
has mentioned autonomy of the data subjects, data subjects’ expectation, power balance,
avoidance of deception, ethical and truthful processing 196. These elements are particularly
relevant in the case at hand. The principle of fairness under Article 5(1)(a) GDPR underpins the
entire data protection framework and seeks to address power asymmetries between the data
controllers and the data subjects in order to cancel out the negative effects of such
asymmetries and ensure the effective exercise of the data subjects’ rights. The EDPB has
previously explained that “the principle of fairness includes, inter alia, recognising the
reasonable expectations of the data subjects, considering possible adverse consequences
processing may have on them, and having regard to the relationship and potential effects of
imbalance between them and the controller” 197.

223. The EDPB recalls that a fair balance must be struck between, on the one hand, the
commercial interests of the controllers and, on the other hand, the rights and expectations of
the data subjects under the GDPR 198. A key aspect of compliance with the principle of fairness
under Article 5(1)(a) GDPR refers to pursuing “power balance” as a “key objective of the
controller-data subject relationship” 199, especially in the context of online services provided
without monetary payment, where users are often not aware of the ways and extent to which

193
Draft Decision, paragraph 5.76.
194
Art. 8 EU Charter of Fundamental Rights states as follows: “1. Everyone has the right to the protection of personal
data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the
consent of the person concerned or some other legitimate basis laid down by law” (emphasis added).
195
EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, Version 2, Adopted on 20 October
2020 (hereinafter “EDPB Guidelines on Data Protection by Design and by Default”), paragraph 69.
196
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
197
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 12.
198
On the balance between the different interests at stake see for example: Judgement of the Court of Justice of 12
December 2013, X, C-486/12, ECLI:EU:C:2013:836; Judgement of the Court of Justice of 7 May 2009, College van
burgemeester en wethouders van Rotterdam v M. E. E. Rijkeboer, C-553/07, ECLI:EU:C:2009:293; Judgment of the
Court (Grand Chamber) of 9 November 2010, Volker und Markus Schecke GbR (C-92/09) and Hartmut Eifert (C-93/09)
v Land Hessen, ECLI:EU:C:2010:662.
199
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.

78

their personal data is being processed 200. Consequently, lack of transparency can make it
almost impossible in practice for the data subjects to exercise an informed choice over the use
of their data 201, which is in contrast with the element of “autonomy” of data subjects as to the
processing of their personal data 202.

224. Considering the constantly increasing economic value of personal data in the digital
environment, it is particularly important to ensure that data subjects are protected from any
form of abuse and deception, intentional or not, which would result in the unjustified loss of
control over their personal data. Compliance by providers of online services acting as
controllers with all three of the cumulative requirements under Article 5(1)(a) GDPR, taking
into account the particular service that is being provided and the characteristics of their users,
serves as a shield from the danger of abuse and deception, especially in situations of power
asymmetries.

225. The EDPB has previously emphasised that the identification of the appropriate lawful
basis is tied to the principles of fairness and purpose limitation 203. In this regard, the IT SA
rightly observes that while finding a breach of transparency relates to the way in which
information has been provided to users via the Facebook Terms of Service and Privacy Policy,
compliance with the principle of fairness also relates to “how the controller addressed the
lawfulness of the processing activities in connection with its social networking service” 204. Thus,
the EDPB considers that an assessment of compliance by Meta IE with the principle of fairness
requires also an assessment of the consequences that the choice and presentation of the legal
basis entail for the Facebook service users. In addition, that assessment cannot be made in the
abstract, but has to take into account the specificities of the particular social networking
service and of the processing of personal data carried out, namely for the purpose of online
behavioural advertising 205.

226. The EDPB notes that in this particular case the breach of Meta IE’s transparency
obligations is of such gravity that it clearly impacts the reasonable expectations of the
Facebook users by confusing them on whether clicking the “Accept” button results in giving
their consent to the processing of their personal data. The EDPB notes in this regard that one
of the elements of compliance with the principle of fairness is avoiding deception i.e. providing
information “in an objective and neutral way, avoiding any deceptive or manipulative language
or design” 206.

200
On “online services”, see further EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 3-5.
201
further EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 4.
202
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70. According to this element of fairness,
“data subjects should be granted the highest degree of autonomy possible to determine the use made of their
personal data, as well as over the scope and conditions of that use or processing”.
203
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 1.
204
IT SA Objection, paragraph 2.3.
205
See Draft Decision, paragraph 4.44 where the IE SA holds that “targeted advertising forms a core element of
Facebook’s business model” and Meta IE Article 65 Submissions, paragraph 6.32 where Meta IE claims that “It would
be impossible to provide the Facebook Service in accordance with the Terms of Service without providing behavioural
advertising”.
206
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.

79

227. As the IE SA itself notes, the Complainant argues that Meta IE relied on “forced consent”
for the processing simply because it did in fact believe that the legal basis for processing the
controller was relying upon was consent 207. This is illustrated by the multiple arguments that
the Complainant presents in order to demonstrate the “forced consent”, including the
reference to the use by Meta IE of “additional ‘tricks’ to pressure the users” 208. For example,
the Complainant refers to the inclusion in the user interface page of “two fake red dots
(violation against Article 5(1)(a) – neither ‘fair’, nor ‘transparent’), that indicated that the user
has new messages and notifications, which he/she cannot access without consenting – even if
the user did not have such notifications or messages in reality” 209. The EDPB considers that the
LSA should have taken into account the use of such practices by Meta IE in relation to the
principle of fairness, regardless of its finding that Meta IE has not sought to rely on consent in
order to process personal data to deliver the Facebook Terms of Service 210.

228. In addition, and as previously mentioned in paragraph 97 of this Binding Decision, the
Complainant presents the results of a poll according to which only 1.6% to 2.5% of the 1000
Facebook users who responded to the poll understood the request to accept the Facebook
Terms of Service to be a contract 211. In the EDPB’s view, there are clear indications that
Facebook users’ expectations with regard to the applicable legal basis have not been
fulfilled 212.

229. As recognised by the IE SA itself, “the user is left to guess as to what processing is carried
out on what data” 213. Therefore, the EDPB shares the IT SA’s concern that Facebook users are
left ”in the dark" 214and considers that the processing by Meta IE cannot be regarded as ethical
and truthful 215 because it is confusing with regard to the type of data processed, the legal basis
and the purpose of the processing, which ultimately restricts the Facebook users’ possibility to
exercise their data subjects’ rights.

230. Furthermore, the EDPB considers that the extensive analysis by the IE SA with regard to
the issue of legal basis and transparency in relation to the processing being carried out in
reliance on Article 6(1)(b) GDPR is closely linked to the issue of compliance by Meta IE with the
principle of fairness. Considering the seriousness of the infringements of the transparency
obligations by Meta IE already identified in the Draft Decision and the related

207
Draft Decision, paragraph 3.2.
208
Complaint, paragraph 1.4.
209
Complaint, paragraph 1.4.
210
Draft Decision, Finding 1.
211
See paragraph 97 of this Binding Decision.
212
According to the fairness element of “expectation”, “processing should correspond with data subjects’ reasonable
expectations” - EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
213
Draft Decision, paragraph 5.63.
214
IT SA Objection, paragraph 2.4
215
See EDPB Guidelines on Data Protection by Design and by Default, paragraph 70, where the EDPB explains that
“ethical” means that “[t]he controller should see the processing’s wider impact on individuals’ rights and dignity“ and
“truthful” means that “[t]he controller must make available information about how they process personal data, they
should act as they declare they will and not mislead the data subjects”.

80

misrepresentation of the legal basis relied on, the EDPB agrees with the IT SA that Meta IE has
presented its service to the Facebook users in a misleading manner 216, which adversely affects
their control over the processing of their personal data and the exercise of their data subjects'
rights. Therefore, the EDPB is of the opinion that the IE SA’s finding of breach of Article 5(1)(a)
GDPR with regard to the principle of transparency 217 should extend to the principle of fairness
too.

231. This is all the more supported by the fact that, in the circumstances of the present case
as demonstrated above 218, the overall effect of the infringements by Meta IE of the
transparency obligations under Articles 5(1)(a), 12(1), 13(1)(c) GDPR and the infringement of
Article 6(1) GDPR 219further intensifies the imbalanced nature of the relationship between
Meta IE and the Facebook users brought up by the IT SA objection. The combination of factors,
such as the asymmetry of the information created by Meta IE with regard to Facebook service
users, combined with the “take it or leave it” situation that they are faced with due to the lack
of alternative services in the market and the lack of options allowing them to adjust or opt out
from a particular processing under the contract with Meta IE, systematically disadvantages
Facebook service users, limits their control over the processing of their personal data and
undermines the exercise of their rights under Chapter III of the GDPR.

232. Therefore, the EDPB instructs the IE SA to include a finding of an infringement of the
principle of fairness under Article 5(1)(a) GDPR by Meta IE, in addition to the infringement of
the principle of transparency under the same provision, and to adopt the appropriate
corrective measures, by addressing, but without being limited to, the question of an
administrative fine for this infringement as provided for in Section 9 of this Binding Decision.

5.79 Accordingly, and as directed by the EDPB further to the Article 65 Decision, I find that Facebook
has infringed the principle of fairness pursuant to Article 5(1)(a) GDPR.

Finding 4: Facebook has infringed the principle of fairness pursuant to Article 5(1)(a) GDPR.

216
IT SA Objection, paragraph 2.3.
217
Draft Decision, paragraphs 5.59-5.76.
218
See paragraphs 221-230 of this Binding Decision.
219
See paragraph 133 of this Binding Decision.
81

6 SUMMARY OF FINDINGS

ISSUE FINDING

Reliance on Article 6(1)(b) GDPR I find that Facebook infringed Article 6(1)
GDPR when it relied on Article 6(1)(b) GDPR to
process the Complainant’s personal data for
the purpose of behavioural advertising in the
context of its offering of Terms of Service.

Whether Facebook failed to provide I find that Facebook has infringed Articles
necessary information regarding its legal basis 5(1)(a), 12(1) and 13(1)(c) GDPR
for processing pursuant to acceptance of the
Terms of Service and whether the information
set out was set out in a transparent manner

As raised by the Italian SA by way of its As directed by the EDPB pursuant to the
objection, whether Facebook infringed the Article 65 Decision, I find that Facebook has
Article 5(1)(a) principle of fairness in the infringed the Article 5(1)(a) principle of
context of its approach to the provision of fairness.
information as part of the presentation of its
Terms of Service to the Complainant.

7 DECISION ON CORRECTIVE POWERS

7.1 I have set out above, pursuant to Section 111(1)(a) of the 2018 Act, my view to the effect that the
Facebook has infringed Articles 5(1)(a), 12(1) and 13(1)(c) GDPR. As required by the EDPB
pursuant to the Article 65 Decision, I have also found that Facebook has infringed Article 6(1)
GDPR as well as the Article 5(1)(a) principle of fairness.

7.2 Under Section 111(2) of the 2018 Act, where the Commission makes a decision (in accordance
with Section 111(1)(a)), it must, in addition, make a decision as to whether a corrective power
should be exercised in respect of the controller or processor concerned and, if so, the corrective
power to be exercised. For the reasons set out above and the reasons below, my view is that
corrective measures should be exercised.

8 ORDER TO BRING PROCESSING INTO COMPLIANCE

8.1 Article 58(2) GDPR sets out the corrective powers which supervisory authorities may employ in
respect of non-compliance by a controller or processor.

82

8.2 My view is that the corrective power provided for in Article 58(2)(d) GDPR, i.e. an order to bring
processing into compliance (“the Order”), should be imposed. The Order would, firstly, require
Facebook to bring the Data Policy and Terms of Service into compliance with Articles 5(1)(a),
12(1) and 13(1)(c) GDPR as regards information provided on: (i) data processed pursuant to
Article 6(1)(b) GDPR as well as (ii) data processed for the purposes of behavioural advertising in
the context of the Facebook service, in accordance with the principles set out in this Decision.
Facebook argues that it is neither necessary nor proportionate to make this order.220 For the
reasons set out above and below, I have concluded that it is necessary and proportionate to do
so.

8.3 It was proposed in the Preliminary Draft Decision that this order should be complied with within
three months of the date of notification of any final decision. Facebook argued that this was not
a reasonable period of time within which to make the necessary changes, as the changes would
be resource-intensive and would require “sufficient lead in time for preparing the relevant
changes, conducting and taking account of user testing of the proposed changes, internal cross-
functional engagement as well as of course engagement with the Commission, and localisation
and translation of the information for countries in the European Region.” 221

8.4 Facebook is a large multinational organisation with significant financial, technological and human
resources at its disposal. Moreover, the interim period, prior to any such rectification to the
current lack of information being provided to data subjects, will involve a serious ongoing
deprivation of their rights (as articulated in Section 9 below). Moreover, the Commission has
provided specific analysis to Facebook in relation to the correct interpretation of the provisions
in question and the requisite information that is absent from the relevant user-facing documents.
This specificity should negate any need for extensive engagement with the Commission during
the period of implementation, and provides clarity for Facebook as to what objective its very
significant resources should be directed towards in order to comply with this order. As such, I am
not satisfied that it would be impossible or indeed disproportionate to make an order in these
terms, having regard to the importance of the data subject rights involved, the specificity of the
order and Facebook’s resources.

8.5 I therefore order that the Terms of Service and Data Policy be brought into compliance within a
period of three months commencing on the day following the date of service, on Facebook, of
this Decision.

8.6 I consider that the Order is necessary to ensure that full effect is given to Facebook’s obligations
under Articles 5(1)(a), 12(1), and 13(1)(c) GDPR in light of the infringements outlined above. The
substance of the Order is the only way in which the defects pointed out in this Decision can be
rectified, which is essential to the protection of the rights of data subjects. It is on this basis that

220
Facebook Submissions on Preliminary Draft Decision, paragraph 11.
221
Ibid, paragraph 12.4.
83

I am of the view that this power should be exercised. Facebook disagrees and states that it is
already voluntarily attempting to alter the documents to express the views set out in the
Preliminary Draft Decision, and would therefore like to continue using “less onerous means” to
ensure compliance. 222

8.7 However, having regard to the non-compliance in this Decision, in my view, such an order is
proportionate and is the minimum order required in order to guarantee that compliance will take
place in the future. The fact that Facebook is already taking steps to bring its information into
compliance means that there would be nothing practically onerous about an order to carry out
something that Facebook already intends to carry out. On that basis I see nothing in these
arguments to suggest a lack of proportionality arises in relation to the Order.

8.8 As instructed by the EDPB, in paragraph 288 of the Article 65 Decision, the Order would, secondly,
require Facebook to take the necessary action to bring its processing of personal data for the
purposes of behavioural advertising (“the Processing”), in the context of the Facebook Terms of
Service, into compliance with Article 6(1) GDPR in accordance with the conclusion reached by
the EDPB, as recorded at paragraphs 132 and 133 of the Article 65 Decision within a period of
three months, commencing on the day following the date of service, on Facebook, of this
Decision. More specifically, in this regard, Facebook is required to take the necessary action to
address the EDPB’s finding that Facebook is not entitled to carry out the Processing on the basis
of Article 6(1)(b) GDPR, taking into account the analysis and views expressed by the EDPB in
Section 4.4.2 of the Article 65 Decision. Such action may include, but is not limited to, the
identification of an appropriate alternative legal basis, in Article 6(1) GDPR, for the Processing
together with the implementation of any necessary measures, as might be required to satisfy the
conditionality associated with that/those alternative legal basis/bases.

8.9 By way of its Final Submissions, Facebook submitted as follows:

a. Firstly 223, in relation to the matters covered by the term “the Processing” (as defined in
paragraph 8.8, above), Facebook noted its understanding that this term refers “specifically to
the processing for the purpose of behavioural advertising carried out by [Facebook] to-date
on the basis of Article 6(1)(b) GDPR in the context of the Terms of Service as considered in the
Inquiry.” Facebook noted that, as previously explained in its Article 65 Submissions, it carries
out certain other types of processing for behavioural advertising purposes on the basis of
Article 6(1)(a) GDPR. For the avoidance of doubt, I confirm Facebook’s understanding as to
the processing covered by the second limb of the above Order. The term “the Processing”, as
defined in paragraph 8.8, above, means any processing for behavioural advertising purposes
which has been carried out by Facebook to date, in reliance on Article 6(1)(b) GDPR.

222
Ibid, paragraphs 12.2 and 12.3.
223
The Final Submissions, paragraph 2.4 (and footnote 6)

84

b. Secondly, Facebook submitted224 that, notwithstanding the EDPB’s determination, the
Commission has discretion as regards the date of commencement of the applicable
compliance periods. In this regard, Facebook noted that the Article 65 Decision does not
require the Commission to provide that the Order must take effect “on the day following the
date of service of the [Commission’s] final decision”. Facebook further submitted 225 that the
timeline for compliance, as regards the action required to be taken pursuant to both limbs of
the Order, should run consecutively rather than concurrently.

c. In support of the above submissions, Facebook has estimated that it “will take at least
to implement both compliance orders” by reference to the work that will be required
to give effect to the terms of the Order. This work includes (but is not limited to)

. Facebook has further identified that, once this
work is completed, it will then need to develop and/or update user-facing materials, to the
extent needed to explain these changes to users, including updates to the Privacy Policy and
other transparency notices.

d. Facebook has further submitted that, if the Order is made in the terms proposed, this would
require it to dedicate its resources to attempting to comply with the Order immediately and
“certainly before the period within which [Facebook] is entitled to appeal from the final
decision has elapsed.” This, according to Facebook, would seriously “impair and prejudice”
its right to an effective appeal.

8.10 Having considered the above matters in light of the Article 65 Decision, I do not agree with
Facebook’s submission that the Commission has discretion to delay the activation of the timeline
for compliance associated with any aspect of the Order. It is clear, from paragraph 286 of the
Article 65 Decision, that the EDPB considered it necessary for Facebook to take the remedial
action required to address the relevant infringements “within three months”. While Facebook
has correctly identified that the EDPB has not expressly identified the starting point of this
compliance period, the Commission’s view is that it goes without saying that the starting point
has to be the adoption and notification of the Commission’s final decision, given that this is the
earliest time from which the applicable timeline for compliance can start to run. Any contrary
suggestion would be inconsistent with the need for urgent action that was clearly indicated to be
required in paragraphs 286, 288 and 290 of the Article 65 Decision. It would further render
meaningless the EDPB’s consideration of the compliance period in terms of a fixed number of
months (in this case, three).

224
The Final Submissions, paragraph 4.3 and Section 5
225
The Final Submissions, paragraph 4.3 and Section 6
85

8.11 Insofar as Facebook appears to consider it significant that the Commission itself amended the
terms of the existing Order such that the timeline for compliance is now stated to run from the
day following the date of service, on Facebook, of this Decision, the Commission does not consider
this to be a material amendment of the existing text. The Commission considered it necessary to
add this clarification to address the risk of there being a delay between the date of adoption of
this Decision and the date on which this Decision is formally notified to/served upon Facebook (as
has occurred in at least one previous inquiry). The clarification ensures legal certainty, as regards
the timelines associated with the Order and Facebook’s right to a judicial remedy.

8.12 Finally, as regards the resources that Facebook will need to devote to the matters covered by the
terms of the Order, I note that I have already had regard to the significant financial, technological
and human resources at Facebook’s disposal. Furthermore, I do not agree that Facebook will
need to await the outcome of its efforts to achieve compliance with the second limb of the Order
before it might address the first limb. I note, in this regard, that the first limb of the Order was
present in the Draft Decision (dated 6 October 2021). Facebook was already aware of the
likelihood that it would have to take action to address the shortcomings identified as part of the
analysis that underpinned the findings of infringement of the transparency provisions (namely
Articles 5(1)(a), 12(1) and 13(1)(c) GDPR). In the circumstances, Facebook has already had time
to begin the groundwork required to achieve compliance with its transparency obligations.

8.13 For the avoidance of doubt, I am not persuaded by Facebook’s submission that the envisaged date
of commencement of the timeline for compliance would “seriously impair and prejudice” its right
to an effective appeal. I note, in this regard, that Facebook has not explained how such a risk
would arise from the timely implementation of the deadline for compliance with the Order. I
further note that matters pertaining to the possible filing of any appeal will likely be dealt with by
Facebook’s internal and external legal advisors as opposed to the “stakeholders” whose input will
be required as part of Facebook’s efforts to achieve compliance with the terms of the Order.
While I anticipate that there will, of course, be overlap in terms of the resources that might need
to devote time to both the required remedial action and matters pertaining to the possible filing
of any appeal, I do not envisage how such overlap would be anywhere near total such as to give
rise to a risk to Facebook’s ability to exercise its right to an effective appeal. I further note that
the compliance deadline extends beyond the limitation periods prescribed for any application for
judicial redress under Irish law. In these circumstances, I am satisfied that Facebook’s right to
pursue judicial redress will not be impaired by the compliance periods outlined above.

9 ADMINISTRATIVE FINE

9.1 I note that Article 58(2)(i) GDPR permits me to consider the imposition of an administrative fine,
pursuant to Article 83 GDPR, “in addition to, or instead of” the other measures outlined in Article
58(2), depending on the circumstances of each individual case. This is also reflected in Section 115
of the 2018 Act, which permits the Commission to impose an administrative fine on its own or in
86

combination with any other corrective power specified in Article 58(2) GDPR. Article 83(1) GDPR,
in turn, identifies that the administration of fines “shall in each individual case be effective,
proportionate and dissuasive”.

9.2 Further, when deciding whether or not to impose an administrative fine and the amount of any
such fine, Article 83(2) GDPR requires me to give “due regard” to eleven criteria. Those criteria,
together with my assessment of each, are set out below.

9.3 In the Draft Decision, I considered the imposition of an administrative fine in relation to the finding
of infringement identified at Finding 3 above, namely the finding of infringement of Articles
5(1)(a), 12(1) and 13(1)(c) GDPR in the context of Facebook’s approach to transparency. Following
the circulation of the Draft Decision to the supervisory authorities concerned for the purpose of
enabling them to share their views, in accordance with Article 60(3) GDPR, objections to the
administrative fines proposed by the Draft Decision were raised by the supervisory authorities of
Germany, France, the Netherlands, Norway and Poland. Having considered those objections, the
EDPB determined as follows:

351. The EDPB recalls that the consistency mechanism may also be used to promote a
consistent application of administrative fines. A fine should be effective, proportionate and
dissuasive, as required by Article 83(1) GDPR, taking account of the facts of the case. In
addition, when deciding on the amount of the fine, the LSA shall take into consideration the
criteria listed in Article 83(2) GDPR.
…

353. The finding in the Draft Decision of a transparency infringement for the processing
concerned still stands. The EDPB recalls that, on substance, no objections were raised on this
finding. Meta IE infringed its general transparency obligations by being unclear on the link
between the purposes of processing, the lawful bases of processing and the processing
operations involved, irrespective of the validity of the legal basis relied on for the ‘processing
concerned’. It remains the case that, for the transparency infringements, ‘the processing
concerned’ should be understood as meaning all of the processing operations that Meta IE
carries out on the personal data under its controllership for which Meta IE indicated it relied
on Article 6(1)(b) GDPR, including for the purposes of behavioural advertising. This is without
prejudice to the fact that Meta IE inappropriately relied on 6(1)(b) as a legal basis to process
personal data for the purpose of behavioural advertising as part of the delivery of its Facebook
service under the Facebook Terms of Service. Whether or not Meta IE appropriately chose its
legal basis for processing, the transparency infringement as assessed in the Draft Decision still
stands. Therefore, the IE SA must not modify this description retroactively in light of the
assessment of the validity of the legal basis, including for the purpose of carrying out any
reassessment of the administrative fines originally proposed by the Draft Decision, as might be
required by this Binding Decision.

354. In light of the objections found relevant and reasoned, the EDPB addresses whether the
Draft Decision proposes a fine for the transparency infringements that is in accordance with
the criteria established by Article 83(2) GDPR and the criteria provided for by Article 83(1)
87

GDPR. In doing this, the EDPB will first look into a preliminary matter, then assess the disputes
arisen in respect of the analysis of specific criteria under Article 83(2) performed by the LSA,
and then examine whether the proposed fine meets the requirements of effectiveness,
dissuasiveness and proportionality set in Article 83(1) GDPR, including by affording adequate
weight to the relevant factors and to the circumstances of the case.

Preliminary matter: the total turnover of the undertaking

355. The DE SAs does not contest the identification of the relevant undertaking in the IE SAs
Draft Decision, but contests the turnover figure cited in the Draft Decision. Though the IE SA
deems the objection not relevant, in the Composite Response the IE SA agrees with the DE SAs
on the principle that the total turnover figure should be used when calculating the
administrative fine. Moreover, the IE SA adds that “the turnover figure in the final decision will
in any event refer to the 2021 turnover for Meta Platforms, Inc. and Meta Ireland”.

356. For the avoidance of doubt, the EDPB instructs the IE SA to take into consideration the
total turnover of all the entities composing the single undertaking, i.e. the consolidated
turnover of the group of companies headed by Meta Platforms, Inc..

357. On the notion of “preceding financial year”, the EDPB recalls the decision taken in its
Binding Decision 1/2021 (paragraph 298) and takes note of the IE SA’s intention to take the
same approach in the current case.

358. In addition, the EDPB agrees with the approach taken by the IE SA for the present case to
include in the Draft Decision a provisional turnover figure based on the most up to date
financial information available at the time of circulation to the CSAs pursuant to Article 60(3)
GDPR. The final decision will have to refer to the whole undertaking’s annual turnover
corresponding to the financial year preceding the date of the final decision.

The number of data subjects affected (Article 83(2)(a) GDPR)

359. The DE SAs puts forward that the number of affected data subjects may be even higher
than the monthly users as of May 2021 in the European Economic Area confirmed
by Meta IE to the IE SA. The DE SAs refer to a Meta Platforms, Inc. press release of 27 January
2021, inferring from that “whilst [Meta Platforms, Inc.] reported 2.80 billion monthly active
users, they report 3.30 billion ‘family monthly active people’ for 2020. Applying this increase of
about 18 % there could be about affected data subjects ( plus 18 % =
)”.

360. The IE SA is “satisfied that the reference to the number of users of the ‘family’ of apps
refers to the total number of users across all apps owned by Meta Platforms Inc., (i.e. also
including users of WhatsApp and Instagram) and not solely the number of users of the
Facebook App. Such apps are not covered by the Facebook Terms of Service, and so are not
relevant to the present circumstances”. Meta IE confirms the IE SA’s response, adding that the
2020 figures cited in the DE SAs’ objection “relate to the global number of unique people using
at least one of the Meta Family of Apps”.

88

361. From the elements put forward, the EDPB sees no reason to question the response given
by the IE SA on this objection. Therefore, the EDPB is of the view that the Draft Decision does
not need to be amended with regard to the number of data subjects affected. This is without
prejudice to the conclusions reached below on whether the fine is in line with Article 83, taking
into consideration all the circumstances of the case, including the number of data subjects.

On any action taken by the controller to mitigate the damage suffered by data subjects (Article
83(2)(c) GDPR)

362. The PL SA disagrees with the mitigating factor identified by the IE SA by reference to Meta
IE’s willingness to engage in steps to bring its processing into compliance on a voluntary basis
pending the conclusion of the inquiry.

363. The IE SA states that “[Meta IE]’s willingness to engage in steps to bring its processing into
compliance on a voluntary basis” should be understood as actions taken to mitigate the
damage to data subjects, distinct from actions taken to comply. In the present case, the EDPB
fails to see how such a distinction can be made. Additionally, drawing this distinction seems
inconsistent with the IE SA’s position that the negative impact on data subjects lies precisely
in the transparency infringements and thus in the “the risks to data subjects in being unable to
effectively exercise their rights by being unable to discern what specific data processing is being
done on what legal basis and for what objective”. In other words, the damage caused to data
subjects is, in these circumstances, consubstantial with the finding of the infringement itself.

364. In addition, the EDPB agrees with the PL SA that the expression of an “intention to bring
the processing operations into the compliance with the provisions of GDPR” as such cannot
serve as evidence of actions already taken to mitigate damage suffered. In order for this
element to serve as a mitigating factor, further evidence would be necessary for instance
demonstrating that the controller did whatever they could in order to reduce the
consequences of the breach for the individuals concerned.

365. The EDPB agrees with the IE SA that “[taking] steps to attempt to comply with legal
obligations is a duty, and has no mitigating impact on a sanction for a breach of those
obligations”. In any case, Meta IE’s “decision to begin preparation for voluntary compliance on
the basis of the views set out in the Preliminary Draft Decision” is merely a first step of a longer
process towards full compliance with the GDPR. The information available in the file does not
include indications that the actions taken by the controller have gone beyond willingness to
prepare to change its practices in case this appeared necessary.

366. The EDPB finds the IE SA does not provide sufficient justification for the mitigating factor
identified, and instructs the IE SA to modify its Draft Decision on this matter, by considering
this factor as neither aggravating nor mitigating.

On other factors and the non-exhaustive nature of the criteria in Article 83(2) GDPR

367. Meta IE argues some CSAs “introduce criteria that are not provided for by Article 83(2)
GDPR”, which “amounts to a breach of the principle of legal certainty, which is of particular
importance with respect to the imposition of administrative fines which are criminal in nature”.

89

Meta IE acknowledges that Article 83(2)(k) GDPR is open-ended as it refers to any other
aggravating or mitigating factor applicable to the circumstances of the case, arguing however
that the criteria of Article 83(2) GDPR focus only on the data controller or processor, or on the
infringement.

368. The EDPB does not share such a restrictive reading of Article 83(2)(k) GDPR, which it
deems leaves room for “all the reasoned considerations regarding the socio-economic context
in which the controller or processor operates, those relating to the legal context and those
concerning the market context”. The EDPB considers this provision “of fundamental
importance for adjusting the amount of the fine to the specific case” and that “it should be
interpreted as an instance of the principle of fairness and justice applied to the individual case”.
The EDPB recalls that Article 83(2) GDPR contains a non-exhaustive list of assessment criteria
to be considered, if appropriate, by the LSA in determining the amount of the fine
corresponding to what is necessary to be effective, proportionate, and dissuasive in
accordance with Article 83(1) GDPR.

369. Given the open-ended nature of Article 83(2), the EDPB disagrees with the argument by
Meta IE contending that the principle of legal certainty was breached. In any case, the EDPB
recalls that it is settled case law that legal certainty is not absolute. All cases of application of
a general norm can “not be determined in advance by the legislature”. Therefore, legal
certainty “cannot be interpreted as prohibiting the gradual clarification of rules of criminal
liability by means of interpretations in the case-law” and undertakings are expected to take
appropriate legal advice to anticipate the possible consequences of a rule and to assess the risk
of infringement with “special care”. Finally, even if were the case that supervisory authorities
had previously issued conflicting views, such a circumstance would not be relevant when
assessing the predictability of an infringement. The ECtHR has also ruled that the fact that a
point of law is ruled on for the first time does not undermine legal certainty “if the meaning
given is both foreseeable and consistent with the essence of the offence”.

The financial benefit obtained from the infringement (Article 83(2)(k) GDPR)

370. As explicitly stated in Article 83(2)(k) GDPR, financial benefits gained directly or indirectly
from the infringement can be considered an aggravating element for the calculation of the
fine. When applying this provision, the supervisory authorities must “assess all the facts of the
case in a manner that is consistent and objectively justified”. Therefore, financial benefits from
the infringement could be an aggravating circumstance if the case provides information about
profit obtained as a result of the infringement of the GDPR.

371. The aim of Article 83(2)(k) is to ensure that the sanction applied is effective, proportionate
and dissuasive in each individual case. With regard to the financial benefits obtained from the
infringement, the EDPB considers that when there is a benefit, the sanction should aim at
“counterbalancing the gains from the infringement” while keeping an effective, dissuasive and
proportionate fine.

372. The financial benefit obtained by Meta IE was considered by the IE SA in the Draft Decision
with regard to the transparency infringements. The IE SA found it had insufficient elements to
conclude - beyond speculating - that Meta IE benefited from the infringement.

90

373. The DE SAs disagree with the IE SA’s decision to set aside this factor. The DE SA describes
a counterfactual - where there would be 1 million less monthly users ( of the monthly
users according to paragraph 9.15 of the Draft Decision if the transparency
violations had not occurred) - which would amount to an estimated less in
turnover.

374. Considering the need to have fines that are effective, proportionate and deterrent, and
in light of common accepted practice in the field of EU competition law, which inspired the
fining framework under the GDPR, the EDPB is of the view that, when calculating the
administrative fine, the supervisory authority could take account of the financial benefits
obtained from the infringement, in order to impose a fine that exceeds that amount.

375. In the present case, neither the IE SA nor the DE SAs have provided an estimation of the
financial benefit gained by Meta IE with the transparency infringements. The DE SAs’
calculation presents an example and is still largely based on assumptions on a lower number
of monthly users. Due to this, the EDPB does not have sufficiently precise information to
evaluate the specific weight of the financial benefit obtained from the infringement.

376. Therefore, the EDPB considers that it does not have objective elements to conclude
whether the fine envisaged in relation to the transparency infringements takes sufficient
account of the financial benefit obtained from the infringement and, therefore, has a deterrent
effect in this respect.

377. Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no
effect if they are disproportionally low compared to the benefits obtained with the
infringement. The EDPB considers that the IE SA should ascertain if further estimation of the
financial benefit from the infringement of transparency obligations is possible in this case.
Insofar as this results in the need to increase the amount of the fine proposed, the EDPB
requests the IE SA to increase the amount of the fine proposed.

The profitability of the undertaking - other factor (Article 83(2)(k) GDPR)

378. The DE SAs request the IE SA to consider, in addition to turnover, the annual profit of the
undertaking in its assessment. The DE SAs position is that the undertaking’s sensitivity to
administrative fines is significantly influenced by profitability, not only turnover. The DE SAs
argue that the Draft Decision does not demonstrate that profitability was taken into account
to assess “sensitivity to administrative fines” and does not ensure the fine is effective,
proportionate and dissuasive.

379. Meta IE argues Article 83(2) GDPR does not identify annual profit as a factor to which the
LSA should have regard in calculating the amount of the administrative fine. The EDPB has
explained its view on the open-ended character of Article 83(2)(k) GDPR above (see paragraphs
367-369).

380. The EDPB recalls that in determining administrative fines under Article 83 GDPR the total
worldwide annual turnover of the undertaking should be considered, as this “gives an

91

indication, albeit approximate and imperfect, of the size of the undertaking and of its economic
power”. The EDPB does not find that in the case at hand the LSA should be requested to amend
its Draft Decision to additionally consider the annual profit of the undertaking. At the same
time, the EDPB reiterates that the imposition of an appropriate fine cannot be the result of a
simple calculation based on the total turnover and that as stated above all the circumstances
of the specific case have to be considered in order to assess if the administrative fine is
effective, proportionate and dissuasive as required by Article 83(1) GDPR.

381. Moreover, the size of the undertaking concerned and its financial capacity are elements
that should be taken into account in the calculation of the amount of the fine in order to ensure
its dissuasive nature. Taking into consideration the size and global resources of the undertaking
in question is justified by the impact sought on the undertaking concerned, in order to ensure
that the fine has sufficient deterrent effect, given that the fine must not be negligible in the
light, particularly, of its financial capacity. The EDPB recalls that a fine to be imposed on an
undertaking may need to be increased to take into account a particularly large turnover of the
undertaking, so the fine is sufficiently dissuasive. In this respect, the EDPB further notes that
in order to ensure a sufficiently deterrent effect, the global turnover of the undertaking can be
considered also in light of the undertaking’s ability to raise the necessary funds to pay its fine.

The effectiveness, proportionality and dissuasiveness of the administrative fine (Article 83(1)
GDPR)

382. With regard to effectiveness of the fines, the EDPB recalls that the objective pursued by
the corrective measure chosen can be to re-establish compliance with the rules, or to punish
unlawful behaviour, or both. In addition, the EDPB notes that the CJEU has consistently held
that a dissuasive penalty is one that has a genuine deterrent effect. In that respect, a distinction
can be made between general deterrence (discouraging others from committing the same
infringement in the future) and specific deterrence (discouraging the addressee of the fine
from committing the same infringement again). Therefore, in order to ensure deterrence, the
fine must be set at a level that discourages both the controller or processor concerned as well
as other controllers or processors carrying out similar processing operations from repeating
the same or a similar unlawful conduct. Proportionality of the fine needs also to be ensured as
the measure must not go beyond what is necessary to attain that objective. In this respect, the
EDPB disagrees with Meta IE’s views that there is no basis to conclude that the amount of the
fine must have a general preventive effect.

383. The EDPB reiterates that it is incumbent upon the supervisory authorities to verify
whether the amount of the envisaged fines meets the requirements of effectiveness,
proportionality and dissuasiveness, or whether further adjustments to the amount are
necessary, considering the entirety of the fine imposed and all the circumstances of the case,
including e.g. the accumulation of multiple infringements, increases and decreases for
aggravating and mitigating circumstances and financial/socio-economic circumstances.
Further, the EDPB recalls that the setting of a fine is not an arithmetically precise exercise, and
supervisory authorities have a certain margin of discretion in this respect.

384. The DE, FR, NL, NO and PL SAs, object to the level of the fine envisaged in the Draft
Decision as they consider the proposed fine not effective, proportionate and dissuasive (Article

92

83(1) GDPR). These SAs argue that the elements of Article 83(2) GDPR are not weighed
correctly by the LSA when calculating the administrative fines in the present case, in light of
the requirements of Article 83(1) GDPR.

385. Specifically, the DE, FR, NL and NO SAs refer to the nature and gravity of the infringement
and the number of data subjects concerned. The PL SA adds that the gravity of the
infringement is compounded by the fact that the data processing is an essential part of Meta
IE’s business model. The DE SAs also refer to the infringement’s duration and the negligence
identified by the IE SA.

386. The EDPB takes note Meta IE’s disagreement with the fine proposed by the IE SA and their
view that any objections aiming to increase the quantum of fines are not compatible with
Article 83 GDPR.

387. The EDPB notes that in the Draft Decision the IE SA indicates being satisfied the proposed
fine is effective, proportionate and dissuasive, taking into account all the circumstances of the
IE SA’s inquiry. The IE SA assessed the different criteria of Article 83(2) GDPR in relation to the
transparency infringements found. The IE SA considered the infringements as serious in
nature, and in terms of gravity of the infringements found a significant level of non-
compliance. Furthermore, the EDPB underlines that, as established by the IE SA, the
infringements affect a significant number of data subjects and are extensive. The EDPB also
observes that the infringements is considered negligent in character. Further, the IE SA
considered the level of damage suffered by data subjects as being significant. In addition, the
IE SA identifies only one mitigating factor, however without articulating the weight accorded
to it.

388. Meta IE argues that reputation costs should also be taken into consideration, citing the IE
SA’s remark on “the significant publicity that a fine in this region will attract”. On principle, the
EDPB agrees that reputation costs could be taken into consideration to some extent, if credible
arguments are be put forward about the grave detriment that would ensue. Meta IE does not
present such arguments. The EDPB is of the view that in this case other incentives would offset
any reputational costs. As far as advertisers are concerned, Meta IE puts forward that “[the]
personalised nature of the Facebook Service is also the reason why it has been instrumental in
the success of small and medium sized businesses (‘SMEs’) worldwide, including across the EU.
Personalisation on the Facebook Service enables SMEs to compete for customers through
‘customizing products and services, [...] building a unique brand image, tailoring marketing to
a specific audience and developing a strong one-to-one connection with a community of
customers’”. As far as users of the Facebook service are concerned, there are network effects
at play which leads to incentives to join - or not leave - the platform, so as not to be excluded
from participating in discussions, corresponding with and receiving information from others.

389. The FR SA compares the proposed fine with the fine of 225 million euros decided upon by
the IE SA in its decision dated 20 August 2021 against WhatsApp Ireland Limited for
transparency infringements (breaches of Articles 12 and 13 GDPR). The FR SA also compares
with the fine of 746 million euros decided by the LU SA in its decision of 15 July 2021 against
the company Amazon Europe Core for carrying out behavioural advertising without a valid
legal basis and for transparency infringements (Articles 6, 12 and 13 GDPR). While the EDPB

93

agrees with both the IE SA and Meta IE that imposing fines requires a case-by-case assessment
under Article 83 GDPR, the EDPB notes that the cases cited by the FR SA do show marked
similarities with the current case, as they both refer to large internet platforms run by data
controllers with multi-national operations and significant resources available to them,
including large, in-house, compliance teams. Moreover, there are similarities with regard to
the infringements involved. Thus, these cases can give an indication on the matter.

390. The DE SAs calculate that the envisaged upper limit of the fine range is about 0.05 % of
the global annual turnover, which it notes is 80 times lower than the maximum ceiling provided
for in Article 83(5) GDPR. For illustrative purposes, the DE SAs add that this upper limit would
amount to a fine of per person (on the basis of data subjects affected
according to paragraph 9.15 of the Draft Decision). Also illustrative is the amount of time, on
average, it took Meta IE to generate 36 million euros in turnover in 2020, which was about 4
hours and 30 minutes.

391. The EDPB agrees with the objections raised that - if the proposed fine was to be imposed
for the transparency infringements - there would be no sufficient special preventive effect
towards the controller, nor a credible general preventive effect. The proposed fine amount,
even where a final amount at the upper limit of the range would be chosen, is not effective,
proportionate and dissuasive, in the sense that this amount can simply be absorbed by the
undertaking as an acceptable cost of doing business. As behavioural advertising is at the core
of Meta IE’s business model, the risk of this occurring is all the greater. By bearing the cost the
administrative fine, the undertaking can avoid bearing the cost of adjusting their business
model to one that is compliant as well as any future losses that would follow from the
adjustment.

392. Though the IE SA touches upon the notions of effectiveness, proportionality and
dissuasiveness in relation to the proposed fine, there is no justification based on elements
specific to the case to explain the modest fine range chosen. Moreover, the EDPB notes that
while the IE SA takes into consideration the turnover of the undertaking to ensure that the fine
it proposed does not exceed the maximum amount of the fine provided for in Article 83(5)
GDPR, the Draft Decision does not articulate how and to what extent the turnover of this
undertaking is considered to ascertain that the administrative fine meets the requirement of
effectiveness, proportionality and dissuasiveness. In this regard the EDPB recalls that the
turnover of the undertaking concerned is not exclusively relevant for the determination of the
maximum fine amount in accordance with Article 83(4)-(6) GDPR, but should also be
considered for the calculation of the fine itself, where appropriate, to ensure the fine is
effective, proportionate and dissuasive in accordance with Article 83(1) GDPR. The EDPB
therefore instructs the IE SA to elaborate on the manner in which the turnover of the
undertaking concerned is considered for the calculation of the fine.

393. While a single mitigating factor identified by the IE SA is mentioned, there is no indication
the weight that has been attributed to this factor in the context of the Article 83(2) assessment.
As indicated above (see paragraph 366), the EDPB finds the Draft Decision does not sufficiently
justify this mitigating factor, hence it should not be considered an aggravating or mitigating
factor.

94

394. In light of the above, the EDPB considers that the proposed fine does not adequately
reflect the seriousness and severity of the infringements nor has a dissuasive effect on Meta
IE. Therefore, the fine does not fulfil the requirement of being effective, proportionate and
dissuasive in accordance with Article 83(1) and (2) GDPR. In light of this, the EDPB directs the
IE SA to set out a significantly higher fine amount for the transparency infringements identified,
in comparison with the upper limit for the administrative fine envisaged in the Draft Decision.
In doing so, the IE SA must remain in line with the criteria of effectiveness, proportionality, and
dissuasiveness enshrined in Article 83(1) GDPR in its overall reassessment of the amount of the
administrative fine.

9.4 I have taken account of the above directions of the EDPB in the Article 83(2) assessments set out
below.

9.5 As noted earlier in this Decision, the EDPB, by way of the Article 65 Decision, has also directed me
to find that Articles 6(1) and the Article 5(1)(a) principle of fairness have been infringed. Pursuant
to those determinations, the EDPB made further directions, as regards the imposition of
additional administrative fines. In relation to the finding of infringement of Article 6(1) GDPR, the
EDPB directed, at paragraph 473 of the Article 65 Decision, that:

“Taking into account the nature and gravity of the infringements as well as other aspects in
accordance with Article 83(2) GDPR, the EDPB considers that the IE SA must exercise its power
to impose an additional administrative fine.”

9.6 At paragraph 509, the EDPB further directed that:

“The EDPB instructs the IE SA to cover the additional infringement of Article 6(1) GDPR with an
administrative fine that is effective, proportionate and dissuasive in accordance with Article
83(1) GDPR.”

9.7 As regards the manner in which I should assess the new infringement of Article 6(1) GDPR, the
EDPB instructed as follows:

441. The EDPB concurs that the decision to impose an administrative fine needs to be taken
on a case-by-case basis in light of the circumstances and is not an automatic one. In the case
at hand, however, the EDPB agrees with the reasoning put forward by the AT, DE, FR, NO and
SE SAs in their objections. The EDPB reiterates that lawfulness of processing is one of the
fundamental pillars of the data protection law and considers that processing of personal data
without an appropriate legal basis is a clear and serious violation of the data subjects’
fundamental right to data protection.

95

442. Several of the factors listed in Article 83(2) GDPR speak strongly in favour of the imposition
of an administrative fine for the infringement of Article 6(1) GDPR.

The nature, gravity and duration of the infringement (Article 83(2)(a) GDPR)

443. As mentioned above and outlined below, the nature and gravity of the infringement
clearly tip the balance in favour of imposing an administrative fine.

444. With respect to the scope of processing, the EDPB notes the IE SA’s assessment that the
personal data processing carried out by Meta IE on the basis of Article 6(1)(b) GDPR is
extensive, adding that “[Meta IE] processes a variety of data in order to serve users
personalised advertisements, tailor their ‘News Feed’, and to provide feedback to advertising
partners on the popularity of particular advertisements. The processing is central to and
essential to the business model offered”.

445. In this respect, the EDPB also recalls that the infringement at issue relates to the
processing of personal data of a significant number of people and that the impact on them has
to be considered.

446. Though the damage is very difficult to express in terms of a monetary value, it remains
the case that data subjects have been faced with data processing that should not have
occurred (by relying inappropriately on Article 6(1)(b) as a legal basis as established in section
4.4.2). The data processing in question - behavioural advertising - entails decisions about
information that data subjects are exposed to or excluded from receiving. The EDPB recalls
that non-material damage is explicitly regarded as relevant in Recital 75 and that such damage
may result from situations “where data subjects might be deprived of their rights and freedoms
or prevented from exercising control over their personal data”. Given the nature and gravity of
the infringement of Article 6(1)(b), a risk of damage caused to data subjects is, in such
circumstances, consubstantial with the finding of the infringement itself.

The intentional or negligent character of the infringement (Article 83(2)(b) GDPR)

447. The SE SA argues the infringement of Article 6(1)(b) GDPR should be considered
intentional on Meta IE’s part, which is an aggravating factor.

448. The EDPB takes note of Meta IE’s position that it did not act intentionally with the aim to
infringe the GDPR, nor was negligent - but “has relied on what it has consistently considered in
good faith to be a valid legal basis for the purpose of processing of personal data for
behavioural advertising and which now requires escalation to the EDPB for resolution”. Before
addressing each of the elements of this claim, the EDPB first notes that establishing either
intent or negligence is not a requirement for imposing a fine, but deserves ‘due regard’.
Second, contrary to what Meta IE implies, the mere circumstance that a dispute between the
LSA and the CSAs has escalated to the EDPB does not serve as evidence that a controller acted
in good faith with respect to the disputed issues. First, the dispute arises only (long) after the
controller has decided on its course of action, and therefore cannot inform it. Second, a dispute
may simply bring to light that an LSA has decided to challenge a position commonly held by (a
majority of) the CSAs.

96

449. The EDPB Guidelines on calculation of fines confirm that there are two cumulative
elements on the basis of which an infringement can be considered intentional: the knowledge
of the breach and the willfulness in relation to such act. By contrast, an infringement is
“unintentional” when there was a breach of the duty of care, without having intentionally
caused the infringement.

450. The characterisation of an infringement as intentional or negligent shall be done on the
basis of objective elements of conduct gathered from the facts of the case. It is worth noting
the broader approach adopted with respect to the concept of negligence, since it also
encompasses situations in which the controller or processor has failed to adopt the required
policies, which presumes a certain degree of knowledge about a potential infringement. This
provides an indication that non-compliance in situations in which the controller or processor
should have been aware of the potential breach (in the example provided, due to the lack of
the necessary policies) may amount to negligence.

451. The SE SA argues that Meta IE “has continued to rely on Article 6(1)(b) for the processing,
despite the aforementioned Guidelines [2/2019 on the processing of personal data under
Article 6(1)(b) GDPR in the context of the provision of online services to data subjects] – which
clearly gives doubt to the legality of the processing – which were first adopted on 9 April 2019
and made final on 8 October 2019. The infringement must in all cases be considered intentional
from that later date.”

452. The EDPB recalls that even prior to the adoption Guidelines 2/2019, there were clear
indicators that spoke against relying on contract as legal basis. First, in WP29 Opinion 02/2010
on online behavioural advertising, only consent - as required by Article 5(3) ePrivacy Directive
- is put forward as possible legal basis for this activity. As Article 6 GDPR resembles Article 7 of
the Data Protection Directive to a large extent, WP29 Opinion 02/2010 remained a relevant
source on this matter for controllers preparing for the GDPR to enter into application. Second,
WP29 Opinion 06/2014 on the notion of legitimate interests explicitly states that “the fact that
some data processing is covered by a contract does not automatically mean that the processing
is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for
building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website
and the items purchased. This is because the data controller has not been contracted to carry
out profiling, but rather to deliver particular goods and services, for example. Even if these
processing activities are specifically mentioned in the small print of the contract, this fact alone
does not make them ‘necessary’ for the performance of the contract”.

453. It stems from the above that Meta IE had (or should have had) knowledge about the
infringement of Article 6(1)(b) GDPR. However, this mere element is not sufficient to consider
an infringement intentional, as stated above, since the “aim” or “wilfulness” of the action
should be demonstrated.

454. The EDPB recalls that that having knowledge of a specific matter does not necessarily
imply having the “will” to reach a specific outcome. This is in fact the approach adopted in the
EDPB Guidelines on calculation of fines and WP29 Guidelines on Administrative Fines, where
the knowledge and the “wilfulness” are considered two distinctive elements of the

97

intentionality. While it may prove difficult to demonstrate a subjective element such as the
“will” to act in a certain manner, there need to be some objective elements that indicate the
existence of such intentionality.

455. The EDPB recalls that the CJEU has established a high threshold in order to consider an
act intentional. In fact, even in criminal proceedings the CJEU has acknowledged the existence
of “serious negligence”, rather than ‘intentionality’ when “the person responsible commits a
patent breach of the duty of care which he should have and could have complied with in view
of his attributes, knowledge, abilities and individual situation”. In this regard, the EDPB
confirms that a company for whom the processing of personal data is at the core of its business
activities is expected to have sufficient measures in place for the safeguard of personal data:
this does not, however, per se change the nature of the infringement from negligent to
intentional.

456. In this regard, the SE SA puts forward that Meta IE based its processing of personalised
advertisement on consent until the GDPR came into force on 25 May 2018, and at this time
switched to relying on Article 6(1)(b) GDPR for the processing in question instead. The timing
and the logistics for this switch suggests this act was done with the intention of circumventing
the new rights of users under Article 6(1)(a) GDPR. The SE SA adds that “[the] proposed finding
of infringement concerning information deficits about the processing, namely on what legal
basis it is based, further supports this conclusion, since it goes to show that Facebook was
aware of the questionable legality of that basis and tried to conceal the infringement to avoid
scrutiny by supervisory authorities and data subjects”.

457. The EDPB considers the timing of the changes made by Meta IE to its Facebook Terms of
Service as an objective element; however, this alone does not indicate intention. Around this
time period, many controllers updated their data protection policies. The objection suggests
that the conclusion on intentionality is corroborated by the shortcomings to the transparency
obligations: in the EDPB’s view, the combination of the timing of the change of legal basis with
the lack of transparency is not sufficient to indicate intention either.

458. Therefore, on the basis of the available information, the EDPB is not able to identify a will
of Meta IE to act in breach of the law, as it cannot be concluded that Meta IE intentionally
acted to circumvent its legal obligations.

459. Therefore, the EDPB considers that the arguments put forward by the SE SAs do not meet
the threshold to demonstrate the intentionality of the behaviour of Meta IE. Accordingly, the
EDPB is of the view that the Draft Decision does not need to include this element.

460. At the same time, the EDPB notes that, even establishing that the infringement was
committed negligently, a company for whom the processing of personal data is at the core of
its business activities should have in place sufficient procedures for ensuring compliance with
the GDPR.

461. The EDPB does not accept Meta IE’s claim of “good faith”, but is of the view that Meta IE
was certainly seriously negligent in not taking adequate action, within a reasonable time
period, following the adoption of Guidelines 2/2019 on 9 April 2019. Even before that date,

98

the EDPB considers there was at the very least negligence on Meta IE’s part considering the
contents of WP29 Opinion 02/2010 on online behavioural advertising and WP29 Opinion
06/2014 on the notion of legitimate interests (see paragraphs 452 - 453 above), which mean
Meta IE had (or should have had) knowledge about the infringement of Article 6(1)(b) GDPR,
the fact that processing of personal data is at the core of its business practices, and the
resources available to Meta IE to adapt its practices so as to comply with data protection
legislation.

The degree of responsibility of the controller taking into account technical and organisational
measures implemented pursuant to Articles 25 and 32(Article 83(2)(d) GDPR)

462. The EDPB considers the degree of responsibility of Meta IE’s part to be of a high level, on
the same grounds as set in the Draft Decision with regard to the transparency infringements.

The manner in which the infringement became known (Article 83(2)(h) GDPR)

463. The DE SAs identify an aggravating factor in the fact that the “infringement became known
by a complaint of a data subject, not by chance or report by the controller itself”.

464. The EDPB considers that, as a rule, the circumstance that the infringement became known
to the LSA by way of a complaint should be considered neutral. The DE SAs do not put forward
reasons that would justify a departure from the rule in the present case.

465. Therefore, the EDPB is of the view that the Draft Decision does not need to include this
element as an aggravating or mitigating factor.

The financial benefit obtained from the infringement (Article 83(2)(k) GDPR)

466. The DE SAs and SE SA argue Meta IE gained financial benefits from their decision to rely
on contract as legal basis for behavioural advertising, rather than obtaining consent from the
users of Facebook. The DE SAs engaged in a detailed calculation to justify their estimation of
the benefit, although acknowledging it was based on assumptions. While not providing an
estimate of its size, the SE SA considers the existence of financial benefit sufficiently proven on
the basis of “the self-evident fact that Facebook has made significant financial gain from being
able to provide personal advertisement as part of a whole take it or leave it offer for its social
media platform service, as opposed to establishing a separate legal basis for it. By also being
unclear in the information to data subjects, it is a reasonable assumption that more data
subjects have been misled into being subject to the processing, thus increasing the financial
benefits gained by Facebook pursuant to personal advertisement”.

467. The EDPB recalls that financial benefits from the infringement could be an aggravating
circumstance if the case provides information about profit obtained as a result of the
infringement of the GDPR.

468. In the present case, the EDPB considers that it does not have sufficiently precise
information to evaluate the specific weight of the financial benefit obtained from the
infringement.

99

469. Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no
effect if they are disproportionally low compared to the benefits obtained with the
infringement. The EDPB considers that the IE SA should ascertain if an estimation of the
financial benefit from the infringement is possible in this case. Insofar as this results in the
need to increase the amount of the fine proposed, the EDPB requests the IE SA to increase the
amount of the fine proposed.

The profitability of the undertaking - other factor (Article 83(2)(k) GDPR)

470. For the reasons stated above (paragraphs 378 - 381), the EDPB is of the view that the
Draft Decision does not need to include this element as aggravating or mitigating factor as put
forward by the DE SAs.

Competitive advantage - other factor (Article 83(2)(k) GDPR)

471. The NO SA identifies an aggravating factor in that “that the unlawful processing of
personal data in all likelihood has contributed to the development of algorithms which may be
harmful on an individual or societal level, and which may have considerable commercial value
to FIL. The algorithms may have contributed to giving FIL a competitive advantage vis-à-vis its
competitors”.

472. On principle, the EDPB agrees that a competitive advantage could be an aggravating factor
if the case provides objective information that this was obtained as a result of the infringement
of the GDPR. In the present case, the EDPB considers that it does not have sufficiently precise
information to evaluate the existence of a competitive advantage resulting from the
infringement. The EDPB considers that the IE SA should ascertain if an estimation of the
competitive advantage derived from the infringement is possible in this case. Insofar as this
results in the need to increase the amount of the fine proposed, the EDPB requests the IE SA
to increase the amount of the fine proposed.

***

473. Taking into account the nature and gravity of the infringement as well as other aspects in
accordance with Article 83(2) GDPR, the EDPB considers that the IE SA must exercise its power
to impose an additional administrative fine. Also, covering this additional infringement with a
fine would be in line with the IE SA’s (proposed) decision to impose administrative fines in this
case for the transparency infringements relating to processing carried out in reliance on Article
6(1)(b) GDPR. The EDPB underlines that, in order to be effective, proportionate and dissuasive,
a fine should reflect the circumstances of the case. Such circumstances not only refer to the
specific elements of the infringement, but also those of the controller or processor who
committed the infringement, namely its financial position.

9.8 I have taken account of the above directions of the EDPB in the Article 83(2) assessments set out
below.

100

9.9 Finally, in relation to the new finding of infringement of the Article 5(1)(a) principle of fairness
that was established by the EDPB, the EDPB further directed that:

477. As previously established, the principle of fairness under Article 5(1)(a) GDPR, although
intrinsically linked to the principles of lawfulness and transparency under the same provision,
has an independent meaning. It underpins the whole data protection framework and plays a
key role for securing a balance of power in the controller-data subject relationship.

478. Considering the EDPB’s findings in Section 6 that Meta IE has not complied with key
requirements of the principle of fairness as defined by the EDPB, namely allowing for
autonomy of the data subjects as to the processing of their personal data, fulfilling data
subjects’ reasonable expectation, ensuring power balance, avoiding deception and ensuring
ethical and truthful processing, as well as the overall effect of the infringement by Meta IE of
the transparency obligations and of Article 6(1) GDPR, the EDPB reiterates its view that Meta
IE has infringed the principle of fairness under Article 5(1)(a) GDPR and agrees with the IT SA
that this infringement should be adequately taken into account by the IE SA in the calculation
of the amount of the administrative fine to be imposed following the conclusion of this inquiry.

479. Therefore, the EDPB instructs the IE SA to take into account the infringement by Meta IE
of the fairness principle enshrined in Article 5(1)(a) GDPR as established above when, re-
assessing the administrative fines for the transparency infringements and the determination
of the fine for the lack of legal basis. If, however, the IE SA considers an additional fine for the
breach of the principle of fairness is an appropriate corrective measure, the EDPB requests the
IE SA to include this in its final decision. In any case, the IE SA must take into account the criteria
provided for by Article 83(2) GDPR and ensuring it is effective, proportionate and dissuasive in
line with Article 83(1) GDPR.

9.10 For the avoidance of doubt, the Commission does not consider an additional fine for the breach
of the Article 5(1)(a) principle of fairness that was established by the Article 65 Decision to be an
appropriate corrective measure. The Commission notes, in this regard, that the EDPB’s finding of
infringement of the Article 5(1)(a) fairness principle was largely based on the lack of transparency,
as regards the information that was presented to the data subject concerning the processing that
would be carried out further to the Terms of Service (see, for example, paragraphs 226, 229 and
230 of the Article 65 Decision). The Commission’s Draft Decision contains separately proposed
findings of infringement of the transparency obligations set out in Articles 5(1)(a), 12(1) and
13(1)(c) and proposes to exercise corresponding corrective powers in the form of administrative
fines and an order to bring processing into compliance. In the circumstances, the imposition of a
further fine for the finding of infringement of the Article 5(1)(a) fairness principle would risk
punishing Facebook twice for the same wrongdoing.

9.11 From the above starting points, the required assessments, for the purpose of Article 83(2), of the
infringements that were found to have occurred elsewhere in this Decision are set out
immediately below.

101

Article 83(2)(a): the nature, gravity and duration of the infringement taking into account the nature
scope or purpose of the processing concerned as well as the number of data subjects affected and the
level of damage suffered by them

9.12 I note that Article 83(2)(a) GDPR requires consideration of the identified criterion by reference to
“the infringement” as well as “the processing concerned”.

The infringements of Articles 5(1)(a), 12(1) and 13(1)(c) GDPR in the context of transparency

9.13 Considering first the meaning of “infringement”, it is clear from Articles 83(3)-(5) GDPR, that
“infringement” means an infringement of a provision of the GDPR. In the context of this Inquiry, I
have made findings that reflect my view that Facebook infringed Articles 5(1)(a), 12(1) and
13(1)(c) GDPR (“the Transparency Infringements”). Thus, “the infringement”, for the purpose of
my corresponding assessment of the Article 83(2) GDPR criteria, should be understood
(depending on the context in which the term is used) as meaning an infringement of Articles
5(1)(a), 12(1) and 13(1)(c) GDPR. While each is an individual “infringement” of the relevant
provision, they all concern transparency and, by reason of their common nature and purpose, are
likely to generate the same, or similar, outcomes in the context of some of the Article 83(2) GDPR
assessment criteria. Accordingly, and for ease of review, I will assess all three infringements
simultaneously, by reference to the collective term “Transparency Infringements”, unless
otherwise indicated to the contrary.

9.14 The phrase “the processing concerned”, in the context of the Transparency Infringements, should
be understood as meaning all of the processing operations that Facebook carries out on the
personal data under its controllership for which it indicated reliance on Article 6(1)(b) GDPR,
including for the purposes of behavioural advertising 226. The within Inquiry was based on an
assessment of the extent to which Facebook complies with its transparency obligations in the
context of a specific Complaint. The Inquiry examined, inter alia the extent of the information
Facebook provided to the Complainant about processing carried out in reliance on Article 6(1)(b)
GDPR. Given the generality of the Complaint and therefore the Inquiry, the precise parameters of
this processing were not directly relevant to the factual analysis carried out. The phrase “the
processing concerned”, in the context of the Transparency Infringements, therefore refers simply
to the processing addressed in the Preliminary Draft Decision i.e. the processing carried out by
Facebook for the purpose of delivering its Terms of Service, including processing personal data
for behavioural advertising. Notwithstanding the EDPB’s determination that Facebook is not
permitted to rely on Article 6(1)(b) GDPR when processing personal data for behavioural

226
See para. 353 of the EDPB’s Binding Decision 3/2022 on the dispute submitted by the Irish SA on Meta Platforms
Ireland Limited and its Facebook service (Art. 65 GDPR), adopted on 5 December 2022.
102

advertising purposes, I am required (by paragraph 353 of the Article 65 Decision) to retain the
scope of the “processing concerned”, as set out above.

The infringement of Article 6(1) GDPR in the context of processing for behavioural advertising

9.15 In the context of the infringement of Article 6(1) GDPR that was established by the EDPB in the
Article 65 Decision, the phrase “the processing concerned” should be understood as meaning all
of the processing operations that are carried out by Facebook for the purpose of behavioural
advertising.

9.16 From this starting point, I will now assess the Article 83(2)(a) criterion in light of the particular
circumstances of the Inquiry. I note, in this regard, that Article 83(2)(a) comprises the nature,
gravity and duration of the infringement; the nature, scope or purpose of the processing
concerned; the number of data subjects affected; and the level of damaged suffered by them; as
follows:

Nature, gravity and duration of the infringement

9.17 In terms of the nature of the Transparency Infringements, the proposed findings concern
infringements of the data subject rights. As set out in the analysis of Article 13(1)(c) GDPR above,
my view is that the right concerned – the right to information – is a cornerstone of the rights of
the data subject. Indeed, the provision of the information concerned goes to the very heart of the
fundamental right of the individual to protection of personal data which stems from the free will
and autonomy of the individual to share their personal data in a voluntary situation such as this.
If the required information has not been provided, the data subject has been deprived of the
ability to make a fully informed decision as to whether they wish to use a service that involves the
processing of their personal data and engages their associated rights. Furthermore, the extent to
which a data controller has complied with its transparency obligations has a direct impact on the
effectiveness of the other data subject rights. If data subjects have not been provided with the
prescribed information, they may be deprived of the knowledge they need in order to consider
exercising one of the other data subject rights.

9.18 I further note, in this regard, that Articles 83(4) and (5) GDPR are directed to the maximum fine
that may be imposed in a particular case. The maximum fine prescribed by Article 83(5) GDPR is
twice that prescribed by Article 83(4) GDPR. The infringements covered by Article 83(5) GDPR
include infringements of the data subject’s rights pursuant to Article 12 to 22 GDPR and
infringements of the principles in Article 5 GDPR. It is therefore clear that the legislator considered
the data subject rights and the Article 5 GDPR principles to be particularly significant in the context
of the data protection framework as a whole.

103

9.19 Facebook has argued that the nature of the Transparency Infringements amount to a good faith
difference of opinion, and present a new and subjective interpretation of the GDPR. 227 As part of
my assessment of the Article 83(2)(c) GDPR criterion, which requires consideration of “any action
taken by the controller or processor to mitigate the damage suffered by data subjects”, I note
that it would be unfair to criticize Facebook for failing to take action to mitigate any damage
suffered in circumstances where its position was that no infringement had occurred and,
accordingly, no damage had been suffered by data subjects. This does not, however, do anything
to alter the infringement’s objectively serious character.

9.20 In terms of the nature of the Article 6(1) infringement that was established by the EDPB,
paragraph 441 of the Article 65 Decision provides that:

“The EDPB reiterates that lawfulness of processing is one of the fundamental pillars of the data
protection law and considers that processing of personal data without an appropriate legal
basis is a clear and serious violation of the data subjects’ fundamental right to data protection.”

9.21 In considering the nature and scope of the processing in the context of the analysis leading to the
finding of infringement of Article 6(1) itself, the EDPB noted, at paragraphs 95 and 96 of the Article
65 Decision, that:

“… Meta IE collects data on its individual users and their activities on and off its Facebook social
network service via numerous means such as the service itself, other services of the Meta group
including Instagram, WhatsApp and Oculus, third party websites and apps via integrated
programming interfaces such as Facebook Business Tools or via cookies, social plug-ins, pixels
and comparable technologies placed on the internet user’s computer or mobile device.
According to the descriptions provided, Meta IE links these data with the user’s Facebook
account to enable advertisers to tailor their advertising to Facebook’s individual users based on
their consumer behaviour, interests, purchasing power and personal situation. This may also
include the user’s physical location to display content relevant to the user’s location. Meta IE
offers its services to its users free of charge and generates revenue through this personalised
advertising that targets them, in addition to static advertising that is displayed to every user in
the same way.

The EDPB considers that these general descriptions signal by themselves the complexity,
massive scale and intrusiveness of the behavioural advertising practice that Meta IE conducts
through the Facebook service. These are relevant facts to consider to assess the
appropriateness of Article 6(1)(b) GDPR as a legal basis for behavioural advertising and to what
extent reasonable users may understand and expect behavioural advertising when they accept
the Facebook Terms of Service and perceive it as necessary for Meta IE to deliver its service.”

227
Facebook Submissions on Preliminary Draft Decision, paragraph 13.2.
104

9.22 With specific reference to the scope of the processing, paragraph 444 of the Article 65 Decision,
provides that:

“… the EDPB notes the IE SA’s assessment that the personal data processing carried out by
Meta IE on the basis of Article 6(1)(b) GDPR is extensive, adding that “[Meta IE] processes a
variety of data in order to serve users personalised advertisements, tailor their ‘News Feed’,
and to provide feedback to advertising partners on the popularity of particular advertisements.
The processing is central to and essential to the business model offered”

9.23 It is therefore clear that the EDPB considers the Article 6(1) infringement to concern one of the
“fundamental pillars” of the GDPR and the nature and scope of the processing to be extensive,
complex, intrusive and on a massive scale. The Commission further notes, in this regard, that
paragraph 443 of the Article 65 Decision indicates that the EDPB considered the nature of the
infringement to be significant, in the context of its conclusion that an administrative fine ought to
be imposed in relation to the infringement of Article 6(1) GDPR.

9.24 In terms of the gravity of the Transparency Infringements, my findings are such that Facebook
has not provided the required information in the required manner under Article 13(1)(c) GDPR
and has also infringed Articles 12(1) and 5(1)(a) GDPR. This, in my view, represents a significant
level of non-compliance, taking into account the importance of the right to information, the
consequent impact on the data subjects concerned and the number of data subjects potentially
affected (each of which is considered further below).

9.25 Facebook argues that the Transparency Infringements are on the lower end of the scale in their
nature and gravity because the Commission’s interpretation amounts to new and subjective views
being imposed on it. 228 I do not accept that these views are new or subjective. I set out at Section
5 in great detail the extent to which this level of compliance is expected by the transparency
guidelines, which are a publicly available document. The clear inconsistencies between the
transparency guidelines and the manner in which Facebook attempted to comply with its
obligations makes clear that the Commission’s interpretation is neither new nor subjective. The
Commission is carrying out its functions under the GDPR, by interpreting and applying the relevant
provisions of the GDPR to the Complaint before it. Facebook also argues that no evidence has
been presented of the impact on data subjects from a lack of transparency. 229 On the contrary,
this entire Complaint arises from a failure to provide sufficiently transparent information such
that the Complainant could understand the agreement to the Terms of Service was not consent
in the sense meant in the GDPR. Moreover, I have already set out in Section 5 the risks to data
subjects in being unable to effectively exercise their rights by being unable to discern what specific
data processing is being done on what legal basis and for what objective. This is more than

228
Ibid.
229
Ibid.
105

sufficient to show the negative impact that this has had on data subjects and specifically on the
Complainant. Given that this concerns a significant impact in the manner set out in this Decision,
I cannot accept the suggestion from Facebook that the proposed administrative fine be replaced
with a reprimand. 230

9.26 In terms of the gravity of the Article 6(1) infringement that was established by the EDPB, the
Article 65 Decision does not identify, with any particularisation, the EDPB’s position on the gravity
of the Article 6(1) infringement. The Commission notes, however, that paragraph 443 of the
Article 65 Decision indicates that the EDPB considered the gravity of the infringement to be
significant, in the context of its conclusion that an administrative fine ought to be imposed in
relation to the infringement of Article 6(1) GDPR:

“As mentioned above and outlined below, the nature and gravity of the infringement clearly tip
the balance in favour of imposing an administrative fine.”

9.27 The Commission, for its part, notes that infringements of Article 6 are subject to the higher fining
threshold set out in Article 83(5) GDPR. The maximum fine prescribed by Article 83(5) GDPR is
twice that prescribed by Article 83(4) GDPR. This arrangement clearly indicates that the legislator
considered the matters covered by Article 83(5) GDPR to be particularly significant in the context
of the data protection framework as a whole.

9.28 In terms of the duration of the Transparency Infringements, this complaint-based Inquiry relates
in part to a lack of information provided to the Complainant as regards the lawful basis relied on
and the connection between Article 6(1)(b) GDPR and specific processing operations or sets of
operations. The Complaint therefore relates to the transparency of the relevant documents at the
time the Complaint was lodged. In that sense, this Inquiry relates to specific alleged infringements
at a specific point in time, because that is what the Complaint concerns. In imposing corrective
powers however, the GDPR requires that the broader impact of infringements be considered (as
I will set out below in relation to each individual criterion). To that extent, it is necessary at times
to move from the specific to the general.

9.29 I note at this juncture that Facebook has taken issue with various alleged inconsistencies between
the approach to factors considered in administrative fines in the Preliminary Draft Decision and
in other decisions made by the Commission under the GDPR to date.231 The Commission does not
agree that there is any inconsistency in the manner in which it has assessed the Article 83(2) GDPR
criteria. The Commission is not required to apply the same approach across all inquiries,
regardless of the differences between such inquiries. The Commission’s approach to the presence
or absence of relevant previous infringements (for the purpose of the Article 83(2)(e) GDPR

230
Ibid.
231
Ibid, paragraph 14.2.
106

assessment) differs, depending inter alia on the contexts of different types of controllers,
particularly as concerns the scale of the processing at issue. Unlike the position with the smaller-
scale domestic inquiries to which Facebook refers, inquiries into larger internet platforms
generally concern data controllers or processors with multi-national operations and significant
resources available to them, including large, in-house, compliance teams.

9.30 Moreover, such entitles are further likely to be engaged in business activities that are uniquely
dependent on the large-scale processing of personal data. The Commission’s view is that the size
and scale of such entities, the level of dependency on data processing and the extensive resources
that are available to them necessitate a different approach to the absence of previous relevant
infringements. That approach has been reflected in the decisions that differ in their
considerations of particular factors from this one. In the circumstances, the Commission does not
accept that there has been an inconsistency in the Commission’s approach to determining the
quantum of any fine.

9.31 In relation to the infringement of Article 6(1) that was established by the EDPB, the Article 65
Decision does not contain any indication in relation to the manner in which the EDPB took account
of the duration of the Article 6(1) infringement. The Commission notes that the infringement has
occurred since 25 May 2018 and remains ongoing.

Taking into account the nature, scope or purpose of the processing concerned

9.32 The personal data processing carried out by Facebook pursuant to Article 6(1)(b) GDPR is
extensive. Facebook processes a variety of data in order to serve users personalised
advertisements, tailor their “News Feed”, and to provide feedback to advertising partners on the
popularity of particular advertisements. The processing is central to and essential to the business
model offered, and, for this reason, the provision of compliant information in relation to that
processing becomes even more important. This, indeed, may include location and IP address data.

9.33 The EDPB’s views, as regards the scope of the processing concerned, in the context of the Article
6(1) infringement have already been recorded at paragraph 9.21, above.

The number of data subjects affected

9.34 In the context of the Transparency Infringements, I noted, in the Draft Decision, that Facebook
has confirmed that, as of the date of the Complaint, it had approximately monthly active users
and that, as of May 2021, it had approximately monthly active users in the European
Economic Area. 232

232
Ibid, paragraph 4.11.
107

9.35 Eurostat, the statistical office of the European Union confirms that, as of 1 January 2020, the
population of the “”EU 27” was approximately 488 million, the population of the UK was
approximately 67 million, the population of Norway was approximately 5 million, and the
populations of Iceland and Liechtenstein were approximately 364,000 and 39,000 respectively. 233

9.36 By reference to these figures, the total population of the EEA (including the UK) by reference to
the latest available figures is approximately 520 million. While it is not possible, or indeed
necessary, for me to identify the precise number of users affected by the Infringements, it is useful
to have some point of reference in order to consider the extent of EEA data subjects that are
potentially affected by the Infringements. The figures available for Facebook equates to
approximately of the population of the EEA (including the UK), by reference to the
Eurostat figures above.

9.37 In relation to the finding of infringement of Article 6(1) GDPR that was established by the EDPB,
paragraph 445 of the Article 65 Decision recalls, by reference to the assessment recorded
immediately above, that “the infringement at issue relates to the processing of personal data of a
significant number of people”. Footnote 886 (to paragraph 445 of the Article 65 Decision) further
references paragraph 9.17 of the Commission’s Draft Decision, with the EDPB noting that this
figure “amounts to roughly of the population [of the EEA, including the UK].”

The level of damage suffered by them

9.38 In the context of the Transparency Infringements, I note that Recital 75 (which acts as an aid to
the interpretation of Article 24 GDPR, the provision that addresses the responsibility of the
controller), describes the “damage” that can result where processing does not accord with the
requirements of the GDPR:

“The risk to the rights and freedoms of natural persons, of varying likelihood and severity,
may result from personal data processing which could lead to physical, material or non-
material damage, in particular: … where data subjects might be deprived of their rights
and freedoms or prevented from exercising control over their personal data …”

9.39 As set out above, my findings are such that users have not been provided with the information in
relation to processing pursuant to Article 6(1)(b) GDPR that they are entitled to receive. This
represents, in my view, quite a significant information deficit and one which, by any assessment
of matters, can equate to a significant inability to exercise control over personal data. I have also
pointed out the centrality of the processing to Facebook’s business model. This makes it all the
more important that information on this processing be provided in a transparent manner, and
makes the implications of it not being provided in such a manner all the more significant.

233
https://ec.europa.eu/eurostat/tgm/table.do?tab=table&init=1&language=en&pcode=tps00001&plugin=1.
108

9.40 I further note that the failure to provide all of the prescribed information undermines the
effectiveness of the data subject rights and, consequently, infringes the rights and freedoms of
the data subjects concerned. A core element of transparency is empowering data subjects to
make informed decisions about engaging with activities that cause their personal data to be
processed, and making informed decisions about whether to exercise particular rights, and
whether they can. This right is undermined by a lack of transparency on the part of a data
controller.

9.41 Facebook argues that the above amounts to mere speculation. 234 I have already set out in detail
in this Decision the risks to data subject rights involved in the denial of transparency, and indeed
provided the concrete example of the breach of the Complainant’s rights to transparency about
the use of her personal data. This is more than sufficient to show that rights have been damaged
in a significant manner, given the lack of an opportunity to exercise data subject rights while being
fully informed.

9.42 In the context of the infringement of the infringement of Article 6(1) GDPR that was established
by the EDPB, paragraph 446 of the Article 65 Decision records that:

“Though the damage is very difficult to express in terms of a monetary value, it remains the
case that data subjects have been faced with data processing that should not have occurred …
. The data processing in question – behavioural advertising – entails decisions about
information that data subjects are exposed to or excluded from receiving. The EDPB recalls
that non-material damage is explicitly regarded as relevant in Recital 75 and that such damage
may result from situations “where data subjects might be deprived of their rights and freedoms
or prevented from exercising control over their personal data”. Given the nature and gravity
of the infringement of Article 6(1) GDPR, a risk of damage caused to data subjects is, in such
circumstances, consubstantial with the finding of the infringement itself.”

9.43 Paragraph 129 of the Article 65 Decision considers the risks arising from the Article 6(1)
infringement as follows:

“Given that the main purpose for which a user uses the Facebook service is to communicate
with others, and that Meta IE conditions its use to the user’s acceptance of a contract and the
behavioural advertising it includes, the EDPB cannot see how a user would have the option of
opting out of a particular processing which is part of the contract as the IE SA seems to argue.
The users’ lack of choice in this respect would rather indicate that Meta IE’s reliance on the
contractual performance legal basis deprives users of their rights, among others, to withdraw
their consent under Article 6(1)(a) GDPR and Article 7 GDPR and/or to object to the processing
of their data based on Article 6(1)(f) GDPR.”

234
Facebook Submissions on Preliminary Draft Decision, paragraph 4.13.
109

9.44 The EDPB further considered, at paragraph 131 of the Article 65 Decision, that:

“Some of the safeguards from which data subjects would be deprived due to an inappropriate
use of Article 6(1)(b) GDPR as legal basis, instead of others such as consent 6(1)(a) GDPR and
legitimate interest 6(1)(f) GDPR, are the possibility to specifically consent to certain processing
operations and not to others and to the further processing of their personal data (Article 6(4)
GDPR); their freedom to withdraw consent (Article 7 GDPR); their right to be forgotten (Article
17 GDPR); and the balancing exercise of the legitimate interests of the controller against their
interests or fundamental rights and freedoms (Article 6(1)(f) GDPR). As a result, owing to the
number of users, market power, and influence of Meta IE and its economically attractive
business model, the risks derived from the current findings of the Draft Decision could go
beyond the Complainant and the millions of users of Facebook service in the EEA and affect the
protection of the hundreds of millions of people covered by the GDPR.”

9.45 It therefore appears that the EDPB considered the infringement to give rise to a risk of loss of
control over, and ability to exercise choice concerning, one’s personal data. This is consistent with
the Complainant’s position that the infringement had the effect of negating her free will (see point
ii, page 17 of the Complaint).

9.46 The Commission considers that the infringement of the Article 5(1)(a) fairness principle may be
taken into account, as required by the Article 65 Decision, under this particular heading. The
Commission notes, in this regard, paragraph 224 of the Article 65 Decision, which records the
EDPB’s view that:

“Considering the constantly increasing economic value of personal data in the digital
environment, it is particularly important to ensure that data subjects are protected from any
form of abuse and deception, intentional or not, which would result in the unjustified loss of
control over their personal data. Compliance by providers of online services acting as
controllers with all three of the cumulative requirements under Article 5(1)(a) GDPR, taking into
account the particular service that is being provided and the characteristics of their users,
serves as a shield from the danger of abuse and deception, especially in situations of power
asymmetries.”

9.47 The EDPB further notes, at paragraphs 229 and 230 of the Article 65 Decision, that:

“… the EDPB shares the IT SA’s concern that Facebook users are left ”in the dark" and considers
that the processing by Meta IE cannot be regarded as ethical and truthful because it is
confusing with regard to the type of data processed, the legal basis and the purpose of the
processing, which ultimately restricts the Facebook users’ possibility to exercise their data
subjects’ rights.

110

… Considering the seriousness of the infringements of the transparency obligations by Meta IE
already identified in the Draft Decision and the related misrepresentation of the legal basis
relied on, the EDPB agrees with the IT SA that Meta IE has presented its service to the Facebook
users in a misleading manner, which adversely affects their control over the processing of their
personal data and the exercise of their data subjects' rights.”

9.48 The EDPB’s views highlight the same damage as already identified above, namely the loss of
control over, and ability to exercise choice concerning, one’s personal data.

9.49 On the basis of the views that have been expressed by the EDPB, as recorded above, I conclude
that the infringement of Article 6(1) GDPR falls within the upper range of the scale, in terms of
seriousness, for the purpose of the assessment of the Article 83(2)(a) criterion. By way of its Final
Submissions, Facebook expressed its disagreement with this proposed conclusion and the
underlying assessments set out above.

Facebook’s Final Submissions in response to the assessment of the Article 6(1) infringement for the
purpose of Article 83(2), as introduced to this Decision following the adoption of the Article 65 Decision

9.50 Following the amendment of the Draft Decision to take account of the EDPB’s Article 65 Decision,
Facebook was invited to exercise its right to be heard in relation to those aspects of the Draft
Decision in relation to which the Commission was required to make a final determination or,
otherwise, to exercise its discretion. Facebook furnished its submissions on these matters under
cover of letter dated 19 December 2022 (“the Final Submissions”).

9.51 In relation to the nature of the Article 6(1) infringement, Facebook submitted 235 that the EDPB’s
conclusion on this aspect of matters “is not correct and not supported by the evidence, particularly
where (i) the [Commission] itself found [Facebook’s] reliance on Article 6(1)(b) for [behavioural
advertising purposes] valid in principle, meaning the infringement cannot be said to have been
“clear”; and (ii) the Article 65 Decision acknowledges that legal bases are available [to support
processing for behavioural advertising] and that there is no hierarchy between those legal bases.”
In this regard, Facebook respectfully urges the Commission not to adopt the EDPB’s “flawed
arguments” with respect to Article 83(2)(a) in light of a number of “significant errors in the EDPB’s
reasoning” that it has identified in its Final Submissions.

9.52 In circumstances where the Article 65 Decision is binding upon the Commission, I am not in a
position to act contrary to, or otherwise look behind, the views that have been so expressed the
EDPB.

235
The Final Submissions, paragraphs 9.4 to 9.7
111

9.53 In relation to the gravity of the Article 6(1) infringement, Facebook, firstly, noted that the Article
65 Decision does not articulate any clear reasoning or position with respect to the gravity of the
purported infringement, rendering the assessment of this element meaningless. Facebook has
further submitted236 that a “finding in respect of gravity cannot simply be extrapolated from the
fact that the infringement found is subject to a particular fining cap in accordance with Article
83(5), with no reference to the facts.” Facebook submitted that gravity should not be considered
significant or an aggravating factor for the same reasons as those provided in response to the
proposed assessment of the nature of the assessment, as summarised above.

9.54 As before, the Commission is not in a position to act contrary to the views that have been clearly
expressed by the EDPB in its binding Article 65 Decision. As already acknowledged, the EDPB has
not elaborated on the reasons why it considers the gravity of the Article 6(1) infringement to be
one of the factors that tip the balance in favour of the imposition of a fine. This does not alter the
fact, however, that the EDPB clearly considered the gravity of the Article 6(1) infringement to be
of one of the factors that warranted the imposition of an administrative fine. In these
circumstances, it is not open to the Commission to conclude that the gravity of the infringement
is not significant, in terms of its impact on the overall assessment of the Article 83(2)(a) criterion.

9.55 In relation to the duration of the Article 6(1) infringement, Facebook has submitted 237 that the
duration of the alleged infringement “should not be considered an aggravating factor in this
particular case”. In the absence of any specific direction from the EDPB, in this regard, the
Commission has not treated this factor as being significant, in terms of its impact on the overall
assessment of the Article 83(2)(a) criterion.

9.56 In relation to the number of data subjects and the level of damage suffered by them, Facebook
has submitted 238 that:

• “the only data subject who is relevant for the purpose of Article 83(2)(a) is the data subject
represented by the Complainant and any consideration of the level of damage suffered is
confined to a consideration of any damage the Complainant may have suffered. No evidence
of any such damage has been adduced in the Inquiry”;

• “even if it is open to the [Commission] to consider whether other data subjects have been
affected and to have regard to any damage suffered by them, there is no evidence whatsoever
in this Inquiry that any other data subjects have suffered any damage.”

• “the [Commission’s] assessment of whether damage has been suffered for the purposes of
Article 83(2)(a) must be based on evidence of damage stemming from the specific

236
The Final Submissions, paragraphs 9.8 to 9.13
237
The Final Submissions, paragraphs 9.14 to 9.19
238
The Final Submissions, paragraphs 9.20 to 9.29
112

infringement in question (here, the Article 6(1) GDPR infringement). It is not permissible for
the DPC to assume that the Complainant has suffered damage or to base the calculation of
the proposed Article 6(1) fine on “the same damage as already identified” as the basis for the
purposed Article 5(1)(a) fine.”

• “an alleged “loss of control” should not be equated with damage within the meaning of Article
83(2)(a) GDPR”;

• There is no factual or evidential basis to support an assertion that users experienced a “loss
of control”. “This is especially true considering that everyone has a choice as to whether they
wish to use the Facebook Service in the first place and can always deactivate their accounts.”

9.57 In response to the above submissions, it is, firstly, important to note that the Commission is
subject to a binding decision of the EDPB, which includes an assessment of the damage suffered
by data subjects, at paragraph 446 thereof. In the circumstances, it is not open to the Commission
to find that no damage has been suffered. Secondly, the Complainant herself identified the
damage that she alleges to have suffered in connection with the matters which formed the basis
for the EDPB’s findings of infringement of Article 6(1) and the Article 5(1)(a) principle of fairness.
Thirdly, as regards the damage suffered by data subjects other than the Complainant, the matters
covered by the findings of infringement are not matters on which any individual user of the
Facebook Service has the power to exercise choice (other than, of course, the choice to use the
Facebook Service or not). Where any individual data subject chooses to use the Facebook Service,
the basic processing that takes place (the subject of the within Inquiry) is the same as that applied
to the personal data of the Complainant. In these circumstances, it cannot be said that the
identified damage suffered, i.e. loss of control over one’s personal data, is limited to the
Complainant alone. For these reasons, it is appropriate for the Commission to take account of
the damage suffered by all user data subjects as part of the Article 83(2) assessment.

9.58 Having taken account of the Final Submissions, I remain of the view that the infringement of
Article 6(1) GDPR falls within the upper range of the scale, in terms of seriousness, for the purpose
of the assessment of the Article 83(2)(a) criterion.

ARTICLE 83(2)(B): THE INTENTIONAL OR NEGLIGENT CHARACTER OF THE INFRINGEMENT

9.59 In assessing the character of the Transparency Infringements, I note that the GDPR does not
identify the factors that need to be present in order for an infringement to be classified as either
“intentional” or “negligent”. The Article 29 Working Party considered this aspect of matters in its
“Guidelines on the application and setting of administrative fines for the purposes of Regulation
2016/679” as follows:

113

“In general, “intent” includes both knowledge and wilfulness in relation to the
characteristics of an offence, whereas “unintentional” means that there was no intention
to cause the infringement although the controller/processor breached the duty of care
which is required in the law.” 239

9.60 The Administrative Fines Guidelines go on to distinguish between circumstances that are
indicative of ‘intentional breaches’ and those that are indicative of breaches occasioned by
unintentional, or negligent, conduct. In this regard, the Guidelines cite “failure to read and abide
by existing policies” and “human error” as being examples of conduct that may be indicative of
negligence.

9.61 The Complainant has clearly asserted that the alleged infringements on Facebook’s part were
intentional acts. Moreover, she states that the character of the infringement is that it was a
decision made knowingly to present information in a particular way. Facebook is however entitled
to a hold differing position in relation to the interpretation of particular provisions of the GDPR.
While Facebook may have believed that it was in compliance with the GDPR, it is my view that the
Transparency Infringements arose out of a deliberate decision. It is important that Facebook
provides clarity about the precise extent of the processing operations carried out pursuant to
Article 6(1)(b) GDPR and that it adheres strictly to its transparency obligations when choosing the
lawful bases on which they rely.

9.62 Facebook cites the above passage from the Fining Guidelines to support its position that
“intention” refers to a deliberate breach of the GDPR rather than a deliberate act. 240 I note in this
regard that the Fining Guidelines refer to two requirements, “knowledge” and “wilfulness”. This
suggests a controller must infringe the GDPR both in full knowledge of the infringement’s
characteristics and also in a deliberate manner. Having considered the nature of the infringements
further in the context of the Fining Guidelines, I accept Facebook’s submissions that any
intentional breach must be an intentional and knowing breach of a provision of the GDPR. There
is no evidence that this has taken place.

9.63 Facebook also argues that even if the position on the definition of intent is accepted, what
occurred was not a deliberate act but an omission. 241 In light of my finding in the above paragraph
it is unnecessary to consider this submission.

9.64 I am therefore satisfied that the failure to provide the requisite information was negligent in
character. Facebook is under a clear legal duty to correctly apply the law and it has not done so.

239
Article 29 Working Party “Guidelines on the application and setting of administrative fines for the purposes of
Regulation 2016/679”, page 11.
240
Facebook Submissions on Preliminary Draft Decision, paragraph 4.14.
241
Ibid.
114

This amounts to a breach of the duty imposed by the provisions of the GDPR, and is on that basis
a negligent infringement.

9.65 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, paragraphs
449 to 461, inclusive, of the Article 65 Decision record as follows:

“The EDPB Guidelines on calculation of fines confirm that there are two cumulative elements
on the basis of which an infringement can be considered intentional: the knowledge of the
breach and the wilfulness in relation to such act. By contrast, an infringement is
“unintentional” when there was a breach of the duty of care, without having intentionally
caused the infringement.

The characterisation of an infringement as intentional or negligent shall be done on the basis
of objective elements of conduct gathered from the facts of the case. It is worth noting the
broader approach adopted with respect to the concept of negligence, since it also encompasses
situations in which the controller or processor has failed to adopt the required policies, which
presumes a certain degree of knowledge about a potential infringement. This provides an
indication that non-compliance in situations in which the controller or processor should have
been aware of the potential breach (in the example provided, due to the lack of the necessary
policies) may amount to negligence.”

…

The EDPB recalls that even prior to the adoption [of] Guidelines 2/2019, there were clear
indicators that spoke against relying on contract as legal basis. First, in WP29 Opinion 01/2010
on online behavioural advertising, only consent – as required by Article 5(3) ePrivacy Directive
– is put forward as possible legal basis for this activity. As Article 6 GDPR resembles Article 7
of the Data Protection Directive to a large extent, WP29 Opinion 02/2010 remained a relevant
source on this matter for controllers preparing for the GDPR to enter into application. Second,
WP Opinion 06/2014 on the notion of legitimate interests explicitly states that “the fact that
some data processing is covered by a contract does not automatically mean that the processing
is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for
building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website
and the items purchased. This is because the data controller has not been contracted to carry
out profiling, but rather to deliver particular goods and services, for example. Even if these
processing activities are specifically mentioned in the small print of the contract, this fact alone
does not make them ‘necessary’ for the performance of the contract”

It stems from the above that Meta IE had (or should have had) knowledge about the
infringement of Article 6(1)(b) GDPR. However, this mere element is not sufficient to consider
an infringement intentional, as stated above, since the “aim” or “wilfulness” of the action
should be demonstrated.

The EDPB recalls that that having knowledge of a specific matter does not necessarily imply
having the “will” to reach a specific outcome. This is in fact the approach adopted in the EDPB
Guidelines on calculation of fines and WP29 Guidelines on Administrative Fines, where the

115

knowledge and the “wilfulness” are considered two distinctive elements of the intentionality.
While it may prove difficult to demonstrate a subjective element such as the “will” to act in a
certain manner, there need to be some objective elements that indicate the existence of such
intentionality.

The EDPB recalls that the CJEU has established a high threshold in order to consider an act
intentional. In fact, even in criminal proceedings the CJEU has acknowledged the existence of
“serious negligence”, rather than ‘intentionality’ when “the person responsible commits a
patent breach of the duty of care which he should have and could have complied with in view
of his attributes, knowledge, abilities and individual situation”. In this regard, the EDPB
confirms that a company for whom the processing of personal data is at the core of its business
activities is expected to have sufficient measures in place for the safeguard of personal data:
this does not, however, per se change the nature of the infringement from negligent to
intentional.

In this regard, the SE SA puts forward that Meta IE based its processing of personalised
advertisement on consent until the GDPR came into force on 25 May 2018, and at this time
switched to relying on Article 6(1)(b) GDPR for the processing in question instead. The timing
and the logistics for this switch suggests this act was done with the intention of circumventing
the new rights of users under Article 6(1)(a) GDPR. The SE SA adds that “[the] proposed finding
of infringement concerning information deficits about the processing, namely on what legal
basis it is based, further supports this conclusion, since it goes to show that Facebook was
aware of the questionable legality of that basis and tried to conceal the infringement to avoid
scrutiny by supervisory authorities and data subjects”.

The EDPB considers the timing of the changes made by Meta IE to its Facebook Terms of Service
as an objective element; however, this alone does not indicate intention. Around this time
period, many controllers updated their data protection policies. The objection suggests that the
conclusion on intentionality is corroborated by the shortcomings to the transparency
obligations: in the EDPB’s view, the combination of the timing of the change of legal basis with
the lack of transparency is not sufficient to indicate intention either.

Therefore, on the basis of the available information, the EDPB is not able to identify a will of
Meta IE to act in breach of the law, as it cannot be concluded that Meta IE intentionally acted
to circumvent its legal obligations.

Therefore, the EDPB considers that the arguments put forward by the SE SAs do not meet the
threshold to demonstrate the intentionality of the behaviour of Meta IE. Accordingly, the EDPB
is of the view that the Draft Decision does not need to include this element.

At the same time, the EDPB notes that, even establishing that the infringement was committed
negligently, a company for whom the processing of personal data is at the core of its business
activities should have in place sufficient procedures for ensuring compliance with the GDPR.

The EDPB does not accept Meta IE’s claim of “good faith”, but is of the view that Meta IE was
certainly seriously negligent in not taking adequate action, within a reasonable time period,
following the adoption of Guidelines 2/2019 on 9 April 2019. Even before that date, the EDPB

116

considers there was at the very least negligence on Meta IE’s part considering the contents of
WP29 Opinion 02/2010 on online behavioural advertising and WP29 Opinion 06/2014 on the
notion of legitimate interests … , which mean Meta IE had (or should have had) knowledge
about the infringement of Article 6(1)(b) GDPR, the fact that processing of personal data is at
the core of its business practices, and the resources available to Meta IE to adapt its practices
so as to comply with data protection legislation.”

9.66 As set out above, the EDPB determined the Article 6(1) infringement to be “seriously negligent”
in character. In the circumstances, I proposed to treat this factor as an aggravating factor of
significant weight.

Facebook’s Final Submissions in response to the assessment of the Article 6(1) infringement for the
purpose of Article 83(2), as introduced to this Decision following the adoption of the Article 65 Decision

9.67 Facebook disagrees 242 with the above conclusion on the basis of a range of submissions, all of
which challenge the basis for the EDPB’s conclusion. Facebook submits that the finding of
infringement of Article 6(1) GDPR can “at most be considered inadvertent, such that this should
not be treated as an aggravating factor for the purpose of Article 83(2).” In the alternative,
Facebook has submitted that the Commission should not afford any material weight to this factor
in light of its “good faith reliance on what it considered to be a valid legal basis, (b) the errors in
the reasoning of the EDPB [as identified]; and (c) the lack of legal certainty in the interpretation of
Article 6(1)(b) GDPR.”

9.68 As already noted, above, the Article 65 Decision is binding upon the Commission. In the
circumstances, it is not open to the Commission to disregard the views that have been clearly
expressed by the EDPB, in relation to the character of the Article 6(1) infringement. In
circumstances where the EDPB has determined the Article 6(1)(b) infringement to be “seriously
negligent” in character, I remain of the view that this requires me to treat this factor as an
aggravating factor of significant weight, notwithstanding Facebook’s Final Submissions on the
point.

ARTICLE 83(2)(C): ANY ACTION TAKEN TO MITIGATE THE DAMAGE TO DATA SUBJECTS

9.69 Facebook’s position is that its approach to transparency, in the context in which the Transparency
Infringements have been found, complies fully with the GDPR. Notwithstanding my proposed
disagreement with this position, I accept that it represents a genuinely held belief on Facebook’s
part. This does not alter the fact that infringements have occurred. On that basis, there has been
no effort to mitigate the damage to data subjects, given Facebook’s position was that no damage
was taking place.

242
The Final Submissions, paragraphs 9.30 to 9.37
117

9.70 Facebook argues that this analysis is flawed because it takes no account of the effort made to
comply with the GDPR. There is no reason why, on the basis of Transparency Guidelines, Facebook
could not have taken steps to ensure compliance and thereby mitigate damage. I am not satisfied
that there is any reason why day-to-day compliance related activities in a large multinational
organisation, which is an important legal duty and commonplace business activity, could be
considered a mitigating factor. Taking steps to attempt to comply with legal obligations is a duty,
and has no mitigating impact on a sanction for a breach of those obligations. This is distinct from
any act that might be taken to mitigate specific damage to data subjects. I am not of course
treating this factor as aggravating given that, beyond simply complying with the GDPR, there are
no obvious mitigating steps that could have been taken. It is on this basis that I treat this factor
as neither mitigating nor aggravating.

9.71 By way of the Draft Decision, I proposed to take account of and acknowledge, as a mitigating
factor, Facebook’s willingness to engage in steps to bring its processing into compliance on a
voluntary basis pending the conclusion of this Inquiry. Further, however, to an objection raised
by the Polish SA, during the Article 60 consultation period, the EDPB determined, in paragraphs
362 to 366 of the Article 65 Decision, as follows:

363. The IE SA states that “[Meta IE]’s willingness to engage in steps to bring its processing
into compliance on a voluntary basis” should be understood as actions taken to mitigate the
damage to data subjects, distinct from actions taken to comply685. In the present case, the
EDPB fails to see how such a distinction can be made. Additionally, drawing this distinction
seems inconsistent with the IE SA’s position that the negative impact on data subjects lies
precisely in the transparency infringements and thus in the “the risks to data subjects in
being unable to effectively exercise their rights by being unable to discern what specific data
processing is being done on what legal basis and for what objective”686. In other words, the
damage caused to data subjects is, in these circumstances, consubstantial with the finding of
the infringement itself687.

364. In addition, the EDPB agrees with the PL SA that the expression of an “intention to bring
the processing operations into the compliance with the provisions of GDPR” as such cannot
serve as evidence of actions already taken to mitigate damage suffered. In order for this
element to serve as a mitigating factor, further evidence would be necessary for instance
demonstrating that the controller did whatever they could in order to reduce the
consequences of the breach for the individuals concerned688.

365. The EDPB agrees with the IE SA that “[taking] steps to attempt to comply with legal
obligations is a duty, and has no mitigating impact on a sanction for a breach of those
obligations”. In any case, Meta IE’s “decision to begin preparation for voluntary compliance
on the basis of the views set out in the Preliminary Draft Decision” is merely a first step of a
longer process towards full compliance with the GDPR. The information available in the file
does not include indications that the actions taken by the controller have gone beyond
willingness to prepare to change its practices in case this appeared necessary.

118

366. The EDPB finds the IE SA does not provide sufficient justification for the mitigating factor
identified, and instructs the IE SA to modify its Draft Decision on this matter, by considering
this factor as neither aggravating nor mitigating.

9.72 On the basis of the above, and in accordance with the instruction of the EDPB, the Commission
treats this factor as neither mitigating nor aggravating.

9.73 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, this aspect
of the Article 83(2) assessment has not been addressed in the Article 65 Decision. I note that
Facebook, throughout the course of the Inquiry, considered that it was entitled to process
personal data for behavioural advertising purposes, insofar as that formed a core part of the
Facebook Terms of Service, in reliance on Article 6(1)(b) GDPR. That being the case, it follows that
Facebook could not have been expected to take action “to mitigate the damage suffered by data
subjects” in circumstances where it did not consider any infringement to have occurred or any
damage to have been suffered by data subjects. In the circumstances, the Commission proposed
to consider this factor to be neither aggravating nor mitigating.

Facebook’s Final Submissions in response to the assessment of the Article 6(1) infringement for the
purpose of Article 83(2), as introduced to this Decision following the adoption of the Article 65 Decision

9.74 By way of the Final Submissions, Facebook has urged me to take account of various mitigating
matters such as the absence of evidence of harm and the fact that various voluntary steps have
been taken to improve transparency for users since the Inquiry has commenced, including as
recently as July 2022. I note that I have already addressed Facebook’s submissions concerning
the absence of evidence of harm, as part of the Article 83(2)(a) assessment. In relation to the
voluntary changes that have been made since the date of circulation, to the CSAs, of the Draft
Decision, the Commission is unable to give credit to these changes, as a mitigating factor, without
an assessment of the changes themselves. Given that such an assessment is not possible within
the temporal scope of the within Inquiry, the Commission is unable to treat this matter as a
mitigating factor. Accordingly, I remain of the view that this factor ought to be treated as neither
aggravating nor mitigating.

ARTICLE 83(2)(D): THE DEGREE OF RESPONSIBILITY OF THE CONTROLLER OR PROCESSOR TAKING INTO ACCOUNT TECHNICAL
AND ORGANISATIONAL MEASURES IMPLEMENTED BY THEM PURSUANT TO ARTICLES 25 AND 32

9.75 The Fining Guidelines set out that:

“The question that the supervisory authority must then answer is to what extent the
controller “did what it could be expected to do” given the nature, the purposes or the size
of the processing, seen in light of the obligations imposed on them by the Regulation.”

119

9.76 In relation to Facebook’s responsibility from a technical and organisational perspective, Facebook
has argued that, given it did not deliberately and knowingly break the law. It could not be said to
have responsibility “at the highest level”. 243 While I accepted this argument and revised my
provisional view as a consequence, I nonetheless consider that Facebook’s responsibility is
certainly at a high level.

9.77 In this regard, I once again emphasise that the position as implemented represented a genuinely
held belief, and the modes of implementation of compliance utilised by Facebook in this regard
constituted a genuine effort to implement compliance based on this genuinely held belief. This
genuine effort, however, has ultimately fallen short in terms of compliance in significant respects.
I have found that it concerns serious data processing, and that it was deliberate act, in spite of the
genuinely help belief that the modes of implementation were compliant. The degree of
responsibility on Facebook’s part is therefore, in my view, responsibility of a high level.

9.78 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, paragraph
462 of the Article 65 Decision provides that:

“The EDPB considers the degree of responsibility of Meta IE’s part to be of a high level, on the
same grounds as set [out] in the Draft Decision with regard to the transparency infringements.”

9.79 In the circumstances, the Commission proposed to consider this to be an aggravating factor, of
moderately significant weight.

Facebook’s Final Submissions in response to the assessment of the Article 6(1) infringement for the
purpose of Article 83(2), as introduced to this Decision following the adoption of the Article 65 Decision

9.80 By way of the Final Submissions, Facebook disagreed244 with the above assessment on the basis
that “the EDPB’s conclusion at para. 462 of the Article 65 Decision that [Facebook] had a “high
degree” of responsibility pursuant to this factor is based on an incomplete analysis and the EDPB
fails to consider any of the relevant subfactors set forth by the Article 29 Working Party Draft
Administrative Fine Guidelines in reaching its conclusion.”

9.81 As already noted above, the EDPB’s Article 65 Decision is binding upon the Commission.
Accordingly, the Commission is not permitted to look behind the EDPB’s views and
determinations. In the circumstances, I remain of the view that this factor ought to be treated as
an aggravating factor, of moderately significant weight, notwithstanding Facebook’s Final
Submissions.

243
Ibid, paragraph 14.16.
244
The Final Submissions, paragraphs 9.42 to 9.47
120

ARTICLE 83(2)(E): ANY RELEVANT PREVIOUS INFRINGEMENTS BY THE CONTROLLER OR PROCESSOR

9.82 In the context of the Transparency Infringements, I noted that there have been no relevant
previous infringements by Facebook of the GDPR in this regard on which findings have been made.
Facebook once again compares the lack of mitigation in this regard to a decision of the
Commission on a domestic matter. 245 I have already set out my views on these arguments above.
Further, the Article 83(2) GDPR criteria are matters that I must consider when deciding whether
to impose an administrative fine and, if so, the amount of that fine. The Article 83(2) GDPR criteria
are not binary in nature, such that, when assessed in the context of the circumstances of
infringement, they must be found to be either a mitigating or an aggravating factor.

9.83 Accordingly, it does not follow that the absence of a history of infringement must be taken into
account as a mitigating factor. This is particularly the case where the GDPR has only been in force
for a relatively short period of time. On this basis, my view is that this is neither a mitigating factor
nor an aggravating one for the purpose of this assessment.

9.84 In relation to the infringement of Article 6(1) that was established by the EDPB, the Article 65
Decision has not addressed this particular aspect of matters. As at the date of circulation of the
Commission’s Draft Decision, were there no relevant previous infringements by Meta IE that fell
to be considered under this particular heading. In the circumstances, I proposed to consider this
factor to be neither mitigating nor aggravating.

Facebook’s Final Submissions in response to the assessment of the Article 6(1) infringement for the
purpose of Article 83(2), as introduced to this Decision following the adoption of the Article 65 Decision

9.85 Facebook, by way of the Final Submissions 246, disagrees with the above and, instead, urges the
Commission to treat this factor as mitigating, in line with the Commission’s approach in other
(named) inquiries. I note, in this regard, that the named inquiries do not concern cross-border
processing.

9.86 In response to the above, the Commission is not required to apply the same approach across all
of its inquiries. The Commission’s approach to the presence or absence of relevant previous
infringements (for the purpose of the Article 83(2)(e) assessment) differs, depending inter alia on
the contexts of different types of controllers and, in particular, the scale of the processing at issue.
Unlike the position with the smaller-scale domestic inquiries that Facebook has cited as examples,
inquiries into larger internet platforms generally concern data controllers or processors with
multi-national operations and significant resources available to them, including large, in-house,
compliance teams. Such entitles are further likely to be engaged in business activities that are

245
Ibid, paragraphs 4.17-4.18.
246
The Final Submissions, paragraphs 9.48 to 9.50
121

uniquely dependent on the large-scale processing of personal data. The Commission’s view is
that the size and scale of such entities, the level of dependency on data processing and the
extensive resources that are available to them necessitate a different approach to the absence of
previous relevant infringements. That approach has been reflected in the decisions that have
been cited by Facebook in support of its submission. I note, in this regard, that Facebook’s
submissions do not reference the Commission’s decision in the Twitter (breach notification)
inquiry, nor the Commission’s decision in the WhatsApp (own volition) transparency inquiry, nor
the Facebook (12 breaches) inquiry. The Commission’s approach to the Article 83(2) assessment,
as recorded in these decisions (amongst others), is consistent with that applied to the within
inquiry. Accordingly, I remain of the view that this factor ought to be treated as neither mitigating
nor aggravating.

ARTICLE 83(2)(F): THE DEGREE OF COOPERATION WITH THE SUPERVISORY AUTHORITY, IN ORDER TO REMEDY THE
INFRINGEMENT AND MITIGATE THE POSSIBLE ADVERSE EFFECTS OF THE INFRINGEMENT

9.87 The Fining Guidelines state that:

“… it would not be appropriate to give additional regard to cooperation that is already
required by law for example, the entity is in any case required to allow the supervisory
authority access to premises for audits/inspection.”

9.88 In the context of the Transparency Infringements, Facebook argues that cooperation in this
matter should be treated as a mitigating factor and again cites a decision of the Commission. 247 I
once again refer to my analysis on that issue above. Furthermore, I cannot accept that such
activity, in the ordinary course of adhering to legal duties to cooperate and engage with a
regulator, could be found to be a mitigating factor in a sanction. If this were the case, all
controllers would get the benefit of such a mitigating factor aside from those that did not actively
behave in an uncooperative manner. This position reflects the erroneous treatment of the Article
83(2) GDPR factors as binary choices between mitigation and aggravation to which I have already
referred.

9.89 For these reasons, while Facebook has cooperated fully with the Commission at all stages of the
Inquiry, it is required to do so by law. Furthermore, I note that the cooperation that would be
relevant to the assessment of this criterion is cooperation “in order to remedy the infringement
and mitigate the possible adverse effects of the infringement”. In the circumstances, and in light
of my views set out above, nothing arises for assessment by reference to this criterion.

9.90 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the Article
65 Decision has not addressed this particular aspect of matters. In the circumstances, the

247
Ibid, paragraph 14.19.
122

Commission proposes to consider this factor to be neither mitigating nor aggravating for the same
reasons set out in the Article 83(2)(c) assessment, above.

Facebook’s Final Submissions in response to the assessment of the Article 6(1) infringement for the
purpose of Article 83(2), as introduced to this Decision following the adoption of the Article 65 Decision

9.91 By way of the Final Submissions, Facebook has submitted 248 that I should treat this factor as
mitigating in light of the fact that it has taken “various voluntary steps to improve transparency
for its users (which the EDPB considers underpins the alleged Article 6(1) infringement) throughout
the course of the Inquiry … and will undertake all efforts to comply with any order issued by the
[Commission], as required.” Facebook further submits that it has cooperated fully with the
Commission throughout the Inquiry.

9.92 I have already addressed the reasons why I cannot take account, as a mitigating factor, of any
voluntary steps taken by Facebook following the date of circulation of the Draft Decision to the
CSAs (the steps taken before that date having been deemed, by the EDPB, to be insufficient to be
treated as a mitigating factor). While the Commission recognises that Facebook has cooperated
fully throughout the Inquiry, the Commission notes that Facebook is obliged to do so by virtue of
Article 31 GDPR. Furthermore, and while the Commission acknowledges Facebook’s commitment
to undertake “all efforts to comply with any order” that might be issued further to this Decision,
I again note that Facebook is subject to an obligation to comply with the terms of the relevant
order. In the circumstances, I am unable to take account of such matters as mitigating factors.

9.93 Accordingly, I remain of the view that this factor ought to be treated as neither mitigating nor
aggravating.

ARTICLE 83(2)(G): THE CATEGORIES OF PERSONAL DATA AFFECTED BY THE INFRINGEMENT

9.94 In the context of the Transparency Infringements, I noted that the lack of transparency concerned
broad categories of personal data relating to users who sign up to the service. I have set out
several times in this Decision that the assessment of data processing in this Inquiry was, by its
nature, rather generalised. Indeed, the lack of transparency on Facebook’s part has itself
contributed to a lack of clarity on precisely what categories of personal data are involved. I
therefore agree with Facebook’s submission that this is not an aggravating factor, 249 and I also do
not regard it as a mitigating one.

9.95 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the Article
65 Decision has not addressed this particular aspect of matters. The Commission notes, however,

248
The Final Submissions, paragraphs 9.51 to 9.53
249
Ibid, paragraph 14.20.
123

the “relevant facts” identified by the EDPB in paragraphs 95 and 96 of the Article 65 Decision,
including in relation to the personal data concerned, as follows:

“… Meta IE collects data on its individual users and their activities on and off its Facebook social
network service via numerous means such as the service itself, other services of the Meta group
including Instagram, WhatsApp and Oculus, third party websites and apps via integrated
programming interfaces such as Facebook Business Tools or via cookies, social plug-ins, pixels
and comparable technologies placed on the internet user’s computer or mobile device.
According to the description provided, Meta IE links these data with the user’s Facebook
account to enable advertisers to tailor their advertising to Facebook’s individual users based on
their consumer behaviour, interests, purchasing power and present situation. This may also
include the user’s physical location to display content relevant to the user’s location.”

9.96 While, as noted already in the Commission’s Draft Decision, it was neither necessary, for the
purpose of the examination of the Complaint, nor possible, from an examination of the relevant
privacy material, to identify the particular categories of personal data undergoing processing, it
seems clear that the EDPB considered the processing to concern a broad range of categories of
personal data. Given the nature of behavioural advertising, it appears to be beyond dispute that
the processing of a broad range of personal data is required to be carried out to achieve the
objectives of behavioural advertising. In the circumstances, I proposed to consider to consider
this to be an aggravating factor of moderately significant weight.

Facebook’s Final Submissions in response to the assessment of the Article 6(1) infringement for the
purpose of Article 83(2), as introduced to this Decision following the adoption of the Article 65 Decision

9.97 By way of the Final Submissions, Facebook submits 250 that this factor should be treated neutrally
in circumstances where the views of the EDPB that form the basis for the Commission’s
assessment under this heading rely, in turn, on “descriptions of processing that are inaccurate and
outside the scope of the Inquiry …”.

9.98 As already outlined above, the Article 65 Decision is binding upon the Commission. Accordingly,
it is not open to the Commission to revisit or otherwise look behind the views expressed, and
determinations made, by the EDPB. In the circumstances, I remain of the view that this factor
ought to be treated as an aggravating factor of moderately significant weight.

ARTICLE 83(2)(H): THE MANNER IN WHICH THE INFRINGEMENT BECAME KNOWN TO THE SUPERVISORY AUTHORITY, IN
PARTICULAR WHETHER, AND IF SO TO WHAT EXTENT, THE CONTROLLER OR PROCESSOR NOTIFIED THE INFRINGEMENT

250
The Final Submissions, paragraphs 9.54 to 9.57
124

9.99 In the context of the Transparency Infringements, I noted that the subject matter became known
to the Commission due to an Inquiry conducted on foot of the Complaint. The subject matter did
not give rise to any requirement of notification, and I have already acknowledged several times
that the controller’s genuinely held belief is that no infringement is/was occurring.

9.100 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, paragraph
465 of the EDPB Decision records the EDPB’s view that: “the Draft Decision does not need to
include this element as an aggravating or mitigating factor.” Accordingly, I proposed to consider
this factor this factor to be neither mitigating nor aggravating. Facebook, by way of the Final
Submissions, confirmed 251 its agreement with the above approach. In the circumstances, I
conclude that this factor is neither mitigating nor aggravating.

ARTICLE 83(2)(I): WHERE MEASURES REFERRED TO IN ARTICLE 58(2) HAVE PREVIOUSLY BEEN ORDERED AGAINST THE
CONTROLLER OR PROCESSOR CONCERNED WITH REGARD TO THE SAME SUBJECT-MATTER, COMPLIANCE WITH THOSE
MEASURES

9.101 In the context of the Transparency Infringements, I concluded that this criterion is not applicable.

9.102 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the Article
65 Decision has not addressed this particular aspect of matters. The Commission notes that
measures have not previously been ordered against Facebook with regard to the same subject
matter. In the circumstances, the Commission proposes to consider this factor as neither
mitigating nor aggravating. Facebook, by way of the Final Submissions, confirmed 252 its
agreement with the above approach. In the circumstances, I conclude that this factor is neither
mitigating nor aggravating.

ARTICLE 83(2)(J): ADHERENCE TO APPROVED CODES OF CONDUCT PURSUANT TO ARTICLE 40 OR APPROVED CERTIFICATION
MECHANISMS PURSUANT TO ARTICLE 42

9.103 In the context of the Transparency Infringements, I concluded that this criterion is not applicable.

9.104 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB, the Article
65 Decision has not addressed this particular aspect of matters. The Commission proposes to
consider this factor as neither mitigating nor aggravating in circumstances where nothing arises
for assessment under this heading. Facebook, by way of the Final Submissions, confirmed 253 its
agreement with the above approach. In the circumstances, I conclude that this factor is neither
mitigating nor aggravating.

251 The Final Submissions, paragraph 9.58
252 The Final Submissions, paragraph 9.59
253 The Final Submissions, paragraph 9.60

125

ARTICLE 83(2)(K): ANY OTHER AGGRAVATING OR MITIGATING FACTOR APPLICABLE TO THE CIRCUMSTANCES OF THE CASE,
SUCH AS FINANCIAL BENEFITS GAINED, OR LOSSES AVOIDED, DIRECTLY OR INDIRECTLY, FROM THE INFRINGEMENT

9.105 In the Preliminary Draft Decision I considered the following factors in the context of the
Transparency Infringements:

• Facebook does not charge for its service.

• The subject matter of the infringements relate directly to the provision of information in
relation to what is, by Facebook’s own admission, its core business model i.e. personalised
advertising provided pursuant to a contract with users.

• The question is therefore whether a more transparent approach to processing operations
carried out on foot of that contract would represent a risk to Facebook’s business model. In
my l view it would, if existing or prospective users were dissuaded from using the service by
clearer explanations of the processing operations carried out, and their purposes.

• In my view the above risk is sufficiently high to justify the conclusion that this lack of
transparency has the potential to have resulted in financial benefits for Facebook.

9.106 Facebook however argues that this does not at all propose a financial risk, and argues that no
evidence of same has been presented.254 Neither I nor Facebook can know, until the contingent
event has happened, which one of us is correct in our belief as to the likely impact, on the
continued growth of the user base. Given that any general consideration of this is ultimately
involves an element of speculation on both Facebook’s and the Commission’s part, I considered,
in the Draft Decision, that this factor is neither aggravating nor mitigating.

9.107 Following the circulation of the Draft Decision to the supervisory authorities concerned for the
purpose of enabling them to share their views in accordance with Article 60(3) GDPR, an objection
was raised on behalf of supervisory authorities of Germany, concerning this aspect of matters.

9.108 Having considered the merits of the objection, the EDPB, by way of paragraph 377 of the Article
65 Decision, instructed the Commission to:

“ascertain if further estimation of the financial benefit from the infringement of transparency
obligations is possible in this case. Insofar as this results in the need to increase the amount of
the fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.”

254
Ibid, paragraph 14.21.
126

9.109 As recognised by the EDPB, at paragraph 370 of the Article 65 Decision, the Commission is
required to “assess all the fact of the case in a manner that is consistent and objectively justified.”
Despite specific requests made by the Commission during the course of the Article 65
deliberations, no directions have been provided by the EDPB, in its Article 65 Decision, as to the
manner in which the Commission might seek to ascertain, on an objectively justifiable basis, an
estimation of the financial benefit gained from an infringement such as the one under assessment.
In the absence of directions, the Commission is unable to ascertain an estimation of the matters
identified above.

9.110 The Commission separately notes, under this heading, the EDPB’s view, as set out in the EDPB’s
Binding Decision 1/2021 255 (paragraphs 409 to 412, inclusive), that the turnover of the
undertaking concerned ought to be taken into account not just for the calculation of the
applicable fining “cap” but also for the purpose of assessing the quantum of the administrative
fine itself. This position is further reflected in the Fining Guidelines 04/2022 (see, for example,
paragraph 49). The EDPB, by way of paragraph 393 of the Article 65 Decision, reiterated this
position and instructed the Commission to “elaborate on the manner in which the turnover of the
undertaking concerned is considered for the calculation of the fine.”

9.111 The Commission’s assessment of the undertaking concerned and the applicable turnover figure is
detailed further, below. While this is not a matter that can properly be classified as either
mitigating or aggravating, by reference to the circumstances of the case, the Commission has
taken the significant turnover of the undertaking concerned into account when determining the
quantum of the proposed fine, as set out below.

9.112 In relation to the finding of infringement of Article 6(1) GDPR that was established by the EDPB,
paragraphs 467 to 469 of the Article 65 Decision records the EDPB’s views that, for the purpose
of the Article 83(2)(k) assessment:

“The EDPB recalls that financial benefits from the infringement could be an aggravating
circumstance if the case provides information about profit obtained as a result of the
infringement of the GDPR.

In the present case, the EDPB considers that it does not have sufficiently precise information to
evaluate the specific weight of the financial benefit obtained from the infringement.

Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no effect
if they are disproportionally low compared to the benefits obtained with the infringement. The
EDPB considers that the IE SA should ascertain if an estimation of the financial benefit from the

255 Binding decision 1/2021 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding

WhatsApp Ireland under Article 65(1)(a) GDPR, adopted 28 July 2021

127

infringement is possible in this case. Insofar as this results in the need to increase the amount
of the fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.”

9.113 In a similar vein, the EDPB, at paragraph 472 of the Article 65 Decision, expressed the view that:

“On principle, the EDPB agrees that a competitive advantage could be an aggravating factor if
the case provides objective information that this was obtained as a result of the infringement
of the GDPR908. In the present case, the EDPB considers that it does not have sufficiently
precise information to evaluate the existence of a competitive advantage resulting from the
infringement. The EDPB considers that the IE SA should ascertain if an estimation of the
competitive advantage derived from the infringement is possible in this case. Insofar as this
results in the need to increase the amount of the fine proposed, the EDPB requests the IE SA to
increase the amount of the fine proposed.”

9.114 Despite specific requests made by the Commission, during the course of the Article 65
deliberations, no directions have been provided by the EDPB, in its Article 65 Decision, as to the
manner in which the Commission might seek to ascertain an estimation of: (i) the financial benefit
gained from an infringement such as the one under assessment; or (ii) the competitive advantage
derived from the infringement. I note, in this regard, the views previously expressed by the
EDPB 256 that:

“… when deciding on the imposition of corrective measures in general, and fines in particular,
“supervisory authorities must assess all the facts of the case in a manner that is consistent and
objectively justified.”

9.115 In the absence of directions, the Commission is unable to ascertain an estimation of the matters
identified above. Accordingly, I am unable to take these matters into account for the purpose of
this assessment.

9.116 As before, the Commission separately notes, under this heading, the EDPB’s view, as set out in
the EDPB’s binding decision 1/2021 257, that the turnover of the undertaking concerned ought to
be taken into account not just for the calculation of the applicable fining “cap” but also for the
purpose of assessing the quantum of the administrative fine itself. This position is further
reflected in the Fining Guidelines 04/2022 (see, for example, paragraph 49 thereof). The
Commission’s assessment of the undertaking concerned and the applicable turnover figure is
detailed further below in this Decision. While this is not a matter that can properly be classified

256
Binding decision 1/2021 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding
WhatsApp Ireland under Article 65(1)(a) GDPR, adopted 28 July 2021, paragraph 403.
257
Ibid, paragraphs 409 to 412, inclusive
128

as either mitigating or aggravating, by reference to the circumstances of the case, the Commission
has taken the significant turnover of the undertaking concerned into account when determining
the quantum of the proposed fine, as set out below.

Facebook’s Final Submissions in response to the assessment of the Article 6(1) infringement for the
purpose of Article 83(2), as introduced to this Decision following the adoption of the Article 65 Decision

9.117 Facebook, by way of the Final Submissions, expressed 258 its disagreement with the Commission’s
proposal to have regard to the turnover of the undertaking concerned in calculating the amount
of the fine. As already noted above, this requirement was previously determined by the EDPB in
its Binding Decision 1/2021 and reiterated in the Article 65 Decision. In the circumstances, it is
not open to the Commission to disregard this requirement. Neither is it open to the Commission
to treat “Meta Ireland alone” as being the relevant “undertaking” for these purposes 259.

WHETHER TO IMPOSE AN ADMINISTRATIVE FINE

The Transparency Infringements

9.118 I proposed to impose an administrative fine in relation to the Transparency Infringements in
circumstances where:

• The infringements are serious in nature. The lack of transparency goes to the heart of data
subject rights and risks undermining their effectiveness by not providing transparent
information in that regard. While the infringements considered here relate to one lawful
basis, it nonetheless concerns vast swathes of personal data impacting millions of data
subjects. When such factors are considered, it is clear that the infringements are serious in
their gravity. I have taken this into account when determining, for the purpose of Article
83(2)(a) GDPR, that the infringements are at the upper end of the scale, in terms of
seriousness.

• Over of the population of the EEA seems to be impacted by the infringements. This is a
very large figure. I consider this to be an aggravating factor of significant weight.

• I note in particular the impact a lack of transparency has on a data subject’s ability to be fully
informed about their data protection rights, or indeed about whether in their view they
should exercise those rights. I have taken this into account when determining, for the purpose
of Article 83(2)(a) GDPR, that the infringements are at the upper end of the scale, in terms of
seriousness.

258
The Final Submissions, paragraphs 9.62 to 9.68
259
See the Article 65 Decision, paragraph 496
129

• I have already found that the infringement was negligent. While I am not calling into question
Facebook’s right to come to a genuine view on this matter, I am taking into account the failure
of an organisation of this size to provide sufficiently transparent materials in relation to the
core of its business model. For the avoidance of doubt, and noting the views expressed by
the EDPB in its Fining Guidelines 04/2022, that “(a)t best, negligence could be regarded as
neutral”, I have taken this into account as a neutral factor.

• I note that Facebook’s Data Policy and Terms of Service have been amended, and because
this is an Inquiry into a particular complaint the documents being considered are no longer
contemporary. Therefore, I am not attaching significant weight to the question of the duration
of the infringement, in circumstances where more recent versions of the relevant documents
are outside the scope of the Inquiry. In the circumstances, and for the avoidance of doubt, I
have taken this into account as a neutral factor.

9.119 Facebook argues that the infringements set out above are “co-extensive” and amount to the same
infringement.260 It is incorrect to state that these amount to different labels for the same
infringement. One amounts to a failure to provide information that is required by the law. The
other amounts to a failure to provide the information required by the law (only some of which
has been provided) in the manner the law requires. The information that is and is not provided
both relate to data processing on foot of one provision of the GDPR. That does not in and of itself
render them the same infringement. A failure to provide certain information and a failure to set
out other information in a particular manner are self-evidently different infringements in their
character.

9.120 Based on the analysis set out above, the nature, gravity and duration of the infringements and
the potential number of data subjects affected, I proposed, by way of the Draft Decision, to
impose the following administrative fines in respect of the Transparency Infringements:

• In respect of the failure to provide sufficient information in relation to the processing
operations carried out on foot of Article 6(1)(b) GDPR, thereby infringing Articles 5(1)(a) and
13(1)(c) GDPR, I propose a fine of between €18 million and €22 million.

• In respect of the failure to provide the information that was provided on the processing
operations carried out in foot of Article 6(1)(b) GDPR, in a concise, transparent, intelligible
and easily accessible form, using clear and plain language, thereby infringing Articles 5(1)(a)
and 12(1) GDPR, I propose a fine of between €10 million and €14 million.

260
Ibid, paragraph 15.1.
130

9.121 In determining the quantum of the fines proposed above, I took account of the requirement, set
out in Article 83(1) GDPR, for fines imposed to be “effective, proportionate and dissuasive” in each
individual case. My view was that, in order for any fine to be “effective”, it must reflect the
circumstances of the individual case. As already discussed above, the Infringements are serious,
both in terms of the extremely large number of data subjects potentially affected, the categories
of personal data involved, and the consequences that flow from the failure to comply with the
transparency requirements for users.

9.122 In order for a fine to be “dissuasive”, it must dissuade both the controller/processor concerned
as well as other controllers/processors carrying out similar processing operations from repeating
the conduct concerned.

9.123 As regards the requirement for any fine to be “proportionate”, this requires the adjustment of
the quantum of any proposed fine to the minimum amount necessary to achieve the objectives
pursued by the GDPR. My view was that the fines proposed above did not exceed what was
necessary to enforce compliance with the GDPR, taking into account the size of Facebook’s user
base, the impact of the infringements on the effectiveness of the data subject rights enshrined in
Chapter III of the GDPR and the importance of those rights in the context of the GDPR as a whole.

9.124 Accordingly, my view was that the fines proposed above would, if imposed on Facebook, be
effective, proportionate and dissuasive, taking into account all of the circumstances of the Inquiry.

9.125 Further to the circulation of the Draft Decision to the concerned supervisory authorities for the
purpose of enabling them to express their views in accordance with Article 60(3) GDPR, objections
were raised in relation to this aspect of matters by the supervisory authorities of Germany, France,
the Netherlands, Norway and Poland. Having considered the merits of those objections, the EDPB
determined as follows:

391. The EDPB agrees with the objections raised that - if the proposed fine was to be imposed
for the transparency infringements - there would be no sufficient special preventive effect
towards the controller, nor a credible general preventive effect. The proposed fine amount,
even where a final amount at the upper limit of the range would be chosen, is not effective,
proportionate and dissuasive, in the sense that this amount can simply be absorbed by the
undertaking as an acceptable cost of doing business. As behavioural advertising is at the core
of Meta IE’s business model, the risk of this occurring is all the greater. By bearing the cost the
administrative fine, the undertaking can avoid bearing the cost of adjusting their business
model to one that is compliant as well as any future losses that would follow from the
adjustment.

392. Though the IE SA touches upon the notions of effectiveness, proportionality and
dissuasiveness in relation to the proposed fine, there is no justification based on elements
specific to the case to explain the modest fine range chosen. Moreover, the EDPB notes that
while the IE SA takes into consideration the turnover of the undertaking to ensure that the fine
131

it proposed does not exceed the maximum amount of the fine provided for in Article 83(5)
GDPR, the Draft Decision does not articulate how and to what extent the turnover of this
undertaking is considered to ascertain that the administrative fine meets the requirement of
effectiveness, proportionality and dissuasiveness. In this regard the EDPB recalls that the
turnover of the undertaking concerned is not exclusively relevant for the determination of the
maximum fine amount in accordance with Article 83(4)-(6) GDPR, but should also be
considered for the calculation of the fine itself, where appropriate, to ensure the fine is
effective, proportionate and dissuasive in accordance with Article 83(1) GDPR. The EDPB
therefore instructs the IE SA to elaborate on the manner in which the turnover of the
undertaking concerned is considered for the calculation of the fine.

393. While a single mitigating factor identified by the IE SA is mentioned, there is no indication
the weight that has been attributed to this factor in the context of the Article 83(2) assessment.
As indicated above (see paragraph 366), the EDPB finds the Draft Decision does not sufficiently
justify this mitigating factor, hence it should not be considered an aggravating or mitigating
factor.

394. In light of the above, the EDPB considers that the proposed fine does not adequately
reflect the seriousness and severity of the infringements nor has a dissuasive effect on Meta
IE. Therefore, the fine does not fulfil the requirement of being effective, proportionate and
dissuasive in accordance with Article 83(1) and (2) GDPR. In light of this, the EDPB directs the
IE SA to set out a significantly higher fine amount for the transparency infringements identified,
in comparison with the upper limit for the administrative fine envisaged in the Draft Decision.
In doing so, the IE SA must remain in line with the criteria of effectiveness, proportionality, and
dissuasiveness enshrined in Article 83(1) GDPR in its overall reassessment of the amount of the
administrative fine.

9.126 I note that, with the exception of the proposed treatment, in the Draft Decision, of the matters
originally assessed pursuant to Article 83(2)(c) (which has now been amended in line with the
instruction set out in the Article 65 Decision), the EDPB agreed with the manner in which the
Commission assessed the circumstances of the Transparency Infringements for the purposes of
the Article 83(2) criteria. That being the case, it seems clear that the EDPB’s instruction, above,
concerns my view that the originally proposed fines were effective, proportionate and dissuasive
for the purpose of Article 83(1) GDPR. In other words, the focus of the EDPB’s instruction is the
quantum of the fines that were originally proposed by the Article 60 Draft Decision. I note, in this
regard, the EDPB’s instruction that I set out a “significantly” higher fine, in comparison with the
upper limit for the originally proposed administrative fines. By way of guidance, the Article 65
Decision records as follows:

389. The FR SA compares the proposed fine with the fine of 225 million euros decided upon by
the IE SA in its decision dated 20 August 2021 against WhatsApp Ireland Limited for
transparency infringements (breaches of Articles 12 and 13 GDPR). The FR SA also compares
with the fine of 746 million euros decided by the LU SA in its decision of 15 July 2021 against
the company Amazon Europe Core for carrying out behavioural advertising without a valid
132

legal basis and for transparency infringements (Articles 6, 12 and 13 GDPR). While the EDPB
agrees with both the IE SA and Meta IE that imposing fines requires a case-by-case assessment
under Article 83 GDPR, the EDPB notes that the cases cited by the FR SA do show marked
similarities with the current case, as they both refer to large internet platforms run by data
controllers with multi-national operations and significant resources available to them,
including large, in-house, compliance teams. Moreover, there are similarities with regard to
the infringements involved. Thus, these cases can give an indication on the matter.

9.127 On the basis of the instruction and guidance set out above, I propose to impose administrative
fines as follows:

• In respect of the failure to provide sufficient information in relation to the processing
operations carried out on foot of Article 6(1)(b) GDPR, thereby infringing Articles 5(1)(a) and
13(1)(c) GDPR, I propose a fine of between €75 million and €85 million.

• In respect of the failure to provide the information that was provided on the processing
operations carried out in foot of Article 6(1)(b) GDPR, in a concise, transparent, intelligible
and easily accessible form, using clear and plain language, thereby infringing Articles 5(1)(a)
and 12(1) GDPR, I propose a fine of between €65 million and €75 million.

9.128 I expressed the (provisional) view that administrative fines within these ranges would satisfy the
requirement, in Article 83(1) GDPR for any administrative fine imposed to be effective,
proportionate and dissuasive in each individual case. In this regard, I have taken account of:

a. The purpose of the fine, which is to sanction the infringements of Articles 12(1), 13(1)(c),
5(1)(a) (and taking into account the infringement of the Article 5(1)(a) fairness principle) that
was found to have occurred (by the EDPB in the Article 65 Decision);

b. The requirement for any fine to be effective. In this regard, I note that the fines proposed
above reflect the circumstances of the case, including both the specific elements of the
infringement as well as those elements that relate to the controller which committed the
infringement, namely its financial position (as required by paragraph 414 of the EDPB’s
Binding Decision 1/2021);

c. The requirement for a genuinely deterrent effect, in terms of discouraging both Facebook and
others from committing the same infringement in the future;

d. The requirement for any fine to be proportionate and to not exceed what is necessary to
achieve the stated objective (as recorded at a., above). The Commission considers that the
fines proposed are proportionate to the circumstances of the case, taking into account the
gravity of the infringements and all of the elements that may lead to an increase (aggravating

133

factors) or decrease (mitigating factors) of the initial assessment as well as the significant
turnover of the undertaking concerned. It also takes account of the views, assessments and
instructions of the EDPB, as set out in the Article 65 Decision (and incorporated into this
Decision, above). It also takes account of the fact that the fine will be imposed in addition to
an order requiring Facebook to take action to bring its processing into compliance.

Facebook’s Final Submissions in response to the re-assessment of the administrative fines originally
proposed by the Draft Decision, in relation to the Transparency Infringements

9.129 Facebook, by way of the Final Submissions 261, has challenged the proposed reassessment of the
fines corresponding to the Transparency Infringements.

9.130 Insofar as the relevant submissions express disagreement with matters that have been
determined by the EDPB or, otherwise, upon which the EDPB has expressed a view, in the Article
65 Decision, that decision is binding upon the Commission. Accordingly, it is not open to the
Commission to disregard or otherwise look behind any views expressed or instructions given by
the EDPB in the Article 65 Decision.

9.131 Furthermore, insofar as the relevant submissions restate matters that have already been
considered by the Commission (such as Facebook’s view that the Transparency Infringements are
“technical in nature”), I do not propose to engage further with such matters.

9.132 As regards Facebook’s submission 262 that its willingness to engage in steps to bring its processing
into compliance on a voluntary basis pending the conclusion of this Inquiry on the basis that it has
“now clearly “gone beyond willingness” to give effect to such substantial changes”, I am unable
to take account of any such action given that it occurred after the circulation of the Draft Decision
to the CSAs for their views, pursuant to Article 60(3) GDPR and, otherwise, in the absence of an
assessment of the adequacy of the steps taken.

9.133 Facebook has further submitted that the proposed increase is incompatible with Article 83(1)
GDPR. It also notes the inconsistency between the increased fining ranges being proposed and
the Commission’s previously expressed view that the lower fining ranges proposed by the Draft
Decision were effective, proportionate and dissuasive. It is important to bear in mind, in this
regard, that the Commission’s view, that the previously proposed fining ranges were effective,
proportionate and dissuasive, has been overtaken by the Article 65 Decision. The EDPB, in that
decision, expressed a range of views and it is not open to the Commission to look behind those
views, as appears to be suggested by Facebook.

261
The Final Submissions, paragraphs 13.1 to 14.26
262
The Final Submissions, paragraph 13.5

134

9.134 As regards Facebook’s submissions 263 directed to challenging how the increased fining ranges
might be said to be “effective, proportionate and dissuasive”, I note that these submissions share
a range of common arguments, including:

• Submissions that it is not appropriate for the Commission to take account of Facebook’s
“financial position” and questioning the difference between “financial position” and
“turnover” in circumstances where the Commission previously indicated that it had taken
Facebook’s turnover into account when assessing the quantum of the originally proposed
fining ranges;

• Submissions concerning the level of the increase proposed by the Commission. Facebook
has submitted, in this regard, that the Commission “has proposed an increase well in
excess of the purported instruction of the EDPB “to set out a significantly higher fine
amount” in respect of these alleged infringements”. Facebook has further suggested that:
“(i)t appears (although this is not clear) that the [Commission] was influenced in this
regard by the EDPB’s comments regarding fines imposed by other supervisory authorities
in respect of transparency infringements, namely the WhatsApp and Amazon Decisions.
Without engaging in any factual assessment of these decisions, the EDPB asserts that
these cases “show marked similarities with the current case, as they both refer to large
internet platforms run by data controllers with multi-national operations and significant
resources available to them, including large, in-house, compliance teams. Moreover,
there are similarities with regard to the infringements involved”.

9.135 As already noted above, the Commission is required, by the Article 65 Decision and Binding
Decision 1/2021, to take account of the turnover of the undertaking concerned when quantifying
the amount of the proposed administrative fine. The Commission did so as part of its original
assessment, however the EDPB, by way of the Article 65 Decision, instructed the Commission to
re-assess quantum on the basis that the proposed amounts were insufficient to satisfy the
requirements of Article 83(1) GDPR. The Article 65 Decision provides at paragraph 391, for
example, that:

“The EDPB agrees with the objections raised that - if the proposed fine was to be imposed for
the transparency infringements - there would be no sufficient special preventive effect
towards the controller, nor a credible general preventive effect. The proposed fine amount,
even where a final amount at the upper limit of the range would be chosen, is not effective,
proportionate and dissuasive, in the sense that this amount can simply be absorbed by the
undertaking as an acceptable cost of doing business. As behavioural advertising is at the core
of Meta IE’s business model, the risk of this occurring is all the greater. By bearing the cost the
administrative fine, the undertaking can avoid bearing the cost of adjusting their business
model to one that is compliant as well as any future losses that would follow from the
adjustment.” [emphasis added]

263
The Final Submissions, paragraphs 14.5 to 14.26
135

9.136 In the circumstances, it was incumbent on the Commission to re-assess the manner in which
account was previously taken of the turnover of the undertaking concerned. The Commission
notes, in this regard, the very significant turnover of the Meta Platforms, Inc. group of companies
and considers that the increased fining ranges take appropriate account of that significant level
of turnover, as required by the Article 65 Decision. For the avoidance of doubt, however, the
Commission has, first and foremost, addressed its mind to the Article 83 framework when
assessing the questions of whether an administrative fine ought to be imposed and, if so, the
amount of any such fine. That ought to be clear from the detailed analysis of the individual
circumstances of this Inquiry set out in this Section 9. Otherwise, the Commission has re-assessed
the quantum of its originally proposed fines by reference to the instructions and directions
provided by the EDPB in the Article 65 Decision. Any suggestions of comparison with the Amazon
or WhatsApp decisions are without foundation.

9.137 Having taken account of the Final Submissions, I remain of the views set out in paragraphs 9.127
and 9.128, above.

Proposed quantum of fining range - the Article 6(1) GDPR infringement

9.138 In relation to the infringement of Article 6(1) GDPR that was established by the EDPB in the Article
65 Decision, my conclusions, further to the Article 83(2) assessment recorded above, are that:

• The infringement of Article 6(1) GDPR (and taking into account the infringement of the
Article 5(1)(a) fairness principle) has been assessed as falling at the upper end of the scale,
in terms of seriousness, for the purpose of Article 83(2)(a).

• The seriously negligent character of the Article 6(1) GDPR infringement ought, in the
particular circumstances of this inquiry, to be taken into account as an aggravating factor
of significant weight.

• The degree of responsibility of the controller is to be treated as an aggravating factor, of
moderately significant weight.

• The broad range of categories of personal data affected by the infringement ought to be
taken into account as an aggravating factor of moderately significant weight.

• Otherwise, the assessments of the Article 83(2)(c), 83(2)(e), 83(2)(f), 83(2)(h), 83(2)(i),
83(2)(j) and 83(2)(k) criteria are to be treated as neither mitigating nor aggravating for
the purpose of the Article 6(1) GDPR infringement.

136

9.139 On the basis of the above, I proposed to impose an (additional) administrative fine of an amount
falling within the range of €55 million and €65 million, in respect of the infringement of Article
6(1) GDPR (and taking into account the infringement of the Article 5(1)(a) fairness principle).

9.140 I expressed the (provisional) view that an administrative fine within this range would satisfy the
requirement in Article 83(1) GDPR for any administrative fine imposed to be effective,
proportionate and dissuasive in each individual case. In this regard, I have taken account of:

a. The purpose of the fine, which is to sanction the infringement of Article 6(1) (and taking
into account the infringement of the Article 5(1)(a) fairness principle) that was found to
have occurred (by the EDPB in the Article 65 Decision);

b. The requirement for any fine to be effective. In this regard, the Commission notes that
the fine proposed above reflects the circumstances of the case, including both the specific
elements of the infringement as well as those elements that relate to the controller which
committed the infringement, namely its financial position (as required by paragraph 414
of the EDPB’s Binding Decision 1/2021);

c. The requirement for a genuinely deterrent effect, in terms of discouraging both Facebook
and others from committing the same infringement in the future;

d. The requirement for any fine to be proportionate and to not exceed what is necessary to
achieve the stated objective (as recorded at a., above). The Commission considers that
the fine proposed is proportionate to the circumstances of the case, taking into account
the gravity of the infringements and all of the elements that may lead to an increase
(aggravating factors) or decrease (mitigating factors) of the initial assessment as well as
the significant turnover of the undertaking concerned. It also takes account of the fact
that the fine will be imposed in addition to an order requiring Facebook to take action to
bring its processing into compliance;

e. I have also taken particular account, in this regard, of the facts that:

i. The EDPB’s finding of infringement of Article 6(1) GDPR was partially based on
the lack of transparency (see, for example, paragraphs 123, 125 and 126 of the
Article 65 Decision) as regards the information that was presented to the data
subject concerning the processing that would be carried out further to the
Facebook Terms of Service.

ii. The EDPB’s finding of infringement of Article 5(1)(a) fairness principle was
similarly largely based on the lack of transparency (see, for example, paragraphs
226, 229 and 230 of the Article 65 Decision), as regards the information that was

137

presented to the data subject concerning the processing that would be carried
out further to the Terms of Service.

iii. As already noted, this Decision contains separate findings of infringement of the
transparency obligations set out in Articles 5(1)(a), 12(1) and 13(1)(c) and
proposes to exercise corresponding corrective powers in the form of
administrative fines and an order to bring processing into compliance. I have
taken these separate punitive and remedial, respectively, measures into account
when proposing the fining range set out above so as to avoid the risk of punishing
Facebook twice in respect of the same conduct. This factor necessitated a
moderately significant reduction in the fine that might otherwise have been
imposed, notwithstanding the significant turnover of the undertaking concerned
and the outcome of the Article 83(2)(a) assessment, as recorded above.

Facebook’s Final Submissions in response to the assessment of the Article 6(1) infringement for the
purpose of Article 83(2), as introduced to this Decision following the adoption of the Article 65 Decision

9.141 Facebook, by way of its Final Submissions, disagreed with the above assessments of the Article
6(1) GDPR infringement. For ease of response, I have summarised the relevant submissions
thematically, as follows:

Discretion of the Commission

9.142 Under this heading, Facebook submitted, firstly 264, that by proposing “exponential increases to
the administrative fines in respect of [the Transparency Infringements] … the [Commission] has
taken account of the Article 65 Decision and no additional administrative fine is required or
warranted in respect of the infringement of Article 6(1) GDPR”. Facebook notes, in this regard,
that the Article 65 Decision requires the Commission to impose an administrative fine to “cover”
the EDPB’s finding of infringement of Article 6(1) GDPR.

9.143 It submitted, secondly 265, that the imposition of a fine for the Article 6(1) infringement while also
substantially increasing the fines for the Transparency Infringements is disproportionate and
unnecessary in circumstances where the infringements are based on the same underlying
processing and alleged harm to data subjects.

9.144 Thirdly, it submitted 266 that, just as the Commission has decided not to impose an additional fine
in respect of Article 5(1)(a) (fairness principle) GDPR due to the overlapping nature of the

264
The Final Submissions, paragraph 8.1
265
The Final Submissions, paragraph 8.1
266
The Final Submissions, paragraph 8.2

138

infringements, it should similarly decide not to impose an additional fine in relation to the Article
6(1) infringement because this would risk punishing Facebook twice for the same wrongdoing.
Furthermore, it submitted 267 that it was “particularly inappropriate for the [Commission] to
impose three separate and substantial fines in respect of these infringements, having regard to
the principle of concurrence of laws. It cannot plausibly be maintained that these infringements
are sufficiently distinct to warrant three separate fines in circumstances where the [Commission]
itself considers the conduct constituting the alleged Article 6(1) infringement to be so similar to
the other infringements that it can incorporate significant elements of the fines assessment by
reference.”

9.145 The above submissions are premised upon the misunderstanding that the Commission has
discretion, as regards, the imposition of a fine for the Article 6(1) infringement. The Commission,
being subject to a binding decision of the EDPB, has no such discretion. This is clear from the
Article 65 Decision itself, in particular paragraphs 441 and 442 thereof, which state that:

“the EDPB agrees with the reasoning put forward by the [supervisory authorities of Austria,
Germany, France, Norway and Sweden] in their objections. The EDPB reiterates that lawfulness
of processing is one of the fundamental pillars of the data protection law and considers that
processing of personal data without an appropriate legal basis is a clear and serious violation
of the data subjects’ fundamental right to data protection.

Several of the factors listed in Article 83(2) GDPR speak strongly in favour of the imposition of
an administrative fine for the infringement of Article 6(1) GDPR.”

9.146 In the circumstances, it is clear that the Commission is required to impose an administrative fine
in respect of the finding of infringement of Article 6(1) GDPR that was established by the EDPB
and, when doing so, to take account of the instructions, deliberations and determinations of the
EDPB, as recorded in Section 9.2.4.2.1 of the Article 65 Decision.

9.147 It is important to note that this instruction (to impose an administrative fine for the Article 6(1)
infringement) sits separately to, and alongside, the EDPB’s further instruction that the
Commission “set out a significantly higher fine amount” in respect of the Transparency
Infringements that were already proposed by way of the Draft Decision.

9.148 Finally, as regards the Commission’s decision not to impose a separate administrative fine in
respect of the infringement of the Article 5(1)(a) principle of fairness that was established by the
EDPB, the Article 65 Decision specifically afforded the Commission discretion in relation to the
manner in which this particular infringement might be addressed by way of a corrective power.
This is clear from paragraph 479 of the Article 65 Decision. The inclusion of this express discretion

267
The Final Submissions, paragraph 8.4
139

is in marked contrast with the absence of any similar discretion in relation to the
imposition/increase of administrative fines for the Article 6(1) and Transparency Infringements.

Inadequate Rationalisation

9.149 Under this heading, Facebook submitted 268 that “the reasoning in the Draft Decision in respect of
the calculation of the fines is inadequate, such that it is impossible to understand how the
proposed fining ranges have been calculated or how the different factors discussed by the
[Commission] have had an impact on the proposed fine and, as a result, to make meaningful
submissions in respect of same.”

9.150 I do not agree that this is the case. As is evident from the extensive analysis set out above, the
Commission has clearly identified the factors that were considered relevant for the purpose of
each of the individual Article 83(2) assessments. Furthermore, the manner in which the relevant
factors have been taken into account, as a mitigating or aggravating factor, as well as the weight
that has been attributed to each one has been clearly addressed.

9.151 This approach is in line with the Commission’s obligation to provide reasons for its decisions.
While the Commission is required to explain how it arrived at the level of a proposed fine, it is not
required to apply such specificity so as to allow a controller or processor to make a precise
mathematical calculation of the expected fine 269.

Incompatibility with Article 83(1) GDPR

9.152 Facebook, by way of its Final Submissions, has submitted 270 that the proposed fine for the Article
6(1) infringement “– both individually and taken cumulatively with the other significant
administrative fines being proposed in respect of the Transparency Infringements – is inconsistent
with the requirements of Article 83(1) GDPR”.

9.153 Facebook further submits that the proposed fine is “manifestly excessive and far higher than the
minimum amount necessary to be “effective” and “dissuasive”, and is therefore not
“proportionate”.”

9.154 Facebook, thirdly, submits that the reasoning in the Draft Decision as to why the administrative
fines comply with the requirements of Article 83(1) GDPR is “wholly inadequate”. Facebook has
added, in this regard, that this has undermined its ability to make meaningful submissions in
response to same.

268 The Final Submissions, paragraph 9.2
269
See, by analogy, HSBC Holdings plc and Others v Commission, T-105/17, ECLI:EU:T:2019:675, paragraphs 336 –
354.
270
The Final Submissions, paragraphs 10.1 to 10.25
140

9.155 I note that, in having detailed my views as to the reasons why I consider the proposed fines to be
effective, proportionate and dissuasive, I have followed the directions of the EDPB that were set
out on this particular matter in its Binding Decision 1/2021 271. Accordingly, I consider that the
Commission has adequately addressed this aspect of matters.

9.156 Otherwise, I note that I have already addressed many of the matters raised by Facebook as part
of this aspect of its Final Submissions elsewhere in this Decision. In relation to Facebook’s
submissions concerning the “very onerous compliance order requiring significant expenditure of
resources”, it is important to recall that the objective sought to be achieved by the Order (the
remediation of any identified infringements) differs from the objective sought to be achieved by
the imposition of an administrative fine (the sanctioning of any identified infringements).
Furthermore, the “significant expenditure of resources” are the resources of Facebook itself,
which is, as already noted, an entity with significant resources available to it. In the
circumstances, I do not agree that, in the circumstances of this particular inquiry, such matters
should operate to offset the quantum of any proposed fine.

9.157 Having completed my assessment of whether or not to impose a fine (and of the amount of any
such fine), I must now consider the remaining provisions of Article 83 GDPR, with a view to
ascertaining if there are any factors that might require the adjustment of the proposed fines.

9.158 Having taken account of the Final Submissions, I remain of the views set out in paragraphs 9.139
and 9.140, above.

10 OTHER RELEVANT FACTORS

ARTICLE 83(3) GDPR

10.1 Article 83(3) GDPR provides that:

“If a controller or processor intentionally or negligently, for the same or linked processing
operations, infringes several provisions of this Regulation, the total amount of the
administrative fine shall not exceed the amount specified for the gravest infringement.”

10.2 As outlined previously, Facebook’s infringements of Articles 5(1)(a), 13(1)(c), and 12(1) GDPR all
relate to the same processing operations concerning its processing carried out in accordance with
Article 6(1)(b) GDPR. Therefore, the total amount of the administrative fine must not exceed the
amount specified for the gravest infringement. The gravest infringement identified is the failure
to provide the information mandated by Articles 13(1)(c) and 5(1)(a) GDPR.

271
See Binding Decision 1/2021, paragraphs 413 to 416

141

10.3 Subsequent to the finalisation of the Preliminary Draft Decision, the EDPB adopted a binding
decision (“the EDPB Decision”) 272 relating to IN 18-12-2, an inquiry conducted by the Commission
into WhatsApp Ireland Limited’s compliance with Articles 12, 13 and 14 GDPR. The EDPB Decision
arose out of a dispute resolution procedure pursuant to Article 65 GDPR, and was adopted by the
Commission in conjunction with the Commission’s final decision on 2 September 2021.

10.4 The EDPB Decision applies an interpretation of Article 83(3) GDPR that differs from the
interpretation I set out in the Preliminary Draft Decision. In light of the Commission’s obligations
of cooperation and consistency in, inter alia, Articles 60(1) and 63 GDPR, it is necessary for me to
follow the EDPB’s interpretation of Article 83(3) GDPR in future inquiries given that it is a matter
of general interpretation that is not specific to the facts of the case in which it arose.

10.5 The relevant passage of the EDPB decision is as follows:

“315. All CSAs argued in their respective objections that not taking into account
infringements other than the “gravest infringement” is not in line with their interpretation
of Article 83(3) GDPR, as this would result in a situation where WhatsApp IE is fined in the
same way for one infringement as it would be for several infringements. On the other
hand, as explained above, the IE SA argued that the assessment of whether to impose a
fine, and of the amount thereof, must be carried out in respect of each individual
infringement found and the assessment of the gravity of the infringement should be done
by taking into account the individual circumstances of the case. The IE SA decided to
impose only a fine for the infringement of Article 14 GDPR, considering it to be the gravest
of the three infringements.

316. The EDPB notes that the IE SA identified several infringements in the Draft
Decision for which it specified fines, namely infringements of Article 12, 13 and 14 GDPR,
and then applied Article 83(3) GDPR.

317. Furthermore, the EDPB notes that WhatsApp IE agreed with the approach of the
IE SA concerning the interpretation of Article 83(3) GDPR. In its submissions on the
objections, WhatsApp IE also raised that the approach of the IE SA did not lead to a
restriction of the IE SA’s ability to find other infringements of other provisions of the GDPR
or of its ability to impose a very significant fine. WhatsApp IE argued that the alternative
interpretation of Article 83(3) GDPR suggested by the CSAs is not consistent with the text
and structure of Article 83 GDPR and expressed support for the IE SA’s literal and purposive
interpretation of the provision.

272https://edpb.europa.eu/system/files/2021-

09/edpb_bindingdecision_202101_ie_sa_whatsapp_redacted_en.pdf.
142

318. In this case, the issue that the EDPB is called upon to decide is how the calculation
of the fine is influenced by the finding of several infringements under Article 83(3) GDPR.

319. Article 83(3) GDPR reads that if “a controller or processor intentionally or
negligently, for the same or linked processing operations, infringes several provisions of
this Regulation, the total amount of the administrative fine shall not exceed the amount
specified for the gravest infringement.”

320. First of all, it has to be noted that Article 83(3) GDPR is limited in its application
and will not apply to every single case in which multiple infringements are found to have
occurred, but only to those cases where multiple infringements have arisen from “the
same or linked processing operations”.

321. The EDPB highlights that the overarching purpose of Article 83 GDPR is to ensure
that for each individual case, the imposition of an administrative fine in respect of an
infringement of the GDPR is to be effective, proportionate and dissuasive. In the view of
the EDPB, the ability of SAs to impose such deterrent fines highly contributes to
enforcement and therefore to compliance with the GDPR.

322. As regards the interpretation of Article 83(3) GDPR, the EDPB points out that the
effet utile principle requires all institutions to give full force and effect to EU law. The EDPB
considers that the approach pursued by the IE SA would not give full force and effect to
the enforcement and therefore to compliance with the GDPR, and would not be in line
with the aforementioned purpose of Article 83 GDPR.

323. Indeed, the approach pursued by the IE SA would lead to a situation where, in
cases of several infringements of the GDPR concerning the same or linked processing
operations, the fine would always correspond to the same amount that would be
identified, had the controller or processor only committed one – the gravest –
infringement. The other infringements would be discarded with regard to calculating the
fine. In other words, it would not matter if a controller committed one or numerous
infringements of the GDPR, as only one single infringement, the gravest infringement,
would be taken into account when assessing the fine.

324. With regard to the meaning of Article 83(3) GDPR the EDPB, bearing in mind the
views expressed by the CSAs, notes that in the event of several infringements, several
amounts can be determined. However, the total amount cannot exceed a maximum limit
prescribed, in the abstract, by the GDPR. More specifically, the wording “amount specified
for the gravest infringement” refers to the legal maximums of fines under Articles 83(4),
(5) and (6) GDPR. The EDPB notes that the Guidelines on the application and setting of
administrative fines for the purposes of the Regulation 2016/679 state that the

143

"occurrence of several different infringements committed together in any particular single
case means that the supervisory authority is able to apply the administrative fines at a
level which is effective, proportionate and dissuasive within the limit of the gravest
infringement". The guidelines include an example of an infringement of Article 8 and
Article 12 GDPR and refer to the possibility for the SA to apply the corrective measure
within the limit set out for the gravest infringement, i.e. in the example the limits of Article
83(5) GDPR.

325. The wording “total amount” also alludes to the interpretation described above.
The EDPB notes that the legislator did not include in Article 83(3) GDPR that the amount
of the fine for several linked infringements should be (exactly) the fine specified for the
gravest infringement. The wording “total amount” in this regard already implies that
other infringements have to be taken into account when assessing the amount of the fine.
This is notwithstanding the duty on the SA imposing the fine to take into account the
proportionality of the fine.

326. Although the fine itself may not exceed the legal maximum of the highest fining
tier, the offender shall still be explicitly found guilty of having infringed several provisions
and these infringements have to be taken into account when assessing the amount of the
final fine that is to be imposed. Therefore, while the legal maximum of the fine is set by
the gravest infringement with regard to Articles 83(4) and (5) GDPR, other infringements
cannot be discarded but have to be taken into account when calculating the fine.

327. In light of the above, the EDPB instructs the IE SA to amend its Draft Decision on
the basis of the objections raised by the DE SA, FR SA and PT SA with respect to Article
83(3) GDPR and to also take into account the other infringements – in addition to the
gravest infringement – when calculating the fine, subject to the criteria of Article 83(1)
GDPR of effectiveness, proportionality and dissuasiveness.”

10.6 The impact of this interpretation would be that administrative fine(s) would be imposed
cumulatively, as opposed to imposing only the proposed fine for the gravest infringement. The
only applicable limit for the total fine imposed, under this interpretation, would be the overall
“cap”. By way of example, in a case of multiple infringements, if the gravest infringement was one
which carried a maximum administrative fine of 2% of the turnover of the undertaking, the
cumulative fine imposed could also not exceed 2% of the turnover of the undertaking.

10.7 In this Inquiry, all of the infringements that have been found to have occurred (either by the
Commission directly or by the EDPB in the Article 65 Decision) are subject to the higher fining
“cap” set out in Article 83(5) GDPR. Accordingly, the total amount of administrative fines that
may be imposed must not exceed 4% of the total worldwide annual turnover of the undertaking
concerned.

144

10.8 As the EDPB Decision was adopted subsequent to Facebook having made submissions on the
Preliminary Draft Decision, I afforded Facebook an opportunity to make submissions on this
specific matter: that is, the EDPB’s interpretation of Article 83(3) GDPR.

10.9 As a preliminary matter, Facebook has objected to the manner in which it has been asked to make
submissions on this interpretation, and in particular that it was provided with an extract copy of
a working draft rather than an entire copy of the working draft of the Draft Decision. This, in its
view, results in a requirement to make submissions “in the abstract” without having sight of the
reasoning for the alteration of the fining range. 273

10.10 As is set out in this Decision, Facebook has already been afforded an opportunity to make
comprehensive submissions on the Preliminary Draft Decision that addressed every factor
proposed by the Commission for consideration in determining, if any, the appropriate fine. It was
not the intention of the Commission, in this regard, to seek additional submissions from Facebook
on the reasoning for a particular fining range, those submissions having already been made in
detail. The purpose of requesting new submissions, on this point, was to enable Facebook to
exercise a right to be heard on the application of the interpretation of Article 83(3) GDPR in the
EDPB Decision. On this basis, I do not accept that Facebook has been deprived of the opportunity
to “meaningfully exercise right to be heard”. 274

10.11 On the substance, Facebook has argued that the above interpretation and application of Article
83(3) GDPR is incorrect and/or should not be applied because: the EDPB decision is incorrect as a
matter of law and is, in any event, not binding on the Commission; even if the decision were
binding on the Commission, it does not require that the Commission impose administrative fines
in the manner proposed; the Commission has not had regard to the criteria of effectiveness,
proportionality and dissuasiveness in Article 83(1) GDPR when determining the total cumulative
proposed fine; and no decision on the correct interpretation of Article 83(3) GDPR should be made
prior to the determination of a pending application by WhatsApp Ireland, pursuant to Article 263
TFEU, before the General Court of the Court of Justice of the European Union, to annul the EDPB
Decision (“the Annulment Proceedings”). 275

10.12 Facebook’s first substantive submission on this matter is that the EDPB Decision is not binding on
the Commission. A number of legal arguments are made in this regard, including that binding
decisions of the EDPB only apply to specific individual cases (as set out in article 65(1) GDPR) 276
and that only the CJEU can issue binding decisions on matters of EU law. 277 For the avoidance of

273
Ibid, paragraph 2.1.
274
Ibid.
275
Facebook Submissions 9 September 2021, paragraph 1.2.
276
Ibid, paragraph 3.4.
277
Ibid, paragraph 3.6.
145

doubt, the Commission has not expressed the view, nor does it hold the view, that the EDPB
Decision is legally binding on it in this Inquiry and/or generally. The Commission is nonetheless, in
this regard, bound by a number of provisions of the GDPR and the real question that arises in this
context is the extent to which the Commission should have regard to the EDPB’s approach.

10.13 The Commission is bound by Article 60(1) GDPR, which states in the imperative that “the lead
supervisory authority shall cooperate with the other supervisory authorities concerned in
accordance with this Article in an endeavour to reach consensus” [emphasis added]. The
Commission is similarly required to cooperate with other supervisory authorities, pursuant to
Article 63 GDPR. Facebook has argued that these obligations relate only to specific cases where a
dispute has arisen. 278 Moreover, it submits that the EDPB’s function in ensuring correct
application of the GDPR is provided for instead in Article 70(1) GDPR, such as through issuing
opinions and guidelines. 279

10.14 It is not the position of the Commission that the EDPB in and of itself has the power to issue
decisions of general application that bind supervisory authorities. The issue is not the powers or
functions of the EDPB, but rather the legal responsibility of the Commission to the concerned
supervisory authorities, who in themselves happen to be constituent members of the EDPB. In
this regard, assistance is provided in the interpretation of the Commission’s duties under Article
60(1) GDPR by Recital 123, which states that “…supervisory authorities should monitor the
application of the provisions pursuant to this Regulation and contribute to its consistent
application throughout the Union…”. The Commission’s view is that the duty to cooperate and
ensure consistency that is placed on it by the GDPR would be rendered ineffective were it not to
ensure, to the best of its ability, such interpretations were applied consistently.

10.15 The alternative scenario, as proposed by Facebook, would result in entrenched interpretations
being consistently advanced by individual supervisory authorities. The consequence would be
inevitable dispute resolution procedures under Article 65 GDPR, and the issuing of a binding
decision once again applying an alternative interpretation to the specific facts at hand that had
already been comprehensively addressed in a previous dispute resolution procedure. Such a
scenario would deprive the duties to cooperate and act consistently of almost any meaning. In
the Commission’s view, such an interpretation would therefore be contrary to the principle of
effet utile. This is, as has been set out, a distinct issue from the legal powers or functions of the
EDPB itself.

10.16 Facebook has argued that the EDPB Decision “did not direct the [Commission] to impose separate
fines in respect of each infringement and to then add those fines together”, but rather that the
final amount should be considered in accordance with the requirements that the fine be effective,

278
Ibid, paragraph 3.3.
279
Ibid, paragraph 3.5.

146

proportionate and dissuasive pursuant to Article 83(1) GDPR. It submits that overlap between the
infringements should be taken into account, in this regard. 280 It goes on to argue that as there is
“…significant – if not complete – overlap between the infringements” 281 and that the fines relate
to “…what is essentially the same set of facts and alleged infringement…”, the fine is contrary to
the EU law principles of proportionality, ne bis in idem and concurrence of laws. 282

10.17 Facebook develops this aspect of its argument in a later section of its submission, by suggesting
that “it appears…that the [Commission] does not propose to engage in any meaningful
assessment of whether the total fine [meets the Article 83(1) GDPR criteria]”. 283 Facebook argues
that because the Commission viewed the fines proposed in the Preliminary Draft Decision as
effective, proportionate and dissuasive, a fine that is between €8 million and €12 million higher
must go beyond that standard. 284 Facebook also argues that its ability to make submissions in
relation to this new proposed fine is “restricted” due to it not being given sight of the entire
working draft but simply of the working draft relevant to the application of the EDPB’s
interpretation of Article 83(3) GDPR. 285

10.18 In relation to the requirements of Article 83(1) GDPR, which includes the EU law principle of
proportionality relied on by Facebook, the Commission refutes any suggestion that it has not had
regard to this provision in proposing a final fine. The latter part of Section 9 of this Decision set
out, in detail, the Commission’s reasoning as to why the proposed fine is effective, proportionate,
and dissuasive. Moreover, as has been set out, Facebook has provided extensive submissions on
the Preliminary Draft Decision as to its views on what an effective, dissuasive and proportionate
sanction would be. I therefore reject any suggestion that there was “a failure to adequately
consider whether, taken as a whole, the proposed fines in respect of all the infringements are
effective, proportionate and dissuasive”. 286

10.19 Facebook has already provided submissions on the Preliminary Draft Decision, which clearly set
out its view on the approach to fines in this matter, without prejudice to its view that no
infringement of the GDPR has taken place. The purpose of the additional opportunity for
submissions referred to here was to address the interpretation of Article 83(3) GDPR in the EDPB
Decision and its application to this Inquiry, not to reopen the question of the appropriate quantum
for any administrative fine and/or to provide for an additional round of submissions on that issue.
The Commission in any event rejects any suggestion that the Article 83(1) GDPR criteria are not
met by the new fine on the application of the new interpretation of Article 83(3) GDPR, and as is
seen in Section 9 above, I have given due consideration to this and to Facebook’s submissions in

280
Ibid, paragraph 4.2.
281
Ibid, paragraph 4.4.
282
Ibid, paragraph 4.3.
283
Ibid, paragraph 5.6.
284
Ibid, paragraph 5.10.
285
Ibid, paragraph 5.11
286
Ibid, paragraph 5.12.
147

this regard. I therefore remain satisfied that the proposed application of Article 83(3) GDPR is
consistent with Article 83(1) GDPR, for the reasons set out here and in Section 9.

10.20 In relation to the alleged contravention of the ne bis in idem principle, I also reiterate the views
expressed at the end of Section 9 herein, in relation to the Transparency Infringements. It sets out
that the failure to provide required information, and the failure to set out required information
in a transparent manner, are entirely different wrongs. The legislator has provided for two distinct
requirements, and each individual requirement has been infringed by Facebook. For these
reasons and the reasons set out above, I do not accept this submission. Similarly, the Commission
is not applying a new and retroactive view of wrongdoing to the conduct in a manner envisaged
by principle of concurrence of laws. It is simply determining the proper interpretation of Article
83(3) GDPR. This has no impact on the Commission’s detailed consideration of Facebook’s
submissions on the separate and more general question of the appropriate penalty.

10.21 It also argues that the taking into account of the undertaking’s turnover is incorrect as a matter
of law, as it is not set out as a factor in Article 83(2) GDPR. In this regard, the Commission relies
on its existing analysis of its obligations to cooperate with the concerned supervisory authorities
and apply the GDPR consistently. For the same reasons provided to support the Commission’s
decision to apply the EDPB Decision’s interpretation of Article 83(3) GDPR in general, the
Commission intends to maintain this consideration of the undertaking’s turnover.

10.22 Finally, Facebook has argued that, in light of the intended Annulment Proceedings in respect of
the WhatsApp Decision, the Commission should not finalise the Draft Decision until a final
decision as to the correct interpretation of Article 83(3) GDPR has been made by the CJEU.
Facebook’s submission is simply that “there is, at a minimum, very considerable doubt as to the
correct interpretation of Article 83(3) GDPR” and that on this basis the Commission should not
proceed with this Decision until the matter is finalised. 287 Facebook has provided no legal
authority in support of this proposition. Notwithstanding the possible overlap between some of
the questions referred and the issues arising for decision in this inquiry, given the advanced stage
of this Inquiry I am satisfied that there is no reason to delay this matter. The prospect of intended
legal proceedings in respect of a separate decision does not provide any basis in law for
suspending a separate Inquiry.

10.23 For the sake of completeness, I note that Facebook reiterated its concerns as part of its Final
Submissions 288. I have already addressed the subject-matter of those concerns above.

ARTICLE 83(5) GDPR

287
Ibid, paragraph 6.3.
288
The Final Submissions, paragraphs 11.1 to 11.2 and paragraphs 15.1 to 15.3
148

10.24 Turning, finally, to Article 83(5) GDPR, I note that this provision operates to limit the maximum
amount of any fine that may be imposed in respect of certain types of infringement, as follows:

“Infringements of the following provisions shall, in accordance with paragraph 2, be
subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up
to 4% of the total worldwide annual turnover of the preceding financial year, whichever is
higher:
(a) the basic principles for processing … pursuant to Articles 5, 6, 7 and 9;
(b) the data subjects’ rights pursuant to Articles 12 to 22;
…”

10.25 In order to determine the applicable fining “cap”, it is firstly necessary to consider whether or not
the fine is to be imposed on “an undertaking”. Recital 150 clarifies, in this regard, that:

“Where administrative fines are imposed on an undertaking, an undertaking should be
understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those
purposes.”

10.26 Accordingly, when considering a respondent’s status as an undertaking, the GDPR requires me to
do so by reference to the concept of ‘undertaking’, as that term is understood in a competition
law context. In this regard, the CJEU has established that:

“an undertaking encompasses every entity engaged in an economic activity regardless of
the legal status of the entity and the way in which it is financed” 289.

10.27 The CJEU has held that a number of different enterprises could together comprise a single
economic unit where one of those enterprises is able to exercise decisive influence over the
behaviour of the others on the market. Such decisive influence may arise, for example, in the
context of a parent company and its wholly owned subsidiary. Where an entity (such as a
subsidiary) does not independently decide upon its own conduct on the market, but carries out,
in all material respects, the instructions given to it by another entity (such as a parent), this means
that both entities constitute a single economic unit and a single undertaking for the purpose of
Articles 101 and 102 TFEU. The ability, on the part of the parent company, to exercise decisive
influence over the subsidiary’s behaviour on the market, means that the conduct of the subsidiary
may be imputed to the parent company, without having to establish the personal involvement of
the parent company in the infringement 290.

289
Höfner and Elser v Macrotron GmbH (Case C-41/90, judgment delivered 23 April 1991), EU:C:1991:161, para. 21.
290
Akzo Nobel and Others v Commission, (Case C-97/08 P, judgment delivered 10 September 2009) EU:C:2009:536,
paragraphs 58 – 60.
149

10.28 In the context of Article 83 GDPR, the concept of ‘undertaking’ means that, where there is another
entity that is in a position to exercise decisive influence over the controller/processor’s behaviour
on the market, then they will together constitute a single economic entity and a single
undertaking. Accordingly, the relevant fining “cap” will be calculated by reference to the turnover
of the undertaking as a whole, rather than the turnover of the controller or processor concerned.

10.29 In order to ascertain whether a subsidiary determines its conduct on the market independently,
account must be taken of all the relevant factors relating to the economic, organisational and
legal links which tie the subsidiary to the parent company, which may vary from case to case 291.

10.30 The CJEU has, however, established 292 that, where a parent company has a 100% shareholding in
a subsidiary, it follows that: the parent company is able to exercise decisive influence over the
conduct of the subsidiary; and a rebuttable presumption arises that the parent company does in
fact exercise a decisive influence over the conduct of its subsidiary.

10.31 The CJEU has also established that, in a case where a company holds all or almost all of the capital
of an intermediate company which, in turn, holds all or almost all of the capital of a subsidiary of
its group, there is also a rebuttable presumption that that company exercises a decisive influence
over the conduct of the intermediate company and indirectly, via that company, also over the
conduct of that subsidiary 293.

10.32 The General Court has further held that, in effect, the presumption may be applied in any case
where the parent company is in a similar situation to that of a sole owner as regards its power to
exercise a decisive influence over the conduct of its subsidiary 294. This reflects the position that:

“… the presumption of actual exercise of decisive influence is based, in essence, on the
premise that the fact that a parent company holds all or virtually all the share capital of
its subsidiary enables the Commission to conclude, without supporting evidence, that that
parent company has the power to exercise a decisive influence over the subsidiary without
there being any need to take into account the interests of other shareholders when
adopting strategic decisions or in the day-to-day business of that subsidiary, which does

291
Ori Martin and SLM v Commission (C-490/15 P, judgment delivered 14 September 2016) ECLI:EU:C:2016:678,
paragraph 60.
292
Akzo Nobel and Others v Commission, (C-97/08 P, judgment delivered 10 September 2009).
293
Judgment of 8 May 2013, Eni v Commission, Case C-508/11 P, EU:C:2013:289, paragraph 48.
294
Judgments of 7 June 2011, Total and Elf Aquitaine v Commission, T-206/06, not published, EU:T:2011:250,
paragraph 56; of 12 December 2014, Repsol Lubricantes y Especialidades and Others v Commission, T-562/08, not
published, EU:T:2014:1078, paragraph 42; and of 15 July 2015, Socitrel and Companhia Previdente v Commission,
T-413/10 and T-414/10, EU:T:2015:500, paragraph 204.

150

not determine its own market conduct independently, but in accordance with the wishes
of that parent company … 295”

10.33 Where the presumption of decisive influence has been raised, it may be rebutted by the
production of sufficient evidence that shows, by reference to the economic, organisational and
legal links between the two entities, that the subsidiary acts independently on the market.

10.34 It is important to note that “decisive influence”, in this context, refers to the ability of a parent
company to influence, directly or indirectly, the way in which its subsidiary organises its affairs, in
a corporate sense, for example, in relation to its day-to-day business or the adoption of strategic
decisions. While this could include, for example, the ability to direct a subsidiary to comply with
all applicable laws, including the GDPR, in a general sense, it does not require the parent to have
the ability to determine the purposes and means of the processing of personal data by its
subsidiary.

10.35 I have noted already that Facebook’s ultimate parent is Facebook Inc. I also note that Note 22 of
the Financial Statements most recently filed, as at the date of preparation of the Preliminary Draft
Decision 296, further confirms, on page 34, that:

“Controlling parties:

At 31 December 2018, the company is a wholly-owned subsidiary of Facebook
International Operations Limited, a company incorporated in the Republic of Ireland, its
registered office being 4 Grand Canal Square, Grand Canal Harbour, Dublin 2.

The ultimate holding company and ultimate controlling party is Facebook Inc., a company
incorporated in Wilmington, Delaware, United States of America. The ultimate holding
company and controlling party of the smallest and largest group of which the company is
a member, and for which consolidated financial statements are drawn up, is Facebook,
Inc.”

10.36 On this basis, it is my understanding that Facebook is a wholly-owned subsidiary of Facebook
International Operations Limited; Facebook International Operations Limited is wholly owned and
controlled by Facebook Inc.; and, as regards any intermediary companies in the corporate chain,
between Facebook and Facebook, Inc., it is assumed, by reference to the statement at Note 22 of
the Notes to the Financial Statements (quoted above) that the “ultimate holding company and

295
Opinion of Advocate General Kokott in Akzo Nobel and Others v Commission, C-97/08 P, EU:C:2009:262, point 73
(as cited in judgment of 12 July 2018, The Goldman Sachs Group, Inc. v European Commission, Case T-419/14,
ECLI:EU:T:2018:445, paragraph 51).
296
While I note that Facebook has since filed its Directors Report and Financial Statements for the financial year
ending 31 December 2020, I note that the relevant information set out therein is materially identical to that recorded
in this Decision.
151

controlling party of the smallest and largest group of which [Facebook] is a member … is Facebook,
Inc.”. It is therefore assumed that Facebook, Inc. is in a similar situation to that of a sole owner as
regards its power to (directly or indirectly) exercise a decisive influence over the conduct of
Facebook.

10.37 It seemed therefore at the time of preparing the Preliminary Draft Decision, that the corporate
structure of the entities concerned is such that Facebook Inc. is in a position to exercise decisive
influence over Facebook’s behaviour on the market. Accordingly, a rebuttable presumption will
arise to the effect that Facebook Inc. does in fact exercise a decisive influence over the conduct
of Facebook on the market.

10.38 If this presumption is not rebutted, it would mean that Facebook, Inc. and Facebook constitute a
single economic unit and therefore form a single undertaking within the meaning of Article 101
TFEU. Consequently, the relevant fining “cap” for the purpose of Articles 83(4) and (5) GDPR,
would fall to be determined by reference to the consolidated turnover of the group of companies
headed by Meta Platforms, Inc.. Facebook has made submissions in this regard in an attempt to
rebut the presumption of decisive influence.

10.39 In particular, Facebook submitted that the presumption of decisive influence on the market does
not translate into a data protection context without considering what “behaviour on the market”
means in a data protection context.297 It argues that this analysis should focus instead on the
entity that has the decision-making capacity in the context of data protection matters, rather than
matters relating to the market in general as is the case in competition law. I do not agree with this
assessment. Firstly, the suggested approach (involving an assessment of where the decision-
making power lies, in relation to the processing of personal data) is effectively a replication of the
assessment that must be undertaken at the outset of the inquiry process, the outcome of which
determines (i) the party/parties to which the inquiry should be addressed; and (ii) (in cross border
processing cases) the supervisory authority with jurisdiction to conduct the inquiry. Given the
consequences that flow from this type of assessment, it would not be appropriate for this
assessment to be conducted at the decision-making stage of an inquiry.

10.40 Secondly, the suggested approach could not be applied equally in each and every case. Where,
for example, the presumption of decisive influence has been raised in the context of a cross-
border processing case where one of the entities under assessment is outside of the EU, an
assessment of that entity’s ability to exercise decisive influence over the respondent’s data
processing activities would likely exceed scope of Article 3 GDPR. Such a scenario risks
undermining the Commission’s ability to comply with its obligation, pursuant to Article 83(1)
GDPR, to ensure that the imposition of fines, in each individual case, is “effective, proportionate
and dissuasive”.

297
Facebook Submissions on Preliminary Draft Decision, paragraph 16.2.
152

10.41 Finally “behaviour on the market” has a meaning normally ascribed to it in EU competition law.
In summary, “behaviour on the market” describes how an entity behaves and conducts its affairs
in the context of the economic activity in which it engages. Such behaviour will include matters
such as the policies and procedures it implements, the marketing strategy it pursues, the terms
and conditions attaching to any products or services it delivers, its pricing structures, etc. I
therefore can see no basis in law, in Facebook’s submissions or otherwise, to deviate from this
well-established principle as set out both in the GDPR, other provisions of EU law and the
jurisprudence of the CJEU.

10.42 Applying the above to Article 83(5) GDPR, I first note that, in circumstances where the fine is being
imposed on an ‘undertaking’, a fine of up to 4% of the total worldwide annual turnover of the
preceding financial year may be imposed. I note, in this regard, that Meta Platforms, Inc. reported
the generation of revenue in the amount of $117,929 billion in respect of the year ended 31
December 2021. That being the case, the fine proposed above does not exceed the applicable
fining “cap” prescribed by Article 83(5) GDPR 298.

SUMMARY OF ENVISAGED ACTION

10.43 I therefore decide to exercise the following corrective powers:

10.44 An order is hereby made, pursuant to Article 58(2)(d) GDPR, requiring Facebook to bring
processing into compliance (“the Order”) within a period of three months commencing on the
day following the date of service, on Facebook, of this Decision. More specifically, the Order:

a. firstly, requires Facebook to bring the Data Policy and Terms of Service into compliance
with Articles 5(1)(a), 12(1) and 13(1)(c) GDPR as regards information provided on: (i) data
processed pursuant to Article 6(1)(b) GDPR as well as (ii) data processed for the purposes
of behavioural advertising in the context of the Facebook service, in accordance with the
principles set out in this Decision; and

b. secondly, requires Facebook to take the necessary action to bring its processing of
personal data for the purposes of behavioural advertising (“the Processing”), in the
context of the Facebook Terms of Service, into compliance with Article 6(1) GDPR in
accordance with the conclusion reached by the EDPB, as recorded at paragraphs 132 and
133 of the Article 65 Decision. More specifically, in this regard, Facebook is required to
take the necessary action to address the EDPB’s finding that Facebook is not entitled to
carry out the Processing on the basis of Article 6(1)(b) GDPR, taking into account the
analysis and views expressed by the EDPB in Section 4.4.2 of the Article 65 Decision. Such
action may include, but is not limited to, the identification of an appropriate alternative

298
https://investor.fb.com/investor-news/press-release-details/2022/Meta-Reports-Fourth-Quarter-and-Full-Year-
2021-Results/default.aspx
153

legal basis, in Article 6(1) GDPR, for the Processing together with the implementation of
any necessary measures, as might be required to satisfy the conditionality associated with
that/those alternative legal basis/bases.

10.45 An administrative fine is hereby imposed, pursuant to Articles 58(2)(i) and 83, addressed to
Facebook, in the amount of €210 million. For the avoidance of doubt, that fine reflects the
infringements that were found to have occurred, as follows:

a. In respect of the failure to provide sufficient information in relation to the processing
operations carried out in purported reliance on Article 6(1)(b) GDPR, thereby infringing
Articles 5(1)(a) and 13(1)(c) GDPR, a fine in the amount of €80 million is hereby imposed.

b. In respect of the failure to provide the information that was provided on the processing
operations carried out in purported reliance on Article 6(1)(b) GDPR, in a concise,
transparent, intelligible and easily accessible form, using clear and plain language,
thereby infringing Articles 5(1)(a) and 12(1) GDPR, a fine in the amount of €70 million is
hereby imposed.

c. In respect of the infringement of Article 6(1) GDPR (and taking into account the
infringement of the Article 5(1)(a) fairness principle), a fine in the amount of €60 million
is hereby imposed.

This Decision is addressed to:

Meta Platforms Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2

Dated the 31st day of December 2022

Decision-Maker for the Commission:

_______________________________________
Helen Dixon
Commissioner for Data Protection

154

SCHEDULE 1

3 CHRONOLOGY, PROCEDURAL AND SCOPE MATTERS PERTAINING TO INQUIRY PROVISIONALLY DECIDED

1.6 The Complaint was lodged with the Austrian DPA on 25 May 2018 (the date on which the GDPR
became applicable) by the Complainant’s representative: “noyb – European Center for Digital
Rights” (“NOYB”). The legal framework for the Complaint as lodged with the Commission is set out
below. In brief, the Complaint concerns the lawfulness of Facebook’s processing of personal data,
specifically data processing on foot of the Complainant’s acceptance of Facebook’s Terms of
Service, and the transparency of information provided by Facebook to the Complainant about that
processing.

1.7 The Commission began the Inquiry by designating an investigator (“the Investigator”), who
produced a draft of an inquiry report (“the Draft Report”) and, following submissions from the
Parties, a final inquiry report (“the Final Report”). In considering this Inquiry, I have relied on the
facts as set out in the Final Report. I have also had regard to the views set out by the Investigator
in the Final Report, as well as to the entirety of the file, in preparing this Schedule.

1.8 The preliminary draft decision (“the Preliminary Draft Decision”) set out my provisional findings,
as the decision-maker in this matter, in relation to (i) whether or not an infringement of the GDPR
has occurred/is occurring; and (ii) the envisaged action to be taken by the Commission in respect
of same. The Preliminary Draft Decision was circulated to Facebook and NOYB (collectively “the
Parties”) on 14 May 2021. I received submissions from the Parties.

1.9 The submissions were received and taken into account by the Commission. I have finalised a draft
version this Schedule and a draft decision (“the Draft Decision”), which was submitted by the
Commission to other concerned supervisory authorities (‘the CSAs”) (within the meaning of Article
4(22) GDPR), pursuant to Article 60 GDPR, on 6 October 2021. The Preliminary Draft Decision and
this Schedule were provided to the Parties for the purpose of allowing them to make submissions
in relation to my provisional findings. I considered the submissions so made by the Parties and,
where necessary, made amendments to take account of these prior to the finalisation of the Draft
Decision. The Schedule and Draft Decision were circulated to the CSAs in accordance with the
procedure set out in Article 60 GDPR and as explained in, inter alia, my letters sent to Facebook and
the Complainant respectively on 17 April 2020 (“the Article 60 Process”).

1.10 The cross-border processing under examination in this Inquiry was such that all other EU/EEA
supervisory authorities (“SAs, each one being an “SA”) were engaged as supervisory authorities
concerned (“CSAs”) for the purpose of the cooperation process outlined in Article 60 of the GDPR.
Following the circulation of the Draft Decision and Schedule to the CSAs for the purpose of enabling
them to express their views, in accordance with Article 60(3) GDPR, objections were raised by the
SAs of Austria, Sweden, Norway, the Netherlands, Poland, Finland, France, Portugal, Italy and

155

Hamburg (representing a co-ordinated response by the German SAs). A number of comments were
also exchanged by various CSAs.

1.11 Having considered the matters raised, the Commission, by way of a Composite Response
Memorandum dated 25 July 2022, set out its responses to the various objections and comments.
Ultimately, it was not possible to reach consensus with the CSAs on the subject-matter of the
objections and, accordingly, the Commission determined that it would not follow them. That being
the case, the Commission referred the objections to the EDPB for determination pursuant to the
Article 65(1)(a) dispute resolution mechanism. In advance of doing so, the Commission invited
Facebook to exercise its right to be heard on all of the material that the Commission proposed to
put before the EDPB. Facebook exercised its right to be heard by way of its submissions dated 15
July 2022 (the “Article 65 Submissions”).

1.12 The EDPB adopted its Article 65 Decision on 5 December 2022 and notified it to the Commission
and all other CSAs on 6 December 2022. As per Article 65(1), the EDPB’s decision is binding upon
the Commission. Accordingly, and as required by Article 65(6) of the GDPR, the Commission has
now amended its Draft Decision, by way of this Decision, in order to take account of the EDPB’s
determination of the various objections from the CSAs which it deemed to be “relevant and
reasoned” for the purpose of Article 4(24) of the GDPR. As part of the amendment process,
Facebook was invited to exercise its right to be heard in relation to any matters in relation to which
the Commission was required to make a final determination or, otherwise, exercise its own
discretion. Facebook exercised its right to be heard by way of its submissions furnished under cover
of letter dated 19 December 2022 (“the Final Submissions”)

1.13 For the avoidance of doubt, this Schedule is an integral and operative part of my final decision (“the
Decision) for the purposes of Article 60 and 65 GDPR. The previous division of material into two
documents is entirely a structural choice, so as to enable a more exclusive focus on the substantive
Complaint in the main document, while dealing with matters of a more procedural nature herein.
It has been incorporated into the Decision itself as part of the finalisation process, prior to adoption.

LEGAL BASIS FOR THE INQUIRY

1.14 The Inquiry in this case was conducted by the Investigator under Section 110 of the 2018 Act.

1.15 The decision-making process for the Inquiry which applies to this case is provided for under Section
113(2)(a) of the 2018 Act. Additionally, Section 113(3)(a) of the Act requires that the Commission
must consider the information obtained during the Inquiry; decide whether an infringement is
occurring or has occurred; and if so, decide on the envisaged action (if any) to be taken in relation
to the data controller. This function is performed by me in my role as the decision-maker. In so
doing, I have carried out an independent assessment of all of the materials provided to me by the
Investigator.

156

1.16 As stated above, the Inquiry was commenced pursuant to Section 110 of the 2018 Act. By way of
background in this regard, under Part 6 of the 2018 Act, the Commission has the power to
commence an inquiry on several bases, including on foot of a complaint, or of its own volition.

1.17 In his consideration of the material gathered during the initial stages of this Inquiry, the Investigator
was satisfied that Facebook constitutes a data controller and that the processing referred to in the
Complaint constitutes cross-border processing, such that the Commission is the lead supervisory
authority as set out in the GDPR. I make my decision in this regard below.

REFERRAL BY AUSTRIAN DPA

1.18 The Complaint was referred to the Commission by the Austrian DPA on the basis that (i) the
Complaint concerns cross-border processing and (ii) Facebook, as the data controller, has its main
establishment in Ireland. In this regard, the Austrian DPA forwarded the Complaint to the
Commission on 30 May 2018. The Commission assessed the Complaint and as lead supervisory
authority, commenced the Inquiry under Section 110 of the 2018 Act on 20 August 2018. The Parties
were also notified of the commencement of the Inquiry on 20 August 2018.

STATUS OF NOYB

1.19 NOYB is acting as a representative of a named individual in accordance with Article 80 GDPR, which
states that:

“The data subject shall have the right to mandate a not-for-profit body, organisation or
association which has been properly constituted in accordance with the law of a Member
State, has statutory objectives which are in the public interest, and is active in the field of
the protection of data subjects’ rights and freedoms with regard to the protection of their
personal data to lodge the complaint on his or her behalf…”

1.20 For the purposes of assessing compliance with Article 80 GDPR, it is necessary to assess whether
NOYB was a properly constituted not-for-profit body with objectives in the public interest and that
was actively engaged in “the field of the protection of data subject rights”. In this regard, the
Investigator consulted NOYB’s website, and NOYB’s articles of association, which explain that it is a
“verein” (association) under Austrian law. Having reviewed paragraphs 91-96 of the Final Report
and Appendix 4 of the Final Report (NOYB’s articles of association), I am satisfied that NOYB meets
the definition set out in Article 80 GDPR. NOYB is a not-for-profit body that appears on its face
(although the Commission has no specific competence to rule in this regard) to be validly
constituted in accordance with Austrian law, with objectives which are in the public interest. From
having reviewed this information, I am also satisfied that NOYB is active in the field of the protection

157

of data subject rights. On this basis, I am satisfied that these all meet the definition in Article 80
GDPR.

1.21 Moreover, it is necessary to determine the validity of the data subject’s mandate in order to decide
whether NOYB may represent them. I am satisfied, having reviewed paragraphs 98-101 of the Final
Report and Appendix 3 of the Final Report (the data subject’s “mandate”) that the mandate
provided to NOYB by the data subject was lawful, and that therefore NOYB has the right to
represent the data subject in this matter. The mandate includes the name, address and signature
of the data subject being represented by NOYB. I note, as was noted by the Investigator, that the
mandate specifically refers to “forced consent to the update privacy policy that I clicked on to in
May 2018”. On an objective reading of this mandate, NOYB was given authority to represent the
data subject in relation to alleged infringements of the GDPR concerning agreement to the Terms
of Service and Data Policy.

1.22 I have also considered “Attachment F” to the Complainant’s submissions on the Draft Report i.e. an
affidavit (sworn statement). This affidavit, sworn on 3 September 2019, states that, in the data
subject’s view, NOYB has the authority to represent them “in all matters and in all arguments and
legal claims against Facebook according to Article 80 GDPR”. My view is that this cannot alter, post
hoc, the nature of the data subject mandate that was provided to NOYB in accordance with Article
80 GDPR to launch a complaint on its behalf. The nature of the Complaint was specified and detailed
in the mandate. However, as the scope of the Complaint as I propose to find below does not, in my
view, conflict with the mandate, the question of whether “Attachment F” can broaden the scope of
NOYB’s mandate is moot.

1.23 Facebook expressed no particular view on NOYB’s status under Article 80 GDPR, or on the data
subject’s mandate.

PROCEDURAL CONDUCT OF INQUIRY

1.24 As set out above, the Inquiry was commenced on 20 August 2018 for the purposes of examining
and assessing the circumstances surrounding the Complaint as referred to the Commission by the
Austrian DPA, with a view to ultimately facilitating a decision under Section 113(2)(a) of the Act.

1.25 The Commission commenced the Inquiry as it was “of the opinion that one or more provisions of
the [2018] Act and/or the GDPR may have been contravened in relation to the personal data of the
data subject who is represented by the Complainant pursuant to Art. 80(1) GDPR…” 299 The
Commission formed this view on the basis of the contents of the Complaint and the arguments it
sets out. The Parties were informed of the commencement of the Inquiry by letters dated 20 August
2018. The letter to Facebook set out that the scope of the Inquiry would encompass the contents
of the Complaint. The letter also set out a number of queries for Facebook.

299
Letter of the Commission to Facebook, 20 August 2018.
158

1.26 Facebook responded to these queries by way of correspondence, with an attached schedule and
appendices, on 27 September 2018.

1.27 Following this, the Investigator wrote to the Complainant on 23 November 2018 to set out his views
on the scope of the Complaint. In this context, a number of procedural issues were raised by the
Complainant in correspondence dated 3 December 2018. These issues consisted of an allegation of
delay on the part of the Commission, and an allegation of bias on the part of the Commission, and
a rejection of the interpretation of the Complaint’s scope proposed by the Investigator. The
Investigator responded to the Complainant on 16 January 2019 refuting the allegations in strong
terms. A further phone call took place between the Investigator and Mr. Maximilian Schrems, a
representative of the Complainant, on 26 January 2019, in this regard.

1.28 The Investigator wrote to Facebook on 25 January 2019 to set out his views on the scope of the
Complaint, in the same manner as set out in the letter to the Complainant on 23 November 2018.
Facebook raised a number of preliminary procedural queries with the Investigator by letter dated
5 February 2019. Facebook enquired as to whether its submissions of 27 September 2018 would be
taken into account in circumstances where it was of the view that these submissions extended
beyond the scope as set out by the Investigator in the letter of 25 January 2019. Facebook also
sought assurances in respect of the confidentiality of information provided in submissions to the
Commission, and queried how information would be shared with concerned supervisory authorities
pursuant to Article 60 GDPR.

1.29 The Investigator responded to Facebook’s query on 8 February 2019, and confirmed that
Facebook’s submission of 27 September 2018 would be taken into account. Furthermore, the
Investigator informed Facebook that it would consider the matter of confidentiality of material in
the context of the Article 60 Process by way of separate correspondence. The Investigator also
asked Facebook to set out clearly any material that it regarded as confidential and/or commercially
sensitive in any submissions to the Commission, including the submissions of 27 September 2018
in this Inquiry.

1.30 Facebook corresponded further with the Commission on 13 February 2019 seeking confirmation
that aspects of the submission of 27 September 2018 that did not fall within the scope of the
Complaint as set out the Investigator’s letter of 25 January 2019 would not be taken into account.
Facebook also sought an extension to the deadline (which was 15 February 2019) that had been set
for submissions in the Investigator’s letter of 25 January 2019. The Investigator wrote to Facebook
on 15 February 2019 confirming that the extension would be granted and asking Facebook to
specify any part of the submission of 27 September 2018 that it argued should not be taken into
account.

1.31 In response to the letter of 25 January 2019, Facebook sent its submissions on 22 February 2019,

159

in accordance with the extension of time provided by the Investigator. The Complainant was
informed of same. On 23 March 2019, the Complainant wrote to the Commission to request an
update as to progress, which was provided by the Investigator on 28 March 2019. That letter set
out the procedure that would be followed in terms of the preparation of a Draft Report, the Final
Report, and the decision-making process.

1.32 Mr Schrems raised a number of concerns with the Investigator in a phone conversation on 1 April
2019. Further to this, the Complainant wrote to the Investigator on 19 April 2019 to set out the
concerns in writing. These concerns related to dealing directly with the Commission in
circumstances where the Complaint was lodged with the Austrian DPA, as well as concerns
surrounding the applicability of Irish procedural law as opposed to Austrian procedural law, and
conflicts between Irish procedural law and Austrian procedural law. These concerns were also
raised by the Complainant in its submissions on the Draft Report and were addressed in the Final
Report. I address these concerns and procedural issues below.

1.33 Having completed the Draft Report, the Investigator furnished the parties with a copy of the Draft
Report on 28 June 2019. Facebook’s submissions on the Draft Report were received by the
Investigator on 28 July 2019, and the Complainant’s submissions on same were received by the
Investigator on 9 September 2019. The Investigator proceeded to prepare the Final Report.

1.34 As has already been outlined, Facebook asserted confidentiality over some material sent to the
Commission in the context of its submissions during the course of the Inquiry. The Complainant
argued that it was entitled to view the material, and also formally requested access to the entire
investigation file. Facebook subsequently expressed its willingness to share all relevant material
with the Complainant on a voluntary basis. I have considered the issues surrounding the
confidentiality dispute in the correspondence between the parties. I am satisfied that no additional
issues of confidentiality arise in circumstances where no specific issues of commercial sensitivity
have been identified by Facebook in response to such requests, aside from Facebook’s position that
the ongoing Inquiry is, in general, a confidential process.

1.35 The Parties were furnished with each other’s submissions on the Draft Report, for their information.
The Final Report was provided to me as decision-maker on 4 April 2020.

1.36 In terms of its contents, the Final Report sets out the factual background, and the scope and legal
basis, for the Inquiry. It also provides an outline of the facts as established during the course of the
Inquiry, an outline of the dispute about the scope of the Inquiry and the Investigator’s view on
same, and an outline of the procedural disputes that arose during the Inquiry and the Investigator’s
view on same. The Final Report further sets out the Investigator’s views as to whether, in respect
of these matters, Facebook complied with its obligations under GDPR and the 2018 Act.

160

1.37 A draft of this Schedule and the Preliminary Draft Decision, i.e. a draft of this decision prepared to
enable to parties to make submissions, were sent to the parties on 14 May 2021. The parties
furnished the Commission with submissions on that Preliminary Draft Decision and the draft of the
Schedule, which I have taken account of in preparing this Schedule and the Decision. The
Complainant was not furnished with the section of the Preliminary Draft Decision that addressed
the envisaged action i.e. what corrective powers would be imposed, as this is a matter for the
Commission and not something that falls within the framework of a complaint pursuant to Article
77 GDPR.

1.38 As for any alleged failure to hear the complainant on the question of corrective powers, my view is
that this is simply not a matter for a complainant. A complaint consists of an allegation that unlawful
processing is taking place, and therefore is an allegation of an infringement. The question of a
corrective power e.g. an administrative fine is solely within the competence of the Commission.

1.39 The Complainant, in this regard, provided the example of a ban on unlawful processing as
something a Complainant should be heard in relation to. 300 In making this argument, the
Complainant points out that the Complaint in fact seeks a specific “remedy”, i.e. the ending of all
processing that the Complainant believes to be unlawful. 301

1.40 It must be acknowledged, however, that the position adopted in the Preliminary Draft Decision was
that no unlawful processing had been identified by the Complainant, and the proposed
infringements related to transparency rather than to the processing of data. As such, it must
logically follow that the Commission was not proposing a ban on any processing, given that the
Preliminary Draft Decision did not propose to find that any unlawful processing was actually taking
place. In this regard, even if there were merit to this argument in some particular circumstances, it
was clearly not applicable in the context in which it was made.

1.41 Furthermore, in circumstances where the Commission was minded to find that unlawful processing
was taking place, the position of the Complainant in this regard is abundantly clear. Were the
Commission not minded to ban any such processing, the Complainant’s position is clearly that it
should. If the Commission were minded to ban it, the Complainant has made it clear that it would
agree with the decision. In that sense, the Complainant has in fact been heard in no uncertain terms
in relation to the question of whether any processing (the processing in question being considered
in detail in the accompanying Decision) should be banned.

1.42 What has happened is that the Complainant has not been furnished with, and given the opportunity
to make submissions on, the section of the Preliminary Draft Decision that proposed an
administrative fine, something which is not a matter for the Complainant in any event. As I have set
out, the Preliminary Draft Decision did not propose to find that any unlawful processing was taking

300
Ibid, paragraph 3.4.5.
301
Ibid.
161

place. This leads to the inevitable conclusion that the section of the Preliminary Draft Decision the
Complainant was not provided with would not (and indeed could not) propose banning processing.
Therefore even taking this particular argument of the Complainant at its height, it is not applicable
in these circumstances.

1.43 Moreover, the Complainant was afforded a right to be heard on the impact any alleged unlawful
processing had on her, which is a factor to be considered in the imposition of an administrative fine
under Article 83(2)(a) GDPR. This provided the Complainant with an opportunity to speak to the
only factor in my consideration of which the Complainant has direct experience.

1.44 For the above reasons, these suggestions on the part of the Complainant’s representative to the
effect that it was not afforded a full right to be heard in relation to this inquiry are either ill-founded
or based on mischaracterisations of fact and law.

4 Procedural Issues to be Decided

2.1 As set out above, this is the Schedule to the Decision made by the Commission, (at this point, I note
that I am the sole member of the Commission) in accordance with Section 113 of the 2018 Act. Section
113 of the 2018 Act provides as follows:

(2) Where section 109 (4)(a) applies, the Commission shall—

(a) in accordance with subsection (3), make a draft decision in respect of the complaint
(or, as the case may be, part of the complaint) and, where applicable, as to the
envisaged action to be taken in relation to the controller or processor concerned, and

(b) in accordance with Article 60 and, where appropriate, Article 65, adopt its decision in
respect of the complaint or, as the case may be, part of the complaint.

(3) In making a draft decision under subsection (2)(a), the Commission shall, where applicable, have
regard to—

(a) the information obtained by the Commission in its examination of the complaint,
including, where an inquiry has been conducted in respect of the complaint, the
information obtained in the inquiry, and

(b) any draft for a decision that is submitted to the Commission by a supervisory authority
in accordance with Article 56(4).

(4) Where the Commission adopts a decision under subsection (2)(b) to the effect that an
infringement by the controller or processor concerned has occurred or is occurring, it shall, in
addition, make a decision—
162

(a) where an inquiry has been conducted in respect of the complaint—

(i) as to whether a corrective power should be exercised in respect of the controller
or processor concerned, and

(ii) where it decides to so exercise a corrective power, the corrective power that is
to be exercised,

2.2 In accordance with Section 113, it is for me, as the sole member of the Commission, to consider the
information obtained in the course of the Inquiry; to decide whether an infringement is occurring
or has occurred; and if so, to decide on the envisaged action in respect of the controller (if any). In
so doing, I will carry out an independent assessment of all of the materials provided to me by the
Investigator.

2.3 Given that the Commission is the lead supervisory authority under Article 56(1) GDPR for the
purposes of the data processing operations at issue, I was obliged under Section 113(2) and Article
60(3) GDPR to complete the Draft Decision and provide it to the CSAs, as defined in Article 4(22).

2.4 As set out above at paragraph 1.1, this concerns my Decision, having submitted the Draft Decision
under Article 60(3) GDPR to the CSAs, and having taken account of the Article 65 Decision, as
explained in the text of the Decision itself. The purpose of the Draft Schedule and the Preliminary
Draft Decision were to allow the parties to make any submissions in respect of my provisional
findings set out. This is the finalised version of the Schedule and Decision, as also explained in
further detail in the Decision.

DECISION-MAKING PROCESS – MATERIALS CONSIDERED

2.5 The Final Report was transmitted to me on 4 April 2020, together with the Investigator’s file,
containing copies of all correspondence exchanged between the Investigator and the Parties; and
copies of any submissions made by the Parties, including the submissions made by the Parties in
respect of the Investigator’s Draft Report. A letter then issued to the Parties on 17 April 2020 to
confirm the commencement of the decision-making process.

2.6 As decision-maker, I must be satisfied that Facebook is a controller within the meaning of the GDPR,
that the Commission has competence in respect of this Inquiry, and that fair procedures have been
followed throughout the Inquiry. As I have set out above, a number of procedural complaints were
made by NOYB throughout the Inquiry process. These issues are addressed in this Schedule.

163

2.7 The Complainant’s submissions on the Preliminary Draft Decision took issue with this approach. It
was argued that this breached the Complainant’s right to be heard. 302 It was also argued that the
use of the term “materials considered” suggested that there must be some materials that the
Commission did not consider. 303 For the avoidance of doubt, I have considered all material
submitted to me by the Parties, and the entire file in general. There is no question of any breach of
the Complainant’s right to be heard.

FACEBOOK AS CONTROLLER

2.8 In commencing the Inquiry, the Investigator was satisfied that Facebook is the controller, within
the meaning of Article 4(7) of the GDPR, in respect of the personal data that was the subject of
the Complaint. In this regard, Facebook confirmed that it was the controller for data processing
in the European Union in a letter to the Commission dated 25 May 2018, appended to the
Investigator’s Final Report (“the Final Report”) at Appendix 8.

2.9 The concept of controllership is defined in Article 4(7) GDPR which states that a controller is

“the natural or legal person, public authority, agency or other body which, alone or jointly
with others, determines the purposes and means of the processing of personal data;
where the purposes and means of such processing are determined by Union or Member
State law, the controller or the specific criteria for its nomination may be provided for by
Union or Member State law”.

2.10 In considering whether Facebook is a controller within the EU for the purposes of the GDPR, I note
that Facebook’s Dublin office constitutes Facebook’s International Headquarters, and that
Facebook had approximately 1,300 direct employees and several thousand further indirect
employees working for their Dublin office at the time of the preparation of the Preliminary Draft
Decision. 304 Amongst these employees are key data protection personnel, including Facebook’s
Head of Data Protection and Associate General Counsel. In the context of the Commission’s work
as Ireland’s data protection regulator, it has become clear that Facebook determines the purposes
and means of data processing through its role as a global centre of decision-making within
Facebook companies generally, and particularly in relation to the processing of personal data. I
am therefore satisfied that it is a data controller for European (and, indeed, EMEA) users as
defined by Article 4(7) GDPR.

2.11 In relation to the work of the Commission, and my work as Commissioner, it is clear to me based
on direct experience that decisions in relation to the purposes and means of data processing for

302
Complainant Submissions on Preliminary Draft Decision, paragraph 2.2.
303
Ibid, paragraph 3.1.
304
https://www.irishtimes.com/business/technology/facebook-ireland-staff-log-some-of-the-highest-salaries-in-
the-state-1.4096130; https://www.thejournal.ie/facebook-jobs-sheryl-sandberg-4451174-Jan2019/.

164

European data subjects are made by Facebook Ireland Limited (“Facebook”). I note the
submissions made by Facebook on 27 September 2018, in which it stated that it “…is both
responsible for, and has the power to make, decisions about the purposes and means of processing
of personal data from EU data subjects…”. 305 Moreover, the submission stated that:

“Facebook Ireland is the service provider of the Service in the EU and also determines the
purposes and means of processing EU users’ data. It is the only entity with decision-making
power regarding:

• Setting polices governing how EU user data is processed;
• Deciding whether and how our products that involve processing of user data will be
offered in the EU;
• Controlling the access to and use of EU user data; and
• Handling and resolving data-related inquiries and complaints from European users of
the Service whether directly or indirectly via regulators.” 306

2.12 By way of a specific recent example, the Commission attended Facebook’s Dublin office in order
to inspect documents relating to the roll-out of a dating feature. This roll-out was delayed as a
result of concerns expressed by the Commission about the compliance of the feature with data
protection law. In the context of this inspection, it was clear that decisions in relation to this data
processing were made by Facebook, just as other such decisions have been made in the past, and
are made on a daily basis. For these reasons, I am in agreement with the Investigator, and find
that Facebook is a data controller as defined by Article 4(7) GDPR. Specifically, I am satisfied that
Facebook is the data controller for users in the European Union.

COMPETENCE OF THE COMMISSION

2.13 Pursuant to Article 56(1) GDPR, “the supervisory authority of the main establishment or of the
single establishment of the controller or processor shall be competent to act as lead supervisory
authority for the cross-border processing carried out by that controller or processor”. It follows
that the Commission is only competent to act as the lead supervisory authority if (i) Facebook’s
main or single establishment in the Union is located is Ireland, and (ii) there is cross-border
processing as defined in the GDPR.

2.14 I will first consider whether Facebook is the main or single establishment of the Facebook group
within the Union. The term “main establishment” in respect of a controller, is defined in Article
4(16) GDPR as “…the place of its central administration in the Union” where “decisions on the
purposes and means of the processing of personal data are taken.”

305
Facebook Submissions 27 September 2018, paragraph 2.2.
306
Ibid, paragraph 2.4
165

2.15 Facebook confirmed to the Commission, in a letter of 25 May 2018 at Appendix 8 of the Final
Report: “…we wish to formally confirm that the following controllers will have their main
establishment in the European Union in Ireland: Facebook Ireland Limited…”. Furthermore, having
reviewed the Directors’ Report and Financial Statements most recently filed on behalf of
Facebook with the Companies Registration Office (in respect of the financial year ended 31
December 2018), I note that page 3 of the Directors’ Report confirms that:

“Facebook Ireland Limited (“the company”) is a wholly-owned subsidiary of Facebook
International Operations Limited, which is its immediate parent and controlling party.
Facebook International Operations is incorporated in the Republic of Ireland and its
ultimate parent is Facebook, Inc. (“Facebook”), a company incorporated in Wilmington,
Delaware, United States of America.”

2.16 In their submissions of 27 September 2018, Facebook submitted that:

“Facebook Ireland has more than personnel at its headquarters in Dublin who
manage, among other things, the operations and data processing relating to EU users,
including the analysis and exercise of those users’ rights, information security including
user information security, engineering, user support, law enforcement response, data
protection and privacy operations and policy and legal teams including, critically, the data
protection teams. Facebook Ireland’s senior decision makers operate in cross-functional
teams, which include representatives from its Legal, Policy, Law Enforcement Response,
Community Operations, Information Security, and Privacy Operations. The DPO and his
office provide oversight of these teams and their work. These decision makers formulate
user data processing policies and oversee the implementation of these policies in respect
of users of the Service in the EU. On a daily basis, Facebook Ireland’s personnel are
responsible for managing the personal data of EU users and determining the means and
purposes of processing this personal data.” 307

2.17 In this regard, I further note that the Investigator, and the Commission generally, was satisfied, in
commencing the Inquiry, that Facebook was the main establishment in the European Union within
the meaning of Article 56(1) GDPR. I further note that nothing has been brought to my attention
to suggest that the position, in this regard, has changed since I considered it in the context of the
preparation of the Preliminary Draft Decision.

2.18 As I have already observed, Facebook’s headquarters in Dublin constitutes Facebook’s
International Headquarters. Moreover, I have already found, for the reasons set out above, that
decisions on the purposes and means of the processing of personal data are taken by Facebook.
For these reasons and the reasons already set out above, I am satisfied that Facebook Ireland is
Facebook’s place of central administration in the Union. I am also satisfied, on the information

307
Ibid, paragraph 2.9.
166

available to me, that decisions which relate to the means and purposes of data processing are
made by Facebook.

2.19 To turn to cross-border processing, cross-border processing is defined in Article 4(23) GDPR as
either:

“(a) processing of personal data which takes place in the context of the activities of
establishments in more than one Member State of a controller or processor in the Union
where the controller or processor is established in more than one Member State;
or

(b) processing of personal data which takes place in the context of the activities of a single
establishment of a controller or processor in the Union but which substantially affects or
is likely to substantially affect data subjects in more than one Member State.”

2.20 In its submissions dated 27 September 2018, Facebook confirmed that “Facebook Ireland provides
the Service to hundreds of millions of users across the EU and in doing so is engaged in cross-
border processing pursuant to Article 4(23) GDPR.” 308

2.21 I also note that the Investigator was satisfied that there was cross-border processing carried out
by Facebook (within the meaning of Article 4(23) GDPR), in relation to the personal data that was
the subject of the Complaint. 309 Given the scale of Facebook’s operations across the European
Union outlined above, I am satisfied that there is cross-border processing as defined in the GDPR
for the purposes of this Complaint.

2.22 I am satisfied based on the above evidence secured through publicly available sources,
information voluntarily provided by Facebook, and information acquired by the Commission in
the course of conducting investigations, that Facebook is the data controller for EU users and is
the organisation’s place of central administration in the Union. I am also satisfied, for the reasons
set out above, that this Complaint concerns cross-border processing. I therefore agree with the
Investigator that Facebook meets the definition of “main establishment” in Article 4(16) GDPR,
and that therefore the Commission is competent to act as lead supervisory authority in
accordance with Article 56 GDPR.

ISSUES OF AUSTRIAN LAW

2.23 The next procedural issue is an overarching point that is relevant to each of the other individual
points raised by the Complainant, and so I will consider this point before considering the other
points in turn. This Complaint was lodged with the Austrian DPA, who then transferred the

308
Facebook Submissions 27 September 2018 paragraph, 2.7.
309
Final Report, page 19-20.
167

Complaint to the Commission as lead supervisory authority in accordance with Article 56 GDPR.
The Commission then launched a statutory inquiry in accordance with Irish law. The Complainant,
however, argues that because the Complaint itself was lodged with the Austrian DPA in Austria,
the Complaint must be handled in accordance with the procedural laws of both Austria and
Ireland. The Complainant’s representative has initiated legal proceedings in Austria against the
Austrian DPA in this regard (“the Austrian Proceedings”).

2.24 Briefly, and by way of background, the Austrian Proceedings arise out of a formal complaint made
by the Complainant to the Austrian DPA (“the Austrian Complaint”). The Austrian Complaint argues
that the Commission has contravened Austrian law by not adhering to the relevant procedural rules
and not applying Austrian contract law to this Complaint. The Complainant also argues that the
Commission has contravened Austrian law by not considering certain matters that the Complainant
deems to be within the scope of the Complaint. On this basis and others (which are not directly
relevant for these purposes), the Complainant asks that the Austrian DPA lift a suspension currently
in operation on its handling of the Complaint so that it can also deal with that same Complaint. The
Austrian DPA rejected these arguments for a number of reasons, including that it cannot act while
the Commission’s procedures are ongoing. The Complainant has appealed this decision of the
Austrian DPA in the Austrian courts, resulting in the Austrian Proceedings.

2.25 The Complainant made similar arguments in its submissions to the Investigator, 310 and specifically
argues that the applicable procedural law is the Allgemeines Verwaltungsverfahrengesetz (“the
AVG”), Austria’s code of administrative procedure. It is the Complainant’s view that the AVG
permits the alteration of the scope of a procedure in particular circumstances, and seeks to rely on
this in order to dispute the Investigator’s view of the scope of the Complaint, and to alter that scope.
My decision on procedural matters relating to the scope of the Complaint is considered in detail
below, and at this point I am solely considering the applicability or otherwise of the AVG to the
actions of the Commission in general.

2.26 As the decision-maker at the Commission, I take no view on the Complainant’s characterisation of
the AVG or of any other questions of Austrian law. The Commission was established in Ireland by
the 2018 Act, thereby meeting Ireland’s obligations to establish such an authority under Article 51
(and Chapter VI generally) GDPR, given it is directly applicable in Ireland pursuant to Article 288 of
the Treaty on the Functioning of the European Union. Section 12 of the 2018 Act provides a number
of functions for the Commission “in addition to the functions assigned to the Commission by virtue
of its being the supervisory authority for the purposes of the Data Protection Regulation”.

2.27 Chapter VI of the GDPR sets out in detail the responsibilities and powers of supervisory authorities.
While it is not necessary to set out Chapter VI here, it is noteworthy that Article 51(1) GDPR states
that “[e]ach Member States shall provide for one or more independent public authorities to be
responsible for monitoring the application of this Regulation” [my emphasis]. Moreover, Section 12

310
Complainant Submissions of 9 September 2019, paragraph 1.1.
168

of the 2018 Act does not confer any powers on the Commission in respect to the laws of any other
jurisdiction.

2.28 The powers of the Commission must be limited to those conferred on it by law. The Commission is
tasked with encouraging, monitoring and enforcing compliance with the GDPR. In that context it is,
like all other public authorities in the State, bound by the administrative law of Ireland and EU law,
including EU law on fair procedures and the European Charter of Fundamental Rights and
Freedoms. Further, as I stated above, Article 56(1) GDPR sets out that “the supervisory authority of
the main establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority”.

2.29 The Commission therefore derives its legal authority to handle the Complaint from the GDPR and
the 2018 Act, and is, in that regard, bound by the legal order set out above. The Commission is not
bound, nor must it have regard to, the administrative law of Austria, or of any other jurisdiction.
Moreover, it seems to me that not only does the administrative law of Austria not bind the
Commission, but that any attempt by the Commission to apply such law would be plainly ultra vires
the powers conferred on the Commission by law.

2.30 The parties were afforded an opportunity to address the provisional conclusions reached in the
Schedule to the Preliminary Draft Decision. In making the argument that this position was “an
archaic and purely nationalistic idea of international law”, the Complainant’s submissions advance
the position that, while the Commission operates under Irish and EU law, it must at times interpret
the AVG. This is said to include interpreting and applying Austrian law in order to determine the
scope of the complaint. 311 It is also argued that the Commission has failed to cooperate with the
Austrian DPA by asking for clarifications on the nature of the law.

2.31 To address the latter issue first, the Commission has cooperated in full with the Austrian DPA
throughout this Inquiry.

2.32 In relation to the possible application of Austrian procedural law, at no point do the Complainant’s
submissions point to any legal authority for the proposition that the Commission must interpret
and apply aspects of Austrian procedural law to this Complaint, beyond the citation of the
provisions of Austrian law themselves which are said to be relevant. The Commission has not sought
clarifications on Austrian procedural law given the Commission does not accept, and has not been
presented with any legal authority for, the suggestion that it must apply, interpret, or in any way
consider the procedural law of Austria.

2.33 No further distinct argument was made to elaborate on why Austrian law would be applicable to
any procedure being conducted by an Irish supervisory authority in Ireland. The Commission is
established under Irish law, specifically the Data Protection Act 2018, and must exercise its

311
Complainant submissions on Preliminary Draft Decision, page 7.
169

functions under and in accordance with the 2018 Act and applicable EU law, including, in particular,
the GDPR. This being so, I find that I am not obliged to apply Austrian procedural law in the exercise
of my functions in this Inquiry. Indeed, it must be open to doubt whether the Commission would
ever have jurisdiction or competence to do so.

ALLEGATION OF BIAS

2.34 As has been set out above, the Complainant wrote to the Investigator on 3 December 2018 raising
a number of procedural issues, including an allegation of bias on the part of the Commission, which
I will address here. I will subsequently address the Complainant’s allegation that the manner in
which the Commission dealt with the scope of the Complaint was contrary to its right to fair
procedures, before considering the substantive question of the scope of the Complaint under
examination.

2.35 In the letter dated 3 December 2018, the Complainant alleged that there had been prior
“approval” by the Commission of the legal bases used by Facebook for processing personal data.
This was based in part on a statement made in Vienna’s Landesgericht (Regional Court) that the
“used legal basis for the processing of data under GDPR was developed under extended regulatory
involvement by the [Commission] in multiple personal meetings between November 2017 and July
2018”. 312 In the letter, the Complainant stated that “[t}his does not just raise questions about your
claim that you have to “investigate” and “inquire” [sic.] this matter – when in fact you have already
negotiated with the Facebook Group about these legal and factual questions between 2017 and
2018, but raises issues about an obvious bias of a decision maker that has previously approved the
criticized mechanism.” 313

2.36 In the same letter, the Complainant referred to the existence of a rule against bias in both Ireland
and in Austria, but did not elaborate on its legal views of the nature of the test in either
jurisdiction, and did not present any arguments explaining why, in its view, the Commission had
acted in a manner that contravened any such test. Moreover, the Complainant offered no
evidence to substantiate the factually inaccurate claim that the Commission “previously
approved” the “mechanism” in question or to substantiate the allegation that the consultation
process gave rise to the apprehension of bias.

2.37 The Investigator responded to this and other allegations in a letter dated 16 January 2019. The
Investigator correctly observed that the allegations of bias were unsubstantiated, and confirmed
that “[the Commission] does not and never has, endorsed, jointly developed, approved or in any
other way assented or consented to a controller’s or processor’s policies or position in relation to
compliance with its data protection obligations.” It was clarified that the interactions referred to
by the Complainant were for the purpose of “being updated…and being providing high level

312
Case 3Cg52/14k at the LGfZRS Wien, paragraph 209.
313
Letter from Complainant to Commission 3 December 2018.
170

feedback” to both Facebook and to a large number of other private and public sector
organisations with which the Commission interacts as part of its “consultation and engagement
with regulatory stakeholders.” I agree with the Investigator’s view just set out, for the reasons
which I have set out above.

2.38 I also note and agree with the Investigator’s statement in the same letter that outlined the
Commission’s statutory obligations under the Data Protection Acts 1988 and 2003, which were in
force at the time. This also applies, as was pointed out by the Investigator, under Article 57 GDPR.
The Commission implements these obligations to promote awareness of data protection law by
maintaining an active consultation function. The Investigator also clarified that the Commission
“makes it abundantly clear to any organisation that seeks to consult with it that this is the premise
upon which consultation takes place and that it is entirely a matter for that organisation to ensure
that it is in compliance with data protection law.” This is, in my view, an accurate characterisation
of the position. In a subsequent telephone call with staff of the Commission on 25 January 2019,
Mr. Schrems, raised the matter of bias once again. At this point, a Deputy Commissioner at the
Commission, reiterated the DPC’s position, in this regard, to Mr. Schrems. 314

2.39 This issue of bias was not raised again until the Complainant furnished the Investigator with
submissions on the Draft Report dated 9 September 2019. For the sake of completeness, the
entirety of the Complainant’s submission, in this regard, is set out below:

“Since it follows from Facebook's submission (e.g. page 2 of the submissions of 27. 9. 2018)
that the Irish DPC even worked out (!) the procedure criticised in the complaint together with
Facebook in ten sessions, the problem of bias is once again drawn to attention.

It seems difficult to imagine, for example, that the authority could make use of its power to
issue penalties if it had worked on the punishable conduct with Facebook in advance. This also
gives rise to a potential conflict with the GDPR, which provides in Article 83(1) for "effective,
proportionate and dissuasive" penalties.

We do not yet know how the Irish authority intends to take case [sic.] of this problem and we
expressly reserve the right to appeal any decision on this basis.” 315

2.40 As is evident from this quotation, the Complainant offered no specific evidence in respect of this
unsubstantiated allegation that “the Irish DPC even worked out(!) the procedure criticised in the
complaint together with Facebook”. Moreover, no reference is made to the Commission’s
clarification that no approval or authorisation for the Terms of Service was provided to Facebook
by the Commission. The premise of the Complainant’s argument, as had already been pointed out
by the Investigator, is incorrect. The reference to “meetings” in Facebook’s submissions cited by

314
Memorandum of phone call, 25 January 2019.
315
Submissions of Complainant 9 September 2019, pages 6-7, paragraph 1.8.
171

the Complainant in the above quotation is the only reference to the Commission’s consultation
function in any submissions made by Facebook in relation to this Inquiry. The reference is as
follows:

“We have drafted this response against the background of our detailed direct engagement
with the Commission prior to the implementation of the recent update to our terms, spanning
10 meetings, which covered many of the issues responded to herein. Facebook Ireland has not
materially changed its compliance approach since these meetings.”

2.41 It is clear that this is a reference to a consultative process, and at no point does Facebook assert
that the Terms of Service were approved or endorsed by the DPC; it is merely asserted that these
Terms of Service have not changed since a consultation process took place. Facebook would of
course not be entitled to rely on remarks made in such meetings. In addition, it is not clear to me
how Facebook can be said to be using the above statement to support its legal position, or indeed
any argument, in relation to the Inquiry. For the purpose of providing additional context, I also
emphasise that this quotation is taken from a two-page covering letter preceding submissions to
the Commission in the context of the Inquiry as opposed to being extracted from the body of such
submissions to the Commission.

2.42 Finally, this matter was raised, indirectly, in the form of an “open letter” published by NOYB and
sent to other European Data Protection Authorities and to the European Data Protection Board
(“the EDPB”). In this letter, public allegations were made about the Commission’s cooperation
with what the Complainant calls Facebook’s “consent bypass”. 316 To the extent that this letter
directly addresses the allegation of bias at all, it once again proceeds on the false factual premise
that that Facebook “simply followed the [Commission]’s advice.” It is further alleged that this
renders the Commission’s processes “structurally biased because it is essentially reviewing its own
legal advice”. It has already been clarified above that, contrary to this assertion, the Commission
did not approve any such mechanism, nor did it provide legal advice to Facebook. It has also been
clarified that Facebook has in fact not sought to rely on such consultations in this Inquiry.

2.43 In the open letter, it was alleged that “[k]eeping these meetings confidential is only adding to the
impression that the [Commission] and Facebook have engaged in a relationship that is
inappropriate for a neutral and independent oversight authority.” 317 Aside from the fact that the
Commission’s consultation function is widely publicised, such an allegation has no basis in law.
The relevant facts have been provided to the Complainant by the Commission on multiple
occasions, and a reasonable and objective explanation of those facts has been provided to the
Complainant by the Commission on multiple occasions.

316
Open letter of NOYB, page 3, https://noyb.eu/sites/default/files/2020-05/Open%20Letter_noyb_GDPR.pdf.
317
Ibid.
172

2.44 It is factually not the case that the Commission endorsed or approved of the Terms of Service and
Data Policy of Facebook or indeed of any other organisation. Moreover, irrespective of any
feedback that may or may not have been provided to Facebook or any other organisation, the
Commission always emphasises that the consultation function is entirely distinct from any
statutory inquiries, investigations, or decisions of the Commission. I also emphasise that this
decision-making process is also functionally independent of the procedure conducted by the
Investigator that led to the Final Report, just as the statutory inquiries are functionally
independent from any and all consultations with the Commission. The factual premise of the
allegation is incorrect, and the test for bias has not been met.

2.45 The parties were afforded an opportunity to address the provisional conclusions reached in the
Schedule to the Preliminary Draft Decision. The Complainant disagrees that no evidence of bias
has been provided, and points to a statement made in an Austrian court by a representative of
Facebook. That statement consists of the quotation in paragraph 2.32 above. I have set out my
views on that statement. The Complainant goes on to argue that “[t]he DPC has also never
provided any evidence, memo or other evidence to substantiate its claims that these meetings did
not have the substance that Facebook alleged”. 318 This does not in any way the substantiate the
serious allegation of bias made by the Complainant.

2.46 Firstly it has not been denied by the Commission or Facebook that “these meetings did not have
the substance that Facebook alleged”. The presence of engagement and consultation does not of
course, in and of itself, suggest approval of any kind. Any decision by Facebook, or an individual
employee of Facebook, to reference such meetings in the context of defending particular
practices is a matter for Facebook. In this regard, it is relevant to note that the Commission is not
party to the Austrian proceedings referred to by the Complainant. To the extent that Facebook
seeks to rely on or has ever relied on any consultative process with the Commission in order to
defend the lawfulness of a particular practice, this has been in error. More pertinently, for present
purposes, Facebook makes no such argument in the context of this Complaint. This is because the
Commission never provided any such approval in this case nor does it do so in the context of its
engagement and consultation role more generally. Unfortunately the Complainant and/or her
representative has chosen to rely on one specific isolated statement – in proceedings to which
the Commission is not a party - and to make assumptions on the basis of that statement which
do not correspond to the factual position. In circumstances where the allegation of bias has not
been substantiated, I must reject that allegation.

2.47 I am therefore satisfied that fair procedures have been followed in this and every regard thus far
throughout the Inquiry.

3. THE SCOPE OF THE COMPLAINT AND INQUIRY

318
Complainant Submissions on Preliminary Draft Decision, page 8.
173

PROCEDURAL ISSUES SURROUNDING THE SCOPE OF THE COMPLAINT

3.1. The question of scope is also considered in the main body of this Decision, and therefore this
section is to be read in conjunction with the Decision. The Complainant also alleged that in
determining the scope of the Complaint and in not allowing the Complainant to revise the scope
of that Complaint, the Commission was acting contrary to the Complainant’s right to fair
procedures. In the letter dated 3 December 2018, the Complainant specifically articulated its view
that it objected to a “one shot” approach, and instead argued it should be afforded the
opportunity to respond to Facebook’s views on the Complaint. These arguments were necessarily
linked to the Complainant’s assertion of a right of access to all of Facebook’s submissions to the
Commission in respect of this Complaint, an issue which has now been disposed as these
submissions have been shared with the Complainant on a voluntary basis, as described above.
The Complainant sought to advance the argument that the Commission should engage in an open-
ended inquiry into each individual processing operation carried out by Facebook.

3.2. In response, in the letter dated 16 January 2019, the Investigator informed the Complainant that:

“the DPC has identified two main issues (each with associated sub-issues for
consideration, as detailed in our most recent communication to you) which are the
primary focus of that statutory inquiry. The DPC considers that all data protection matters
raised in your complaint fall within these two main issues, as set out in detail in our letter
dated 23 November 2018. As such the DPC’s position is that the scope of the current
inquiry captures all elements of the Facebook complaint.”

3.3. This matter was not raised again until the Complainant contacted the Investigator by email on 23
March 2019 seeking an update on the status of the Complaint. The Investigator responded by
letter dated 28 March 2019. This letter outlined the procedure that would be followed going
forward, and the Investigator also reaffirmed that “the DPC notified NOYB of its view concerning
the scope of inquiry C-18-5-5.”

3.4. The Complainant wrote to the Investigator by letter dated 19 April 2019, and addressed the issue
of the scope of the Complaint further. The Complainant stated that “we reserve the right to amend
our arguments should one of the controllers seek to depart from the factual or legal premises our
complaints were based on.” It was also emphasised, in that regard, that “the complaints explicitly
states that the complaints are based on our knowledge at the time of submission”. Contrastingly,
Facebook argued that the Complaint’s scope should be strictly limited to processing that was
Facebook processed on foot of consent.

3.5. In the Draft Report, the Investigator relied on a statement in the Complaint which read:

174

“For practical reasons, the scope of this complaint is explicitly limited to any processing
operations that are wholly or partly based on Article 6(1)(a) and/or Article 9(2)(a) of the
GDPR. Our current understanding is, that these are used as bases for all processing
operations described in the controller’s privacy policy…” 319

3.6. The Investigator went on to consider in detail the contents of the Complaint, including its focus
on the Complainant’s view that all data processing pursuant to the data subject’s acceptance of
the Terms of Service was based on consent. 320 The Investigator also set out that, in the words of
the Complainant, the Complaint rested on a “preliminary assumption” that all processing carried
out pursuant to the Terms of Service was based on consent or, alternatively, that all processing
based on these documents “simply has no legal basis”. 321 The Investigator observed that the legal
analysis in the Complaint was confined to the issue of consent. 322

3.7. Having outlined the scope, the Complaint then states that “[n]evertheless, nothing in this
complaint shall indicate that other legal bases the controller may rely on are not equally invalid or
may not be equally the subject of subsequent legal actions.” 323 This qualifying remark, while
alluding to the fact that the Complainant may have other views in relation to other legal bases for
data processing carried out by Facebook, is evidently not one that describes the character of the
Complaint in question. While such a remark clearly refers to hypothetical positions the
Complainant may have or take in the future, it cannot alter the limiting character of the preceding
statement in and of itself. It instead clarifies that the Complainant reserves its position in respect
of any other legal bases on which Facebook may or may not rely.

3.8. Having taken an objective reading of the Complaint, the Investigator concluded that the issues
that arose were:

• Issue (a): the acceptance of the Terms of Service and/or Data Policy was an act of consent;
• Issue (b): Facebook cannot lawfully rely on necessity for the performance of a contract to
process data arising out of the data subject’s acceptance of those same documents;
• Issue (c): Facebook misrepresented the legal basis for processing this data; and
• Issue (d): Facebook failed to provide the necessary information regarding its legal basis
for processing this data.

3.9. In its submissions on the Draft Report, the Complainant argued that “the DPC believes it can
exclude certain questions from the proceedings and arbitrarily determine a scope of procedure

319
Complaint, paragraph 1.6.
320
Draft Report, Page 5.
321
Ibid, page 6.
322
Ibid, page 7.
323
Complaint, Paragraph 1.6.

175

based on the hypothetical or guessed will of the complainant”. 324 The assertion was made that
“[i]t is also not alien to Irish procedural law that a request may be amended if, based on the
defendant's submissions, another alleged legal basis for data processing arises.” 325

3.10. The Investigator gave consideration to these submissions and ultimately did not revise his view. 326
Facebook also remained of the view that, contrary to both the view of the Investigator and the
Complainant, the Complaint should be strictly limited to data processing carried out, as a matter
of fact, on the basis of consent. 327 The Investigator found that it was not necessary to engage in a
factual “trawl” of each one of Facebook’s processing operations, but instead to carry out a legal
and factual analysis based on the objective content of the Complaint itself. 328 This was not based
on an assessment of the “will” of the Complainant, hypothetical or otherwise, but simply on an
assessment of the content of the Complaint.

3.11. In submissions on the Schedule to the Preliminary Draft Decision, the Complainant maintained
this position. Not only were further arguments made in support of the argument that the
Commission has breached the Complainant’s right to fair procedures by misinterpreting the scope
of the Complaint, but the Complainant’s submissions also accuse the Commission of either
“simply not understand[ing] or read[ing] large parts of – or, as it seems to us wilfully
mischaracterises the submissions of the Complainant”. 329 These most serious accusations are
refuted by the Commission in the strongest of terms. For the avoidance of doubt, the Commission
has given full consideration to all relevant material, including, but not limited to, all submissions
made by the Complainant. The Commission also rejects the unfounded accusations of mala fides
that are made in the alternative in this regard.

3.12. The Complainant also relies on Austrian procedural law in the submissions on the Preliminary
Draft Decision in order to argue that the Complaint should be interpreted in a particular manner.
In this regard I reiterate that there is no legal authority for the proposition that the Commission
is bound to interpret and apply Austrian procedural law to the Complaint, and further note that
the Complainant has been unable to produce such authority despite having ample opportunity to
do so. In particular the Complainant argues that the core of the Complaint’s scope is the “remedy”
being sought, i.e. a ban on all processing carried out on foot of the “consent bypass”. 330 It goes
without saying that in order for such a ban to become relevant to any procedure, there must be
a finding of a breach of the GDPR on the basis alleged in the first instance. This is why the first
step in any such analysis involves considering the infringement in advance of this proposed
“remedy”.

324
Submissions of 9 September 2019, page 5, paragraph 1.3.
325
Ibid.
326
Final Report, page 18.
327
Ibid, page 11.
328
Ibid, page 13.
329
Complainant Submissions on Preliminary Draft Decision, page 5.
330
Ibid, page 8.
176

3.13. The Commission, in the Preliminary Draft Decision, considered the allegation that an infringement
is taking place in the form of unlawful processing arising from the alleged consent bypass. The
Commission has considered further submissions from the Parties in this regard, and formed a view
in the Draft Decision. It is difficult to see how the absence of the exercise of a particular corrective
power, which necessarily can only be imposed if the Commission finds that an alleged
infringement has made out, can be characterised as a failure to deal with the entire scope of a
Complaint.

3.14. The Complainant also alleges that it has been unable to respond to Facebook’s “defence”. The
Complainant submits that there has been no opportunity to respond to Facebook’s argument that
it actually relies on a different legal basis for processing personal data to the one the Complainant
thought it relied on. 331 On the contrary, the Complainant has made extensive submissions on this
argument that has been put forward by Facebook, both in its submissions on the Draft Report and
in its submissions on the Preliminary Draft Decision. Contrary to what is argued on the
Complainant’s behalf, no dispute has been “removed” from scope. Both legal bases that have
arisen over the course of this Inquiry are fully considered in the Decision, as they were considered
in the Preliminary Draft Decision.

3.15. I must make an assessment as to whether the Complainant’s specific allegations of procedural
unfairness in how this was addressed by the Commission thus far have merit. In the “open letter”
to which I have already referred, the Complainant alleged that “the Investigator departed from
the applications that were made in accordance with Austrian procedural law and decided to
investigate only certain elements of our complaint and to reinterpret our requests.” 332

3.16. It does not seem to me that the above quotation is an accurate characterisation of what has taken
place. I have already (as had the Investigator) set out views on why Austrian procedural law does
not apply to the activities of the Commission. The merits or otherwise of the Investigator’s
objective analysis of the content of the Complaint is addressed later in this section. I do not accept,
however, that there is, in principle, a procedural defect in limiting the scope of a complaint-based
inquiry to the objective contents of the very Complaint that led the Commission to conduct an
Inquiry. As well as conforming to Section 113 of the 2018 Act (set out earlier in this Section of the
Schedule), this approach is perfectly logical.

3.17. The Complainant’s arguments in relation to any alleged procedural defects in the manner in which
the scope of the Complaint is to be determined, i.e. by the objective content of the Complaint,
are based on Austrian Administrative law, and particularly on the AVG. Insofar as that those
arguments are based on Austrian law, for reasons already set out, the Commission cannot
consider those arguments, save to the extent that they raise issues of either Irish or EU law. I note

331
Ibid, paragraph 3.4.1.
332
Open letter, page 6 https://noyb.eu/sites/default/files/2020-05/Open%20Letter_noyb_GDPR.pdf.
177

that Facebook did not make submissions on the issue of the applicability or otherwise of the AVG
during this Inquiry.

3.18. Moreover, as I have set out, the decision to conduct a complaint-based Inquiry arising out of the
contents of a Complaint seems to me to be a perfectly logical approach. The alternative would be
an open-ended procedure, where the content of a “complaint” would crystallise at some
unspecified future date. The inherent problem with such an approach is that it would not amount
to an inquiry based on the Complaint which was lodged with the Commission, but would instead
be an inquiry directed by the Complainant, with its subject matter and steps dictated on an
evolving and ongoing basis by the Complainant. Furthermore, it is unclear how it could be said
that such an approach constitutes a complaint that concerns personal data relating to the
complainant. This would presumably only occur once a complainant is satisfied of receipt of all
information they might require, and has been afforded the opportunity to amend the complaint
itself based on the submissions of the other party.

3.19. The unfairness that could arise from such an approach stems from the fact that it would, in effect,
enable a form of post-hoc amendment to an existing complaint over the course of an indefinite
period of time, which could only come to an end at a time and in a manner of the Complainant’s
choosing. This would not only amount to a fundamentally one-sided approach, but would also
alter the character of the inquiry to the extent that it could no longer be described as “complaint-
based”, but rather “complainant-led”.

3.20. This also applies to aspects of the Complaint that either reserve the Complainant’s position or
express views on hypothetical investigative and/or corrective powers that, in the Complainant’s
personal view, the Commission should exercise. I see no breach of fair procedures in considering
the Complaint as a whole in order to determine the exact infringements being alleged. There is
no procedural right to make generalised requests to the Commission to either conduct broad-
based investigations or exercise particular corrective powers in the context of a complaint. In any
case, as I have also set out above, the question of a “remedy”, here a ban on processing (which
now is said by the Complainant to be at the core of the Complaint), can only arise when a
particular infringement involving unlawful processing has been made out.

3.21. The Complainant, having lodged the Complaint via the Austrian DPA, responded to the Draft
Report, which set out clearly the submissions of Facebook and the Investigator’s views on same.
The Complainant will also be afforded the opportunity to make submissions on the Preliminary
Draft Decision. No suggestion has been made that the alternative procedure proposed by the
Complainant is a requirement of Irish law, nor that the procedure that has been followed in
relation to the scope breaches any rules of fair procedures in Irish law. Moreover, I am unaware
of any case law or statutory provisions in Irish law or EU law that suggests that such an approach
is contrary to the Complainant’s right to fair procedures, and the Complainant has not referred to
any such law in its submissions.

178

SUBSTANTIVE SCOPE OF THE COMPLAINT

3.22. Put in high-level terms, this complaint-based Inquiry concerns the requirement under EU data
protection law for any entity collecting and processing personal data to establish “a lawful basis”
for the processing under Articles 6 GDPR. This particular Complaint was lodged by reference to
Facebook and its lawful basis for processing user personal data and “special category” personal
data. I have set out, in summary form, the contents of the Complaint and arguments contained in
it at Section 2 of this document.

3.23. “Personal data” is defined under Article 4(1) GDPR as:

“any information relating to an identified or identifiable natural person (‘data subject’);
an identifiable natural person is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an identification number, location
data, an online identifier or to one or more factors specific to the physical, physiological,
genetic, mental, economic, cultural or social identity of that natural person”.

3.24. Moreover, Article 4(13) GDPR defines the “genetic data” referred to above as:

“personal data relating to the inherited or acquired genetic characteristics of a natural
person which give unique information about the physiology or the health of that natural
person and which result, in particular, from an analysis of a biological sample from the
natural person in question”.

3.25. Article 4(14) GDPR defines “biometric data” as:

“personal data resulting from specific technical processing relating to the physical,
physiological or behavioural characteristics of a natural person, which allow or confirm
the unique identification of that natural person, such as facial images or dactyloscopic
data”.

3.26. Finally, “data concerning health” is defined by Article 4(15) GDPR as:

“personal data related to the physical or mental health of a natural person, including the
provision of health care services, which reveal information about his or her health status”.

3.27. The other special categories or personal data referred to in Article 9 GDPR are not defined in the
GDPR.

179

3.28. As set out above, Article 6 GDPR sets out the lawful bases for the processing of personal data. The
provisions of Article 6 that arise in this complaint-based Inquiry are the first two lawful basis listed
in the Article, in Articles 6(1)(a) and 6(1)(b) GDPR. Article 6(1) GDPR states:

“6. 1 Processing shall be lawful only if and to the extent that at least one of the following
applies:

(a) the data subject has given consent to the processing of his or her personal data for one
or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is
party or in order to take steps at the request of the data subject prior to entering into a
contract;

(c) processing is necessary for compliance with a legal obligation to which the controller
is subject;

(d) processing is necessary in order to protect the vital interests of the data subject or of
another natural person;

(e) processing is necessary for the performance of a task carried out in the public interest
or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the
controller or by a third party, except where such interests are overridden by the interests
or fundamental rights and freedoms of the data subject which require protection of
personal data, in particular where the data subject is a child.

Point (f)f the first subparagraph shall not apply to processing carried out by public
authorities in the performance of their tasks.”

3.29. A number of conditions for consent are enumerated in Article 7 GDPR:

“1. Where processing is based on consent, the controller shall be able to demonstrate that
the data subject has consented to processing of his or her personal data.

2. If the data subject’s consent is given in the context of a written declaration which also
concerns other matters, the request for consent shall be presented in a manner which is
clearly distinguishable from the other matters, in an intelligible and easily accessible form,
using clear and plain language. Any part of such a declaration which constitutes an
infringement of this Regulation shall not be binding.

3. The data subject shall have the right to withdraw his or her consent at any time. The
withdrawal of consent shall not affect the lawfulness of processing based on consent

180

before its withdrawal. Prior to giving consent, the data subject shall be informed thereof.
It shall be as easy to withdraw as to give consent.

4. When assessing whether consent is freely given, utmost account shall be taken of
whether, inter alia, the performance of a contract, including the provision of a service, is
conditional on consent to the processing of personal data that is not necessary for the
performance of that contract.”

3.30. Article 13(c) GDPR requires data controllers to provide information to data subjects on “the
purposes of the processing for which the personal data are intended as well as the legal basis for
the processing”.

3.31. Article 12(1) GDPR requires that “[t]he controller shall take appropriate measures to provide any
information referred to in Articles 13 and 14…to the data subject in a concise, transparent,
intelligible and easily accessible form, using clear and plain language…”.

3.32. Unusual circumstances arise in relation to this Complaint because of its very starting-point,
namely, the assertion that clicking on Facebook’s Terms of Service purported to bring all personal
data processing under the lawful basis of consent for the purposes of Article 6(1)(a) GDPR. This
starting point was rejected in Facebook’s submissions. While the Investigator did not agree with
the entirety of Facebook’s submissions by any means, he also rejected this premise. I also rejected
it in the Draft Decision. This rejection of the foundational premise of the Complaint has inevitably
rendered the overall subject-matter of the Complaint effectively less cohesive.

3.33. The Complaint also refers to processing of special category data covered by Article 9 GDPR. The
Complainant’s submissions on the Draft Report make further arguments in this regard,
particularly in relation to medical data and in relation to special category data processed by
Facebook on the consent of the user (such as facial recognition data). Facebook’s position is that
it does not process any special category data arising out of the acceptance of the Terms of Service,
but only arising from data for which consent is specifically sought.

3.34. In the Draft Decision, I expressed the view that, for the reasons set out above and the additional
reasons set out below where I make conclusions on the scope of the Complaint, the Complaint
even taken at its height quite clearly only concerns data processing arising out of accepting the
Terms of Service. The Complainant’s central arguments on “forced consent” are predicated on
the assertion by the Complainant that accepting the Terms of Service is forcing a consent to
personal data processing for the purposes of the GDPR. Moreover, the Complainant’s
representative has made clear that it views the core of the Complaint as asking for a ban on the
processing of data being processed on foot of the “consent bypass”. In order to establish an
entitlement to such a remedy, it must be established that accepting the Terms of Service results
in unlawful data processing. Whether one focuses on the acceptance of the Terms of Service or
on the remedy sought, the lawfulness of the processing arising from this acceptance, either
181

pursuant to consent under Article 6(1)(a) GDPR or necessity for the performance of a contract
under Article 6(1)(b) GDPR, was, in my view, clearly at the heart of this Complaint.

3.35. I did not however, in the Draft Decision, accept that the processing of sensitive categories of
personal data on the basis of Article 9 GDPR consent fell within the scope of this Inquiry. Facebook
undoubtedly does process special category data on the basis of explicit consent under Article 9
GDPR on its platform including in terms of the separate consent collected for its facial recognition
feature. I expressed the view, in the Draft Decision, that the Complaint was one about whether
the Terms of Service (which is the contract with the user) are a deliberately veiled and inadequate
means of forcing consent under GDPR, or whether they are, as Facebook contends, a contract
with the user for which certain data processing is necessary in order to perform that contract.

3.36. The Complaint considered Article 9 GDPR in circumstances where the Complainant was of the
view that consent was being sought to process personal data (including special category data). It
subsequently came to light that Facebook relied on Article 6(1)(b) GDPR for the processing
complained of. The Complainant has presented no evidence to suggest that any of this processing
carried out on foot of Article 6(1)(b) GDPR involves processing special category data. As this legal
basis is not contained within Article 9 GDPR, such processing would obviously be unlawful if it
were taking place. It is denied by the controller that such processing is taking place, no evidence
has been presented that it is taking place, and no allegation has been made that it is taking place
(aside from in the context of the Complainant’s initial mistaken view that the processing
complained of is based on consent). I therefore was unable to see, when preparing the Draft
Decision, how Article 9 GDPR properly remained within the scope of this Complaint as it is now
understood by the Parties. As set out in paragraph 2.23 of this Decision, the EDPB, in the Article
65 Decision, took a different view, on this particular issue.

3.37. Having reviewed and considered all of the material submitted by the Complainant, I concluded,
in the Draft Decision, that the core of the issues raised by the Complainant were as follows:

a. Accepting the Terms of Service offered by Facebook in April 2018 specifically constituted
an act of consent to personal data processing under the GDPR. The precise extent of the
processing complained of is unclear in the Complaint. A particular focus was, however,
placed on both processing in order to deliver behavioural advertising, and on special
category data. The Complainant takes issue with any unlawful processing based on this
agreement, whatever that agreement’s legal character might be. 333

333
Complainant Submissions on Preliminary Draft Decision, paragraph 3.4.3.

182

b. The Complainant argues that 6(1)(a) GDPR, i.e. consent, is the mandatory, default lawful
basis for personal data processing where there is a contract or agreement primarily
concerned with personal data processing. 334

c. Consent under the GDPR is simply an indication of agreement by the data subject
according to the Complainant. The necessary attributes of freely given, specific, informed
and unambiguous are merely “conditions for its validity”, but not features of objective
“consent”.

d. As an alternative to point (a), Facebook is not entitled to rely on the “necessary for the
performance of a contract” legal basis under Article 6(1)(b) GDPR other than for very
limited processing such as friends lists, photo albums, profiles and news. It therefore
cannot rely on this as an alternative legal basis to consent for the acceptance of the Terms
of Service as a whole. In this regard, the Complainant argues that the “purpose” of the
contract (here, to deliver a social media service) must be considered.

e. On the basis of all of the above, the Complainant contends that clicking accept on
Facebook’s Terms of Service was an attempt by Facebook to seek consent under the GDPR
- just not valid consent. The Complainant describes this as “forced consent”, in that the
only choice a user had in April 2018 was to delete their Facebook account, and “hidden
consent”, in that some of the description of the Facebook service in the Terms of Service
(such as personalisation) implicitly relies on processing of personal data.

f. The Complainant contends that Facebook leads data subjects to believe that it relies on
consent as lawful basis for personal data processing and/or is not transparent about its
lawful bases for processing personal data.

3.38. On the counter side to this, Facebook argues that it forms a contract with its users for the use of
its free service. The Commission observes that this is delivered in the form of a “Click Wrap”
agreement that the user signs up to when clicking “Accept” on the Terms of Service and it looks
similar to an industry standard format for such agreements. Its intention was, Facebook says, to
rely on the legal basis of Article 6(1)(b) GDPR (necessary for the performance of a contract) for
processing carried out on foot of the acceptance of the Terms of Service (and, for other separate
processing, it would rely on legitimate interest and consent).

334
The Complainant characterises this as a “straw man argument” in the paragraph cited ibid. It is instead argued
that the position is that “when interpreting an agreement that is primarily concerned with one party agreeing to
allow the processing of personal data, such an abandoning of the Complainant’s right to data protection must
logically be interpreted as being a “consent” in nature.” The Commission sees this as arguing precisely what is
contained in the above paragraph i.e. where there is an agreement primarily concerned with processing data, that
agreement must be interpreted as consent. On that basis this characterisation of the Complaint is retained herein.
183

3.39. In this regard, it claims that the processing is necessary for the performance of the contract with
the user and that the Data Policy further sets out, in more detail, the other legal bases that would
be relied upon for other data processing operations. These bases, as I have said, included a
reliance on consent for certain operations (such as facial recognition, where special category data
is processed). Facebook rejects the idea that it sought to persuade users that consent was the
legal basis for all personal data processing. It further accordingly rejected the Investigator’s
analysis of whether valid consent was collected at the point of acceptance of the Terms of Service,
on the basis that Facebook never sought to rely on consent.

3.40. The Investigator, for his part, took the Complaint at face value and on its literal terms and analyses
each of the arguments made by the Complainant in the original Complaint submitted. This
seemed to me, when preparing the Draft Decision, to have been a sensible and correct approach.
This was not an “own volition” Inquiry where the Commission was entitled to scope matters of
risk which it decided warranted investigation. While it is normally the role of the Investigator to
focus on the establishment of facts, to set out what elements of the GDPR are engaged against
those facts, to come to a preliminary view on whether there are likely infringements identified
which will then be the subject of further legal analysis and ultimately decision-making by the
Commission, this case is somewhat different.

3.41. By reference to the above approach, the facts to be established are fairly limited and are largely
relating to the wording of Facebook’s Terms of Service and its Data Policy, and the design of its
User Engagement Flow introduced in April 2018 to guide users through the process of accepting
the updated Terms of Service. In fact, it appears to me that the Investigator ended up devoting
time responding to legal and theoretical assertions of the Complainant, such as the argument that
consent is a lex specialis and therefore the mandatory legal basis where a contract primarily
concerns personal data processing. Consequently, the Final Report contains more legal analysis
and argument than might otherwise have been the case (relative to a draft decision). I have
considered all of the analysis of the Investigator carefully and, in some instances, I adopt it and
concur with it. In other instances I reject it, replace it, and explain why.

3.42. Another feature of the Complaint is a section entitled “Applications”. In this section, the
Complainant requests an investigation of a very specific nature, and sets out the corrective
powers that the Complainant believes should be imposed i.e. an administrative fine and a
prohibition on the “relevant processing operations”. This section asks the Commission to:

“fully investigate this complaint, by especially using its powers under Article 58(1)(a), (e)
and (f) of the GDPR, to particularly determine the following facts:
(i.) which processing operations the controller engages in, in relation to the personal data
of the data subject,
(ii.) for which purpose they are performed,
(iii.) on which legal basis for each specific processing operation the controller relies on and

184

(iv.) he/she additionally requests that a copy of any records of processing activities (Article
30 of the GDPR) are acquired.”

3.43. The right to lodge a complaint with a supervisory authority is governed by Article 77 GDPR. Article
77(1) states how a complaint may be made: “every data subject shall have the right to lodge a
complaint with a supervisory authority…if the data subject considers that the processing of
personal data relating to him or her infringes this Regulation” [emphasis added]. Neither the
request above, nor a request to impose specified corrective powers, can be considered to
constitute part of a complaint made in accordance with Article 77(1) GDPR. The Complainant does
not specify any processing operations or any alleged infringements of the GDPR in the above
request, but simply asks the Commission to gather information on its behalf. Neither the GDPR
nor the 2018 Act confer a particular right on a Complainant to make such a request, nor to specify
what corrective powers should be imposed in circumstances where the supervisory authority is
of the view that an infringement has occurred/is occurring. The Complainant, as I have already
set out, also argues the right to demand such “applications” is part of Austrian procedural law. I
have already set out in detail why I do not accept that Austrian procedural law is applicable to the
exercise of my functions.

3.44. In those circumstances, it was for the Investigator, and ultimately for me as decision-maker, to
carry out an objective reading of the Complaint. In so doing, I must consider not only the content
of the Complaint, but also the legal framework by which the Commission is bound. It is also
necessary that an inquiry conducted on foot of a complaint must be feasible and workable.
According to Article 77(1) GDPR, a complaint should relate to data processing that, in a
complainant’s view, infringes the GDPR. There is a lack of reasonable specificity in the above
request in relation to processing operations or alleged infringements.

3.45. Any request to investigate all processing, or hypothetical processing, particularly a request of such
an indefinite nature, does not, in my view, conform to the requirements of Article 77 GDPR. Such
a request does not specify any data processing or any alleged infringement, and would result in a
practically unworkable inquiry. Rather than being a complaint about specific processing
operations, the Complaint in this matter has, at times, strayed into the territory of instructing the
Commission to conduct an open-ended inquiry, and to direct that inquiry and the Commission’s
resources in a manner determined by the Complainant. It is instead for the Commission to decide
on the manner in which a reasonably specific Complaint is to be investigated.

3.46. Moving to Facebook’s views on the scope of the Complaint, when the scope set out above was
put to Facebook in the Preliminary Draft Decision, it argued that

“[i]f the Complaint had intended to raise concerns about Facebook Ireland's compliance
with Articles 5, 12 and 13 GDPR, it would not have said “the scope of this complaint is

185

explicitly limited to any processing operations that are wholly or partly based on Article
6(1)(a) and/or Article 9(2)(a) of the GDPR.” 335

3.47. Facebook’s position is therefore that the issues of transparency fall outside the scope of the
Complaint and by extension this Inquiry, and requested that the Commission reconsider the scope
as set out in the Preliminary Draft Decision. 336 In its submissions, Facebook simply stated that it
did not accept that there was, as has been found by the Commission, an “inherent allegation in
this Complaint that the legal basis relied on by Facebook for processing personal data in
accordance with the acceptance of the Terms of Service is unclear”. 337 Facebook has not provided
more detailed submissions on this issue.

3.48. The Complaint, as Facebook correctly points out, concerns what the Complainant refers to as
“forced consent”. 338 In making this Complaint, it is argued that there has been an attempt to
mislead on Facebook’s part. Indeed, the Complaint rests on the allegation that Facebook
attempted to mislead the Complainant and users generally by informing them that they were
required to consent to certain processing in order to remain a Facebook user. Following
submissions from Facebook to the effect that it was not relying on consent but instead the
performance of the contract as a legal basis, the Complainant went on to argue that the
agreement had the appearance of consent, and that this in itself was misleading. The Complainant
has repeated this argument in the submissions on the Preliminary Draft Decision. 339

3.49. The Complainant also argues that the Terms of Service themselves are vague, and that this has
some bearing on either the nature of the agreement or on how to determine with any precision
what processing operations are necessary in order to perform that contract. The Complainant has
referred to a lack of an awareness, based on the information provided, of precisely what data is
actually processed. These concerns go to the very heart of the principles of transparency and
accountability in the GDPR. While the Complaint stated that it is “limited to any processing
operations that are wholly or partly based on Article 6(1)(a) and/or Article 9(2)(a) of the GDPR”,
this does not exclude the transparency of those processing operations. The processing operations
being considered remain the same even where the transparency of the information provided on
those processing operations is had regard to.

3.50. The Complaint has a clear focus on an alleged lack of transparency on Facebook’s part. Having
considered the submissions of both the Complainant and Facebook on this issue, I concluded that
the Complaint does indeed raise issues of transparency. As I have set out in paragraph 3.1, the
conclusions on scope reflected in this Schedule 1 must read in conjunction with both Section 2 of

335
Facebook Submissions on Preliminary Draft Decision, paragraph 2.1.
336
Ibid, paragraph 2.3.
337
Preliminary Draft Decision, paragraph 5.9 [cited in Facebook Submissions on the Preliminary Draft Decision,
paragraph 6.1].
338
Facebook Submissions on Preliminary Draft Decision, paragraph 2.1.
339
Complainant Submissions on Preliminary Draft Decision, pages 15-19.
186

this Decision as well as the corresponding assessment and determination of the scope of the
Complaint made by the EDPB in the Article 65 Decision, as summarised at paragraph 2.23 of this
Decision.

187

SCHEDULE 2

188