¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
Binding Decision 3/2022 on the dispute submitted by the
Irish SA on Meta Platforms Ireland Limited and its Facebook
service (Art. 65 GDPR)
Adopted on 5 December 2022
Adopted
Table of contents
1 Summary of the dispute............................................................................................................. 5
2 The right to good administration ............................................................................................... 9
3 Conditions for adopting a binding decision .............................................................................. 10
3.1 Objection(s) expressed by several CSA(s) in relation to a Draft Decision ........................... 10
3.2 The IE SA finds the objections to the Draft Decision not relevant or reasoned and does not
follow them ................................................................................................................................. 10
3.3 Admissibility of the case ................................................................................................... 10
3.4 Structure of the binding decision...................................................................................... 11
4 On whether the LSA should have found an infringement for lack of appropriate legal
basis/unlawful data processing ........................................................................................................ 11
4.1 Analysis by the LSA in the Draft Decision .......................................................................... 11
4.2 Summary of the objections raised by the CSAs ................................................................. 13
4.3 Position of the LSA on the objections ............................................................................... 19
4.4 Analysis of the EDPB......................................................................................................... 20
4.4.1 Assessment of whether the objections were relevant and reasoned ......................... 20
4.4.2 Assessment on the merits......................................................................................... 23
5 On whether the LSA’s Draft Decision includes sufficient analysis and evidence to conclude that
Meta IE is not obliged to rely on consent to process the Complainant’s personal data ..................... 37
5.1 Analysis by the LSA in the Draft Decision .......................................................................... 37
5.2 Summary of the objections raised by the CSAs ................................................................. 38
5.3 Position of the LSA on the objections ............................................................................... 42
5.4 Analysis of the EDPB......................................................................................................... 43
5.4.1 Assessment of whether the objections were relevant and reasoned ......................... 43
5.4.2 Assessment on the merits......................................................................................... 45
6 On the potential additional infringement of the principle of fairness ....................................... 51
6.1 Analysis by the LSA in the Draft Decision .......................................................................... 51
6.2 Summary of the objection raised by the CSAs ................................................................... 52
6.3 Position of the LSA on the objection ................................................................................. 53
6.4 Analysis of the EDPB......................................................................................................... 53
6.4.1 Assessment of whether the objection was relevant and reasoned ............................ 53
6.4.2 Assessment on the merits......................................................................................... 55
7 On the potential additional infringement of the principles of purpose limitation and data
minimisation ................................................................................................................................... 59
7.1 Analysis by the LSA in the Draft Decision .......................................................................... 59
7.2 Summary of the objection raised by the CSAs ................................................................... 59
Adopted 2
7.3 Position of the LSA on the objections ............................................................................... 60
7.4 Analysis of the EDPB......................................................................................................... 61
7.4.1 Assessment of whether the objection was relevant and reasoned ............................ 61
8 On corrective measures other than administrative fines .......................................................... 62
8.1 Analysis by the LSA in the Draft Decision .......................................................................... 62
8.2 Summary of the objections raised by the CSAs ................................................................. 63
8.3 Position of the LSA on the objections ............................................................................... 64
8.4 Analysis of the EDPB......................................................................................................... 65
8.4.1 Assessment of whether the objections were relevant and reasoned ......................... 65
8.4.2 Assessment on the merits......................................................................................... 67
9 On the determination of the administrative fine ...................................................................... 72
9.1 On the determination of the administrative fine for the transparency infringements ....... 72
9.1.1 Analysis by the LSA in the Draft Decision .................................................................. 72
9.1.2 Summary of the objections raised by the CSAs ......................................................... 77
9.1.3 Position of the LSA on the objections ........................................................................ 81
9.1.4 Analysis of the EDPB ................................................................................................. 82
9.2 On the determination of an administrative fine for further infringements ........................ 97
9.2.1 Analysis by the LSA in the Draft Decision .................................................................. 97
9.2.2 Summary of the objections raised by the CSAs ......................................................... 98
9.2.3 Position of the LSA on the objections ...................................................................... 103
9.2.4 Analysis of the EDPB ............................................................................................... 103
10 Binding Decision ................................................................................................................ 117
11 Final remarks ..................................................................................................................... 120
Adopted 3
The European Data Protection Board
Having regard to Article 63 and Article 65(1)(a) of the Regulation 2016/679/EU of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(hereinafter “GDPR”)1,
Having regard to the European Economic Area (hereinafter “EEA”) Agreement and in particular to
Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No
154/2018 of 6 July 20182,
Having regard to Article 11 and Article 22 of its Rules of Procedure (hereinafter “EDPB RoP”)3,
Whereas:
(1) The main role of the European Data Protection Board (hereinafter the “EDPB”) is to ensure the
consistent application of the GDPR throughout the EEA. To this effect, it follows from Article 60 GDPR
that the lead supervisory authority (hereinafter “LSA”) shall cooperate with the other supervisory
authorities concerned (hereinafter “CSAs”) in an endeavour to reach consensus, that the LSA and CSAs
shall exchange all relevant information with each other, and that the LSA shall, without delay,
communicate the relevant information on the matter to the other supervisory authorities concerned.
The LSA shall without delay submit a Draft Decision to the other CSAs for their opinion and take due
account of their views.
(2) Where any of the CSAs expressed a reasoned and relevant objection on the Draft Decision in
accordance with Article 4(24) and Article 60(4) GDPR and the LSA does not intend to follow the RRO
or considers that the objection is not reasoned and relevant, the LSA shall submit this matter to the
consistency mechanism referred to in Article 63 GDPR.
(3) Pursuant to Article 65(1)(a) GDPR, the EDPB shall issue a binding decision concerning all the
matters which are the subject of the relevant and reasoned objections, in particular whether there is
an infringement of the GDPR.
(4) The binding decision of the EDPB shall be adopted by a two-thirds majority of the members of the
EDPB, pursuant to Article 65(2) GDPR in conjunction with Article 11(4) EDPB RoP, within one month
after the Chair of the EDPB and the competent supervisory authority have decided that the file is
complete. The deadline may be extended by a further month, taking into account the complexity of
the subject matter upon decision of the Chair of the EDPB on own initiative or at the request of at
least one third of the members of the EDPB.
(5) In accordance with Article 65(3) GDPR, if, in spite of such an extension, the EDPB has not been able
to adopt a decision within the timeframe, it shall do so within two weeks following the expiration of
the extension by a simple majority of its members.
(6) In accordance with Article 11(6) EDPB RoP, only the English text of the decision is authentic as it is
the language of the EDPB adoption procedure.
1
OJ L 119, 4.5.2016, p. 1.
2
References to “Member States” made throughout this decision should be understood as references to “EEA
Member States”.
3
EDPB Rules of Procedure, adopted on 25 May 2018.
Adopted 4
HAS ADOPTED THE FOLLOWING BINDING DECISION
1 SUMMARY OF THE DISPUTE
1. This document contains a binding decision adopted by the EDPB in accordance with
Article 65(1)(a) GDPR. The decision concerns the dispute arisen following a Draft Decision (hereinafter
“Draft Decision”) issued by the Irish supervisory authority (“Data Protection Commission”, hereinafter
the “IE SA”, also referred to in this context as the “LSA”) and the subsequent objections expressed by
a number of CSAs (“Österreichische Datenschutzbehörde” hereinafter the “AT SA”; “Der
Hamburgische Beauftragte für Datenschutz und Informationsfreiheit” also on behalf of other German
SAs4, hereinafter the “DE SAs”; “Office of the Data Protection Ombudsman”, hereinafter the “FI SA”;
“Commission Nationale de l'Informatique et des Libertés", hereinafter the “FR SA”; “Garante per la
protezione dei dati personali", hereinafter the “IT SA”; “Autoriteit Persoonsgegevens”, hereinafter the
“NL SA” ; “Datatilsynet”, hereinafter the “NO SA”; “Urząd Ochrony Danych Osobowych”, hereinafter
the “PL SA”; “Comissão Nacional de Proteção de Dados”, hereinafter the “PT SA”; and
“Integritetsskyddsmyndigheten”, hereinafter the “SE SA” ).
2. The Draft Decision at issue relates to a “complaint-based inquiry” which was commenced by the IE SA
on 20 August 2018 into the Facebook social media processing activities (hereinafter “Facebook
service”) of Facebook Ireland Limited, a company established in Dublin, Ireland. The company has
subsequently changed its name to “Meta Platforms Ireland Limited” and hereinafter it is referred to
as “Meta IE”. Any reference to Meta IE in this binding decision means a reference to either Facebook
Ireland Limited or Meta Platforms Ireland Limited, as appropriate.
3. The complaint was lodged on 25 May 2018 with the AT SA by a data subject who requested the non-
profit NOYB - European Center for Digital Rights (hereinafter, “NOYB”) to represent her under
Article 80(1) GDPR (both hereinafter referred to as the “Complainant”). The Complainant alleged a
violation of the right to data protection and especially “a violation of Articles 5, 6, 7, and 9 of the GDPR
and Article 8 of the CFR [Charter of Fundamental Rights of the EU]”5, by arguing that the controller
relied on a “forced consent”6. The Complainant articulated its requests into a request to investigate7,
a request to find a violation of data subject rights 8, and a request to impose corrective measures9.
4
Objections raised by the Hamburg Commissioner for Data Protection and Freedom of Information also on
behalf of the Bavarian State Office for Data Protection Supervision, the Berlin Commissioner for Data Protection
and Freedom of Information, the Brandenburg Commissioner for Data Protection and Freedom of Information,
the Federal Commissioner for Data Protection and Freedom of Information, the State Commissioner for Data
Protection in Lower Saxony and the State Commissioner for Data Protection North Rhine-Westphalia.
5
Complaint, paragraph 1.2
6
Complaint, paragraph 1.3, 1.4, 2.1, 2.2.
7
Within its request to investigate, the Complainant requested that a full investigation be made to determine
“which processing operations the controller engages in, in relation to the personal data of the data subject”, “for
which purpose they are performed”, “on which legal basis for each specific processing operation the controller
relies on”, and to acquire “a copy of any records of processing activities”. The complaint also requested “that the
results of this investigation [be] made available to [her]”. Complaint, paragraph 3.1.
8
Complaint, paragraph 3.2. The specific rights that the Complainant mentions as violated are Art. 5, 6, 7 and 9
GDPR and Art. 8 of the Charter of Fundamental Rights of the EU, Complaint, paragraph 1.2.
9
More specifically, the complaint requested in paragraph 3.3 that the SA “prohibits all processing operations
that are based on an invalid consent of the data subject”, and in paragraph 3.4 that an “effective, proportionate
and dissuasive fine” be imposed.
Adopted 5
4. On 30 May 2018, the AT SA transferred the complaint to the IE SA. The IE SA stated in its “Schedule to
the Draft Decision”10 that it was satisfied that the IE SA is the LSA, within the meaning of the GDPR,
for Meta IE, as controller, for the purpose of the cross-border processing of personal data in the
context of the Facebook service.
5. The following table presents a summary timeline of the events part of the procedure leading to the
submission of the matter to the consistency mechanism:
20.08.2018 The scope and legal basis of the inquiry were set out in the notice of
commencement of inquiry that the IE SA sent to the parties on 20
August 2018. The IE SA commenced the inquiry and requested
information from this date.
20.08 2018-17.04.2020 Inquiry Report stage:
the IE SA commenced work on the draft inquiry report;
the IE SA prepared a draft inquiry report and issued it to Meta
IE and to the Complainant to allow them to make submissions
in relation to the draft inquiry report;
Meta IE provided its submissions in relation to the draft
inquiry report;
The Complainant provided its submissions in relation to the
draft inquiry report;
Meta IE and the Complainant were furnished with each
other’s submissions and the final report was provided to the
decision-maker;
The IE SA issued a copy of its final inquiry report to Meta IE
and the Complainant.
The IE SA issued a letter to Meta IE and to the Complainant to
confirm the commencement of the decision-making stage.
14.05.2021 The IE SA issued a Preliminary Draft Decision (hereinafter “the
Preliminary Draft Decision”) (including a Schedule) to Meta IE and to
the Complainant.
June 2021 The Complainant provided submissions on the Preliminary Draft
Decision to the IE SA (“Complainant’s Preliminary Draft Submissions
dated 11 June 2021” 11).
Meta IE made submissions on the Preliminary Draft Decision to the IE
SA (“Meta IE’s Preliminary Draft Submissions dated 16 June 2021”).
06.10.2021 The IE SA shared its Draft Decision with the CSAs in accordance with
Article 60(3) GDPR.
Between 21.10.2021 Several CSAs (AT SA, DE SAs, FI SA, FR SA, IT SA, NL SA, NO SA, PL SA,
and 03.11.2021 PT SA and SE SA) raised objections in accordance with
Article 60(4) GDPR.
28.01.2022 The IE SA issued a Composite Response setting out its replies to such
objections and shared it with the CSAs (hereinafter, “Composite
10
IE SA Schedule to the Draft Decision of 6 October 2021 in the matter of LB (through NOYB) v Facebook Ireland
Limited, paragraphs 2.13 - 2.22.
11
This document is mistakenly dated “11.06.2020”.
Adopted 6
Response”). The IE SA requested the relevant CSAs to confirm
whether, having considered the IE SA’s position in relation to the
objections as set out in the Composite Response, the CSAs intended
to maintain their objections.
In light of the arguments put forward by the IE SA in the Composite
Response, the AT SA12, DE SAs13, NO SA14, IT SA15, FR SA16 and NL SA17),
confirmed to the IE SA that they maintain their remaining objections.
30.05.2022 The FI SA informed the IE SA of their decision to withdraw their
objection due to procedural reasons related to their objection18.
3.06.2022 The IE SA invited Meta IE to exercise its right to be heard in respect of
the objections (and comments) that IE SA proposed to refer to the EDPB
under Article 65(1) GDPR along with the IE SA’s Composite Response and
the communications received from the CSAs in reply to the Composite
Response.
15.07.2022 Meta IE furnished the requested submissions (“Meta IE Article 65
Submissions”).
25.07.2022 The IE SA referred the matter to the EDPB in accordance with
Article 60(4) GDPR, thereby initiating the dispute resolution
procedure under Article 65(1)(a).
6. The IE SA triggered the dispute resolution process in the Internal Market Information system
(hereinafter “IMI”)19 on 25 July 2022.
7. Following the submission by the LSA of this matter to the EDPB in accordance with Article 60(4) GDPR,
the EDPB Secretariat assessed the completeness of the file on behalf of the Chair in line with
Article 11(2) EDPB RoP.
8. The EDPB Secretariat contacted the IE SA on 27 July 2022, asking for the transmission via IMI of the
original complaint and any document attached thereto, such as the “Gallup survey” to which the
Complainant referred in its submissions. The IE SA provided the original complaint and its attachments
and confirmed that it had been shared with Meta IE. The IE SA also provided an updated version of
the memorandum it had sent to the Secretariat20 with a revised schedule. These additional documents
did not include the “Gallup survey”, which the IE SA explained was not attached to the original
complaint, but was provided by way of correspondence dated 20 November 2019, sent by the
12
Response of Austrian SA to the IE SA’s Composite Response dated 31 January 2022.
13
Response of Hamburg SA to the IE SA’s Composite Response dated 11 February 2022.
14
Response of Norwegian SA to the IE SA’s Composite Response dated 11 February 2022.
15
Response of Italian SA to the IE SA’s Composite Response dated 11 February 2022.
16
Response of French SA to the IE SA’s Composite Response dated 11 February 2022.
17
Response of Dutch SA to the IE SA’s Composite Response dated 17 February 2022.
18
Withdrawal of Finnish Objection communicated on 30 May 2022.
19
The Internal Market Information (IMI) is the information and communication system mentioned in Art. 17 of
the EDPB Rules of Procedure.
20
The IE SA sent to the EDPB Secretariat a memorandum for the purpose of providing it with the file of material
that the IE SA wished to refer to the EDPB for assessment and determination pursuant to the Article 65(1)(a)
GDPR procedure.
Adopted 7
Complainant to the AT SA, for onward transmission to the IE SA. This occurred over one week after
the Complainant’s representative provided its observations on the investigator’s Draft Inquiry Report.
9. The EDPB Secretariat contacted the IE SA on 23 and 27 September 2022, asking for the transmission
via IMI of specified documents pertaining to the investigation conducted by the IE SA 21. The request
was made to allow the EDPB to come to a fully informed decision on the objections raised by some
CSAs on the scope and conduct of the investigation. From the schedule to the Draft Decision, the EDPB
Secretariat concluded that both Meta IE and the Complainant were given access to the documents
requested and invited the IE SA to confirm this was indeed the case. With regard to the request for
the “Gallup survey”, the EDPB Secretariat pointed out that Meta IE specifically included counter-
arguments to this document in its Article 65 submissions22.
10. The IE SA declined the request, as it considers that the material already provided as sufficient to enable
the EDPB to determine the objections referred to it, as the Draft Decision provides information about
the scope of the inquiry commenced for the purpose of examining the complaint, the procedural steps
taken in the inquiry, the information that was collected during the course of the inquiry process, the
allegations that were put to the data controller, the submissions made by the parties to the inquiry
and the assessments and views of the IE SA. Further, the IE SA expressed its concern over the
possibility of the EDPB concluding its decision on the basis of material which was never put to the
controller concerned as part of the formulation of any allegation of potential wrongdoing. Finally, the
IE SA underlined that, in accordance with Article 11(2) in fine EDPB RoP they would also provide
documents the Board deems necessary.
11. The EDPB considers the “Gallup study” part of the file. The Gallup study is a publicly available
document to which the Complainant refers in its letter to the EDPB and CSAs, which is part of the file
submitted by the IE SA23. The Complainant had previously submitted it to the AT SA on 20 November
2019 for onward transmission to the IE SA. Some CSAs refer to this document in their objections and
Meta IE provides counter arguments to its findings and challenges its reliability with a report (the
“Vanhuele Report”) that Meta IE appends to Annex 2 of its pre-Article 65 submission24.
21
The following documents were requested:
Draft Inquiry Report (DRI) of 28 June 2019;
Meta IE's submissions of 28 July 2019 to the DRI;
Letter from Meta IE to the IE SA of 25 May 2018 whereby Meta IE confirmed it was the controller for the data
processing in the EU;
Meta IE's submissions of 27 Sept 2018 on the complaint;
IE SA letter to NOYB on scope of the inquiry of 23 Nov 2018;
NOYB’s submissions of 3 Dec 2018 on scope and procedure;
IE SA letter to NOYB of 16 Jan 2019 (refusal);
IE SA letter to Meta IE on scope of 25 Jan 2019;
Meta IE's submissions of 22 Feb 2019 on the complaint;
NOYB’s submissions of 19 April 2019 on scope and procedural issues;
Meta IE's submissions of 28 July 2019 to the draft report NOYB’s submissions of 9 Sept 2019 to the draft report;
NOYB’s submissions of 9 Sept 2019 to the draft report;
NOYB’s submission to the IE SA containing the Gallup study in attachment;
Meta IE's additional submissions of 14 Feb 2020 on the draft report;
IE SA Investigator’s final report of 4 April 2020;
22
Meta IE Article 65 Submissions, Annex 2 “the Vanhuele report”.
23
NOYB letter of 25 May 2020, p.2.
24
Meta IE Article 65 Submissions, footnote 132, p.75, and Annex 2.
Adopted 8
12. A matter of particular importance that was scrutinised by the EDPB Secretariat was the right to be
heard, as required by Article 41(2)(a) of the Charter of Fundamental Rights. Further details on this are
provided in Section 2 of this Binding Decision.
13. On 5 October, the decision on the completeness of the file was taken, and it was circulated by the
EDPB Secretariat to all the members of the EDPB.
14. The Chair of the EDPB decided, in compliance with Article 65(3) GDPR in conjunction with Article 11(4)
EDPB RoP, to extend the default timeline for adoption of one month by a further month on account
of the complexity of the subject-matter.
2 THE RIGHT TO GOOD ADMINISTRATION
15. The EDPB is subject to Article 41 of the EU Charter of Fundamental Rights, in particular Article 41 (right
to good administration). This is also reflected in Article 11(1) EDPB RoP. Further details were provided
in the EDPB Guidelines on Article 65(1)(a) GDPR25.
16. The EDPB decision “shall be reasoned and addressed to the lead supervisory authority and all the
supervisory authorities concerned and binding on them” (Article 65(2) GDPR). It is not aiming to
address directly any third party. However, as a precautionary measure to address the possible need
for the EDPB to offer the right to be heard at EDPB level to Meta IE, the EDPB assessed if Meta IE was
offered the opportunity to exercise its right to be heard in relation to the procedure led by the LSA
and the subject matter of the dispute to be resolved by the EDPB. In particular, the EDPB assessed if
all the documents received containing the matters of facts and law used by the EDPB to take its
decision in this procedure had been previously shared with Meta IE.
17. The EDPB notes that Meta IE has received the opportunity to exercise its right to be heard regarding
all the documents containing the matters of facts and of law considered by the EDPB in the context of
this decision and provided its written observations 26, which have been shared with the EDPB by the
LSA.
18. Considering that Meta IE has been already heard by the IE SA on all matters of facts and law addressed
by the EDPB in its decision, the EDPB is satisfied that Article 41 of the EU Charter of Fundamental
Rights has been respected.
19. The EDPB considers that the Complainant is not likely to be adversely affected by this binding decision,
and consequently does not meet the conditions to be granted a right to be heard by the EDPB in line
with Article 41 of the EU Charter of Fundamental Rights, applicable case law, and Article 11 of the
EDPB RoP. This is without prejudice to any right to be heard or other related rights the Complainant
may have before the competent national supervisory authority(/-ies).
25
EDPB Guidelines 03/2021 on the application of Article 65(1)(a) GDPR, adopted on 13 April 2021 (version for
public consultation) (hereinafter, “Guidelines on Art.65(1)(a)”), paragraphs 94-108.
26
In particular, Meta IE Preliminary Draft Submissions dated 16 June 2021, Meta IE Submissions on Article 83(3)
GDPR dated 23 September 2021, Meta IE Article 65 Submissions dated 15 July 2022.
Adopted 9
3 CONDITIONS FOR ADOPTING A BINDING DECISION
20. The general conditions for the adoption of a binding decision by the EDPB are set forth in Article 60(4)
and Article 65(1)(a) GDPR27.
3.1 Objection(s) expressed by several CSA(s) in relation to a Draft Decision
21. The EDPB notes that several CSAs raised objections to the Draft Decision via IMI. The objections were
raised pursuant to Article 60(4) GDPR.
3.2 The IE SA finds the objections to the Draft Decision not relevant or reasoned and
does not follow them
22. On 28 January 2022, the IE SA provided to the CSAs an analysis of the objections raised by the CSAs in
the Composite Response.
23. The IE SA concluded that it would not follow the objections, as it did not consider them relevant and/or
reasoned, within the meaning of Article 4(24) GDPR for the reasons set out in the Composite Response
and below.
3.3 Admissibility of the case
24. The case at issue fulfils, prima facie, all the elements listed by Article 65(1)(a) GDPR, since several CSAs
raised objections to a Draft Decision of the IE SA within the deadline provided by Article 60(4) GDPR,
and the IE SA has not followed objections or rejected them for being, in its view, not relevant or
reasoned.
25. The EDPB takes note of Meta IE’s position that the current Article 65 GDPR dispute resolution should
be suspended in light of the IE SA’s ongoing inquiry on Meta IE’s legal basis for processing data for
behavioural advertising28. Additionally, Meta IE argues such suspension would be appropriate due to
pending preliminary ruling proceedings before the Court of Justice of the EU (hereinafter, “CJEU”)29.
Meta IE refers in particular to cases C-252/2130 and C-446/2131. Following its assessment, the EDPB
decides to continue its proceedings on this Article 65 GDPR dispute resolution, as there is no explicit
legal basis for a stay of the dispute resolution procedure in EU law, nor are existing CJEU rulings on
the matter conclusive for the situation of the EDPB 32. Also, the EDPB takes into consideration the data
27
According to Art. 65(1)(a) of the GDPR, the EDPB will issue a binding decision when a supervisory authority
has raised a relevant and reasoned objection to a Draft Decision of the LSA and the LSA has not followed the
objection or the LSA has rejected such an objection as being not relevant or reasoned.
28
Meta IE Article 65 Submissions, paragraphs 3.4.
29
Meta IE Article 65 Submissions, paragraphs 3.1 - 3.3.
30
Request for a preliminary ruling of 22 April 2021, Meta Platforms and Others, C-252/21 (hereinafter ‘C-252/21
Oberlandesgericht Düsseldorf request’).
31
Request for a preliminary ruling of 20 July 2021, Schrems, C-446/21 (hereinafter ‘C-446/21 Austrian Oberster
Gerichtshof request’).
32
Judgement of the Court of Justice of 28 February 1991, Delimitis, C-234/89, ECLI:EU:C:1991:91; Judgement of
the Court of Justice of 14 December 2000, Masterfoods, C-344/98, ECLI:EU:C:2000:689. These cases concerned
proceedings before the national courts, where the parties faced the risk of being confronted with a conflicting
decision of the national judge that could be seen as de facto nullifying the Commission decision – a power which
is retained by the CJEU. The current dispute resolution procedure concerns the adoption of an administrative
decision, which can be subject to full judicial review.
Adopted 10
subjects’ right to have their complaints handled within a “reasonable period” (Article 57(1)(f) GDPR),
and to have their case handled within a reasonable time by EU bodies (Article 41 Charter). Moreover,
ultimately there are remedies available to the affected parties in case of a discrepancy between the
EDPB binding decision and CJEU rulings in the aforementioned cases33.
26. Considering the above, in particular that the conditions of Article 65(1)(a) GDPR are met, the EDPB is
competent to adopt a binding decision, which shall concern all the matters which are the subject of
the relevant and reasoned objection(s), i.e. whether there is an infringement of the GDPR or whether
the envisaged action in relation to the controller or processor complies with the GDPR 34.
27. The EDPB recalls that its current decision is without any prejudice to any assessments the EDPB may
be called upon to make in other cases, including with the same parties, taking into account the
contents of the relevant Draft Decision and the objections raised by the CSA(s).
3.4 Structure of the binding decision
28. For each of the objections raised, the EDPB decides on their admissibility, by assessing first whether
they can be considered as a “relevant and reasoned objection” within the meaning of
Article 4(24) GDPR as clarified in the guidelines on the concept of a relevant and reasoned objection35.
29. Where the EDPB finds that an objection does not meet the requirements of Article 4(24) GDPR, the
EDPB does not take any position on the merit of any substantial issues raised by that objection in this
specific case. The EDPB will analyse the merits of the substantial issues raised by all objections it deems
relevant and reasoned36.
4 ON WHETHER THE LSA SHOULD HAVE FOUND AN INFRINGEMENT
FOR LACK OF APPROPRIATE LEGAL BASIS/UNLAWFUL DATA
PROCESSING
4.1 Analysis by the LSA in the Draft Decision
30. The IE SA concludes that the GDPR, the jurisprudence and the EDPB guidelines do not preclude Meta
IE from relying on Article 6(1)(b) GDPR as a legal basis to carry out the personal data processing
33
In case an action for annulment is brought against the EDPB decision(s) and found admissible, the General
Court/CJEU has the opportunity to invalidate the decision of the EDPB. In addition, and if the General Court/CJEU
were to deliver any judgment in the time between the adoption of the EDPB’s Art. 65 decision and the adoption
of the IE SA’s final decision, the IE SA may ultimately decide to revise the final national decision it takes following
the EDPB's binding decision - if the CJEU’s rulings give cause to do so - in accordance with the principle of
cooperation as elaborated by the CJEU in the Kühne&Heitz NV case (Judgement of the Court of Justice of 12
January 2004, Kühne & Heitz NV, C-453/00, ECLI:EU:C:2004:17.
34
Art. 65(1)(a) and Art. 4(24) GDPR. Some CSAs raised comments and not per se objections, which were,
therefore, not taken into account by the EDPB.
35
EDPB Guidelines 9/2020 on the concept of relevant and reasoned objection, version 2 adopted on 9 March
2021, (hereinafter, “EDPB Guidelines on RRO”).
36
“The EDPB will assess, in relation to each objection raised, whether the objection meets the requirements of
Art. 4(24) GDPR and, if so, address the merits of the objection in the binding decision.” See EDPB Guidelines on
Article 65(1)(a) GDPR, paragraph 63.
Adopted 11
activities involved in the provision of its service to users, including behavioural advertising insofar as
that forms a core part of the service37. Finding 2 reads “I find the Complainant’s case is not made out
that the GDPR does not permit the reliance by Facebook on 6(1)(b) GDPR in the context of its offering
of Terms of Service”38.
31. The IE SA understands the Complainant’s allegations as 39: being that, firstly, the Complainant was
given a binary choice: i.e. either accept the Facebook Terms of Service and the associated Data Policy
by selecting the “accept” button, or delete her Facebook account40, lack of clarity on which specific
legal basis Meta IE relies on for each processing operation41, and the Complainant’s concern on Meta
IE’s reliance on Article 6(1)(b) GDPR to deliver the Facebook Terms of Service42.
32. While the IE SA acknowledges that the EDPB considers in its EDPB Guidelines 2/2019 on
Article 6(1)(b) GDPR that, as a general rule, processing for online behavioural advertising is not
necessary for the performance of a contract for online service under Article 6(1)(b) GDPR, in this
particular case, having regard to the specific terms of the contract and the nature of the service
provided and agreed upon by the parties, IE SA concluded that Meta IE may in principle rely on
Article 6(1)(b) GDPR as legal basis of the processing of users’ data necessary for the provision of its
service, including through the provision of behavioural advertising insofar as this forms a core part of
that service offered to and accepted by users 43.
33. The IE SA disagrees with what it defines as a “strict threshold of ‘impossibility’ in the assessment of
necessity” proposed by the Complainant and the EDPB44. By “impossibility”, IE SA refers to the
argument put forward that a particular term of a contract (here, behavioural advertising) is not
necessary to deliver an overall service or contract45. The IE SA considers that Article 6(1)(b) GDPR
cannot be interpreted as requiring that it is impossible to perform the contract without the data
processing operations in question46.
34. The IE SA considers behavioural advertising a core part of the service offered to and accepted by the
users, having regard to the specific terms of the contract and the nature of the service provided and
agreed upon by Meta IE and the user47. The IE SA points out that the nature of the service being offered
to Facebook users is set out in the first line of the Facebook Terms of Service: a personalised service
that includes advertising. The IE SA argues that a distinguishing feature and commercially essential
element of the contract between Meta IE and the user is that it funds its Facebook social media service
with targeted and personalised advertising to the user 48.
35. The IE SA considers this information clearly set out and publicly available49. Moreover, the IE SA states
that any reasonable user would expect and understand that this was the bargain being struck, even if
37
Draft Decision, paragraph 4.52 and 4.55.
38
Draft Decision, Finding 2 p. 39.
39
Draft Decision, paragraph 2.12.
40
Draft Decision, paragraph 2.9.
41
Draft Decision, paragraph 2.10.
42
Draft Decision, paragraphs 2.10 and 4.10.
43
Draft Decision, paragraph 4.53.
44
Draft Decision, paragraph 4.47, 4.50 and 4.52.
45
Draft Decision, paragraph 4.47.
46
Draft Decision, paragraph 4.47, 4.49 and 4.50.
47
Draft Decision, paragraphs 4.42 and 4.53.
48
Draft Decision, paragraphs 4.43.
49
Draft Decision, paragraphs 4.43 and 4.44.
Adopted 12
they might prefer that the market would offer them better alternative choices 50. The IE SA responds
to the Complainant’s arguments that this analysis amounts to speculation by pointing out that the
only evidence the Complainant put forward was the Complainant’s own statement and a Gallup poll
and that the IE SA is obliged to consider all of the evidence before it and entitled to take notice of
matters in the public domain51.
36. The IE SA considers that having regard to what it described as the “clear” terms of the contract,
targeted advertising forms a core element of Meta IE’s business model and transaction with users 52.
37. The IE SA thus concludes that Meta IE may in principle rely on Article 6(1)(b) GDPR as a legal basis of
the processing of users’ data necessary for the provision of its Facebook social media service, including
through the provision of behavioural advertising insofar as this forms a core part of that service
offered to and accepted by users 53.
38. The IE SA clarified that, having regard to the scope of the complaint and its inquiry, the above
conclusion ought not to be construed as an indication that all processing operations carried out on
users’ personal data are necessarily covered by Article 6(1)(b) GDPR54.
39. The IE SA also notes that other provisions of the GDPR such as transparency act to strictly regulate the
manner in which this service is to be delivered and the information that should be given to users and
decides to address it separately in its Draft Decision55. The IE SA considers that there have been
significant failings of transparency in relation to the processing56.
40. The IE SA considers that these failings of transparency do not change the “basic fact” that behavioural
advertising forms part of the service offered by Facebook. The IE SA considers that information on
which specific clauses of the “Terms of Service” are used by Meta IE to justify the specific purpose of
its processing, the type of personal data processed and the applicable legal basis would not assist in
deciding the question of principle as to whether Meta IE can rely on Article 6(1)(b) GDPR to provide a
service that includes behavioural or targeted advertising57.
4.2 Summary of the objections raised by the CSAs
41. The AT, DE, FR, IT, NL, NO, PL, PT and SE SAs object to Finding 2 of the Draft Decision and the
assessment leading up to it58.
50
Draft Decision, paragraph 4.43.
51
Draft Decision, paragraph 4.44.
52
Draft Decision, paragraph 4.44.
53
Draft Decision, paragraphs 4.53 and 4.55.
54
Draft Decision, paragraph 4.54.
55
Draft Decision, paragraph 4.51.
56
Draft Decision, paragraph 4.12
57
Draft Decision, paragraph 4.12.
58
AT SA Objection, pp. 1-7; IT SA Objection, pp 1-7; NL SA Objection, paragraphs 4, 25-36; NO SA Objection,
pp.1-2 and 7; PT SA Objection, paragraphs 65-68; SE SA Objection, pp. 2-3.
Adopted 13
42. The AT, IT, NL, NO, and SE SAs consider that the IE SA should have found an infringement of
Article 6(1)(b) GDPR59, in line with the EDPB’s interpretation of this provision60. The DE, FR and PL SAs
argue that the IE SA should have found an infringement of Article 6(1) GDPR61. The PT SA contends
that the IE SA should have found an infringement of Article 5(1)(a) GDPR on the aspect of lawfulness62.
The DE SAs in their objection, further argue that the IE SA should find an additional infringement of
Article 5(1)(a) GDPR63.
43. The DE SAs consider that the IE SE should impose a temporary or definitive limitation of the respective
processing without legal basis in accordance with Article 58(2)(f) GDPR, i.e. the erasure of unlawfully
processed personal data and the ban of the processing of data for the purpose of behavioural
advertising until a valid legal basis is in place64.
44. The FR SA notes that reversing the findings concerning the infringements of Article 6(1) GDPR also
affects the scope of the corrective actions proposed by the IE SA, in addition to the administrative
fine65. The PT SA considers that the proposed additional infringement in relation to the breach of the
lawfulness obligation (Article 5(1)(a) GDPR) should lead to the application of an additional corrective
measure which is not now envisaged in the Draft Decision66.
45. The IT SA, in its objection, also argues that the finding of an infringement of Article 6(1)(b) GDPR
should result in the taking of appropriate corrective measures under Article 58(2)(d) (order to bring
processing operations into compliance) GDPR along with the imposition of an administrative fine
pursuant to Article 83(5)(a) GDPR67.
46. The NO SA, in its objection, also argues that the IE SA should take concrete corrective measures. More
specifically, the NO SA considers that the IE SA should order Meta IE to delete personal data processed
under Article 6(1)(b) GDPR, unless those data were also collected for other purposes with a valid legal
basis, as well as order Meta IE to identify a valid legal basis for future behavioural advertising or from
now on abstain from such processing activities68.
47. The AT, DE, FR, IT, NL, NO, PL, PT and SE SAs put forward several factual and legal arguments for the
proposed change in legal assessment69. Specifically they argue that Meta IE cannot rely on
Article 6(1)(b) GDPR as a legal basis to process a Facebook user’s data for behavioural advertising.
48. In the context of their objection, the AT and FR SAs argue that the factual background of the Draft
Decision does not include all relevant facts. They request amending the factual background to include
59
AT SA Objection, pp. 1-7; IT SA Objection, pp 1-7; NL SA Objection, paragraphs 4, 25-36; NO SA Objection,
pp.1-2 and 7; SE SA Objection, pp. 2-3.
60
EDPB Guidelines 02/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, version 2, adopted on 8 October 2019 (hereinafter, “EDPB
Guidelines 2/2019 on Article 6(1)(b) GDPR”).
61
DE SAs Objection, pp. 1-6 and pp.9-10; FR SA Objection, paragraphs 5-14, 33 and 52; PL SA Objection, pp. 1-2.
62
PT SA Objection, paragraphs 66 and 73.
63
DE SAs Objection, p.10.
64
DE SAs Objection, p. 10.
65
FR SA objection paragraph 53.
66
PT SA objection, paragraphs 66 and 73.
67
IT SA Objection, p. 6.
68
NO SA Objection, p. 7.
69
AT SA Objection, Section B, (p. 1-7); DE SAs Objection, Section I (p. 2 - 10); FR SA Objection, Section II; IT SA
Objection, Section 1 (p. 1-7) ; NL SA Objection, Objection 2 (paragraphs 25-36); NO SA Objection, Objection 1
(pp. 1 - 8); PL SA Objection, p. 1-2; PT SA Objection, paragraphs 49 - 68; SE SA Objection, Section 1 (p. 2-3).
Adopted 14
a definition of “behavioural advertising”70. The AT SA suggests mentioning also the technical
possibilities Facebook uses to conduct it, such as collecting data from other group services, third-party
websites, apps, cookies or similar storage technologies placed on the user’s computer or mobile device
and linking that data with the user’s Facebook account71. The AT SA also suggests including the fact
that on 28 May 2018 Meta IE switched its legal basis to process data for behavioural advertising from
consent to contractual performance. The AT SA considers that the Gallup Institute study presented by
the Complainant should also be included among the relevant facts72. The AT SA considers it as scientific
evidence that shows that only 1.6% of Facebook users understood the request to accept the Facebook
Terms of Service to be “a contract” 73. The AT SA states that this supports its arguments that data
subjects do not have the “expectation” to receive personalised advertisements as “part of a contract”.
49. The DE and NL SAs question the validity of a contract between Meta IE and the user to ground the
processing on Article 6(1)(b) GDPR74, in light of the transparency issues identified by the IE SA75. The
DE SAs question whether the parties reached an agreement if the user did not know that they would
enter into a contract, because Meta IE did not clearly communicate in a transparent manner that the
use of its Facebook service would in the future be based on a contract 76. The NL SA argues that as a
general rule, both parties must be aware of the substance of a contract, in order to willingly enter into
it and considers that “the established serious lack of transparency on behalf of the controller, therefore
leads to a reasonable doubt whether data subjects have indeed been able to enter into a contract with
the controller both willingly and sufficiently informed”77. The NL SA compounds its doubts on the
validity of the contract by arguing that the Terms of Use and the Data Policy documents are lengthy
and unclear and that Meta IE presents a completely one-sided deal whereby an individual data subject
has no influence on any of the terms78. The DE and NL SAs therefore consider that Meta IE’s statement
that it relies on Article 6(1)(b) GDPR for its Facebook Service, in combination with documents with
general descriptions of the service provided, and the IE SA’s reference to the controller’s right to
choose its own legal basis to process data, are insufficient to accept that the performance of a contract
can be used as a legal basis79.
50. The DE and PT SAs contend that the IE SA is competent to assess the validity of contracts in the context
of the GDPR, which is a prerequisite for controllers to base the processing of personal data on
70
AT SA Objection, pp.6-7 ; FR SA Objection, paragraph 6.
71
AT SA Objection, pp.5-7.
72
AT SA Objection, p.7 and SE SA Objection, p.3.
73
AT SA Objection, p.7.
74
DE SAs Objection, p. 4; NL SA Objection, paragraphs 28 and 30.
75
In Finding 3, the IE SA states that “In relation to processing for which Article 6(1)(b) GDPR is relied on, Articles
5(1)(a), 12(1) and 13(1)(c) have been infringed.” The IE SA considered, among others, that “Information on the
specific processing operations (necessarily including the data processed) that will be carried out for the purposes
specified and by reference to the lawful bases specified (the latter two being currently, in my view, set out in a
disjointed manner) should have been provided to the data subject. To the extent that this information was
provided at all, it was not clearly linked with a specific purpose or lawful basis, and was described in an
ambiguous manner (...)” (Draft Decision, paragraph 5.71).
76
DE SAs Objection, p. 4.
77
NL SA Objection, paragraph 30.
78
NL SA Objection, paragraph 28.
79
DE SAs Objection, pp. 3-4 ; NL SA Objection, paragraph 26.
Adopted 15
Article 6(1)(b) GDPR80. The DE, NL, and PT SAs argue that the IE SA should assess whether a suitable
contract is in place as required under Article 6(1)(b) GDPR81.
51. Without prejudice to any arguments made on the existence of a valid contract above, the AT, DE, FR,
IT, NL, NO, PL, PT, and SE SAs are not satisfied by the assessment of necessity in the Draft Decision82.
The AT, DE, FR, IT NL, NO, PL, PT, and SE SAs assert that behavioural advertising is objectively not
necessary for the performance of Meta IE’s contract with the data subject to deliver the Facebook
service and is not an essential or core element of it 83. To highlight the unnecessity of behavioural
advertising to perform the contract with the Facebook user, the AT, DE, and SE SAs contrast this
contract to the contract of providing personalised advertisement between Meta IE and a specific
advertiser, in which Meta IE would presumably have this obligation towards the advertisers, yet not
towards Facebook users that are not party to this contract 84. The DE SAs support this assertion by
pointing out that there is no obligation to offer personalised advertising to the user, and contractual
sanctions for the failure to provide it, as it can be seen from the Facebook Terms of Service 85. The AT,
DE, IT, NO, PL, and SE SAs consider, while referring to the EDPB Guidelines 2/2019 on
Article 6(1)(b) GDPR, that the business models to offer “free” services and in return generate income
by behavioural and personalised advertisement, inter alia, to support the service, cannot be necessary
to perform a contract and fail to comply with data protection regulations 86. The DE SAs also cite the
EDPB Guidelines 08/202087 to underscore that processing cannot be rendered lawful by
Article 6(1)(b) GDPR simply because such advertising indirectly funds the provision of the service and
that while personalisation of content, may, in certain circumstances, constitute an intrinsic and
expected element of certain online services, Article 6(1)(b) GDPR in the context of targeting of social
media users is hardly applicable88. The AT, PL and SE SAs argue that advertisements can still be
displayed on Facebook using alternative methods to behavioural advertising not involving profiling
and tracking89. The SE SA adds that some degree of targeting for increased relevance is possible, such
as geography, language and context90.
52. In addition, the AT, FR, NO, PT and SE SAs argue, also while referring to EDPB Guidelines 2/2019 on
Article 6(1)(b) GDPR91, that the IE SA should have considered the EDPB’s argument that behavioural
advertising cannot be “necessary” within the meaning of Article 6(1)(b) GDPR while a data subject can
80
DE SAs Objection, p. 3; PT SA Objection, paragraph 60.
81
DE SAs Objection, p. 3; NL SA Objection, paragraph 30; PT SA Objection, paragraph 60 - 61.
82
AT SA Objection, pp.3-5; DE SAs Objection pp.4-6; FR SA Objection, paragraphs 8-12; IT SA Objection p.4-5; NL
SA Objection paragraphs 31-32; NO SA Objection, pp.3, 5-7; PL SA Objection, pp.1-2; PT SA, paragraphs 57-58;
SE SA Objection, pp.2-3.
83
AT SA Objection, pp.3-5; DE SAs Objection pp.4-6 ; FR SA Objection, paragraphs 8-12; IT SA Objection p.4-5;
NL SA Objection, paragraph 31; NO SA Objection, pp.3, 5-7; PL SA Objection, pp.1-2; PT SA, paragraphs 57-58;
SE SA Objection, pp.2-3.
84
AT SA Objection, p.3; DE SAs, p.5 ; SE SA Objection, p. 3.
85
DE SAs Objection, pp.4-5.
86
AT SA Objection, pp.4-5 ; DE SAs Objection, pp.5-6; FR SA Objection, paragraph 11; IT SA Objection, p.5; NO
SA Objection, pp.5-6; PL SA Objection, pp.1-2; PT SA Objection, paragraph 55; SE SA Objection, pp.2-3.
87
EDPB Guidelines 08/2020 on the targeting of social media users, version 2.0, adopted on 13 April 2021,
paragraph 49.
88
DE SAs Objection, pp.5 and 6.
89
AT SA Objection pp.4-5; PL SA Objection, p.2; SE SA Objection, p.3.
90
SE SA Objection, p.3.
91
See EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 52.
Adopted 16
object to the processing of his/her personal data for direct marketing purposes at any time without
any reason, in accordance with Article 21(2) GDPR92.
53. The NL SA also refers to the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR to state that “the
reasonable understanding and expectations of all contract parties as to what the core of the service is
play an important role in what determines the extent of personal data processing that is ‘necessary’
for the performance of a contract”93. The AT, NL, and SE SAs contend that data subjects do not
reasonably expect that their data is being processed for personalised advertising simply because Meta
IE briefly refers to it in the Facebook Terms of Service94. The NO SA takes into account how Meta IE
markets its Facebook platform towards potential users (“Connect with friends and the world around
you on Facebook”’) and considers that Facebook users (including those with prior knowledge of data
protection, technical means for profiling or the ad tech industry) should not be deemed to reasonably
expect online behavioural advertising, especially to the extent as it is carried out by Meta IE 95. The IT
SA argues that users can be aware, at the very most, that the service is being funded by personalised
advertising, but they are not factually enabled to adequately know the features of the processing
activities96. The FR and NO SAs consider that the particularly massive and intrusive nature of the
processing of the users’ data cannot meet the reasonable expectations of the users97. The AT, NL and
SE SAs also consider that the Draft Decision is inconsistent in finding that information on specific
processing operations should have been provided, linked with a specific or lawful basis, and described
in an unambiguous manner, while considering that data subjects had a perspective or expectation or
were well informed that their data was being processed for behavioural advertising98.
54. In addition to the arguments made above on the existence of a valid contract and the necessity of
behavioural advertising for the performance of that contract, several SAs raise other considerations
in their objections.
55. The NO SA argues that the IE SA’s interpretation of Article 6(1)(b) GDPR is contrary to the fairness
principle, since data subjects face the dilemma of approving contractual terms possibly entailing
intrusive and harmful processing practices, and being excluded from services on which they are de
facto dependent, due to a lack of realistic alternatives to them 99.
56. On the risks posed by the Draft Decision, the AT, DE, NL, NO, PL, PT, and SE SAs explain that the
proposed interpretation of Article 6(1)(b) GDPR leads to a situation where data protection principles
are either undermined or bypassed entirely with regard to data subjects using the Facebook service100.
57. Specifically the AT, DE, NO, and PT SAs point to the conditions of consent pursuant to Article 7 GDPR
as being bypassed101. The NL SA considers that the Draft Decision allows Meta IE to engage in online
92
AT SA Objection, p. 3 - 4; FR SA Objection, paragraphs 11-12; NO SA Objection, p. 6; PT SA Objection,
paragraphs 64-65; SE SA Objection, p. 2.
93
NL SA Objection, paragraph 31.
94
AT SA Objection, pp.3-4; NL SA Objection, paragraph 28, 30 - 32 ; SE SA Objection, p.3.
95
NO SA, pp. 6-7.
96
IT SA Objection, p.6.
97
FR SA Objection, paragraph 18; NO SA Objection, p.6.
98
AT SA Objection, p.4; NL SA Objection, paragraph 30; SE SA Objection, p.3.
99
NO SA Objection, p. 5.
100
AT SA Objection, pp.5-6; DE SAs Objection, pp.9-10; NL SA Objection, paragraphs 27, 35-36; NO SA Objection,
p.7; PL SA Objection, p.2; PT SA Objection, paragraphs 64; SE SA Objection, p.5.
101
AT SA Objection, p 2 and 5; DE SAs Objection, p. 10; NO SA Objection, p. 4; PT SA Objection, paragraph 64.
Adopted 17
behavioural advertising in a way that bypasses informed consent of data subjects 102. The NO SA
considers that users “would face a dilemma between approving (though not by way of valid consent)
contractual terms possibly entailing intrusive and harmful processing practices, and being excluded
from services”, which ultimately would also “adversely affect data subjects’ freedom of expression and
information”103. The PT SA sees users’ choice reduced to “refusing to contract in order to protect
his/her rights or accepting all data processing without the possibility of exercising the rights conferred
on him by the GDPR under Article 7(3) or Article 21 GDPR”104. The FR SA considers that the Draft
Decision “does not allow the European users of the social network to have control over the fate of their
data”105. The PL SA argues the Draft Decision significantly limits “the possibilities of data subjects to
assert their rights, including pursuing claims”, adding that the lack of a proportionate, dissuasive and
effective corrective measure may lead to Meta IE further infringing the rights or freedoms of data
subjects protected under Article 8 of the Charter of Fundamental Rights of the European Union106.
58. Further, the AT SA sees the risk materialise as in its view Article 25(2) GDPR (privacy by default) is not
applied, “since Facebook – at least in its contract – declares that behavioural advertising is ‘necessary’
for the contractual performance”107.
59. The DE SAs argue the Draft Decision allows Meta IE to “bypass the requirements of a valid legal basis
for the processing that cannot be based on contract performance” 108. The IT SA considers the Draft
Decision would substantially undermine the users’ right “to freely determine the processing of their
personal data for online behavioural advertising”, in part because the requirement to identify a
suitable legal basis would in many situations be reduced to adding a description of processing in a
contract109. The NL SA considers the Draft Decision lowers the threshold for legality of data processing
on the basis of Article 6(1)(b) GDPR severely110. The NO SA considers that the Draft Decision erodes
the lawfulness principle, as in the Draft Decision “it is not the legislation which sets the boundaries for
lawfulness under Article 5(1)(a) GDPR, but instead the individual contract”, which is incompatible with
Article 8 of the Charter of Fundamental Rights and Article 5(1)(a) GDPR111.
60. Several SAs take the view that the Draft Decision, as it stands, sets a dangerous precedent contrary to
the GDPR. The FR SA notes that it could be understood as reflecting the common position of the
European supervisory authorities on this matter, since it is issued following the cooperation procedure
among SAs112. Specifically, the AT, DE, IT, and SE SAs raise that this interpretation of
Article 6(1)(b) GDPR could essentially be used by every controller and therefore endanger the rights
of nearly every data subject within the EEA113.
102
NL SA Objection, paragraph 35.
103
NO SA Objection, p. 5.
104
PT SA Objection, paragraph 64.
105
FR SA Objection, paragraph 36.
106
PL SA Objection, p. 2.
107
AT SA Objection, p 5.
108
DE SAs Objection, p. 9.
109
IT SA Objection, p. 4 and p. 6-7.
110
NL SA Objection, paragraph 35.
111
NO SA Objection, p. 2 and 8.
112
FR SA Objection, paragraph 37.
113
AT SA Objection, p 6; DE SAs Objection, p. 10; FR SA Objection, paragraph 37; IT SA, p.7; SE SA Objection, p.5.
Adopted 18
61. Moreover, the AT, DE, IT, NL, NO, and PT SAs explain that the Draft Decision creates a loophole,
allowing Meta IE and any other controller to make lawful virtually any collection and reuse of personal
data by, as long as they declare that it is processed for the performance of a contract 114.
4.3 Position of the LSA on the objections
62. The IE SA considers that the objections above are not relevant and/or not reasoned for the purpose
of Article 60(4) GDPR and decides not to follow them115.
63. The IE SA contends that a broad, direct competence in contract law to assess the validity of contracts
cannot be inferred from the GDPR tasks of supervisory authorities 116. It argues that this inference
would create a very extensive power for SAs to regulate private law, without an appropriate basis in
EU law.
64. The IE SA argues that the core or fundamental aspects of the Facebook Terms of Service, including
behavioural advertising processing, reflects the mutual expectations of the parties on contractual
performance117. The IE SA contends that a reasonable user would have had sufficient understanding
that the Facebook service was provided on the basis of personalised advertising, based also on a
“recognised public awareness” of behavioural advertising as a form of processing.
65. On the necessity of the processing to perform the contract, the IE SA considers that it does not adopt
a merely formal approach to Article 6(1)(b) GDPR that relies only on the textual content of the
Facebook Terms of Service118. The IE SA states that it does not take the view that all written contractual
terms are necessary for the performance of the contract. The IE SA contends that it focuses in its Draft
Decision on the fundamental purpose or core function of the contract that is necessary for its
performance.
66. The IE SA argues that the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR do not prohibit behavioural
advertising processing under Article 6(1)(b) GDPR if it falls within the core or essential aspects of the
service119. In relation to Meta IE’s processing of personal data, the IE SA differs from the SAs in that it
considers online behavioural advertising as necessary for the performance of the contract (as
described in the Facebook Terms of Service) between Facebook Ireland and the data subject.
67. The IE SA also disagrees with the interpretation of Article 21 GDPR making behavioural advertising
optional and not indispensable120. The IE SA argues that Article 6(1)(b) GDPR is not limited to aspects
of contractual performance which are expressly mandatory and unconditional obligations of the
parties. The IE SA contends that the CJEU has in the past held that processing which exceeds the most
minimal level of processing possible may be regarded as necessary, where it renders a lawful objective
“more effective”. The IE SA affirms that the necessity in the context of Article 6(1)(b) GDPR cannot be
114
AT SA Objection, pp.5-6; DE SAs Objection, pp.9-10; IT SA Objection, pp.4 and 6; NL SA Objection, paragraphs
27, 35-36 ; NO SA Objection, p. 2-3 and 7; PT SA Objection, paragraphs 54 and 63 ; SE SA Objection, p.5.
115
Composite Response, paragraphs 45, 51, 72, 80, 84, 91.
116
Composite Response, paragraph 45.
117
Composite Response, paragraphs 67 and 68.
118
Composite Response, paragraphs 48-51.
119
Composite Response, paragraphs 65-66.
120
Composite Response, paragraphs 69 and 79.
Adopted 19
assessed by reference to hypothetical alternative forms of the Facebook service and that it is not the
role of SAs to impose specific business models on controllers121.
68. The IE SA considers EDPB guidelines as not binding on supervisory authorities, yet it acknowledges
that they should be taken into account122. However, the IE SA argues that the EDPB has not been
provided with the legal power to mandate that certain categories of processing must be based on
consent, to the exclusion of any other legal bases for processing. IE SA’s view is that such a power is
properly exercised from time to time by the EU legislator, in the form of specific legislative
measures123. The IE SA is therefore not satisfied that the EDPB Guidelines 2/2019 on
Article 6(1)(b) GDPR can be construed as a binding and specific prohibition on processing for online
behavioural advertising on the basis of Article 6(1)(b)GDPR. The IE SA considers that under these
Guidelines, where processing for behavioural advertising is a distinguishing characteristic of the
service in question, it can support the business objectives and interests of the controller and be based
on Article 6(1)(b) GDPR. The IE SA considers that to be the case regarding Meta IE’s processing with
reference to the Facebook service124.
69. The IE SA argues that compliance with GDPR transparency obligations under Article 13(1)(c) GDPR
involves a separate and different legal assessment to that required in Article 6(1)(b) GDPR125. The IE
SA acknowledges that the necessity test under Article 6(1)(b) GDPR may require considering
contractual terms and other relevant information, and that the information provided under
Article 13(1)(c) GDPR could, in some cases, inform a data subject’s expectations as to a contractual
service. However, in the present case, the IE SA considers that the transparency infringement it
proposes for its Draft Decision does not impact its findings on the legal basis, as it considers that the
expectations and understanding of the parties on the Facebook Terms of Service include personalised
advertising126.
4.4 Analysis of the EDPB
4.4.1 Assessment of whether the objections were relevant and reasoned
70. The objections raised by the AT, DE, FR, IT, NL, NO, PL, PT and SE SAs concern “whether there is an
infringement of the GDPR”127.
71. The EDPB takes note of Meta IE’s view that not a single objection put forward by the CSAs meets the
threshold of Article 4(24) GDPR128. Meta IE’s primary argument is that “Objections which raise matters
which are not within the Defined Scope of Inquiry are not ‘relevant and reasoned’ within the meaning
of Article 4(24) GDPR” and such objections “ought to be disregarded in their entirety by the EDPB”129.
Contrary to Meta IE’s130 position on relevance, objections can have bearing on the “specific legal and
121
Composite Response, paragraph 71.
122
Composite Response, paragraph 76.
123
Composite Response, paragraph 77.
124
Composite Response, paragraphs 77-79.
125
Composite Response, paragraphs 82-83.
126
Composite Response, paragraph 82.
127
EDPB Guidelines on RRO, paragraph 24.
128
Meta IE Article 65 Submissions, Annex 1, p. 70.
129
Meta IE Article 65 Submissions, paragraphs 4.9 and 4.10.
130
Meta IE cites the EDPB Guidelines on RRO, which state that “[a]n objection should only be considered relevant
if it relates to the specific legal and factual content of the Draft Decision” (paragraph 14) to draw the conclusion
that any objection raising matters outside the scope of the inquiry is not relevant. See Meta IE Article 65
Adopted 20
factual content of the Draft Decision”, despite not aligning with the scope of the inquiry as defined by
an LSA. Nor does the EDPB accept Meta IE’s narrowing the scope of “reasoned” to arguments on issues
that have been investigated or addressed in the inquiry131, as no such limitation can be read in
Article 4(24) GDPR.
72. In essence, Meta IE argues that CSAs may not, under any circumstance, express disagreement with
the scope of the inquiry as decided by the LSA by way of an objection. The EDPB does not share this
reading of Article 65 GDPR, as is explicitly stated in the EDPB Guidelines on RRO132.
73. Furthermore, Meta IE states that “it is not now open to the CSAs to seek to expand the scope of the
Inquiry in the manner proposed and that, were the EDPB to do so, this would constitute a clear breach
of Meta Ireland’s legitimate expectations and right to fair procedures, both as a matter of Irish law
and in accordance with Article 41 of the Charter of Fundamental Rights and Freedoms of the EU (the
‘Charter’)”133. Despite claiming it is “clear”, Meta IE does not demonstrate in which manner its
procedural rights would be inevitably breached by the mere fact that the EDPB finds specific
objections admissible. Admissibility determines the competence of the EDPB, but not the outcome of
the dispute between the LSA and the CSAs. Likewise, Meta IE does not explain how the mere act of
considering the merits of admissible objections inevitably and irreparably breaches the procedural
rights cited by Meta IE134. Accepting Meta IE’s interpretation would severely limit the EDPB possibility
to resolve disputes arising in the one-stop-shop, and thus undermine the consistent application of the
GDPR.
74. The objections of the AT, DE, FR, IT, NL, NO, PL, PT and SE SAs on the finding of an infringement all
have a direct connection with the LSA Draft Decision and refer to a specific part of the Draft Decision,
i.e. Finding 2. All of those objections concern “whether there is an infringement of the GDPR” as they
argue that the IE SA should have found an infringement of Article 6(1), 6(1)(b) or 5(1)(a)(on the aspect
of lawfulness) of the GDPR. As the LSA considered that Article 6(1)(b) GDPR was not breached, the
objections entail a need of a change of the LSA decision leading to a different conclusion.
Consequently, the EDPB finds that the AT, DE, FR, IT, NL, NO, PL, PT and SE SAs objections relating to
the infringement of Article 6(1), 6(1)(b) or 5(1)(a)(on the aspect of lawfulness) GDPR are relevant.
75. As regards the part of the DE SAs objection arguing that the IE SA should find an infringement of
Article 5(1)(a) GDPR and impose the erasure of unlawfully processed personal data and the ban of the
processing of data for the purpose of behavioural advertising until a valid legal basis is in place; the
part of the IT SA objection related to the imposition of an administrative fine pursuant to
Submissions, paragraph 4.11. The EDPB notes that paragraph 14 of the EDPB Guidelines on RRO draws a
distinction between relevant objections and “abstract or broad concerns or remarks” on the one hand and
“minor disagreements” on the other. Moreover, this paragraph should be read in conjunction with paragraph
27 of the EDPB Guidelines on RRO.
131
Meta IE puts forward that “Objections which raise matters which are not within the Defined Scope of Inquiry”
are “inadequately reasoned as they fail to explain how findings of infringement can be made on issues that have
not been investigated or addressed in the Inquiry”. Meta IE Article 65 Submissions, paragraph 4.10 and 4.11. The
EDPB maintains its understanding of the term “reasoned”, as explained in paragraphs 16-19 of its EDPB
Guidelines on RRO.
132
“For instance, if the investigation carried out by the LSA unjustifiably fails to cover some of the issues raised
by the complainant or resulting from an infringement reported by a CSA, a relevant and reasoned objection may
be raised based on the failure of the LSA to properly handle the complaint and to safeguard the rights of the data
subject.” EDPB Guidelines on RRO, paragraph 27.
133
Meta IE Article 65 Submissions, paragraph 4.5.
134
The EDPB fails to see how, for instance, declaring an objection admissible but rejecting it on merits could
impinge on the procedural rights of the controller involved in the underlying case.
Adopted 21
Article 83(5)(a) GDPR for the additional infringement by Meta IE of Article 6(1)(b) GDPR; and the part
of the NO SA objection arguing the IE SA should order Meta IE to delete personal data processed under
Article 6(1)(b) GDPR, as well as order Meta IE to identify a valid legal basis for future behavioural
advertising or from now on abstain from such processing activities, the EDPB notes that these parts
of the objections concern “whether the envisaged action in relation to the controller complies with the
GDPR”. These parts of the three objections are linked to the IE SA’s Finding 2 with regard to
Article 6(1)(b) GDPR. Therefore, they are directly connected with the substance of the Draft Decision
and, if followed, would lead to a different conclusion. Thus, the EDPB considers that these parts of the
DE, IT and NO SAs objections are relevant.
76. The objections of the AT, DE, FR, IT, NL, NO, PL, PT and SE SAs on the finding of an infringement are
also reasoned because they all include clarifications and arguments on legal/factual mistakes in the
LSA’s Draft Decision that require amending. More specifically, the AT, DE, FR, IT, NL, NO, PL, PT and SE
SAs provide detailed arguments to challenge the Draft Decision’s consideration of behavioural
advertising as a necessary, core or fundamental aspect of a contract leading to the need to change
the decision and to find an infringement of Article 6(1)(b) GDPR135. Some of them provide detailed
arguments challenging the validity of the contract on which the use of Article 6(1)(b) GDPR as a legal
basis depends and which the IE SA accepts 136.
77. Some SAs recall, while referring to the terms of the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR137,
that it is the fundamental and mutually understood contractual purpose, which justifies that the
processing is necessary138. This purpose is not only based on the controller’s perspective but also on a
reasonable data subject’s perspective when entering into the contract and thus on “the mutual
perspectives and expectations of the parties to the contract”. The AT, NL, and SE SA contend that data
subjects do not reasonably expect that their data is being processed for personalised advertising
simply because Meta IE briefly refers to it in the Facebook Terms of Service139. The FR, IT and NO SAs
also support this finding and add that data subjects cannot be presumed to be aware of the particularly
massive and intrusive nature of this processing140. Several SAs also consider that the Draft Decision is
inconsistent in finding that information on specific processing operations should have been provided,
linked with a specific or lawful basis, and described in an unambiguous manner, while considering that
data subjects had a perspective or expectation or were well informed that their data was being
processed for behavioural advertising141.
78. The AT, DE, FR, IT, NL, NO, PL, PT and SE SAs objections also identify risks posed by the Draft Decision,
in particular an interpretation of Article 6(1)(b) GDPR that could be invoked by any controller and
would undermine or bypass data protection principles, and thus endanger the rights of data subjects
within the EEA 142.
135
AT SA Objection, pp.3-5; DE SAs Objection pp.4-6; FR SA Objection, paragraphs 8-14; IT SA Objection p.4-5;
NL SA Objection paragraphs 31-32; NO SA Objection, pp.3, 5-8; PL SA Objection, pp.1-2; PT SA, paragraphs 57-
58; SE SA Objection, pp.2-3.
136
DE SAs Objection, pp. 3-4; NL SA Objection, paragraph 26.
137
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 32 and 33.
138
AT SA Objection, p. 5; DE SAs Objection, p.5; FR SA Objection, paragraph 8; NL SA Objection, paragraph 31;
NO SA, p.6; SE SA objection, p.3.
139
AT SA Objection, pp.3-4; NL SA Objection, paragraph 28, 30 - 32; SE SA Objection, p.3.
140
FR SA Objection, paragraph 18; IT SA Objection, paragraph 2.6, NO SA Objection, pp.6-7.
141
AT SA Objection, p.4; NL SA Objection, paragraph 30; SE SA Objection, p.3.
142
See their description of the risks in paragraphs 56 to 61 above.
Adopted 22
79. Meta IE’s contends that in terms of risk, the objections must “demonstrate the likelihood of a direct
negative impact of a certain significance of the Draft Decision on fundamental rights and freedoms
under the Charter and not just any data subject rights”143. Meta IE thus adds a condition to
Article 4(24) GDPR, which is not supported by the GDPR144.
80. As regards the parts of the DE SAs objection requesting the finding of an infringement of
Article 5(1)(a) GDPR, and the parts of the DE, IT and NO SAs objections requesting specific corrective
measures under Article 58 GDPR for the infringement of Article 6(1) or 6(1)(b) GDPR, namely the
imposition of an administrative fine, a ban of the processing of personal data for the purpose of
behavioural advertising, an order to delete personal data processed under Article 6(1)(b) GDPR and
an order to identify a valid legal basis for future behavioural advertising or to abstain from such
processing activities, the EDPB considers that these parts of the objections do not sufficiently
elaborate the legal or factual arguments that would justify a change in the Draft Decision leading to
the finding of an infringement of Article 5(1)(a) GDPR or to the imposition of the specific corrective
measures mentioned above. Likewise, the significance of the risk for the data subjects, which stems
from the IE SA’s decision not to conclude on the infringement of Article 5(1)(a) GDPR and not to
impose the requested corrective measures, is not sufficiently demonstrated.
81. Considering the above, the EDPB finds that the objections of the AT, DE, FR, IT, NL, NO, PL, PT and SE
SAs on the finding of an infringement of Article 6(1), 6(1)(b), or 5(1)(a) (on the aspect of lawfulness)
GDPR are relevant and reasoned in accordance with Article 4(24) GDPR.
82. However, the parts of the DE SAs objection concerning the additional infringement of
Article 5(1)(a) GDPR, and the parts of the DE, IT and NO SAs objections concerning the imposition of
certain corrective measures, namely the imposition of an administrative fine, a ban on the processing
of personal data for the purpose of behavioural advertising, an order to delete personal data
processed under Article 6(1)(b) GDPR and an order to identify a valid legal basis for future behavioural
advertising or to abstain from such processing activities are not reasoned and do not meet the
threshold of Article 4(24) GDPR.
4.4.2 Assessment on the merits
83. In accordance with Article 65(1)(a) GDPR, in the context of a dispute resolution procedure the EDPB
shall take a binding decision concerning all the matters which are the subject of the relevant and
reasoned objections, in particular whether there is an infringement of the GDPR.
84. The EDPB considers that the objections found to be relevant and reasoned in this subsection 145 require
an assessment of whether the Draft Decision needs to be changed insofar as it rejects the
Complainant’s claim that the GDPR does not permit Meta IE’s reliance on Article 6(1)(b) GDPR to
process personal data in the context of its offering of the Facebook Terms of Service. When assessing
the merits of the objections raised, the EDPB also takes into account Meta IE’s position on the
objections and its submissions.
143
Meta IE Article 65 Submissions, p. 70.
144
Art. 1(2) GDPR provides that the GDPR itself “protects fundamental rights and freedoms of natural persons
and in particular their right to protection of personal data”, which directly stems from Art. 8(1) of the Charter.
Therefore, there is no reason to draw a distinction between the data subject rights protected by the GDPR and
the fundamental rights protected under the Charter when interpreting Art. 4(24) GDPR.
145
These objections being those of the AT, DE, FR, IT, NL, NO, PL, PT and SE SAs arguing that the IE SA should
have found an infringement of Art. 6(1)(b), Art. 6(1) or Art. 5(1)(a)(on the aspect of lawfulness) GDPR.
Adopted 23
Meta IE’s position on the objections and its submissions
85. In its submissions, Meta IE argues that the objections lack merit. Meta IE considers that they are based
on incorrect factual assumptions and are legally flawed146. Meta IE states that its reliance on
Article 6(1)(b) GDPR does not “bypass” the GDPR. Nor would it, according to Meta IE, jeopardise data
subject rights, be limited to individually negotiated agreements or be affected by Meta IE’s purported
pre-GDPR legal basis for processing conducted pre-GDPR147.
86. Meta IE argues that there is a lack of factual material and evidence on the issues on which the CSAs
raise objections, including on its reliance on Article 6(1)(b) GDPR for the specific processing operations
it conducts in its Facebook service for the purposes of behavioural advertising148. Meta IE notes that
the IE SA did not consider what processing operations would fall within the term “online behavioural
advertising” and the actual processing operations that Meta IE conducted with respect to the
Complainant or with respect to advertising on the Facebook service more generally149.
87. At the same time, Meta IE contends that, to address the complaint, the IE SA did not have to reach
any conclusions as to whether the actual processing conducted by Meta IE to deliver behavioural
advertising based on Article 6(1)(b) GDPR was lawful150. Meta IE supports the IE’s position that it
would not “have been appropriate to undertake an open-ended assessment of all processing
operations by the controller (having a general association with the Facebook Terms of Service) in order
to handle the complaint. Such an approach would result in a disproportionate and open-ended
examination of processing by Facebook, without first resolving the actual issues which are disputed
between the parties”151.
88. Meta IE thus agrees with the “general and principled in nature” finding the IE SA reached on Meta IE’s
not being precluded from relying on Article 6(1)(b) GDPR for the processing of data necessary to
deliver behavioural advertising152, upon the IE SA’s review of the Facebook Terms of Service and the
nature of its products and features as described in those terms.
89. Meta IE defends that Article 6(1)(b) GDPR can be relied on as a legal basis for behavioural
advertising153. Meta IE argues that its application requires the assessment of whether a given data
processing operation, when properly investigated and analysed, is actually necessary for the
performance of a contract154. Meta IE notes that personalisation, including in the form of behavioural
advertising, is clearly central and objectively reasonable and necessary with regard to the essence of
the Facebook service (as per the Facebook Terms of Service, which govern the contractual relationship
between Meta IE and its users)155.
90. Meta IE argues that the Facebook Terms of Service make clear that users will be shown advertising
personalised to their interests under the heading “Help you discover content, products and services
146
Meta IE Article 65 Submissions, paragraph 5 of summary.
147
Meta IE Article 65 Submissions, paragraph 6 of summary.
148
Meta IE Article 65 Submissions, paragraph 4.42 and 4.43.
149
Meta IE Article 65 Submissions, paragraph 4.7.
150
Meta IE Article 65 Submissions, paragraph 3 of summary and 4.8.
151
Meta IE Article 65 Submissions, paragraph 4.8 and Composite Response, paragraph 21.
152
Meta IE Article 65 Submissions, paragraph 3 of summary and 4.8.
153
Meta IE Article 65 Submissions, paragraph 6.5.
154
Meta IE Article 65 Submissions, paragraph 6.7.
155
Meta IE Article 65 Submissions, paragraphs 6.13 to 6.17.
Adopted 24
that may interest you”156. Meta IE supports the DPC’s finding, based on its review of the Facebook
Terms of Service and a general reference to public debate on these issues, that an average user who
accepts the Facebook Terms of Service would have the expectation that personalisation, including in
the form of behavioural advertising, forms a core and integral part of the Facebook Terms of Service157.
Meta IE backs this argument with a reference to a survey and a study conducted by a private entity
and a digital industry association 158. Meta IE considers that its compliance with the GDPR’s
transparency obligations involves a separate and different legal assessment from Article 6(1)(b)
GDPR159. Meta IE considers demonstrated in this case that Meta IE and its users have a mutual
expectation that personalisation, including in the form of behavioural ads, is core to the Facebook
Terms of Service160.
91. Meta IE recalls that the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR do not categorically prohibit
reliance on Article 6(1)(b) GDPR for behavioural advertising161. Meta IE further adds, referring to the
CJEU’s Huber judgment162, that “processing beyond the most minimal required to achieve the
processing purpose could still be deemed ‘necessary’ if it allowed the relevant processing purpose to
be ‘more effectively’ achieved”163. Meta IE submits that even if Article 6(1)(b) GDPR required the
processing to be absolutely essential to perform the contract, it would be impossible to provide the
Facebook service in accordance with its Term of Service without providing behavioural advertising164.
Meta IE states that the EDPB cannot compel it to change the nature of its service. Meta IE would view
this as a violation of Article 16 of the Charter on the freedom to conduct business enabling service
providers to determine what measures to take in order to achieve the result they seek, based on their
resources, abilities, and compatibility with other obligations and challenges they may encounter in the
exercise of their activity165.
92. Meta IE further argues that its reliance on the contractual necessity legal basis does not jeopardise
data subject rights166. Meta IE considers that these would also be protected by contract and consumer
protection legislations in the EU Member States and acknowledges that compliance with them is a
necessary precondition to the reliance on this legal basis167. Meta IE defends that the contractual
necessity legal basis is not limited to individually negotiated agreements and can also be used for
standard form contracts 168. Meta IE further adds that it would be improper for CSAs and the EDPB to
analyse the validity of the Facebook Terms of Service under applicable laws of contract or to draw
inferences from them169. In response to what Meta IE considers mischaracterisations in certain
156
Meta IE Article 65 Submissions, paragraph 6.15.
157
Meta IE Article 65 Submissions, paragraphs 6.23 and 6.25.
158
Meta IE Article 65 Submissions, paragraph 6.23.
159
Meta IE Article 65 Submissions, paragraph 6.24.
160
Meta IE Article 65 Submissions, paragraph 6.24.
161
Meta IE Article 65 Submissions, paragraph 6.29.
162
Judgement of the Court of Justice of 18 December 2008, Heinz Huber v Bundesrepublik Deutschland,
C-524/06, ECLI:EU:C:2008:724 (hereinafter ‘C-524/06 Huber’), paragraphs 62 and 66.
163
Meta IE Article 65 Submissions, paragraph 6.31.
164
Meta IE Article 65 Submissions, paragraph 6.32.
165
Meta IE Article 65 Submissions, paragraph 6.34.
166
Meta IE Article 65 Submissions, paragraph 6.38.
167
Meta IE Article 65 Submissions, paragraph 6.38.
168
Meta IE Article 65 Submissions, section E.
169
Meta IE Article 65 Submissions, paragraphs 6.43 and 6.44.
Adopted 25
objections of national contract law Meta IE provides expert reports on the validity of the Facebook
Terms of Service in 22 Member States170.
93. Meta IE concludes its arguments in support of its reliance on Article 6(1)(b) GDPR stating that its pre-
GDPR legal basis for data processing does not affect its flexibility to rely on other legal bases post GDPR
if it complies with the relevant requirements171. Meta IE also distinguishes behavioural advertising on
the Facebook service from direct marketing pursuant to Article 21(2) GDPR and thus considers this
provision not applicable to behavioural advertising172.
EDPB’s assessment on the merits
94. The EDPB considers it necessary to begin its assessment on the merits with a general description of
the practice of behavioural advertising carried out in the context of the Facebook service before
determining whether the legal basis of Article 6(1)(b) GDPR is appropriate for this practice in the
present case, based on the Facebook Terms of Service and the nature of its products and features as
described in those terms. The requests for preliminary rulings made to the CJEU in the cases C-
252/21173 and C-446/21174 to which some of the documents in the file refer175 contain helpful
descriptions of Meta IE’s behavioural advertising practices in the context of its Facebook service.
95. These requests for preliminary rulings mention that Meta IE collects data on its individual users and
their activities on and off its Facebook social network service via numerous means such as the service
itself, other services of the Meta group including Instagram, WhatsApp and Oculus, third party
websites and apps via integrated programming interfaces such as Facebook Business Tools or via
cookies, social plug-ins, pixels and comparable technologies placed on the internet user’s computer
or mobile device. According to the descriptions provided, Meta IE links these data with the user’s
Facebook account to enable advertisers to tailor their advertising to Facebook’s individual users based
on their consumer behaviour, interests, purchasing power and personal situation. This may also
include the user’s physical location to display content relevant to the user’s location. Meta IE offers
its services to its users free of charge and generates revenue through this personalised advertising
that targets them, in addition to static advertising that is displayed to every user in the same way.
96. The EDPB considers that these general descriptions signal by themselves the complexity, massive scale
and intrusiveness of the behavioural advertising practice that Meta IE conducts through the Facebook
service. These are relevant facts to consider to assess the appropriateness of Article 6(1)(b) GDPR as
a legal basis for behavioural advertising and to what extent reasonable users may understand and
expect behavioural advertising when they accept the Facebook Terms of Service and perceive it as
necessary for Meta IE to deliver its service176. Accordingly, the EDPB further considers that the IE SA
could have added to its Draft Decision a description of behavioural advertising that Meta IE conducts
through the Facebook service to appropriately substantiate its reasoning leading to its acceptance of
170
Meta IE Article 65 Submissions, paragraphs 6.44 and 6.45 and Annex 3.
171
Meta IE Article 65 Submissions, section F.
172
Meta IE Article 65 Submissions, Section G.
173
C-252/21 Oberlandesgericht Düsseldorf request, pp.6-7.
174
C-446/21 Austrian Oberster Gerichtshof request paragraphs 2-3, 6-13, 15-23.
175
See for instance the references to these requests for a preliminary ruling in the AT SA Objection p.9 and Meta
IE’s Article 65 Submissions, p.14.
176
In the same vein, the Advocate General also provides a description of behavioural advertising in its Opinion
on the case C-252/21 Oberlandesgericht Düsseldorf request, see Opinion of the Advocate General on 20
September 2022), ECLI:EU:C:2022:704, paragraphs 9 and 10.
Adopted 26
Article 6(1)(b) GDPR as a legal basis for that practice in accordance with the IE SA’s duty to state the
reasons for an individual decision177.
97. In the same vein, the EDPB also finds that the content of the Gallup Institute poll, which the
Complainant’s representative requested and subsequently submitted to the IE SA in its submission of
20 November 2019, could have been part of the facts of the Draft Decision178. This poll provides a
supplementary and useful indication on the perspective of Facebook users, which helps assessing
whether they could expect being subject to behavioural advertising as part of a contract. The results
of the poll allege, inter alia, that only 1.6% to 2.5% of the 1.000 respondents179, who are Facebook
users, understood the request to accept the Facebook Terms of Service to be a “contract” that
provides them with a contractual right to personalised advertisement. The IE SA acknowledges the
Complainant’s submission of this poll in its Draft Decision but seemingly dismisses it by focusing
primarily on what it considers as primary sources of factual evidence (primarily, the Facebook Terms
of Service) and “matters in the public domain”180. Conversely, Meta IE seems to attach importance to
this poll. Meta IE engaged an expert to produce a report (the “Vanhuele Report”) that Meta IE appends
to Annex 2 of its pre-Article 65 submission to point to what Meta IE considers “serious flaws” in the
report containing the poll and allege that the Complainant misinterpreted its results181.
98. Notwithstanding the EDPB’s considerations above, the EDPB considers that there is sufficient
information in the file for the EDPB to decide whether the IE SA needs to change its Draft Decision
insofar as it rejects the Complainant’s claim that the GDPR does not permit Meta IE’s reliance on
Article 6(1)(b) GDPR to process personal data in the context of its offering of the Facebook Terms of
Service.
99. As described above in Section 4.1, the IE SA concludes in Finding 2 of its Draft Decision that the
Complainant’s case is not made out that the GDPR does not permit the reliance by Facebook on
Article 6(1)(b) GDPR in the context of its offering of the Facebook Terms of Service. Neither
Article 6(1)(b) GDPR nor any other provision of the GDPR precludes Meta IE from relying on
Article 6(1)(b) GDPR as a legal basis to deliver a service, including behavioural advertising insofar as
that forms a core part of the service182. The IE SA considers that, having regard to the specific terms
of the contract and the nature of the service provided and agreed upon by the parties, Meta IE may
in principle rely on Article 6(1)(b) GDPR as a legal basis of the processing of users’ data necessary for
177
See EDPB Guidelines on Article 65(1)(a) GDPR, paragraph 84 and EDPB Guidelines 02/2022 on the application
of Article 60 GDPR (Version 1.0, Adopted on 14 March 2022), paragraph 111 (stating: “[…] every decision that is
aimed at legal consequences needs to include a description of relevant facts, sound reasoning and a proper legal
assessment. These requirements essentially serve the purpose of legal certainty and legal protection of the
parties concerned. Applied to the area of data protection supervision this means that the controller, processor
and complainant should be able to acknowledge all the reasons in order to decide whether they should bring the
case to trial. Having regard to the decision making process within the cooperation mechanism, CSAs likewise
need to be in the position to decide on possibly taking actions (e.g. agree to the decision, provide their views on
the subject matter)”). See also by analogy Judgement of the Court of Justice of 26 November 2013, Kendrion NV
v European Commission, C-50/12 P, ECLI:EU:C:2013:771, paragraph 42.
178
An informal translation of the presentation of this Study, dated November 2019, as provided by the
Complainant’s representative through its public website, may be found here:
https://noyb.eu/sites/default/files/2020-05/Gallup Facebook EN.pdf (Date of consultation 21 November
2022).
179
According to the poll “Austrians that are active online, age 14 and older”.
180
Draft Decision, paragraph 4.44; Composite Response, paragraph 83.
181
Meta IE Article 65 Submissions, footnote 132, p.75, and Annex 2.
182
Draft Decision, paragraph 4.52.
Adopted 27
the provision of its Facebook service, including through the provision of behavioural advertising
insofar as this forms a core part of its service offered to and accepted by its users 183. The IE SA
considers that a distinguishing feature and commercially essential element of the contract between
Meta IE and the user is that the Facebook service is funded by targeted or personalised advertising to
the user184. The IE SA considers this information clearly set out, publicly available and understandable
by any reasonable user. Meta IE supports this conclusion of the IE SA 185.
100. To assess these claims of the IE SA and Meta IE the EDPB considers it necessary to recall the general
objectives that the GDPR pursues, which, must guide its interpretation, together with the wording of
its provisions and its normative context186.
101. The GDPR develops the fundamental right to the protection of personal data found in Article 8(1) of
the EU Charter of Fundamental Rights and Article 16(1) of the TFEU, which constitute EU primary
law187. As the CJEU clarified, “an EU act must be interpreted, as far as possible, in such a way as not to
affect its validity and in conformity with primary law as a whole and, in particular, with the provisions
of the Charter. Thus, if the wording of secondary EU legislation is open to more than one interpretation,
preference should be given to the interpretation which renders the provision consistent with primary
law rather than to the interpretation which leads to its being incompatible with primary law”188. In the
face of rapid technological developments and increases in the scale of data collection and sharing, the
GDPR creates a strong and more coherent data protection framework in the Union, backed by strong
enforcement, and built on the principle that natural persons should have control of their own personal
data189. By ensuring a consistent, homogenous and equivalent high level of protection throughout the
EU, the GDPR seeks to ensure the free movement of personal data within the EU 190. The GDPR
acknowledges that the right to data protection needs to be balanced against other fundamental rights
and freedoms, such as the freedom to conduct a business, in accordance with the principle of
proportionality191 and has these considerations integrated into its provisions. The GDPR, pursuant to
EU primary law, treats personal data as a fundamental right inherent to a data subject and his/her
dignity, and not as a commodity data subjects can trade away through a contract192. The CJEU provided
additional interpretative guidance by asserting that the fundamental rights of data subjects to privacy
and the protection of their personal data override, as a rule, a controller’s economic interests 193.
102. The principle of lawfulness of Article 5(1)(a) and Article 6 GDPR is one of the main safeguards to the
protection of personal data. It follows a restrictive approach whereby a controller may only process
183
Draft Decision, paragraph 4.53.
184
Draft Decision, paragraphs 4.43 and 4.44.
185
Meta IE Article 65 Submissions, paragraphs 6.23 and 6.25.
186
Judgement of the Court of Justice of 1 August 2022, Vyriausioji tarnybinės etikos komisija, Case C-184/20,
ECLI:EU:C:2022:601, (hereinafter ‘C-184/20 Vyriausioji tarnybinės etikos komisija’), paragraph 121.
187
Recitals 1 and 2 GDPR.
188
Judgement of the Court of Justice of 21 June 2022, Ligue des droits humains v. Conseil des ministres, C-817/19,
ECLI:EU:C:2022:491, (hereinafter ‘C-817/19 Ligue des droits humains'), paragraph 86; and Judgement of the
Court of Justice of 2 February 2021, Consob, C-481/19, ECLI:EU:C:2021:84, paragraph 50 and the case-law cited.
189
Article 1(1)(2) and Recital 6 and 7 GDPR.
190
Article 1(3) and Recitals 9,10 and 13 GDPR.
191
Recital 4 GDPR.
192
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 54.
193
Judgement of the Court of Justice of 13 May 2014, Google Spain SL, C-131/12, ECLI:EU:C:2014:317,
paragraphs 97 and 99.
Adopted 28
the personal data of individuals if it is able to rely on one of the basis found in the exhaustive and
restrictive lists of the cases in which the processing of data is lawful under Article 6 GDPR194.
103. The principle of lawfulness goes hand in hand with the principles of fairness and transparency in
Article 5(1)(a) GDPR. The principle of fairness includes, inter alia, recognising the reasonable
expectations of the data subjects, considering possible adverse consequences processing may have
on them, and having regard to the relationship and potential effects of imbalance between them and
the controller195.
104. The EDPB agrees with the IE SA and Meta IE that there is no hierarchy between these legal bases196.
However, this does not mean that a controller, as Meta IE in the present case, has absolute discretion
to choose the legal basis that suits better its commercial interests. The controller may only rely on one
of the legal basis established under Article 6 GDPR if it is appropriate for the processing at stake197. A
specific legal basis will be appropriate insofar as the processing can meet its requirements set by the
GDPR198 and fulfil the objective of the GDPR to protect the rights and freedoms of natural persons and
in particular their right to the protection of personal data. The legal basis will not be appropriate if its
application to a specific processing defeats this practical effect “effet utile” pursued by the GDPR and
its Article 5(1)(a) and Article 6 GDPR199. These criteria stem from the content of the GDPR 200 and the
interpretation favourable to the rights of data subjects to be given thereto described in paragraph 101
above.
105. The GDPR makes Meta IE, as a data controller for the processing at stake, directly responsible for
complying with the Regulation’s principles, including the processing of data in a lawful, fair and
transparent manner, and any obligations derived therefrom201. This obligation applies even where the
practical application of GDPR principles such as those of Article 5(1)(a) and Article (5)(2) GDPR is
inconvenient or runs counter to the commercial interests of Meta IE and its business model. The
controller is also obliged to be able to demonstrate that it meets these principles and any obligations
derived therefrom, such as that it meets the specific conditions applicable to each legal basis202.
106. The first condition to be able to rely on Article 6(1)(b) GDPR as a legal basis to process the data
subject’s data is that a controller, in line with its accountability obligations under Article 5(2) GDPR,
194
Judgement of the Court of Justice of 11 December 2019, TK v Asociaţia de Proprietari bloc M5A-ScaraA,
C-708/18, ECLI:EU:C:2019:1064, (hereinafter ‘C-708/18 TK v Asociaţia de Proprietari'), paragraph 37.
195
See, recital 39 GDPR and EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 11 and 12.
196
Draft Decision paragraph 3.16 and Meta IE's Article 65 Submissions paragraph 5.12.
197
As mentioned in the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 18, the identification of the
appropriate lawful basis is tied to the principles of fairness and purpose limitation. It will be difficult for
controllers to comply with these principles if they have not first clearly identified the purposes of the processing,
or if processing of personal data goes beyond what is necessary for the specified purposes. See also Section 6 of
this Binding Decision on the potential additional infringement of the principle of fairness.
198
C-708/18 TK v Asociaţia de Proprietari, paragraph 37.
199
See C-524/06 Huber, paragraph 52 on the concept of necessity being interpreted in a manner that fully
reflects the objective of Directive 95/46). On the importance of considering the practical effect (effet utile)
sought by EU law in its interpretation, see also for instance: C-817/19 Ligue des droits humains, paragraph 195;
and Judgement of the Court of Justice of 17 September 2002, Muñoz and Superior Fruiticola, C-253/00,
ECLI:EU:C:2002:497, paragraph 30.
200
Art. 1(1)(2) and (5) GDPR.
201
Art. 5 (2) GDPR “Principle of accountability” of data controllers; see also C-252/21 Oberlandesgericht
Düsseldorf request, Opinion of the Advocate General on 20 September 2022, ECLI:EU:C:2022:704, paragraph 52.
202
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 26.
Adopted 29
has to be able to demonstrate that (a) a contract exists and (b) the contract is valid pursuant to
applicable national contract laws203.
107. Both the IE SA and Meta IE consider that the Facebook Terms of Service make up the entire agreement
between the Facebook user and Meta IE and that the Data Policy is simply a compliance document
setting out information to fulfil the GDPR transparency obligations204. The IE SA thus considers that
the contract for which the analysis based on Article 6(1)(b) must take place, is the Facebook Terms of
Service only205.
108. The IE SA and Meta IE argue that the GDPR does not confer a broad and direct competence to
supervisory authorities to interpret or assess the validity of contracts206. In its Draft Decision, the IE SA
noted that the Complainant explicitly sought to have it investigate and make findings in respect of
contract and consumer law. The IE SA noted that this falls outside of the remit of a supervisory
authority under the GDPR and are instead within the competence of the relevant consumer and
competition authorities207.
109. The EDPB agrees that SAs do not have under the GDPR a broad and general competence in contractual
matters. However, the EDPB considers that the supervisory tasks that the GDPR bestows on SAs imply
a limited competence to assess a contract’s general validity insofar as this is relevant to the fulfilment
of their tasks under the GDPR. Otherwise, the SAs would see their monitoring and enforcement task
under Article 57(1)(a) GDPR limited to actions such as verifying whether the processing at stake is
necessary for the performance of a contract (Article 6(1)(b) GDPR), and whether a contract with a
processor under Article 28(3) GDPR and data importer under Article 46(2) GDPR includes appropriate
safeguards pursuant to the GDPR. Pursuant to the IE SA’s interpretation, the SAs would thus be obliged
to always consider a contract valid, even in situations where it is manifestly evident that it is not, for
instance because there is no proof of agreement between the two parties, or because the contract
does not comply with its Member State’s rules on the validity, formation or effect of a contract in
relation to a child208.
110. As the DE and NL SAs209 argue, the validity of the contract for the Facebook service between Meta IE
and the Complainant is questionable given the strong indications that the Complainant was unaware
of entering into a contract, and (as the IE SA establishes with its Finding 3 of its Draft Decision) serious
transparency issues in relation to the legal basis relied on. In contract law, as a general rule, both
parties must be aware of the substance of the contract and the obligations of both parties to the
contract in order to willingly enter into such contract.
111. Notwithstanding the possible invalidity of the contract, the EDPB refers to its previous interpretative
guidance on this matter 210 to provide below its analysis on whether behavioural advertising is
objectively necessary for Meta IE to provide its Facebook service to the user based on its Facebook
Terms of Service and the nature of the service.
203
Binding Decision 2/2022, paragraph 84.
204
Draft Decision, paragraphs 4.4 to 4.6.
205
Draft Decision, paragraph 4.6.
206
Composite Response, paragraph 45; Meta IE Article 65 Submissions, paragraph 6.43.
207
Draft Decision, paragraph 4.14.
208
Art. 8(3) GDPR.
209
DE SAs Objection, p.4 and NL SA Objection, paragraph 30.
210
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR.
Adopted 30
112. The EDPB recalls211 that for the assessment of necessity under Article 6(1)(b) GDPR, “[i]t is important
to determine the exact rationale of the contract, i.e. its substance and fundamental objective, as it is
against this that it will be tested whether the data processing is necessary for its performance”212. As
the EDPB has previously stated, regard should be given to the particular aim, purpose, or objective of
the service and, for applicability of Article 6(1)(b) GDPR, it is required that the processing is objectively
necessary for a purpose and integral to the delivery of that contractual service to the data subject 213.
113. Moreover, the EDPB notes that the controller should be able to justify the necessity of its processing
by reference to the fundamental and mutually understood contractual purpose. This depends not only
on the controller’s perspective, but also on a reasonable data subject’s perspective when entering into
the contract214.
114. The IE SA accepts the EDPB’s position 215 that, as a general rule, processing of personal data for
behavioural advertising is not necessary for the performance of a contract for online services216.
However, the IE SA considers that in this particular case, having regard to the specific terms of the
contract and the nature of the Facebook service provided and agreed upon by the parties, Meta IE
may in principle rely on Article 6(1)(b) GDPR to process the user’s data necessary for the provision of
its service, including through the provision of behavioural advertising insofar as this forms a core part
of that service offered to and accepted by users.
115. The IE SA views behavioural advertising as a “core”, “fundamental” and “commercially essential”
element of the contract and the commercial transaction between Meta IE and the Facebook users 217.
In support of this consideration, the IE SA refers to the information provided in the Facebook Terms
of Service under the headings: “Provide a personalized experience for you” and “Help you discover
content, products, and services that may interest you”218. The information provided includes reference
to ads and includes the statement that “[w]e use the data we have … to personalize your experience”.
The IE SA further notes that the nature of the service being offered to Facebook users is set out in the
first line of the Facebook Terms of Service,219 which reads textually: “Provide a personalized experience
for you:”. The IE SA considers that it is clear that the Facebook service is advertised (and widely
understood) as one funded by personalised advertising and so, that any reasonable user would expect
and understand and that this was the “bargain being struck, even if they [the users] might prefer that
the market would offer them better alternative choices”220.
116. On this issue, the EDPB recalls that the concept of necessity has its own independent meaning under
EU law. It must be interpreted in a manner that fully reflects the objective pursued by an EU
instrument, in this case, the GDPR221. Accordingly, the concept of necessity under Article 6(1)(b) GDPR
211
See Binding Decision 2/2022, paragraph 89.
212
WP29 Opinion 06/2014 on the notion of legitimate interests, p. 17.
213
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 30.
214
See Binding Decision 2/2022, paragraph 90.
215
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 52.
216
Draft Decision, paragraph 4.53.
217
Draft Decision, paragraphs 4.42, 4.43, 4.53, 4.55 and Finding 2.
218
Draft Decision, paragraphs 4.36 to 4.38.
219
Draft Decision, paragraph 4.43.
220
Draft Decision, paragraph 4.43.
221
See paragraph 101 above on the principles guiding the interpretation of the GDPR and is provisions. The CJEU
also stated in Huber that that “what is at issue is a concept [necessity] which has its own independent meaning
in Community law and which must be interpreted in a manner which fully reflects the objective of that Directive,
[Directive 95/46], as laid down in Article 1(1) thereof”. C-524/06 Huber, paragraph 52.
Adopted 31
cannot be interpreted in a way that undermines this provision and the GDPR’s general objective of
protecting the right to the protection of personal data222 or contradicts Article 8 of the Charter. On
the processing of data in the Facebook service, Advocate General Rantos supports a strict
interpretation of the Article 6(1)(b) GDPR among other legal basis, particularly to avoid any
circumvention of the requirement for consent223.
117. Meta IE promotes among its prospective and current users the perception that the main purpose the
Facebook service serves and for which it processes its users’ data is to enable them to communicate
with others. Meta IE presents its Facebook service in its landing website as a platform enabling users
to “connect with friends and the world around you on Facebook” and at the beginning of its Facebook
Terms of Service224 as being its mission “to give people the power to build community and bring the
world closer together. To help advance this mission, we provide the Products and services described
below to you: (...)” which include in consecutive headings “Connect you with people and organizations
you care about: (...)”; “Empower you to express yourself and communicate about what matters to you:
(...)” and “Help you discover content, products and services that may interest you: (...)”.
118. The fact that the Facebook Terms of Service225 do not provide for any contractual obligation binding
Meta IE to offer personalised advertising to the Facebook users and any contractual penalty if Meta
IE fails to do so shows that, at least from the perspective of the Facebook user, this processing is not
necessary to perform the contract. Providing personalised advertising to its users may be an obligation
between Meta IE and the specific advertisers that pay for Meta IE’s targeted display of their
advertisements in the Facebook service to Facebook users, but it is not presented as an obligation
towards the Facebook users.
119. Nor does Meta IE’s business model of offering services, at no monetary cost for the user to generate
income by behavioural advertisement to support its Facebook service, among others, make this
processing necessary to perform the contract. Under the principle of lawfulness of the GDPR and its
Article 6, it is the business model which must adapt itself and comply with the requirements that the
GDPR sets out in general and for each of the legal bases and not the reverse. As the Advocate General
Rantos stressed recently in his opinion on Meta IE’s processing in Facebook, based on
222
Art. 1(2) GDPR.
223
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
paragraph 51. (The EDPB refers to the Advocate General’s Opinion in its Binding Decision as an authoritative
source of interpretation to underline the EDPB’s reasoning on the processing of data in the Facebook service,
without prejudice to the case-law that the CJEU may create with its future judgments on the Cases C-252/21 and
C-446/21).
224
Which the IE SA Meta IE consider as constituting the entire contract with the Facebook users (see paragraph
101).
225
The Facebook Terms of Service as formulated in one-sided terms as follows: “These Terms govern your use of
Facebook and the products, features, apps, services, technologies, and software we offer (the Facebook Products
or Products), except where we expressly state that separate terms (and not these) apply.” While under Section
1 of the Terms of Service Facebook announces that it “provides” the following services, Section 3 of the Terms
of Service is overwritten with “Your Commitments to Facebook and Our Community”. While Facebook itself only
“offers” various services, it makes clear that the Terms of Service unilaterally impose duties and obligations on
the user. Otherwise, the user may face suspension or termination of her/his account pursuant to Section 4.2 of
the Terms of Service. No (contractual) sanctions appear to apply in the event that Meta IE fails to provide or
poorly performs one or more of these services.
Adopted 32
Article 5(2) GDPR, it is the controller (Meta IE in this case) who is responsible for demonstrating that
the personal data are processed in accordance with the GDPR226.
120. As the EDPB provided in its guidance227 assessing what is “necessary” involves a combined, fact-based
assessment of the processing “for the objective pursued and of whether it is less intrusive compared
to other options for achieving the same goal”. If there are realistic, less intrusive alternatives, the
processing is not “necessary”. Article 6(1)(b) GDPR will not cover processing that is useful but not
objectively necessary for performing the contractual service or for taking relevant pre-contractual
steps at the request of the data subject, even if it is necessary for the controller’s other business
purposes.
121. On the question of whether here there are realistic, less intrusive alternatives to behavioural
advertising that make this processing not “necessary”228, the EDPB considers that there are. The AT,
PL and SE SAs mention as examples contextual advertising based on geography, language and content,
which do not involve intrusive measures such as profiling and tracking of users 229. In his recent opinion
on Facebook, Advocate General Rantos also refers to the Austrian Government’s “pertinent”
observation that in the past, Meta IE allowed Facebook users to choose between a chronological
presentation and a personalised presentation of newsfeed content, which, in his view, proves that an
alternative method is possible230. By considering the existence of alternative practices to behavioural
advertising that are more respectful of the Facebook users’ right to data protection, the EDPB, as the
Advocate General, aims to assess if this processing is objectively necessary to deliver the service
offered, as perceived by the Facebook user whose personal data is processed, and not to dictate the
nature of Meta IE’s service or impose specific business models on controllers, as Meta IE and the IE SA
respectively argue231. The EDPB considers that Article 6(1)(b) GDPR does not cover processing which
is useful but not objectively necessary for performing the contractual service, even if it is necessary
for the controller’s other business purposes232.
122. The EDPB considers that the absolute right available to data subjects, under Article 21(2)(3) GDPR to
object to the processing of their data (including profiling) for direct marketing purposes further
supports its consideration that, as a general rule, the processing of personal data for behavioural
advertising is not necessary to perform a contract. The processing cannot be necessary to perform a
contract if a subject has the possibility to opt out from it at any time, and without providing any reason.
226
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, paragraph 52.
227
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 25.
228
In Schecke, the CJEU held that, when examining the necessity of processing personal data, the legislature
needed to take into account alternative, less intrusive measures. Judgement of the Court of Justice of
9 November 2010, Volker und Markus Schecke GbR, Joined Cases C-92/09 and C-93/09, ECLI:EU:C:2010:662,
(hereinafter ‘Case C-92/09 and C-93/09 Schecke’), paragraph 52. This was repeated by the CJEU in the Rīgas case
where it held that “As regards the condition relating to the necessity of processing personal data, it should be
borne in mind that derogations and limitations in relation to the protection of personal data must apply only in
so far as is strictly necessary”. Judgement of the Court of Justice of 4 May 2017, Valsts policijas Rīgas reģiona
pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA ‘Rīgas satiksme’, C-13/16, ECLI:EU:C:2017:336,
paragraph 30.
229
AT SA Objection; pp.4-5, PL SA Objection, p.2; SE SA Objection, p.3.
230
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, footnote 80.
231
Meta IE Article 65 Submissions, paragraph 6.33 and Composite Response, paragraph 71.
232
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 25.
Adopted 33
123. The EDPB finds that a reasonable user cannot expect that their personal data is being processed for
behavioural advertising simply because Meta IE briefly refers to this processing in the Facebook Terms
of Service (which Meta IE and the IE SA consider as constituting the entirety of the contract), or
because of the “wider circumstances” or “recognised public awareness of behavioural advertising”
derived from its “widespread prevalence” to which the IE SA refers233. Behavioural advertising, as
briefly described in paragraph 95 above, is a set of processing operations of personal data of great
technical complexity, which has a particularly massive and intrusive nature. In view of the
characteristics of behavioural advertising, coupled with the very brief and insufficient information that
Meta provides about it in the Facebook Terms of Service and Data Policy (a separate document that
the IE SA and Meta IE do not even consider part of the contractual obligations), the EDPB finds it
extremely difficult to argue that an average user can fully grasp it, be aware of its consequences and
impact on their rights to privacy and data protection, and reasonably expect it solely based on the
Facebook Terms of Service. The EDPB recalls its Guidelines 2/2019 in which it argues that the
expectations of the average data subject need to be consider in light, not only of the terms of service
but also the way this service is promoted to users234. Advocate General Rantos expresses similar
doubts where he says in relation to Facebook behavioural advertising practices “I am curious as to
what extent the processing might correspond to the expectations of an average user and, more
generally, what ‘degree of personalisation’ the user can expect from the service he or she signs up
for”235 and adds in a footnote that he does not “believe that the collection and use of personal data
outside Facebook are necessary for the provision of the services offered as part of the Facebook
profile”236.
124. Based on the considerations above, the EDPB considers that the main purpose for which users use
Facebook and accept the Facebook Terms of Service is to communicate with others, not to receive
personalised advertisements.
125. Meta IE infringed its transparency obligations under Article 5(1)(a), Article 12(1) and
Article 13(1)(c) GDPR by not clearly informing the Complainant and other users of the Facebook
service’s specific processing operations, the personal data processed in them, the specific purpose
they serve, and the legal basis on which each of the processing operations relies, as the IE SA concludes
in its Draft Decision237. The EDPB considers that this fundamental failure of Meta IE to comply with its
transparency obligations contradicts the IE SA’s finding238 that Facebook users could reasonably
expect online behavioural advertising as being necessary for the performance of their contract (as
described in the Facebook Terms of Service) with Meta IE.
126. The EDPB recalls that “controllers should make sure to avoid any confusion as to what the applicable
legal basis is” and that this is “particularly relevant where the appropriate legal basis is
Article 6(1)(b) GDPR and a contract regarding online services is entered into by data subjects”, because
“[d]epending on the circumstances, data subjects may erroneously get the impression that they are
giving their consent in line with Article 6(1)(a) GDPR when signing a contract or accepting terms of
233
Composite Response, paragraphs 67 and 68.
234
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 57.
235
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, paragraph 56.
236
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, footnote 81.
237
Draft Decision, paragraphs 5.70, 5.71 and Finding 3.
238
Draft Decision, paragraphs 4.43, 4.44, 4.51, 4.53, Finding 2.
Adopted 34
service”239. Article 6(1)(b) GDPR requires the existence, validity of a contract, and the processing being
necessary to perform it. These conditions cannot be met where one of the Parties (in this case the
data subject) is not provided with sufficient information to know that they are signing a contract, the
processing of personal data that it involves, for which specific purposes and on which legal basis, and
how this processing is necessary to perform the services delivered. These transparency requirements
are not only an additional and separate obligation, as the IE SA seems to imply240, but also an
indispensable and constitutive part of the legal basis.
127. The risks to the rights of data subjects derived from this asymmetry of information and an
inappropriate reliance on this legal basis are higher in situations such as in the present case, in which
the Complainant and other Facebook users face a “take it or leave it” situation resulting from the
standard contract pre-formulated by Meta IE and the lack of few alternative services in the market.
The EU legislator has regularly identified and aimed to address with multiple legal instruments these
risks and the imbalance between the parties to consumer contracts. For example, Directive 93/13/EEC
on unfair terms in consumer contracts241 mandates, as the transparency obligations under the GDPR,
the use of plain, intelligible language in the terms of the contracts offered to consumers242. This
Directive even provides that where there is a doubt about the meaning of a term, the interpretation
most favourable to the consumer shall prevail243. Processing of personal data that is based on what is
deemed to be an unfair term under this Directive will generally not be consistent with the requirement
under Article 5(1)(a) GDPR that the processing is lawful and fair244.
128. Advocate General Rantos concludes in reference to Meta IE that the fact that an undertaking providing
a social network enjoys a dominant position in the domestic market for online social networks for
private users “does play a role in the assessment of the freedom of consent within the meaning of that
provision, which it is for the controller to demonstrate, taking into account, where appropriate, the
existence of a clear imbalance of power between the data subject and the controller, any requirement
for consent to the processing of personal data other than those strictly necessary for the provision of
the services in question, the need for consent to be specific for each purpose of processing and the
need to prevent the withdrawal of consent from being detrimental to users who withdraw it”245. In line
with the logic of this argument, the EDPB considers that the dominant position of Facebook also plays
an important role in the assessment of Meta IE’s reliance on Article 6(1)(b) GDPR for its Facebook
service and its risks to data subjects, especially considering how deficiently Meta IE informs the
Facebook users of the data it strictly needs to process to deliver the service.
129. Given that the main purpose for which a user uses the Facebook service is to communicate with
others246, and that Meta IE conditions its use to the user’s acceptance of a contract and the
behavioural advertising it includes, the EDPB cannot see how a user would have the option of opting
239
Binding Decision 01/2021, paragraph 214 and EDPB Guidelines 2/2019 on Article 6(1)(b), paragraph 20.
240
Draft Decision, paragraph 4.51.
241
A contractual term that has not been individually negotiated is unfair under the Directive 93/13/EEC “if,
contrary to the requirement of good faith, it causes a significant imbalance in the parties’ rights and obligations
arising under the contract, to the detriment of the consumer”, see Art. 3(1) Directive 93/13/EEC.
242
Art. 4(2) and Art. 5 Directive 93/13/EEC.
243
Art. 5 Directive 93/13/EEC.
244
EDPB Guidelines on Article 6(1)(b)GPDR, footnote 10.
245
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704, Conclusion, paragraph 78(4).
246
See paragraphs 117-118 and 122-124.
Adopted 35
out of a particular processing which is part of the contract as the IE SA seems to argue 247. The users’
lack of choice in this respect would rather indicate that Meta IE’s reliance on the contractual
performance legal basis deprives users of their rights, among others, to withdraw their consent under
Article 6(1)(a) GDPR and Article 7 GDPR and/or to object to the processing of their data based on
Article 6(1)(f) GDPR.
130. The EDPB agrees with the AT, DE, FR, IT, NL, NO, PL, PT, and SE SAs248 that there is a risk that the Draft
Decision’s failure to establish Meta IE’s infringement of Article 6(1)(b) GDPR, pursuant to the IE SA’s
interpretation of it, nullifies this provision and makes lawful theoretically any collection and reuse of
personal data in connection with the performance of a contract with a data subject. Meta IE currently
leaves the Complainant and other users of the Facebook service with a single choice. They may either
contract away their right to freely determine the processing of their personal data and submit to its
processing for the obscure and intrusive purpose of behavioural advertising, which they can neither
expect, nor fully understand based on the insufficient information Meta IE provides to them. Or, they
may decline accepting the Facebook Terms of Service and thus be excluded from a service that enables
them to communicate with millions of users and for which there are currently few realistic
alternatives. This exclusion would thus also adversely affect their freedom of expression and
information.
131. This precedent could encourage other economic operators to use the contractual performance legal
basis of Article 6(1)(b) GDPR for all their processing of personal data. There would be the risk that
some controllers argue some connection between the processing of the personal data of their
consumers and the contract to collect, retain and process as much personal data from their users as
possible and advance their economic interests at the expense of the safeguards for data subjects.
Some of the safeguards from which data subjects would be deprived due to an inappropriate use of
Article 6(1)(b) GDPR as legal basis, instead of others such as consent 6(1)(a) GDPR and legitimate
interest 6(1)(f) GDPR, are the possibility to specifically consent to certain processing operations and
not to others and to the further processing of their personal data (Article 6(4) GDPR); their freedom
to withdraw consent (Article 7 GDPR); their right to be forgotten (Article 17 GDPR); and the balancing
exercise of the legitimate interests of the controller against their interests or fundamental rights and
freedoms (Article 6(1)(f) GDPR). As a result, owing to the number of users, market power, and
influence of Meta IE and its economically attractive business model, the risks derived from the current
findings of the Draft Decision could go beyond the Complainant and the millions of users of Facebook
service in the EEA and affect the protection of the hundreds of millions of people covered by the GDPR.
132. The EDPB thus concurs with the objections of the AT, DE, FR, IT, NL, NO, PL, PT and SE SAs249 to Finding
2 of the Draft Decision in that the behavioural advertising performed by Meta IE in the context of the
Facebook service is objectively not necessary for the performance of Meta IE’s alleged contract with
data users for the Facebook service and is not an essential or core element of it.
133. In conclusion, the EDPB decides that Meta IE has inappropriately relied on Article 6(1)(b) GDPR to
process the Complainant’s personal data in the context of the Facebook Terms of Service and
therefore lacks a legal basis to process these data for the purpose of behavioural advertising. Meta IE
247
Composite Response, paragraph 69.
248
AT SA Objection, pp.5-6; DE SAs Objection, pp.9-10; FR SA Objection, paragraphs 35-37; IT SA Objection, pp.5-
7; NL SA Objection, paragraphs 27, 35-36; NO SA Objection, p.7; PL SA Objection, p.2; PT SA Objection,
paragraphs 63-64; SE SA Objection, p.5.
249
AT SA Objection, pp. 1-2; DE SAs Objection, pp. 2 and 10; FR SA Objection, paragraphs 5-15 ; IT SA Objection,
pp 1-7; NL SA Objection, paragraphs 4, 25-36; NO SA Objection, pp.1-2; PL SA Objection, pp. 1-2 ; PT SA Objection,
paragraphs 65-68; SE SA Objection, pp. 2-3.
Adopted 36
has not relied on any other legal basis to process personal data in the context of the Facebook Terms
of Service for the purpose of behavioural advertising. Meta IE has consequently infringed
Article 6(1) GDPR by unlawfully processing personal data. The EDPB instructs the IE SA to alter its
Finding 2 of its Draft Decision, which concludes that Meta IE may rely on Article 6(1)(b) GDPR in the
context of its offering of the Facebook Terms of Service, and to include an infringement of
Article 6(1) GDPR based on the shortcomings that the EDPB has identified.
5 ON WHETHER THE LSA’S DRAFT DECISION INCLUDES SUFFICIENT
ANALYSIS AND EVIDENCE TO CONCLUDE THAT META IE IS NOT
OBLIGED TO RELY ON CONSENT TO PROCESS THE COMPLAINANT’S
PERSONAL DATA
5.1 Analysis by the LSA in the Draft Decision
134. The IE SA concludes, as a matter of fact, in its Draft Decision that Meta IE did not rely, or purport to
rely, on the Complainant’s consent to process personal data to deliver the Facebook Terms of Service
and is not legally obliged to rely on consent to do so 250.
135. The IE SA accepts that Meta IE never sought to obtain consent from users through the clicking of the
“Accept” button in the Facebook Terms of Service, based also on Meta IE’s confirmation thereto251.
136. The IE SA distinguishes between agreeing to a contract (which may involve the processing of data) and
providing consent to personal data processing specifically for the purposes of legitimising that
personal data processing under the GDPR. The IE SA observes that, as noted by the EDPB, these are
entirely different concepts which “have different requirements and legal consequences”252.
137. The IE SA also emphasizes that there is no hierarchy between the legal bases that controllers may use
to process personal data under the GDPR 253. The IE SA further argues that neither Article 6(1) GPDR
nor any other provision in the GDPR require that the processing of data in particular contexts must
necessarily be based on consent under Article 6(1)(a)GDPR254. The IE SA argues the GDPR does not
provide that the specific nature and content of a contract, freely entered into by two parties, requires
a higher category or “default” legal basis. The IE SA includes reference to the EDPB Guidelines 2/2019
on Article 6(1)(b) GDPR which assert that where data processing is necessary to perform a contract,
consent is not an appropriate lawful basis on which to rely255.
138. The IE SA considers Article 7 GDPR and its conditions do not in and of themselves indicate the legal
basis on which a controller should rely on in a particular context 256. The IE SA contends that these
250
Draft Decision paragraph 3.12.
251
Draft Decision, paragraphs 3.6, 3.8, 3.12.
252
Draft Decision, paragraph 3.15.
253
Draft Decision, paragraph 3.16.
254
Draft Decision, paragraph 3.17.
255
Draft Decision, paragraph 3.18.
256
Draft Decision, paragraph 3.2.
Adopted 37
conditions would only be relevant where the controller relies upon consent as the legal basis for its
processing, which it views as not being the case for the processing of data by Meta IE in question.
5.2 Summary of the objections raised by the CSAs
139. The AT, DE, FR, NL, and PT SAs object to the assessment in the Draft Decision on consent, leading to
Finding 1 of the IE SA 257. These SAs put forward several factual and legal arguments for the changes
they propose to the Draft Decision.
140. The SE SA holds that if the EDPB were to find that the processing can rely on Article 6(1)(b) GDPR, the
investigation needs to encompass whether special categories of personal data pursuant to
Article 9(1) GDPR are processed, since the performance of a contract is not an exemption pursuant to
Article 9(2) GDPR. Since the SE SA presents its objection as being contingent on whether the EDPB
finds that the data processing in Facebook, based on the Facebook Terms of Service, can rely on
Article 6(1)(b) GDPR258 and the EDPB finds that Meta IE inappropriately relied on Article 6(1)(b) GDPR
(see above in Section 4.4.2), the SE SA’s objection is no longer applicable.
Arguments on the finding of the LSA that Meta IE is not legally obliged to rely on consent
141. The AT, DE, NL and PT SAs consider that the IE SA has not included enough analysis, evidence and
research in the Draft Decision to conclude that Meta IE is not legally obliged to rely on consent to
process the Complainants’ data259.
142. The AT SA points out that the IE SA limits its facts and its legal assessment to the general question
whether Article 6(1)(b) GDPR can be used as legal basis, specifically for behavioural advertising260. The
Draft Decision does not clarify which data categories are being used for behavioural advertising and
where Meta IE relies on Article 6(1)(a) and on 6(1)(b) GDPR for behavioural advertising. Also
unaddressed is, if and to which extent, Meta IE relies on Article 9(2)(a) GDPR for behavioural
advertising as far as sensitive data are concerned and whether Meta IE respected the GDPR conditions
(for example Article 7 GDPR) when obtaining the consent pursuant to Articles 6(1)(a) and
9(2)(a) GDPR. The AT SA argues that the Draft Decision did not address the part of the complaint on
the differences between “consent” and “contractual performance” and regarding Article 9 GDPR.
143. Even though the DE SAs share the IE SA’s finding that Meta IE did not rely on consent for the processing
of data as described in the Facebook Terms of Service, the DE SAs object against the IE SA’s assessment
that in the specific case at issue Meta IE was not legally obliged to obtain consent from the
Complainant261. The DE SAs further add, also in relation to the potential use of Article 6(1)(f) GDPR as
a legal basis, that further investigations on the specific processing activities, purposes and their risks
for rights and freedoms of the Complainant would be necessary to conclude an assessment on the
applicable legal basis262.
257
AT SA Objection, pp.8 to 10; DE SAs Objection, pp.6-8; FR SA Objection, paragraphs 14 and 33 ; NL SA
Objection, paragraph 5; PT SA Objection, paragraphs 37 and 42, 46.
258
SE SA Objection, p. 3.
259
AT SA Objection, pp.8 to 10; DE SAs Objection, pp.6-8; NL SA Objection, paragraph 5; PT SA Objection,
paragraphs 37 and 42, 46.
260
AT SA Objection, pp. 9-10.
261
DE SAs Objection, p.7.
262
DE SAs Objection, p.7.
Adopted 38
144. The NL SA sees as a grave omission in the Draft Decision the lack of any substantive investigation into
what kind of personal data is being processed besides relying on information submitted by the
controller263. The NL SA considers that there are clear indications that consent is legally required for
(parts of) the processing operations of the controller, and that the IE SA could thus draw a different
conclusion on the basis of further inquiries and analysis264. The NL SA considers that the Draft Decision
should be amended if a further inquiry by the IE SA establishes that reliance on consent as a legal
ground is mandatory265.
145. The PT SA agrees with the IE SA’s position in paragraph 3.18 in the Draft Decision on the need to always
verify on the basis of the contract and the data processing actually carried out what legal bases each
data processing at issue relies on, which may be on Article 6(1)(b), (a) and/or (f) GDPR266. The PT SA
adds that it is precisely because a duly reasoned case-by-case verification is required that it cannot
accept the IE SA’s conclusion in paragraph 3.26 of the Draft Decision that the legal basis for the
processing of data under the Facebook Terms of Service does not, as a matter of law, have to be
consent without that analysis being expressed and substantiated in the Draft Decision 267. The PT SA
argues that it is not possible for the IE SA to draw proper legal conclusions on the need for consent,
without having set out the relevant facts and the reasons given on the GDPR, which, in its view, the IE
SA clearly did not do268.
146. In addition, the DE and FR SAs consider that even if Meta IE had relied on consent, it would not have
met the requirements of Article 7(1) GDPR as being “freely given”, as the service is conditional on the
use of the Facebook service as a whole (“take it or leave it”)269. Nor would consent meet the
requirements of Article 7(2) GDPR since, as the IE SA finds, information on the processing of data as
described in the Facebook Terms of Service, is not provided in a concise, transparent, intelligible and
easily accessible form, using clear and plain language.
Arguments on the possible breach of the obligation to rely on consent to process special categories of
personal data (Article 9 GDPR)
147. The AT, DE, FR, NL, and PT SAs consider that the IE SA should have identified and separately assessed
any processing of special categories of personal data under Article 9 GDPR in the context of the
Facebook Terms of Service270. The DE and FR SAs conclude that Meta IE processes the entire amount
of data it holds, including special categories of data, without a legal basis, and thus in breach of
Articles 6 and 9 GDPR271. The AT, NL and PT SAs 272 take the view that the IE SA should broaden the
scope of its investigation and examine whether the conditions for the processing of special categories
of personal data have been met by Meta IE.
148. The AT, FR, NL, and PT SAs consider that the factual background of the Draft Decision misses facts on
whether Meta IE relies on Article 9(1)(a) GDPR to process special categories of personal data for the
263
NL SA Objection, paragraph 10.
264
NL SA Objection, paragraphs 19-20.
265
NL SA Objection, paragraph 20.
266
PT SA Objection, paragraph 36.
267
PT SA Objection, paragraph 37.
268
PT SA Objection, paragraph 46.
269
DE SAs Objection, pp. 7-8 ; FR SA Objection, paragraphs 21-29.
270
AT SA Objection, pp.8-10; DE SAs Objection, pp.6-7; FR SA Objection, paragraph 30; NL SA Objection,
paragraphs 10 and 33 ; PT SA Objection, paragraphs 45-47.
271
DE SAs Objection, p.8 ; FR SA Objection, paragraph 33.
272
AT SA Objection, pp.8-10 ; NL SA Objection, paragraphs 10 and 33 ; PT SA Objection, paragraphs 45-47.
Adopted 39
purpose of behavioural advertising and whether Meta IE respects the requirements of the GDPR, such
as those of its Article 7, in obtaining consent to that end273.
149. The FR, NL, and PT SAs argue that the data that Meta IE’s processing may include special categories of
personal data under Article 9 GDPR274. The DE SAs contend that nothing indicates that Meta IE
excludes these categories of data from its processing for advertising purposes275.
150. The FR SA states that, in a first analysis, informal verifications show that when people fill in their
Facebook profiles, no particular method is made available to them to ensure that they explicitly
consent, on the basis of clear information, to the collection and processing of sensitive data by Meta
IE in its Facebook service276. The FR SA refers to previous decisions and corrective measures it took
against Meta IE on this issue on 26 January 2016 and 27 April 2017277.
151. The FR SA considers that in view of the current conditions under which the company requests the
consent of individuals for the processing of their data, it cannot use the legal basis of contractual
performance Article 6(1)(b) GDPR, legitimate interest Article 6(1)(f) GDPR and consent
Article 6(1)(a) GDPR and Article 9 GDPR and that breaches of Articles 6 and 9 GDPR should then be
observed.
152. The NL SA sees strong indications on the processing of photographs and other images with facial
recognition technology 278. The NL SA is also concerned that the information shared among users of
the platform may include personal data concerning their health. The DE, FR, NL, PT SAs recall that only
consent may be used in this context among the exceptions that Article 9(2) GDPR lays down to the
general prohibition of processing special categories of data279.
Arguments on other types of data requiring consent
153. The NL SA identifies as another indicator contradicting the IE SA’s conclusion that there is no obligation
to seek consent the fact that the controller processes a significant amount of personal data that has
been collected through cookies for online advertising purposes and of location data280.
Risks
154. On the risks posed by the Draft Decision, the DE SAs consider that, as the subject of the complaint was
the processing as described in the Facebook Terms of Service there is also a significant risk for the
fundamental rights and freedoms of all Facebook users in the European Union that their personal
data, including data of special categories are processed without any legal basis 281. The AT SA also
considers that the compliance of Meta IE with the GDPR rules on the processing of special categories
273
AT SA Objection, pp. 8-9; DE SAs Objection, p.7; FR Objection, paragraphs 30-31; NL Objection, paragraph 6;
PT Objection, paragraph 45.
274
FR SA Objection, paragraphs 30-34, NL SA Objection, paragraphs 9-11; PT SA objection, paragraph 45.
275
DE SAs Objection, p.7.
276
FR SA Objection, p.31.
277
FR SA, Objection, p.32.
278
NL SA Objection, paragraphs 9 to 11.
279
DE SAs Objection, p.7; FR SA Objection, paragraphs 30-34, NL SA Objection, paragraphs 9-11; PT SA objection,
paragraph 45.
280
NL SA Objection, paragraphs 7-8 and 12.
281
DE SAs Objection, p.10.
Adopted 40
of data goes beyond the case at stake and affects hundreds of millions of data subjects within the EEA,
as Meta IE is the provider of the biggest social media network in the world282.
155. The AT, DE, FR, NL, and PT SAs argue that the IE SA’s conclusion that consent is not required affects
the rights of data subjects and their control over their personal data283.
156. The AT SA argues that the first risk is that the data subject’s right to lodge a complaint with a
supervisory authority pursuant to Article 77(1) GDPR becomes ineffective because the IE SA did not
handle the complaint in its entire scope, including sensitive data pursuant to Article 9 GPDR284. The AT
SA argues that this is not in line with the CJEU ruling C-311/18, which provides that the supervisory
authority must handle complaints with all due diligence285.
157. The FR SA argues that the Draft Decision poses a risk to the fundamental rights and freedoms of the
individuals concerned, according to Article 4(24) GDPR, insofar as the legal basis of contractual
performance to process the personal data of Facebook users to send them targeted advertising does
not allow the European users to have control over the fate of their data286. The FR SA also notes that
since the Draft Decision will be taken at the end of a cooperation procedure and made public, it could
be interpreted as reflecting the common position of the European supervisory authorities on this
issue, and setting a precedent for accepting that a company may use the legal basis of the contract to
process its users’ data for targeted advertising purposes when such processing is particularly massive
and intrusive287.
158. The NL SA specifies the protections from which the data subjects would be deprived due to the IE SA’s
conclusion that consent is not required, such as the right to data portability (Article 20(1) GDPR); the
possibility to specifically consent to certain processing operations and not to others and to the further
processing of personal data (Article 6(4) GDPR); the freedom to withdraw consent (Article 7 GDPR)
and the subsequent right to be forgotten 288.
159. The AT, DE, and NL SAs note as an additional risk that sensitive personal data falling within the scope
of Article 9 GDPR is processed without meeting the requirements of Article 9(2) GDPR289.
160. The NL SA underlines the risk that allowing the bypassing of legal provisions requiring consent to
process data creates legal uncertainty that hampers the free flow of personal data within the EU 290.
161. The NL SA also argues that not assessing the processing in a sufficiently thorough manner could create
a precedent for controllers to exclude from their privacy policies or terms of service processing
282
AT SA Objection, p.9.
283
AT SA Objection, p.10 ; DE SAs Objection, pp.9-10; FR SA Objection, paragraphs 36-37 ; NL SA Objection,
paragraph 18; PT SA Objection, paragraph 43.
284
AT SA Objection, p.10.
285
Judgement of the Court of Justice of 16 July 2020, Data Protection Commissioner v Facebook Ireland Limited
and Maximillian Schrems, C-311/18, ECLI:EU:C:2020:559 , (hereinafter ‘C-311/18 Schrems II'), referred to in AT
SA Objection, p.10.
286
FR SA Objection, paragraph 36.
287
FR SA Objection, paragraph 37.
288
Art. 17 GDPR and NL SA Objection, paragraph 18.
289
AT SA Objection, p.10; DE SAs Objection, pp.9-10; NL SA Objection, paragraph 18; SE SA Objection, p.5.
290
NL SA Objection, paragraph 18.
Adopted 41
operations that must be based on consent. This would risk leaving data subjects with a reduced degree
of transparency291.
5.3 Position of the LSA on the objections
162. The IE SA considers the objections not reasoned and does not follow them 292.
163. The IE SA argues that the scope of the inquiry is appropriate and relates to the issues raised in the
complaint293. The IE SA also argues that finding of additional infringements which have not been fully
investigated or put to the controller would impose a risk of procedural unfairness by depriving the
controller of its right to be heard in response to a particularized allegation of wrongdoing294.
164. The IE SA notes that it has discretion to determine the framework of the inquiry, taking into account
the scope of the written complaint as lodged295. The IE SA argues that it would not have been possible
to assess each discrete processing operation by Facebook, without first resolving the fundamental
dispute between the parties on the interpretation of Article 6(1) GDPR. The IE SA considers that it
would have been inappropriate and disproportionate for it to undertake an open-ended assessment
of all of Facebook’s processing operations related to the Facebook Terms of Service to handle the
complaint.
165. The IE SA argues that its analysis of Article 6(1)(b) GDPR does not preclude the possibility that certain
discrete processing operations by Facebook may fall outside the scope of Article 6(1)(b) GDPR296. The
IE SA finds it reasonable and practical to set the scope of the inquiry, focusing on the principled issues
of dispute, which it considers as not prejudicing the operation of more specific data protection rules.
166. The IE SA considers that the reference to Article 9 GDPR processing by Meta IE is an element of what
it views as the Complainant’s fundamental allegation: that the agreement to the Facebook Terms of
Service is a form of GDPR consent to processing of personal data, including consent to the processing
of special categories of data 297. The IE SA argues that since the scope of its inquiry addresses this issue,
it is not necessary for it to also conduct an indiscriminate and open-ended assessment of Meta IE’s
processing that may otherwise fall within the scope of Article 9 GDPR.
167. The IE SA notes that under Irish national law, there would be a very significant risk of procedural
unfairness to Meta IE if the IE SA assumed, without any further factual examination, that Meta IE
unlawfully processes special categories of personal data298.
168. According to the IE SA, the CSAs objecting to the Draft Decision intend to maximise the Complainant’s
rights by requiring consent-based processing for certain processing operations and thus prioritising it
over other legal basis299. The IE SA considers that very extensive data protection rights also apply under
the GDPR where the processing is based on Article 6(1)(b) or (f) GDPR. The IE SA contends that the
variation in the extent of data subject rights and protections, depending on the applicable legal basis,
291
NL SA Objection, paragraph 23.
292
Composite Response, paragraphs 30 and 41.
293
Composite Response, paragraphs 94-95.
294
Composite Response, paragraph 94.
295
Composite Response, paragraph 21.
296
Composite Response, paragaraph 22.
297
Composite Response, paragraph 23.
298
Composite Response, paragraph 27.
299
Composite Response, paragraphs 39 and 40.
Adopted 42
is an inherent element of the legislative scheme of the GDPR. The IE SA considers that Article 6 GDPR
does not provide that the “appropriate” data subject rights determine the legal basis for processing.
The IE SA notes that separate to the user’s acceptance of the Facebook Terms of Service, Meta IE relies
on different “acts” of consent for specific aspects of the service, including personalised advertising
based on users’ off-Facebook activities, and to process their GPS location data. In this regard, the IE
SA states that the complaint in this case was about the agreement to the Facebook Terms of Service
and the processing it entails once accepted.
169. The IE SA argues that their objections are inconsistent with the principle of legal certainty, as cited in
Recital 7 GDPR300. The IE SA indicates that it is not satisfied that the GDPR requires the limitation of
processing for the purposes of behavioural advertising to situations where processing is based on data
subject consent301. The IE SA contends that interpretative approach of the CSAs raising objections
would result in the arbitrary application of more restrictive data protection rules for reasons that are
not found in the GDPR. The IE SA also argues that this approach does not take due account of the
extensive data protection rights which apply to all legal bases under the GDPR. The IE SA asserts that
it is not open to the supervisory authorities to create additional binding limitations on the applicable
legal basis for the processing of data for behavioural advertising. The IE SA states that it is the
legislator, not the supervisory authorities, which has defined the conditions for lawful processing.
5.4 Analysis of the EDPB
5.4.1 Assessment of whether the objections were relevant and reasoned
170. The EDPB responds to Meta IE’s primary argument to the contrary in Section 4.4.1 above302.
171. The AT, DE, FR, NL, and PT SAs objections all have a direct connection with the LSA Draft Decision and
refer to a specific part of the Draft Decision, i.e. Finding 1. The AT, DE, FR, NL, and PT SAs argue that
the IE SA has not included enough analysis, evidence and research in the Draft Decision to conclude
that Meta IE is not legally obliged to rely on consent to process the Complainants’ data303. According
to these CSAs, the IE SA should have identified and separately assessed any processing of special
categories of personal data in the context of the Facebook Terms of Service304. They consider that the
IE SA should broaden the scope of its investigation and examine whether the conditions for the
processing of special categories of personal data have been met by Meta IE. The FR, NL, and PT SAs
argue that the data that Meta IE processes may include special categories of personal data under
Article 9 GDPR305. The DE SAs contend that nothing indicates that Meta IE excludes these categories
of data from its processing for advertising purposes. The AT, DE, FR, NL, and PT SAs challenge the
reasoning underlying the conclusion reached by the LSA. Following their assessment would lead to a
300
Composite Response, paragraph 40.
301
Composite Response, paragraph 40.
302
Meta IE argues that “Objections which raise matters which are not within the Defined Scope of Inquiry are not
‘relevant and reasoned’ within the meaning of Article 4(24) GDPR” and such objections “ought to be disregarded
in their entirety by the EDPB”. The EDPB does not share this understanding, as explained above. See paragraphs
71-73.
303
AT SA Objection, pp.8 to 10; DE SAs Objection, pp.6-8; FR SA Objection, paragraphs 14 and 33 ; NL SA
Objection, paragraph 5; PT SA Objection, paragraphs 37 and 42, 46.
304
AT SA Objection, pp.8-10; DE SAs Objection, pp.6-7; FR SA Objection, paragraph 30; NL SA Objection,
paragraphs 10 and 33 ; PT SA Objection, paragraphs 45-47 ; SE SA Objection, pp.1 and 3.
305
DE SAs Objection, p.7; FR SA Objection, paragraphs 30-34; NL SA Objection, paragraphs 9-11; PT SA objection,
paragraph 45.
Adopted 43
different conclusion insofar as the IE SA would fully cover the complaint and include facts and a legal
assessment on processing operations subject to Article 6(1)(a), Article 7 and Article 9 GDPR, which
may reveal an infringement by Meta IE306.
172. Consequently, the EDPB finds that the AT, DE, FR, NL, and PT SAs objections relating to Finding 1,
which states that Meta IE is not required to rely on consent to deliver the Facebook Terms of Service
and its underlying reasoning, and referring to Meta IE’s possible infringements of Article 6(1)(a) and
Article 9 GDPR are relevant.
173. The objections are reasoned because they include clarifications and arguments on legal/factual
mistakes in the LSA’s Draft Decision that require amending. The AT, DE, FR, NL, and PT SAs consider
that the IE SA should have identified and separately assessed any processing of special categories of
personal data under Article 9 GDPR in the context of the Facebook Terms of Service307. In particular,
the FR, NL, PT SAs argue that the data that Meta IE processes may include special categories of
personal data under Article 9 GDPR308. The DE SAs contend that nothing indicates that Meta IE
excludes these categories of data from its processing for advertising purposes309. The AT, DE, FR, NL,
and PT SAs recall that only consent may be used in this context among the exceptions that
Article 9(2) GDPR lays down to the general prohibition of processing special categories of data310. The
NL SA identifies as another indicator contradicting the IE SA’s conclusion that there is no obligation to
seek consent the fact that the controller processes a significant amount of personal data that has been
collected through cookies for online advertising purposes and of location data311. The NL SA also
argues that the IE SA should have investigated more into the safeguards that are implemented by the
controller to address the specific interests of children312.
174. On the risks posed by the Draft Decision, the AT, DE, FR, NL, and PT SAs313 explain that the IE SA’s
Finding 1 - providing that consent is not required - puts at risk the rights of data subjects and their
control over their personal data. The AT SA mentions the risk that the data subject’s right to lodge a
complaint with a supervisory authority pursuant to Article 77(1) GDPR becomes ineffective because
the IE SA does not handle it in its entire scope, including special categories of data under
Article 9 GDPR. The FR SA argues that the Draft Decision could set a precedent for accepting the use
of the contractual performance legal basis to process users’ data for behavioural advertising purposes,
which it views as particularly massive and intrusive. The NL SA specifies that the data subjects could
be deprived of the following protections derived from the use of consent: the right to data portability
(Article 20(1) GDPR); the possibility to specifically consent to certain processing operations and not to
others and to the further processing of personal data (Article 6(4) GDPR); the freedom to withdraw
consent (Article 7 GDPR) and the subsequent right to be forgotten 314. The AT, DE, and NL SAs also note
306
See EDPB Guidelines on RRO, paragraph 15 and EDPB Guidelines on Article 65(1)(a) GDPR, paragraphs 40 and
Sub-sections 4.2, 4.2.3 - 4.2.5.
307
AT SA Objection, pp.8-10; DE SAs Objection, pp.6-7; FR SA Objection, paragraph 30; NL SA Objection,
paragraphs 10 and 33 ; PT SA Objection, paragraphs 45-47.
308
FR SA Objection, paragraphs 30-34; NL SA Objection, paragraphs 9-11; PT SA objection, paragraph 45.
309
DE SAs Objection, p.7.
310
AT SA pp.8-10 ; DE SAs Objection, p.7; FR SA Objection, paragraphs 30-34; NL SA Objection, paragraphs 9-11;
PT SA objection, paragraph 45.
311
NL SA Objection, paragraphs 7-8 and 12.
312
NL SA Objection, paragraph 16.
313
AT SA Objection p.9; DE SAs Objection, pp.9-10; FR SA Objection, paragraphs 36-37; NL SA Objection,
paragraph 18; PT SA Objection, paragraph 43.
314
Art. 17 GDPR.
Adopted 44
as an additional risk that special categories of personal data falling within the scope of Article 9 GDPR
are processed without meeting the requirements of Article 9(2) GDPR315. The NL SA also underlines
the risk that this conclusion creates legal uncertainty that hampers the free flow of personal data
within the EU316. The NL SA further adds the risk that the decision could create by setting a precedent
for controllers to exclude from their privacy policies or terms of service processing operations based
on consent, thus undermining the principle of transparency317.
175. The EDPB concludes that the objections mentioned above are relevant and reasoned (cf.
Article 4(24) GDPR).
176. However, the part of the NL SA objection asking the IE SA to include in its Draft Decision the elements
concerning the need to rely on consent for the placing of tracking technology on end users devices
under ePrivacy legislation falls outside the scope of the EDPB’s mandate 318.
5.4.2 Assessment on the merits
177. In accordance with Article 65(1)(a) GDPR, in the context of a dispute resolution procedure the EDPB
shall take a binding decision concerning all the matters which are the subject of the relevant and
reasoned objections, in particular whether there is an infringement of the GDPR.
178. The EDPB considers that the objections found to be relevant and reasoned in this subsection 319 require
an assessment of whether the Draft Decision needs to be changed on its Finding 1, which concludes
that Meta IE has (a) not sought to rely on consent to process personal data to deliver the Facebook
Terms of Service and (b) is not legally obliged to rely on consent in order to do so. When assessing the
merits of the objections raised, the EDPB also takes into account Meta IE’s position on the objections
and its submissions.
Meta IE’s position on the objections and its submissions
179. In its submissions, Meta IE supports the IE SA’s conclusion that Meta IE does not rely on consent for
the purposes of behavioural advertising and is not required to rely on it320.
180. Meta IE states that it does not seek or rely on consent as its legal basis for purposes of processing
personal data to provide behavioural advertising, except in limited circumstances where Meta IE
separately obtains consent, yet not through the Facebook Terms of Service321. Meta IE claims that it
explains in its Data Policy to data subjects that Meta IE relies on consent under Article 6(1)(a) GDPR
“(f)or using data that advertisers and other partners provide us about your activity off of Meta
Company Products, so we can personalise ads we show you on Meta Company Products and on
websites, apps and Devices that use our advertising services” and that it has a specific process for
obtaining this consent that satisfies the requirements of Article 7 GDPR, “entirely separate from any
interaction by users with the Terms of Service or Data Policy and which was not part of the Complaint
315
AT SA Objection, p.10; DE SAs Objection, pp.9-10; NL SA Objection, paragraph 18.
316
NL SA Objection, paragraph 18.
317
NL SA Objection, paragraph 23.
318
NL SA Objection, paragraphs 7 and 8.
319
These objections being those of the AT, DE, FR, NL, PT SAs relating to Finding 1, which states that Meta IE is
not required to rely on consent to deliver the Facebook Terms of Service, and its underlying reasoning.
320
Meta IE Article 65 Submissions, paragraph 5.2.
321
Meta IE Article 65 Submissions, paragraph 5.4.
Adopted 45
and was not examined” in the IE SA’s inquiry322. Meta IE submits that the Complaint is limited to the
question of whether Meta IE seeks forced consent to data processing through acceptance of the
Facebook Terms of Service. Meta IE then asserts that since it does not seek, obtain, or rely on consent
as a legal basis under Article 6(1)(a) GDPR to process user data via the Facebook Terms of Service, the
inquiry should end there and all unrelated assertions in the objections should be disregarded323.
181. Meta IE alleges that some CSAs suggest that behavioural advertising must in all cases be based on
consent, and in doing so, the CSAs suggest an approach that prioritises consent-based processing over
other legal basis thereby creating a binding limitation for the processing for the purpose of behavioural
advertising324. Meta IE agrees with the IE SA’s assertion that any approach limiting the legal basis on
which a controller could rely would not be consistent with the principle of legal certainty 325. Meta IE
contends that the GDPR contains no express references to behavioural advertising and establishes no
specific limitations on the available legal basis for such processing326. Meta IE considers that the GDPR
was drafted in a way that protects data subjects while affording flexibility to controllers and that its
application is highly dependent on facts and circumstances underlying the relevant processing and the
nature of the service providers327.
182. Meta IE contends that the CSAs have failed to give sufficient consideration to extensive data
protection rights that apply to all legal bases328. Meta IE argues that in defining the conditions for
lawful processing, the EU legislature has ensured that appropriate data protection rights would be
afforded to data subjects no matter what legal basis is relied on and extensive data protection rights
apply to all legal bases329. Meta IE supports the IE SA’s view that Article 6 GDPR does not require legal
bases to be determined by reference to the applicable data subject rights for each basis330.
EDPB’s assessment on the merits
183. The EDPB notes that the Draft Decision that the IE SA submitted via the Article 60 GDPR procedure
results from an inquiry that the IE SA conducted based on a complaint from a data subject and
Facebook user331. The AT SA forwarded this complaint to the IE SA as LSA in the case, given Meta IE’s
main establishment in Ireland.
184. In this complaint, the Complainant alleges that Meta IE violated Articles 5, 6, 7 and 9 GDPR. The
Complainant argues that it is unclear to what the data subject has consented when the data subject
agreed to the Facebook Terms of Service and Privacy Policy332. More specifically, the Complainant
points out that it remains unclear which exact processing operations the controller chooses to base
on each specific legal basis under Articles 6 and 9 GDPR333. The Complainant argues that the Facebook
Terms of Service and Privacy Policy also include special categories of data under Article 9(1) GDPR
because the data subject, as a Facebook user, has interacted with various groups and individuals,
322
Meta IE Article 65 Submissions Footnote 9 and paragraph 6.8.
323
Meta IE Article 65 Submissions, paragraph 5.9.
324
Meta IE Article 65 Submissions, paragraph 5.2.
325
Meta IE Article 65 Submissions, paragraph 5.15.
326
Meta IE Article 65 Submissions, paragraph 5.16.
327
Meta IE Article 65 Submissions, paragraph 5.16.
328
Meta IE Article 65 Submissions, paragraph 5.2.
329
Meta IE Article 65 Submissions, paragraph 5.17.
330
Meta IE Article 65 Submissions, paragraph 5.17.
331
Draft Decision, paragraph 1.13.
332
Complaint, pp.1-2.
333
Complaint, pp.1-2.
Adopted 46
which would inevitably reveal the data subject’s political affiliations, religious views, sexual orientation
and health conditions, even if the data subject has not directly put them in their “profile”334. The
Complainant claims that the controller also allows to target such information for advertisement335.
The Complainant considers that it would be necessary for the SA to investigate the concrete subject
of the alleged consent and the legal basis for all processing operations and to request the record of
processing activities under Article 30(4) GDPR336.
185. Based on the scope of IE SA’s investigation into this complaint, the EDPB considers that the IE SA
decided to limit the scope of its Draft Decision to the following legal issues:
o Issue 1 – Whether clicking on the “accept” button constitutes or must be considered
consent for the purposes of the GDPR
o Issue 2 – Reliance on Article 6(1)(b) GDPR as a lawful basis for personal data
processing
o Issue 3 – Whether Facebook provided the requisite information on the legal basis
for processing on foot of Article 6(1)(b) GDPR and whether it did so in a transparent
manner337.
186. The IE SA argues that it has discretion to determine the framework of the inquiry taking into account
the scope of the written complaint as lodged338. The IE SA considers that it would not have been
possible to undertake an assessment of each discrete processing operation by Meta IE without first
resolving the fundamental dispute between the parties on the interpretation of Article 6(1) GDPR339.
In relation to the processing of Article 9 GDPR categories of data, the IE SA considers that the inquiry
has addressed the fundamental issue of principle on which the complaint depends, and this makes it
unnecessary to conduct an indiscriminate and open-ended assessment of processing falling within the
scope of this Article340. The IE SA thus concludes that Meta IE has (a) not sought to rely on consent in
order to process personal data to deliver the Facebook Terms of Service and (b) is not legally obliged
to rely on consent in order to do so341, based on the submissions of the Parties and the Facebook
Terms of Service342. The IE SA warns CSAs on the legal risks derived from asking through the objections
to expand the material scope of the inquiry and thus cover infringements outside of the complaint
and Draft Decision that the IE SA has not investigated (pursuant to its own decision to limit the scope
of the inquiry) and put to Meta IE343.
187. The EDPB notes that the complaint makes plain the confusion of the Facebook user over which of the
user’s special categories of data are processed, for which purposes and on which basis.
188. The Facebook Terms of Service themselves note in general terms “We collect and use your personal in
order to provide the services described above to you”344, (services which include “Provide a
personalized experience for you” and “Help you discover content, products and services that may
334
Complaint, pp.1-2.
335
Complaint, pp.1-2.
336
Complaint, pp.7 and 16.
337
Draft Decision, paragraph 2.23.
338
Composite Response, paragrah 21.
339
Composite Response, paragraph 21.
340
Composite Response, paragraph 23.
341
Draft Decision, Finding 1 p.23.
342
Draft Decision, paragraph 3.26.
343
Composite Response, paragraph 25-27 and 29.
344
Facebook Terms of Service, Section 2.
Adopted 47
interest you”)345. The Facebook Terms of Service, which are considered as making up the entire
agreement346 include a reference to a separate document: Facebook’s “Data Policy”, which lists under
the heading “Things you and others do and provide:” “Data with special protections: You can choose
to provide information in your Facebook profile fields or Life Events, about your religious views, political
views, who you are ‘interested in’ or your health. This and other information (such as racial or ethnic
origin, philosophical beliefs or trade union membership) is subject to special protections under EU
law”347. The Data Policy describes the purposes for which these data are processed in very general
terms such as “Provide, personalize and improve our products” and “to select and personalize ads,
offers and other sponsored content that we show you”348 with no specific reference to the specific
processing operations and categories of data each purpose would cover. Meta IE thus seems to
acknowledge in its Data Policy349 that it uses special categories of data for behavioural advertising
purposes, without specifying the “special protections under EU law” that it would apply to such
processing. Meta IE only includes a general reference to consent among other legal basis in the same
page350, which includes a link to a separate page mentioning the use of consent on data with special
protection and referring to the Facebook Settings351.
189. The IE SA finds that the way in which Meta IE provides this information, in relation to processing for
which Article 6(1)(b) GDPR is relied upon, and the lack of information on the specific processing
operations, the data involved, their purposes and legal basis constitute an infringement of
transparency obligations under the GDPR (Article 5(1)(a), Article 12 (1), and Article 13(1)(c) GDPR)352.
The IE SA considers the complaint in this case to be limited to the Facebook Terms of Service and the
processing it entails once accepted353. In these circumstances, the IE SA accepts at face value Meta
IE’s submission on its reliance on different “acts” of consent for discrete aspects of the service
separately from the user’s acceptance of the Facebook Terms of Service354. The IE SA does not engage
into any further examination or verification on how consent is sought in the case of processing carried
out to provide discrete aspects of the service and whether all special categories of data under
Article 9 GDPR that Meta IE processes355 in its Facebook service are subject to these “acts” of consent
and thus effectively treated outside the scope of the Facebook Terms of Service and the legal basis of
Article 6(1)(b) GDPR on which the Facebook Terms of Service purportedly rely, or whether some
345
Facebook Terms of Service, Section 1.
346
Facebook Terms of Service, Section 5, paragraph 1.
347
Facebook Data Policy, Section “Things you and others do and provide”.
348
Facebook Data Policy, Section “How do we use this information?-Provide, personalize and improve our
Products”.
349
Facebook Data Policy, Section “Things you and others do and provide” and Section “How do we use this
information?-Provide, personalize and improve our Products”.
350
Facebook Data Policy, Section “What is our legal basis for processing data?”.
351
Facebook website.
352
Draft Decision, paragraphs 5.70-2.76 and Finding 3.
353
The IE SA mentions in its Schedule to the Draft Decision, paragraph 35 “I do not however accept that the
processing of sensitive categories of personal data on the basis of Article 9 GDPR consent falls within the scope
of this Inquiry. Facebook undoubtedly does process special category data on the basis of explicit consent under
Article 9 GDPR on its platform including in terms of the separate consent collected for its facial recognition
feature. The Complaint is one about whether the Terms of Service (which is the contract with the user) are a
deliberately veiled and inadequate means of forcing consent under GDPR, or whether they are, as Facebook
contends, a contract with the user for which certain data processing is necessary in order to perform that
contract.”
354
Composite Response, paragraph 39.
355
Such as the Facebook profile fields containing information on religious views, political views or health to
which Facebook’s Data Policy refers. Facebook’s Data Policy, Section “Things you and others do and provide”.
Adopted 48
special categories of personal data, as defined by the GDPR and EU case-law356, are treated under the
Facebook Terms of Service.
190. The CJEU asserted recently that the purpose of Article 9(1) GDPR is to ensure an enhanced protection
of data subjects for processing, which, because of the particular sensitivity of the data processed, is
liable to constitute a particularly serious interference with the fundamental rights to respect for
private life and to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter357.
The CJEU adopts a wide interpretation of the terms “special categories of personal data” and “sensitive
data” that includes data liable indirectly to reveal sensitive information concerning a natural person358.
Advocate General Rantos reiterates the importance for the protection of data subjects of
Article 9 GDPR and applies the same interpretation to the data processing in the Facebook service for
behavioural advertising by stating that “the prohibition on processing sensitive personal data may
include the processing of data carried out by an operator of an online social network consisting in the
collection of a user’s data when he or she visits other websites or apps or enters such data into them,
the linking of such data to the user account on the social network and the use of such data, provided
that the information processed, considered in isolation or aggregated, make it possible to profile users
on the basis of the categories that emerge from the listing in that provision of types of sensitive
personal data”359.
191. Therefore, the GDPR and the case-law pay especial attention to the processing or potential processing
of special categories of personal data under Article 9 GDPR to ensure the protection of the data
subjects. In this connection, the Complainant alleges in the complaint, among others, a violation of
Article 9 GDPR and expressly requests the IE SA to investigate Meta IE’s processing operations in the
Facebook service covered by this Article 360. In a subsequent submission on the preliminary Draft
Decision, the Complainant criticises the scope that the IE SA decided to give to the complaint and its
lack of investigation of Meta IE’s processing activities and alleges that the IE SA failed to give due
consideration to processing under Article 9 GDPR and other cases in which Meta IE relies on
consent361.
192. In the present case, the IE SA limited its facts and legal assessment in the Draft Decision to the general
questions of whether Facebook has (a) sought to rely on consent in order to process personal data to
deliver the Facebook Terms of Service and (b) if it is legally obliged to rely on consent in order to do
so. The IE SA categorically concludes on these questions. At the same time, the IE SA acknowledges a
serious lack of transparency by Meta IE as regards the information provided concerning the processing
being carried out in reliance on Article 6(1)(b) GDPR and does not clarify which data categories are
being processed for behavioural advertising, if Meta IE processes special categories of data for
behavioural advertising , and if it does, if Meta IE complies with the conditions of Article 9 GDPR and
others relevant to the application of this provision(for example Article 6(1)(a) and Article 7 GDPR).
193. By deciding not to investigate, further to the complaint, the processing of special categories of
personal data in the Facebook service, the IE SA leaves unaddressed the risks this processing poses for
356
See Art. 9 GDPR and C-184/20 Vyriausioji tarnybinės etikos komisija.
357
C-184/20 Vyriausioji tarnybinės etikos komisija, paragraph 126.
358
C-184/20 Vyriausioji tarnybinės etikos komisija, paragraph 127.
359
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704. paragraph 46.
360
Complaint, pp.1-2, 7, 14.
361
Draft Decision, paragraph 2.20 and Complainant Submission on Preliminary Draft Decision of 11 June 2021,
pp.11-13.
Adopted 49
the Complainant and for Facebook users. First, there is the risk that the Complainant’s special
categories of personal data are processed in the Facebook service to build intimate profiles of them
for behavioural advertising purposes without a legal basis and in a manner not compliant with the
GDPR and the strict requirements of its Article 9 and other GDPR provisions relevant thereto. Second,
there is also the risk that Meta IE does not consider as special categories of personal data (in line with
the GDPR and the CJEU case law362) certain categories of personal data it processes and consequently,
that Meta IE does not treat them as required by EU law. Third, the Complainant and other Facebook
users, whose special categories of data are processed, may be deprived of certain special protections
derived from the use of consent, such as the possibility to specifically consent to certain processing
operations and not to others and to the further processing of personal data (Article 6(4) GDPR), the
freedom to withdraw consent (Article 7 GDPR) and the subsequent right to be forgotten363. Fourth,
given the great size and dominant market share of Meta IE in the social media market, leaving
unaddressed its current ambiguity in the processing of special categories of personal data, and its
limited transparency vis-à-vis Facebook users, may set a precedent for controllers to operate in the
same manner and create legal uncertainty hampering the free flow of personal data within the EU.
194. The EDPB further considers, also in view of these risks to the Complainant and to other Facebook
users, that the IE SA did not handle the complaint with all due diligence364. The EDPB sees the lack of
any further investigation into the processing of special categories of personal data as an omission, and
-in the present case- finds it relevant that the Complainant alleged infringements of Article 9 GDPR in
the complaint365. The EDPB contends that, in the present case, the IE SA should have verified on the
basis of the contract and the data processing actually carried out on which legal bases each data
processing operation at issue relies.
195. The EDPB also highlights that in limiting excessively the scope of its inquiry despite the scope of the
complaint in this cross-border case and systematically considering the objections made in this regard
not relevant and/or reasoned and thus denying their formal admissibility, the IE SA as LSA in this case,
constrains the capacity of CSAs to act and tackle the risks to data subjects in sincere and effective
cooperation. As ruled by the CJEU, the LSA must exercise its competence within a framework of close
cooperation with other supervisory authorities concerned and cannot “eschew essential dialogue with
and sincere and effective cooperation with the other supervisory authorities concerned”366. The limited
scope the IE SA gave to the inquiry and its consideration of all the objections made as inadmissible for
being not relevant or reasoned also impairs the EDPB’s capacity to conclude on the matter pursuant
to Article 65 GDPR and thus ensure a consistent application of EU data protection law, especially
considering that the complaint was introduced more than four years ago.
196. As a result of the limited scope of the inquiry and the fact that the IE SA did not assess in its Draft
Decision Meta IE’s processing of special categories of personal data in its Facebook service, the EDPB
does not have sufficient factual evidence on Meta IE’s processing operations to enable it to make a
362
See C-184/20 Vyriausioji tarnybinės etikos komisija and more recently on the processing in Facebook:
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704.
363
Art. 17 GDPR.
364
C-311/18 Schrems II, paragraph 109; Judgement of the Court of Justice of 6 October 2015, Schrems, C-362/14,
ECLI:EU:C:2015:650, paragraph 63; Judgement of the Court of Justice of 4 April 2017, European Ombudsman v
Staelen, C-337/15, ECLI:EU:C:2017:256, paragraphs 12, 34, 43, 114.
365
Complaint, pp.1-2, 7, 14.
366
Judgement of the Court of Justice of 15 June 2021, Facebook Ireland Ltd v Gegevensbeschermingsautoriteit,
C-645/19, ECLI:EU:C:2021:483, (hereinafter ‘C-645/19 Facebook v Gegevensbeschermingsautoriteit), paragraphs
53 and 63.
Adopted 50
finding on any possible infringement by Meta IE of its obligations under Article 9 GDPR and other GDPR
provisions relevant thereto.
197. In conclusion, the EDPB decides that the IE SA cannot categorically conclude at this stage through its
Finding 1 that Meta IE is not legally obliged to rely on consent to carry out the personal data processing
activities involved in the delivery of the Facebook service, including behavioural advertising, as set out
in the Facebook Terms of Service, without further investigating its processing operations, the
categories of data processed (including to identify special categories of personal data that may be
processed), and the purposes they serve.
198. The EDPB instructs the IE SA to remove from its Draft Decision its conclusion on Finding 1. The EDPB
decides that the IE SA shall carry out a new investigation into Meta IE’s processing operations in its
Facebook service to determine if it processes special categories of personal data (Article 9 GDPR), and
complies with the relevant obligations under the GDPR, to the extent that this new investigation
complements the findings made in the IE SA’s Final Decision adopted on the basis of this Binding
Decision, and based on the results of this investigation, issue a new draft decision in accordance with
Article 60(3) GDPR367.
6 ON THE POTENTIAL ADDITIONAL INFRINGEMENT OF THE PRINCIPLE
OF FAIRNESS
6.1 Analysis by the LSA in the Draft Decision
199. The IE SA in its Draft Decision addresses the Complainant’s allegations that the unclear and misleading
nature of Facebook’s updated Terms of Service and Data Policy, together with the mode of acceptance
of the Facebook Terms of Service, have made Facebook users believe that all processing operations
were based on consent under Article 6(1)(a) GDPR and thus constituted a breach of the controller’s
transparency obligations under Articles 5(1)(a) and 13(1)(c) GDPR368. The IE SA analyses the
submissions provided by the controller and, noting the Complaint’s focus on the alleged “forced
consent”369, concludes that Meta IE has breached Articles 5(1)(a), 13(1)(c) and 12(1) GDPR due to the
lack of transparency in relation to the processing for which Article 6(1)(b) GDPR has been relied on370.
The IE SA explains that, while an infringement of Article 5(1)(a) GDPR does not necessarily or
automatically flow from findings of infringement under Articles 12 and/or 13 GDPR, there is an
important link between these provisions371. Nevertheless, the IE SA takes the view that “the factual
question of whether Facebook ‘misled’ the data subject” is not “a separate legal question from whether
Facebook complied with its transparency obligations in the context of processing allegedly carried out
pursuant to Article 6(1)(b) GDPR”372. It concludes that “there is no distinct legal issue raised by the
question whether, as a matter of fact, the Complainant did or did not believe that the processing was
based on Article 6(1)(a) GDPR (i.e. consent) and not on Article 6(1)(b) GDPR (i.e. necessity for the
367
Section 4.2.3 and paragraphs 79 - 80 of the EDPB Guidelines on Article 65(1)(a) GDPR.
368
Draft Decision, paragraphs 5.6 and 5.7
369
See also paragraph 3 of this Binding Decision.
370
Draft Decision, paragraphs 5.59-5.76
371
Draft Decision, paragraph 5.74.
372
Draft Decision, paragraph 2.19.
Adopted 51
performance of a contract)”373. The IE SA points out that Article 5(1)(a) GDPR links transparency to the
overall fairness of the activities of the controller374 and concludes on the breach of this provision in
relation to the infringement of the transparency obligations375.
6.2 Summary of the objection raised by the CSAs
200. The IT SA objects to the scope of Finding 3 of the Draft Decision and to the assessment leading up to
it. The IT SA agrees to a large extent with the Draft Decision’s Finding 3 on the infringement of Article
12(1), Article 13(1)(c), and Article 5(1)(a) GDPR in terms of transparency 376. However, the IT SA argues
that Meta IE has also failed to comply with the more general principle of fairness under Article 5(1)(a)
GDPR, which, in the view of the IT SA, entails separate requirements from those relating specifically
to transparency377.
201. According to the IT SA, the relationship between Meta IE and Facebook users is markedly
unbalanced378 and an infringement of the fairness principle resulted, first of all, from the
misrepresentation of the legal basis for processing by the controller 379, considering that “Facebook
presented its service to users in a misleading manner” and “without taking due account of users’ right
to the protection of their personal data”380. The IT SA argues that “the controller leaves its users in the
dark as they are expected to tell or actually ‘figure out’, from time to time, the possible connections
between purpose sought, applicable legal basis and relevant processing activities”381.
202. Secondly, such infringement also stems from the “high-level and all-encompassing reference to Article
6(1)(b) GDPR as relied upon to enable the massive collection of personal data [...] and their reuse for
multifarious, distinct purposes”, considering the “pervasive as well as prolonged analysis of [the users’]
online behaviour” amounting to a disproportionate interference with their private lives compared to
the pursuit of freedom of enterprise382.
203. The IT SA thus considers that the IE SA should have found an infringement of the fairness principle
under Article 5(1)(a) GDPR, in addition to the infringement of the transparency obligations derived
from this provision, without any need for supplementary investigations383. According to the IT SA,
should the objection be followed, it would also impact the exercise of corrective powers by the IE SA,
i.e. the measures to be imposed on the controller in order to bring the processing into conformity with
the GDPR384.
373
Draft Decision, paragraph 2.19.
374
Draft Decision, paragraph 5.76.
375
Draft Decision, paragraphs 5.59-5.76 and Finding 3.
376
IT SA Objection, paragraph 1.
377
IT SA Objection, paragraph 2.4.
378
IT SA Objection, paragraph 2.2.
379
IT SA Objection, paragraph 2.4.
380
IT SA Objection, paragraph 2.3.
381
IT SA Objection, paragraph 2.4.
382
IT SA Objection, paragraph 2.5.
383
IT SA Objection, paragraph 3.
384
IT SA Objection, paragraph 2.2.(i).
Adopted 52
6.3 Position of the LSA on the objection
204. The IE SA does not consider the IT SA objection to be relevant and reasoned and does not follow it385.
The IE SA examines it together with the other objections relating to the scope and conduct of the
inquiry and contends that introducing novel issues not raised by the Complainant or otherwise put to
the parties would represent a significant departure in terms of the scope of the inquiry 386.
205. The IE SA highlights the legal consequences that would flow from making material changes concerning
infringements outside of the complaint and Draft Decision, namely the likelihood that Meta IE would
succeed in arguing before the Irish Courts that it has been denied an opportunity to be heard on
additional and extraneous findings that are adverse to it 387.The IE SA’s concern arose from the fact
that, according to the IE SA, Meta IE was never invited to be heard in response to an allegation that it
had infringed the fairness principle set out in Article 5(1)(a) GDPR. The IE SA notes, in this regard, that
a respondent has the right to be heard in response to the particulars of the case being made against
it and that this is a core element of a fair procedure pursuant to Irish law. The IE SA takes the view
that expanding the material scope of the inquiry is not possible under Irish procedural law and that,
considering the seriousness of the transparency infringements, it would not be appropriate to delay
the resolution of the matter 388.
6.4 Analysis of the EDPB
6.4.1 Assessment of whether the objection was relevant and reasoned
206. The IT SA objection concerns “whether there is an infringement of the GDPR”389.
207. The EDPB takes note of Meta IE’s view that the objections categorised by the IE SA as relating to the
scope and conduct of the inquiry, among which the IT SA objection regarding the infringement of the
fairness principle, are not reasoned and relevant390. According to Meta IE, the requests to expand the
defined scope of the inquiry are inappropriate in circumstances where the scope of the Inquiry has
been confined to assessing the matter of “forced consent”, as opposed to a wider assessment of the
lawfulness or fairness of Meta IE’s processing activities under other possible legal bases391.
208. Meta IE further contends that the IT SA’s justification for the existence of an infringement of the
fairness principle under Article 5(1)(a) GDPR (rather than the transparency principle protected by the
same provision) is not based on any detailed factual or legal reasoning and fails to address the
significance of the alleged risks to fundamental rights posed by the Draft Decision 392.
209. As it was previously explained, the EDPB does not share the understanding that CSAs may not disagree
with the scope of the inquiry as decided by the LSA by way of an objection393. The EDPB recalls that an
objection could go as far as identifying gaps in the draft decision justifying the need for further
investigation by the LSA, for example in situations where the investigation carried out by the LSA
385
IE SA Composite Response, paragraph 30.
386
IE SA Composite Response, paragraph 25.
387
IE SA Composite Response, paragraph 26.
388
IE SA Composite Response, paragraph 29.
389
Guidelines on RRO, paragraph 24.
390
Meta IE Article 65 Submissions, p. 15, paragraph 4.2.
391
Meta IE Article 65 Submissions, p. 19, paragraph 4.20.
392
Meta IE Article 65 Submissions, Annex 1, p. 124.
393
See paragraphs 72 and 73 of this Binding Decision.
Adopted 53
unjustifiably fails to cover some of the issues raised by the complainant394. In this regard, the EDPB
observes that, in their complaint, the Complainant alleges that the information provided in Meta IE’s
Privacy Policy “is inherently non-transparent and unfair within the meaning of Articles 5(1)(a) and 13(c)
GDPR”395. This is also noted by the IE SA396. In addition, the Complainant alleges that “Asking for
consent to a processing operation, when the controller relies in fact on another legal basis is
fundamentally unfair, misleading and non-transparent within the meaning of Article 5(1)(a) of the
GDPR”397. Therefore, the EDPB disagrees with the IE SA’s finding that assessing Meta IE’s compliance
with the principle of fairness would amount to introducing “novel issues which have not been raised
by the complainant”398.
210. The EDPB notes that the IT SA agrees with the IE SA’s finding with regard to the infringement of the
principle of transparency under Article 5(1)(a) GDPR399. As this finding is not subject to a dispute, the
EDPB will not examine this matter.
211. After analysing the IT SA objection, the EDPB finds that the objection is relevant, as it refers to a
specific part of the Draft Decision (Finding 3400), and if followed would lead to the conclusion that there
is an infringement of the general principle of fairness under Article 5(1)(a) GDPR, in addition to the
breach of the transparency obligations derived from this provision401. The objection, if followed, would
also entail the exercise of corrective powers, i.e. the measures to be imposed on the controller in
order to bring the processing into conformity with the GDPR402.
212. The IT SA objection is also reasoned because it includes several specific legal and factual arguments in
support of finding an additional infringement of the principle of fairness under Article 5(1)(a) GDPR403.
For example, the IT SA explains that “transparency and fairness are two separate notions” and that
“transparency relates to clarity of the information provided to users via the ToS and the privacy policy”,
while “fairness relates to how the controller addressed the lawfulness of the processing activities in
connection with its social networking service”404. The IT SA contends that the “overall relationship
between Facebook and its users is markedly unbalanced”405. According to the IT SA, the first way in
which Meta IE has infringed the principle of fairness was by misrepresenting the legal basis for
processing “without taking due account of users’ right to the protection of personal data”406 and
leaving “its users in the dark”407. Meta IE has also breached the fairness principle, in the IT SA’s view,
by justifying via the broad reference to the legal basis of performance of contract a massive collection
of personal data and their reuse for a wide range of purposes, disproportionately interfering with
users’ private life408.
394
Guidelines on RRO, paragraph 27.
395
Complaint, paragraph 2.3.1.
396
Draft Decision, paragraph 5.7.
397
Complaint, paragraph 2.3.4.
398
IE SA Composite Response, paragraph 25.
399
IT SA Objection, paragraph 1.
400
IT SA Objection, paragraph 1.
401
IT SA Objection, paragraph 3.
402
IT SA Objection, paragraph 2.2.(i).
403
See paragraphs 200-202 of this Binding Decision.
404
IT SA Objection, paragraph 2.3.
405
IT SA Objection, paragraph 2.2.
406
IT SA Objection, paragraph 2.3.
407
IT SA Objection, paragraph 2.4.
408
IT SA Objection, paragraph 2.5. See also paragraph 202 of this Binding Decision.
Adopted 54
213. The IT SA objection also identifies the risks posed by the absence in the Draft Decision of a finding on
the infringement of the fairness principle, namely setting a dangerous precedent for future decisions
regarding other controllers relying on the same business model and weakening the safeguards that
must be provided through the effective, comprehensive implementation of the data protection
framework, including the fairness of the processing principle409.
214. Therefore, the EDPB considers that the IT SA objection is relevant and reasoned (cf. Article 4(24)
GDPR).
6.4.2 Assessment on the merits
215. In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning all the
matters which are the subject of the relevant and reasoned objections, in particular whether there is
an infringement of the GDPR.
216. The EDPB considers that the objection found to be relevant and reasoned in this subsection requires
an assessment of whether the Draft Decision needs to be changed insofar as it contains no finding of
infringement of the fairness principle under Article 5(1)(a) GDPR. When assessing the merits of the
objection raised, the EDPB also takes into account Meta IE’s position on the objection and its
submissions.
217. As previously mentioned, the EDPB takes note of Meta IE’s view that the IT SA objection is not relevant
and reasoned410. The EDPB also notes that Meta IE does not provide further submissions on the
content of the IT SA objection411.
218. Before proceeding with the assessment, the EDPB recalls that the basic principles relating to
processing listed in Article 5 GDPR can, as such, be infringed412. This is apparent from the text of Article
83(5)(a) GDPR which subjects the infringement of the basic principles for processing to administrative
fines of up to 20 million euros, or in the case of undertaking, up to 4% of the total worldwide annual
turnover of the preceding financial year, whichever is higher.
219. The EDPB underlines that the principles of fairness, lawfulness and transparency, all three enshrined
in Article 5(1)(a) GDPR, are three distinct but intrinsically linked and interdependent principles that
every controller should respect when processing personal data. The link between these principles is
evident from a number of GDPR provisions: Recitals 39 and 42, Articles 6(2) and 6(3)(b) GDPR refer to
lawful and fair processing, while Recitals 60 and 71 GDPR, as well as Articles 13(2), 14(2) and 40(2)(a)
GDPR refer to fair and transparent processing.
220. On the basis of the above consideration, the EDPB agrees with the IE SA’s view that “Article 5(1)(a)
links transparency to the overall fairness of the activities of a controller”413 but considers that the
principle of fairness has an independent meaning and stresses that an assessment of Meta IE’s
compliance with the principle of transparency does not automatically rule out the need for an
assessment of Meta IE’s compliance with the principle of fairness too.
409
IT SA Objection, p. 12
410
See paragraph 207 of this Binding Decision.
411
Meta IE Article 65 Submissions, Annex 1, pp. 123-124.
412
See also EDPB Binding Decision 1/2021, paragraph 191.
413
Draft Decision, paragraph 5.76.
Adopted 55
221. The EDPB recalls that, in data protection law, the concept of fairness stems from the EU Charter of
Fundamental Rights414. The EDPB has already provided some elements as to the meaning and effect
of the principle of fairness in the context of processing personal data. For example, the EDPB has
previously opined in its Guidelines on Data Protection by Design and by Default that “Fairness is an
overarching principle which requires that personal data should not be processed in a way that is
unjustifiably detrimental, unlawfully discriminatory, unexpected or misleading to the data subject”415.
222. Among the key fairness elements that controllers should consider in this regard, the EDPB has
mentioned autonomy of the data subjects, data subjects’ expectation, power balance, avoidance of
deception, ethical and truthful processing416. These elements are particularly relevant in the case at
hand. The principle of fairness under Article 5(1)(a) GDPR underpins the entire data protection
framework and seeks to address power asymmetries between the data controllers and the data
subjects in order to cancel out the negative effects of such asymmetries and ensure the effective
exercise of the data subjects’ rights. The EDPB has previously explained that “the principle of fairness
includes, inter alia, recognising the reasonable expectations of the data subjects, considering possible
adverse consequences processing may have on them, and having regard to the relationship and
potential effects of imbalance between them and the controller”417.
223. The EDPB recalls that a fair balance must be struck between, on the one hand, the commercial
interests of the controllers and, on the other hand, the rights and expectations of the data subjects
under the GDPR418. A key aspect of compliance with the principle of fairness under Article 5(1)(a) GDPR
refers to pursuing “power balance” as a “key objective of the controller-data subject relationship”419,
especially in the context of online services provided without monetary payment, where users are often
not aware of the ways and extent to which their personal data is being processed420. Consequently,
lack of transparency can make it almost impossible in practice for the data subjects to exercise an
informed choice over the use of their data 421, which is in contrast with the element of “autonomy” of
data subjects as to the processing of their personal data422.
224. Considering the constantly increasing economic value of personal data in the digital environment, it is
particularly important to ensure that data subjects are protected from any form of abuse and
deception, intentional or not, which would result in the unjustified loss of control over their personal
data. Compliance by providers of online services acting as controllers with all three of the cumulative
414
Art. 8 EU Charter of Fundamental Rights states as follows: “1. Everyone has the right to the protection of
personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the
basis of the consent of the person concerned or some other legitimate basis laid down by law” (emphasis added).
415
EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, Version 2, Adopted on 20
October 2020 (hereinafter “EDPB Guidelines on Data Protection by Design and by Default”), paragraph 69.
416
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
417
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 12.
418
On the balance between the different interests at stake see for example: Judgement of the Court of Justice
of 12 December 2013, X, C-486/12, ECLI:EU:C:2013:836; Judgement of the Court of Justice of 7 May 2009, College
van burgemeester en wethouders van Rotterdam v M. E. E. Rijkeboer, C-553/07, ECLI:EU:C:2009:293; Judgment
of the Court (Grand Chamber) of 9 November 2010, Volker und Markus Schecke GbR (C-92/09) and Hartmut
Eifert (C-93/09) v Land Hessen, ECLI:EU:C:2010:662.
419
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
420
On “online services”, see further EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 3-5.
421
further EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 4.
422
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70. According to this element of
fairness, “data subjects should be granted the highest degree of autonomy possible to determine the use made
of their personal data, as well as over the scope and conditions of that use or processing”.
Adopted 56
requirements under Article 5(1)(a) GDPR, taking into account the particular service that is being
provided and the characteristics of their users, serves as a shield from the danger of abuse and
deception, especially in situations of power asymmetries.
225. The EDPB has previously emphasised that the identification of the appropriate lawful basis is tied to
the principles of fairness and purpose limitation423. In this regard, the IT SA rightly observes that while
finding a breach of transparency relates to the way in which information has been provided to users
via the Facebook Terms of Service and Privacy Policy, compliance with the principle of fairness also
relates to “how the controller addressed the lawfulness of the processing activities in connection with
its social networking service”424. Thus, the EDPB considers that an assessment of compliance by Meta
IE with the principle of fairness requires also an assessment of the consequences that the choice and
presentation of the legal basis entail for the Facebook service users. In addition, that assessment
cannot be made in the abstract, but has to take into account the specificities of the particular social
networking service and of the processing of personal data carried out, namely for the purpose of
online behavioural advertising425.
226. The EDPB notes that in this particular case the breach of Meta IE’s transparency obligations is of such
gravity that it clearly impacts the reasonable expectations of the Facebook users by confusing them
on whether clicking the “Accept” button results in giving their consent to the processing of their
personal data. The EDPB notes in this regard that one of the elements of compliance with the principle
of fairness is avoiding deception i.e. providing information “in an objective and neutral way, avoiding
any deceptive or manipulative language or design”426.
227. As the IE SA itself notes, the Complainant argues that Meta IE relied on “forced consent” for the
processing simply because it did in fact believe that the legal basis for processing the controller was
relying upon was consent427. This is illustrated by the multiple arguments that the Complainant
presents in order to demonstrate the “forced consent”, including the reference to the use by Meta IE
of “additional ‘tricks’ to pressure the users”428. For example, the Complainant refers to the inclusion in
the user interface page of “two fake red dots (violation against Article 5(1)(a) – neither ‘fair’, nor
‘transparent’), that indicated that the user has new messages and notifications, which he/she cannot
access without consenting – even if the user did not have such notifications or messages in reality”429.
The EDPB considers that the LSA should have taken into account the use of such practices by Meta IE
in relation to the principle of fairness, regardless of its finding that Meta IE has not sought to rely on
consent in order to process personal data to deliver the Facebook Terms of Service430.
228. In addition, and as previously mentioned in paragraph 97 of this Binding Decision, the Complainant
presents the results of a poll according to which only 1.6% to 2.5% of the 1000 Facebook users who
responded to the poll understood the request to accept the Facebook Terms of Service to be a
423
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 1.
424
IT SA Objection, paragraph 2.3.
425
See Draft Decision, paragraph 4.44 where the IE SA holds that “targeted advertising forms a core element of
Facebook’s business model” and Meta IE Article 65 Submissions, paragraph 6.32 where Meta IE claims that “It
would be impossible to provide the Facebook Service in accordance with the Terms of Service without providing
behavioural advertising”.
426
EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
427
Draft Decision, paragraph 3.2.
428
Complaint, paragraph 1.4.
429
Complaint, paragraph 1.4.
430
Draft Decision, Finding 1.
Adopted 57
contract431. In the EDPB’s view, there are clear indications that Facebook users’ expectations with
regard to the applicable legal basis have not been fulfilled432.
229. As recognised by the IE SA itself, “the user is left to guess as to what processing is carried out on what
data”433. Therefore, the EDPB shares the IT SA’s concern that Facebook users are left ”in the dark"434
and considers that the processing by Meta IE cannot be regarded as ethical and truthful 435 because it
is confusing with regard to the type of data processed, the legal basis and the purpose of the
processing, which ultimately restricts the Facebook users’ possibility to exercise their data subjects’
rights.
230. Furthermore, the EDPB considers that the extensive analysis by the IE SA with regard to the issue of
legal basis and transparency in relation to the processing being carried out in reliance on Article 6(1)(b)
GDPR is closely linked to the issue of compliance by Meta IE with the principle of fairness. Considering
the seriousness of the infringements of the transparency obligations by Meta IE already identified in
the Draft Decision and the related misrepresentation of the legal basis relied on, the EDPB agrees with
the IT SA that Meta IE has presented its service to the Facebook users in a misleading manner436, which
adversely affects their control over the processing of their personal data and the exercise of their data
subjects' rights. Therefore, the EDPB is of the opinion that the IE SA’s finding of breach of Article 5(1)(a)
GDPR with regard to the principle of transparency437 should extend to the principle of fairness too.
231. This is all the more supported by the fact that, in the circumstances of the present case as
demonstrated above438, the overall effect of the infringements by Meta IE of the transparency
obligations under Articles 5(1)(a), 12(1), 13(1)(c) GDPR and the infringement of Article 6(1) GDPR439
further intensifies the imbalanced nature of the relationship between Meta IE and the Facebook users
brought up by the IT SA objection. The combination of factors, such as the asymmetry of the
information created by Meta IE with regard to Facebook service users, combined with the “take it or
leave it” situation that they are faced with due to the lack of alternative services in the market and
the lack of options allowing them to adjust or opt out from a particular processing under the contract
with Meta IE, systematically disadvantages Facebook service users, limits their control over the
processing of their personal data and undermines the exercise of their rights under Chapter III of the
GDPR.
232. Therefore, the EDPB instructs the IE SA to include a finding of an infringement of the principle of
fairness under Article 5(1)(a) GDPR by Meta IE, in addition to the infringement of the principle of
transparency under the same provision, and to adopt the appropriate corrective measures, by
431
See paragraph 97 of this Binding Decision.
432
According to the fairness element of “expectation”, “processing should correspond with data subjects’
reasonable expectations” - EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
433
Draft Decision, paragraph 5.63.
434
IT SA Objection, paragraph 2.4.
435
See EDPB Guidelines on Data Protection by Design and by Default, paragraph 70, where the EDPB explains
that “ethical” means that “[t]he controller should see the processing’s wider impact on individuals’ rights and
dignity“ and “truthful” means that “[t]he controller must make available information about how they process
personal data, they should act as they declare they will and not mislead the data subjects”.
436
IT SA Objection, paragraph 2.3.
437
Draft Decision, paragraphs 5.59-5.76.
438
See paragraphs 221-230 of this Binding Decision.
439
See paragraph 133 of this Binding Decision.
Adopted 58
addressing, but without being limited to, the question of an administrative fine for this infringement
as provided for in Section 9 of this Binding Decision.
7 ON THE POTENTIAL ADDITIONAL INFRINGEMENT OF THE
PRINCIPLES OF PURPOSE LIMITATION AND DATA MINIMISATION
7.1 Analysis by the LSA in the Draft Decision
233. The IE SA refers to Article 5(1)(b) 440 and Article 5(1)(c) GDPR441 when analysing the extent of the
controller’s obligation under Article 13(1)(c) GDPR and whether Meta IE has infringed this provision.
More specifically, the IE SA highlights that Article 13 GDPR requires that the purposes and legal bases
must be specified in respect of the intended processing and cannot just be cited in the abstract 442.
After explaining why Meta IE’s view that there is no specific obligation for the legal basis to be mapped
to the purpose of processing cannot be reconciled with a literal reading of the GDPR, the IE SA, for
completeness, also engages in a systemic reading based on the legislator’s objective and the contents
of the GDPR as a whole443.
234. In this context, the IE SA’s points out that both Article 5(1)(b) and (c) GDPR focus quite closely on the
purposes for processing and further stresses that the six principles laid down under Article 5 GDPR are
interconnected and operate in combination to underpin the whole GDPR444. However, the IE SA does
not assess whether Facebook’s processing activities entail a separate infringement of the principles of
purpose limitation and data minimisation under Article 5(1)(b) and Article 5(1)(c) GDPR.
7.2 Summary of the objection raised by the CSAs
235. According to the IT SA, there is an additional infringement of points (b) and (c) of Article 5(1) GDPR on
account of Meta IE’s failure to comply with the purpose limitation and data minimisation principles. It
considers that such infringement should be found without the need for any further investigation and
should result into a substantial increase of the proposed administrative fine445.
236. The IT SA puts forward several factual and legal arguments for the proposed change to the Draft
Decision. First, it points out that the IE SA confines its assessment to only one of the contract’s
purposes (the provision of online behavioural advertising), while Facebook’s service would actually be
composed of several processing activities pursuing several purposes446. According to the IT SA, the fact
that Meta IE inappropriately based its multifarious processing activities only on Article 6(1)(b) GDPR
entails an infringement of the purpose limitation and data minimisation principles447. The IT SA
stresses the relevance of these principles in online services contracts, as they are not negotiated on
an individual basis, and refers to pages 15 and 16 of the WP29 Opinion 03/2013 on purpose
440
Draft Decision, paragraphs 5.32 - 5.40.
441
Draft Decision, paragraph 5.32.
442
Draft Decision, paragraph 5.29.
443
Draft Decision, paragraph 5.30.
444
Draft Decision, paragraph 5.32.
445
IT SA Objection, p. 9, paragraph 2.
446
IT SA Objection, p. 7, paragraph 1.1.
447
IT SA Objection, p.7.
Adopted 59
limitation448. The IT SA also refers to the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR and recalls
that, where the contract consists of several separate services or elements of a service that can be
performed independently, the applicability of Article 6(1)(b) GDPR should be assessed for each of
those services separately449.
237. On the risks posed by the Draft Decision, the IT SA refers to the risk identified by the WP29 in its
Opinion 03/2013 on purpose limitation450, namely that “data controllers seek to include processing
terms in contracts to maximise the possible collection and uses of data without adequately specifying
those purposes or considering data minimisation obligations”451. In addition, in the IT SA’s view, the
failure to specify and communicate the purposes of the processing to the data subject creates a risk
of artificially expanding the types of processing or the categories or personal data considered
necessary for the performance of a contract under Article 6(1)(b) GDPR, which would nullify the
safeguards afforded to data subjects under data protection law452.
7.3 Position of the LSA on the objections
238. The IE SA does not consider that the IT SA’s objection is relevant and reasoned453. Categorising the
objection as relating to the scope and conduct of the inquiry, the IE SA adopts the same approach as
with regard to the alleged infringement of the principle of fairness. More specifically, the IE SA
contends that introducing novel issues not raised by the Complainant or otherwise put to the parties
would represent a significant departure in terms of the scope of the inquiry454 and highlights the legal
consequences thereof, namely the likelihood that Meta IE would succeed in arguing before the Irish
Courts that it has been denied an opportunity to be heard on additional and extraneous findings that
are adverse to it455. The IE SA’s concern arose from the fact that, according to the IE SA, Meta IE was
never invited to be heard in response to an allegation that it had infringed Articles 5(1)(b) and (c)
GDPR. The IE SA notes, in this regard, that a respondent has the right to be heard in response to the
particulars of the case being made against it and that this is a core element of a fair procedure
pursuant to Irish law. The IE SA takes the view that expanding the material scope of the inquiry is not
possible under Irish procedural law and that, considering the seriousness of the transparency
infringements, it would not be appropriate to delay the resolution of the matter 456. It further notes
that a very significant risk of procedural unfairness, under Irish national law, would result from the
proposal to assume, without any further factual examination, that Meta IE has infringed the purpose
limitation principle457.
448
IT SA Objection, p. 7, paragraph 1.1.
449
IT SA Objection, p. 7, paragraph 1.1. The IT SA refers to EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, p. 12,
paragraph 37.
450
WP29 Opinion 03/2013 on purpose limitation, adopted on 2 April 2013 (WP203).
451
IT SA Objection, p.7.
452
IT SA Objection, p. 7.
453
IE SA Composite Response, paragraph 30.
454
IE SA Composite Response, paragraph 25.
455
IE SA Composite Response, paragraph 26.
456
IE SA Composite Response, paragraph 29.
457
IE SA Composite Response, paragraph 27.
Adopted 60
7.4 Analysis of the EDPB
7.4.1 Assessment of whether the objection was relevant and reasoned
239. The IT SA objection concerns “whether there is an infringement of the GDPR”458.
240. The EDPB takes note of Meta IE’s view that the IT SA’s objection does not meet the relevant and
reasoned thresholds because it falls outside the defined scope of the inquiry. As previously explained,
the EDPB does not share the understanding that CSAs may not disagree with the scope of the inquiry
as decided by the LSA by way of an objection 459.
241. Meta IE further argues that even if the objection satisfied the abovementioned thresholds, it should
be disregarded because otherwise Meta IE’s right to fair procedures under both Irish and EU law would
be contravened460. It points out that the objection concerns matters that have not been investigated
and relates to theoretical findings on legal bases461.
242. The EDPB considers that the IT SA objection is relevant as it refers to specific parts of the Draft
Decision, namely Finding 2 and Finding 3462, and argues that the IE SA should have found an
infringement of Article 5(1)(b) and (c) GDPR which lay down the principles of data minimisation and
purpose limitation.
243. The objection also includes arguments on legal and factual mistakes in the IE SA’s Draft Decision that
require amending. According to the IT SA, the IE SA’s reasoning is inconsistent because the high-level,
rather unclear information provided to the data subjects is a major criticality that should have led the
IE SA not only to question the features of the information notice, but also to verify, in detail, the
application of the principles of purpose limitation and data minimisation from a substantive
perspective463. More specially, the IT SA takes the view that the IE SA should have had regard to the
actual configuration of the processing operations performed in order to assess whether the controller
had abided by the obligation to process personal data for specified, explicit and legitimate purposes
both when collecting those data and thereafter 464.
244. As regards the risk posed by the Draft Decision, the EDPB takes note of the IT SA’s reference to
paragraph 16 of the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR and reiterates the particular
relevance of Articles 5(1)(b) and (c) GDPR in the context of contracts for online services, in view of the
risk that data controllers may seek to include general processing terms in contracts in order to
maximise the possible collection and uses of data, without adequately specifying those purposes or
considering data minimisation obligations465. Nevertheless, the EDPB stresses that a mere reference
to the EDPB Guidelines is not sufficient to demonstrate the risks posed by the Draft Decision in this
specific case and in these specific circumstances.
458
Guidelines on RRO, paragraph 24.
459
See paragraphs 72 and 73 of this Binding Decision.
460
Meta IE Article 65 Submissions, Annex 1, p. 123.
461
Meta IE Article 65 Submissions, Annex 1, p. 123.
462
The IT SA refers to the IE SA’s reasoning preceding Finding 2 and to paragraphs 5.52, 5.62 and 5.63 preceding
Finding 3 of the Draft Decision.
463
IT SA Objection, p.8, paragraph 1.3.
464
IT SA Objection, p.8, paragraph 1.3.
465
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 16.
Adopted 61
245. The IT SA also considers that the purposes for the processing “must be clearly specified and
communicated to the data subject, in line with the controller’s purpose limitation and transparency
obligations”, otherwise there is “a risk that other data protection obligations might be evaded by
artificially expanding the types of processing or the categories of personal data that are considered to
be ‘necessary’ for performance of the contract under Article 6(1)(b) GDPR - which would in turn nullify
the safeguards afforded to data subjects by personal data protection law”466.
246. The EDPB recalls that the objection must put forward arguments or justifications concerning the
consequences of issuing the decision without the changes proposed in the objection, and how such
consequences would pose significant risks for data subjects’ fundamental rights and freedoms467. The
CSA needs to advance sufficient arguments to explicitly show that such risks are substantial and
plausible468. In addition, the demonstration of the significance of the risks cannot be implied from the
legal and/or factual arguments provided by the CSA, but has to be explicitly identified and elaborated
in the objection469.
247. The EDPB considers that the IT SA objection fails to meet these requirements as it does not
demonstrate the significance of the risk stemming from an omission in the Draft Decision of a finding
that the principles of purpose limitation and data minimisation have been infringed by Meta IE. The
risk, as described by the IT SA objection, is not substantial and plausible enough. Moreover, the risk
relates to the IE SA’s decision not to conclude on the inappropriate use of Article 6(1)(b) GDPR as a
legal basis for Meta IE’s processing activities but fails to establish a clear link with the LSA decision not
to make a finding on the infringement of Article 5(1)(b) and (c) GDPR.
248. Therefore, the EDPB considers that the abovementioned objection by the IT SA is not reasoned (cf.
Article 4(24) GDPR) and will not assess it on the merits.
8 ON CORRECTIVE MEASURES OTHER THAN ADMINISTRATIVE FINES
8.1 Analysis by the LSA in the Draft Decision
249. The IE SA considers that an order to bring processing into compliance (Article 58(2)(d) GDPR) should
be imposed on Meta IE, requiring them to bring their Data Policy and Facebook Terms of Service into
compliance with Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR as regards processing carried
out on the basis of Article 6(1)(b) GDPR within three months of the date of notification of any final
decision470.
250. The LSA considers an order is necessary and proportionate, contrary to the controller’s position 471.
Regarding the necessity, the IE SA explains that this order is the only way to guarantee that Meta IE
amends the infringements outlined in the Draft Decision, which is essential for the protection of data
subjects’ rights. Concerning the proportionality, the LSA points out that the proposed measure is the
minimum action required to ensure the future compliance of the controller. Further, the IE SA recalls
466
IT SA Objection, p. 7, paragraph 1.1.
467
Guidelines on RRO, paragraph 18.
468
Guidelines on RRO, paragraph 37.
469
Guidelines on RRO, paragraph 37.
470
Draft Decision, paragraphs 8.2 and 8.5.
471
Meta IE Submissions on Preliminary Draft Decision, paragraph 12; Draft Decision, paragraph 8.2.
Adopted 62
Meta IE’s available resources, the specificity of the LSA’s order, and the importance of the data
subject’s rights concerned to conclude that such measure is proportionate 472.
8.2 Summary of the objections raised by the CSAs
251. The NL SA objects to the choice of the corrective measures of the LSA in their Draft Decision 473. The
NL SA notes that the IE SA is proposing to impose an order pursuant to Article 58(2)(d) GDPR alongside
an administrative fine, and that this objection concerns the first of these two measures474. More
specifically, the NL SA objects to the order to bring processing into compliance (Article 58(2)(d) GDPR)
within three months proposed by the LSA, arguing that it is not appropriate, not necessary, nor
proportionate to ensure compliance with Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR, as
well as the additional infringement of Article 6(1)(b) and Article 9(2) GDPR raised in its objection475.
The NL SA takes the view that the proposed order is insufficient to remedy the serious situation of
non-compliance arising from these infringements, since it does not remedy the illegality of the
conduct carried out during the transition period (i.e. the time between the issuance of the decision
and the expiration date of the order), bearing in mind that “every day the service continues operations
as described in the Terms of Use and Data Policy”, it does so in an illegal way harming the rights and
freedoms of millions of data subjects in the EEA 476. According to the NL SA, the Draft Decision should
be modified to include a temporary ban on processing (Article 58(2)(f) GDPR), as it would be the “only
measure suitable to make sure that the expansive violation of the fundamental rights and freedoms of
data subjects is not continued”477. The NL SA also argues that the breaches of the GDPR established by
the LSA, combined with the additional breaches put forward by the NL SA, are of a very grave nature
and justify halting processing operations during the time the controller needs to remedy its severe
lack of compliance478. In essence, the NL SA identifies the risk posed by the Draft Decision in that it
allows the company to resume operations as usual while amending the compliance deficits (with
regard to transparency), which they argue essentially deprives data subjects of their rights during a
transition period479.
252. According to the IT SA, the finding of the additional infringement of Article 6(1)(b) GDPR should “result
in the taking of appropriate corrective measures under Article 58(2)(d) GDPR”480.
253. The AT SA argues the use of corrective measures is necessary at hand in order to bring the processing
operations of the controller in line with the GDPR481 and remedy the infringement482 of
472
Draft Decision, paragraph 8.7.
473
NL SA Objection, paragraph 54.
474
NL SA Objection, paragraph 55.
475
NL SA Objection, paragraphs 54-55.
476
NL SA Objection, paragraph 56.
477
NL SA Objection, paragraph 58.
478
NL SA objection, paragraph 64.
479
NL SA objection, paragraph 56, 57, 64.
480
IT SA Objection, paragraph 2.7.
481
AT SA Objection, section C.2, p. 7-8. The AT SA also highlights that according to the CJEU where an
infringement is found during a complaint-based procedure, the SA is under an obligation to take appropriate
action by exercising corrective powers, and cites C-311/18 Schrems II, paragraph 111. Additionally, the AT SA
clarifies that although it takes the position that a complainant does not have a subjective right to request from
the respective supervisory authority the exercise of a specific corrective power and it is up to the authority only
to decide which action is appropriate and necessary (referring to C-311/18 Schrems II, paragraph 112), it finds
the exercise of corrective powers to be necessary in the current case.
482
AT SA Objection, section C.4, p. 8.
Adopted 63
Article 6(1)(b) GDPR. According to the AT SA, the IE SA should exercise “specific corrective powers” so
as to ensure that Meta IE could not continue to unlawfully rely on Article 6(1)(b) GDPR for the
processing of users’ personal data for behavioural advertising483. More specifically, the AT SA suggests
that the IE SA prohibits Meta IE “the processing of a user’s data for behavioural advertising by relying
on Article 6(1)(b) GDPR”484. In the absence of additional corrective measures, the AT SA considers that
if corrective measures are not imposed, there is a risk “that Facebook continues to unlawfully rely on
Article 6(1)(b) GDPR for the processing of a user’s data for behavioural advertising and continues to
undermine or bypass data protection principles”, which would affect hundred of millions of data
subjects within the EEA and bear vast consequences 485.
254. The FR SA notes that reversing the findings concerning the infringements of Article 6(1) GDPR also
affects the scope of the corrective actions proposed by the IE SA, in addition to the administrative
fine486. Moreover, the PT SA considers that the proposed additional infringement in relation to the
breach of the lawfulness obligation (Article 5(1)(a) GDPR) should lead to the application of an
additional corrective measure which is not now envisaged in the Draft Decision487.
255. Finally, according to the NO and DE SAs, the IE SA should take concrete corrective measures in relation
to the additional infringement of Meta IE with Article 6(1)(b) GDPR, namely to order Meta IE to delete
personal data that has been unlawfully processed on Article 6(1)(b) GDPR and to prohibit the use of
this legal basis for such processing activities488.
256. The PL SA objects to the content of the order to bring processing into compliance with the GDPR
(Article 58(2)(d) GDPR) contained in the Draft Decision, arguing that it should be more precise. The PL
SA specifically argues that the order should also include a reference to the EDPB Transparency
Guidelines to ensure the controller is aware that compliance requires differentiating between the
content of the contract with the user and the content of information on data processing489. The PL SA
considers the interpretation of the rules provided in the EDPB Transparency Guidelines crucial in the
present case and, if the Draft Decision is left unchanged, sees a risk the order to bring into compliance
might not be properly applied, which in turn would limit the possibilities of data subjects to assert
their rights490.
8.3 Position of the LSA on the objections
257. The IE SA does not consider the objections above to be relevant and/or reasoned and does not follow
them491. Given that these objections were premised upon the requirement for the Draft Decision to
include a finding of infringement of Article 6(1)(b), on which the IE SA expressed its disagreement –
483
AT SA Objection, section C.1, p. 7.
484
AT SA Objection, section C.4, p. 8.
485
AT SA Objection, section C.3, p. 8.
486
FR SA objection, paragraph 53.
487
PT SA objection, paragraphs 66 and 73.
488
NO SA Objection, p.7; DE SA Objection, p. 10, point 4.
489
PL SA Objection, p. 3. The PL SA refers to paragraph 7 of the EDPB Transparency Guidelines.
490
PL SA Objection, p. 3.
491
Composite Response, paragraphs 37-41 (in response to the NL and DE SAs), paragraph 103 (in response to AT
SA). See also paragraphs 48-51, 63-72, 76-80, 89-91 where the IE SA responds to the NO SAs objections leading
to the NO SAs request to modify the order.
Adopted 64
the IE SA does not consider the objections requesting exercise of a corrective power in response to a
finding of infringement of Article 6(1)(b) as being relevant and reasoned 492.
258. The IE SA considers the PL SA’s objection is not relevant insofar as “the GDPR does not prescribe
specific formalities for the provision of information under Article 13(1)(c) GDPR”493.
8.4 Analysis of the EDPB
8.4.1 Assessment of whether the objections were relevant and reasoned
259. The objections raised by the AT, DE, FR, IT, NL, NO, PL and PT SAs concern “whether the action
envisaged in the Draft Decision complies with the GDPR”494.
260. In addition to the primary argument levelled against all CSA’s objections495, Meta IE provides
arguments on why it considers these objections to be not relevant and/or reasoned. Meta IE argues
that the AT and NL SAs’ objections cannot be considered relevant because they are dependent on
another objection, which Meta IE deems inadmissible and without merit496. On the same basis, Meta
IE refutes that the AT SAs objection is adequately reasoned497. As stated above in Section 4, the EDPB
finds the AT and NL SAs’ objections on the subject of Article 6(1)(b) GDPR relevant and reasoned498.
261. Additionally, Meta IE argues that the AT and NL SAs’ objections fail to set out how the Draft Decision
would pose a direct and significant risk to fundamental rights and freedoms. First, Meta IE refers to
their arguments put forward in response to the AT and NL SAs’ objections on the matter of compliance
with Article 6(1)(b) GDPR499. The EDPB has taken this line of reasoning into consideration above in
Section 4500. Second, Meta IE puts forward that the AT and NL SAs appear to consider that the “Draft
Decision provides Meta Ireland with a mandate to engage in unlawful processing or that it would
prevent the DPC (or the CSAs) from investigating and prohibiting any unlawful processing in the
future”501. Meta IE points out that no such inference can be drawn from the Draft Decision, going on
to draw the conclusion that no risks or consequences “would arise if the Draft Decision was finalised
492
Composite Response, paragraphs 41 and 103.
493
Composite Response, paragraphs 95-96.
494
EDPB Guidelines on RRO, paragraph 32.
495
Meta IE argues that “Objections which raise matters which are not within the Defined Scope of Inquiry are not
‘relevant and reasoned’ within the meaning of Article 4(24) GDPR” and such objections “ought to be disregarded
in their entirety by the EDPB”. The EDPB does not share this understanding, as explained above. See Section
4.4.1.
496
Meta IE Article 65 Submissions, Annex 1, p. 75 : “the Austrian SA’s Objection fails to satisfy the Sufficiently
Relevant Threshold, because it is itself based on an Objection grounded in a mistaken allegation of infringement
of Article 6(1)(b) GDPR, which as explained in Meta Ireland’s response at No. 1.a of this Annex 1, does not satisfy
the Thresholds and lacks merit. Therefore, this Objection is not sufficiently relevant as it has no direct connection
with the Draft Decision.” Analogous wording is used in response to the NL SA’s objection in Meta IE Article 65
Submissions, Annex 1, p. 101.
497
Meta IE Article 65 Submissions, Annex 1, p. 76 : “the Austrian SA’s Objection fails to satisfy the Adequately
Reasoned Threshold because it is premised on its Objection that a finding of infringement should be found
regarding Article 6(1) GDPR, which itself does not satisfy the Thresholds and lacks merit.” Analogous wording is
used in response to the NL SA’s objection in Meta IE Article 65 Submissions, Annex 1, p. 101.
498
Paragraph 78 above.
499
Meta IE Article 65 Submissions, Annex 1, p. 76 referring back to p. 73 and p. 101 referring back to p. 99-100.
500
Paragraph 79 - 80 above.
501
Meta IE Article 65 Submissions, Annex 1, p. 101. Analogous wording is used in response to the AT SA, Meta IE
Article 65 Submissions, Annex 1, p. 76.
Adopted 65
in its current form”502. As to this second line of reasoning, the EDPB fails to see wording by which the
AT SA or NL SA might have suggested it understands the Draft Decision as a mandate for Meta IE to
unlawfully process data, thus limiting future investigations.
262. The NL SA disagrees with the corrective measure chosen by the IE SA in addition to the administrative
fine, arguing that a temporary ban on processing (Article 58(2)(f) GDPR) should have been included in
the Draft Decision instead of an order to bring processing into compliance. If followed, this objection
would lead to a different conclusion as to the choice of corrective measures. In consequence, the EDPB
considers the objection to be relevant.
263. The NL SA argues that an order to bring processing into compliance entails that Meta IE would
maintain its illegal conduct while they amend their compliance deficits503. Conversely, a temporary
ban on Meta IE’s processing of data would ensure that data processing is halted during the time
needed for the company to change its practices to comply with the GDPR 504. In terms of risk, the NL
SA puts forward that “not temporarily banning this processing would undermine the effectiveness of
the GDPR”, and would continue to deprive data subjects of their rights during the transition period505.
The NL SA considers the risk significant, as the controller processes data of monthly active
users in the EEA, which amounts to approximately of the population and also because the
processing involves special categories of personal data506. Therefore, the EDPB considers the objection
to be reasoned and to clearly demonstrate the significance of the risks posed by the Draft Decision.
264. The AT SA disagrees with a specific part of the IE SA’s Draft Decision, namely Chapter 8 “Order to bring
processing into compliance”, arguing that the LSA should have included corrective measures in order
to remedy an infringement of Article 6(1)(b) GDPR507. More specifically, the AT SA suggests that the IE
SA prohibits Meta IE from relying on Article 6(1)(b) GDPR508. Therefore, if followed, this objection
would lead to a different conclusion as to the choice of corrective measures 509. In consequence, the
EDPB considers the objection to be relevant.
265. Furthermore, the AT SA argues that when an infringement is found - notably in light of other objections
raised in the current case in relation to additional infringement of Article 6(1)(b) GDPR - the
supervisory authority is under an obligation to issue appropriate corrective measures pursuant to
Article 58(2) GDPR. In terms of risk, the AT SA argues that without this amendment of the Draft
Decision, Meta IE “could simply continue to unlawfully rely on Article 6(1)(b) GDPR and to undermine
data protection principles” which would continue to affect hundred of millions of data subjects within
the EEA 510. Therefore, the EDPB considers the objection to be reasoned and to clearly demonstrate
the significance of the risks posed by the Draft Decision.
502
Meta IE Article 65 Submissions, Annex 1, p. 101. Analogous wording is used in response to the AT SA, Meta IE
Article 65 Submissions, Annex 1, p. 76.
503
NL SA Objection, paragraph 56 - 57.
504
NL SA Objection, paragraph 64.
505
NL SA Objection, paragraph 57-58.
506
NL SA Objection, paragraph 57-58.
507
AT SA Objection, p. 7-8.
508
AT SA Objection, paragraph C.3.
509
AT SA Objection, p. 7-8.
510
AT SA Objection, p. 8.
Adopted 66
266. Considering the above, the EDPB finds that the objections of the AT and NL SAs requesting additional
and/or alternative specific corrective measures to be imposed are relevant and reasoned pursuant to
Article 4(24) GDPR.
267. In addition, the EDPB recalls the analysis made in Section 4.4.1 above concerning the objections in
relation to the additional breach by Meta IE of its lawfulness obligation made by the FR and PT SAs
(requesting to take appropriate corrective measures) and by the IT SA (asking the LSA to take
corrective measures in accordance with Article 58(2)(d) GDPR), which were found to be relevant and
reasoned.
268. The EDPB recalls that the DE and NO SA called on the LSA to take specific corrective measures in the
event the EDPB followed their objection on compliance with Article 6(1)(b) GDPR. The EDPB considers
these to be reflections upon how, in their view, the LSA should give full effect to the binding
direction(s) as set out in the EDPB’s decision511. In the absence of legal or factual arguments provided
by these objections that would justify including these specific corrective measures in the Draft
Decision as opposed to others, the EDPB does not consider this aspect of the DE and NO SAs objections
to meet the requirements of Article 4(24) GDPR as they are not sufficiently reasoned.
269. Meta IE argues that the PL SA “raises abstract and broad concerns and does not concretely identify
valid concerns with the Draft Decision”. The EDPB finds that the objection is concrete and precise in
the change proposed, namely including a particular reference to the EDPB Transparency Guidelines.
However, the EDPB notes that the PL SA’s objection presents a disagreement on the wording of the
Draft Decision, without going so far as to allege that the envisaged action in relation to the controller
does not comply with the GDPR. Therefore, the EDPB considers the PL SA’s objection in relation to
Chapter 8 of the Draft Decision to be not sufficiently reasoned.
8.4.2 Assessment on the merits
Preliminary matters
270. The EDPB considers that the objections found to be relevant and reasoned in this subsection require
an assessment of whether the Draft Decision needs to be changed in respect of the corrective
measures proposed. More specifically, the EDPB needs to assess the request to impose a ban of
processing for both the infringements of the transparency obligations found by the LSA and the
additional infringement of Article 6(1) GDPR established above in Section 4.4.2, and the connected
issue of the corrective measure to be imposed for the infringement of Article 6(1) GDPR. When
assessing the merits of the objections raised, the EDPB also takes into account Meta IE’s position on
the objection and its submissions.
271. By way of introduction, the EDPB highlights that the analysis carried out in this section does not refer
to the content of the Draft Decision and of the objections in respect of the imposition of administrative
fines, which are covered below in Section 9.
Meta IE’s position on the objections and its submissions
272. Meta IE considers that the LSA has sole discretion to determine the appropriate corrective measures
in the event of a finding of infringement512 and that Article 65(1) GDPR does not confer power to the
511
EDPB Guidelines on Article 65(1)(a) GDPR, paragraph 50.
512
Meta IE Article 65 Submissions, paragraph 8.12 - 8.13.
Adopted 67
EDPB to give instruction as to “which (if any) of the corrective powers provided in Article 58 ought to
be exercised”513.
273. While Meta IE acknowledges that “Article 65(1) GDPR allows the EDPB to consider reasoned objections
as to whether the envisaged corrective measures comply with the GDPR”, it argues that CSAs are
strictly limited to criticism of the corrective measures already put forward by the LSA. Therefore,
according to Meta IE, “should the EDPB find an infringement of Article 6(1)(b) GDPR, the appropriate
course is for it to refer the matter back to the DPC, as LSA, to determine whether to impose any
appropriate corrective measures. Were the EDPB to do otherwise, and direct the DPC to make a specific
order in the terms proposed by certain of the objections, it would exceed its competence under
Article 65 GDPR”514. In addition, Meta IE claims that, where an objection concerns corrective measures
already included in the Draft Decision, this objection should only address whether the proposed
measure complies with the GDPR, insofar that “CSAs cannot seek, through an objection, to substitute
their own view of the corrective measures which ought to be ordered for that of the LSA”515.
274. With respect to the issue of the corrective measure to be imposed for the infringement of
Article 6(1) GDPR, if any, Meta IE argues that a temporary ban is not necessary to achieve the objective
of ensuring compliance with the GDPR, as there exists alternative, less onerous measures to bring its
processing operation into compliance with the GDPR516. In particular, Meta IE puts forward the
significant impact of a temporary ban not only on its activities but also on third parties’ business, such
as SMEs, relying on the platform for behavioural advertising517. In addition, Meta IE considers this
measure disproportionate in comparison with other decisions taken under the Article 60 GDPR
cooperation mechanism in similar circumstances518. Meta IE also alleges the need to establish an
“urgent necessity”519 for imposing a temporary ban. Finally, Meta IE contends that it would be both
unfair and disproportionate to order an immediate ban given that it relied upon a good faith
understanding as to what it considered to be a valid legal basis520.
EDPB’s assessment on the merits
275. First of all, according to the EDPB, the views of Meta IE amount to a misunderstanding of the GDPR
one-stop-shop mechanism and of the shared competences of the CSAs. The EDPB recalls that the
GDPR requires supervisory authorities to cooperate pursuant to Article 60 GDPR to achieve a
consistent interpretation of the Regulation521. The fact that the LSA will be the authority that can
ultimately exercise the corrective powers listed in Article 58(2) GDPR cannot neither limit the role of
the CSAs within the cooperation procedure nor the one of the EDPB in the consistency procedure 522.
513
Meta IE Article 65 Submissions, paragraph 8.14.
514
Meta IE Article 65 Submissions, paragraphs 8.11.
515
Meta IE Article 65 Submissions, paragraphs 8.7 and 8.14.
516
Meta IE Article 65 Submissions, paragraph 8.21, p. 57.
517
Meta IE Article 65 Submissions, paragraph 8.22 p. 57.
518
Meta IE Article 65 Submissions, paragraph 8.23-24 p. 57-58.
519
Meta IE Article 65 Submissions, paragraph 8.25.
520
Meta IE Article 65 Submissions, paragraph 8.25.
521
See GDPR Art. 51(2), 60, 61(1), and C-645/19 Facebook v Gegevensbeschermingsautoriteit, paragraphs 53,
63, 68, 72.
522
Art. 63 and 65 GDPR. In this regard it should be noted that Recital 11 GDPR stresses that “effective protection
of personal data throughout the Union requires [...] equivalent sanctions for infringements in the Member
States’’. Therefore, in order to ensure this ‘’consistent monitoring and enforcement’’ of the GDPR, the legislator
has decided to provide supervisory authorities with the ‘’same corrective powers” (Recital 129 GDPR).
Adopted 68
276. More specifically, when raising an objection on the existing or missing corrective measure(s) in the
Draft Decision, the CSAs should indicate which action they believe would be appropriate for the LSA
to undertake and include in the final decision523. In case of a disagreement on these objections, the
dispute resolution competence of the EDPB covers “all the matters which are subject of the relevant
and reasoned objection” (emphasis added)524. Therefore, contrary to Meta IE’s views, the consistency
mechanism may also be used to promote a consistent application by the supervisory authorities of
their corrective powers, taking into account the range of powers listed in Article 58(2) GDPR525, when
a relevant and reasoned objection questions the action(s) envisaged by the Draft Decision vis-a-vis the
controller/processor, or the absence thereof.
277. In addition, the EDPB finds that Meta IE misunderstands the AT SA objection when it argues that it
does acknowledge that it is for the LSA alone to decide which corrective measures are appropriate
and necessary, by citing paragraph 112 of the Schrems II CJEU judgment526. In fact, the AT SA does no
such thing: in its objection it stated “a complainant does not have a subjective right to request from
the respective supervisory authority (in this case: the DPC) the exercise of a specific corrective power
and it is for the supervisory authority alone to decide which action is appropriate and necessary (see
C‑311/18, paragraph 112)”527 and did not engage in an interpretation of how Article 58(2) GDPR is to
be understood in cross-border cases in the sections referred to. The cooperation and consistency
mechanism of the GDPR is not addressed in CJEU ruling C-311/18 (Schrems II) either.
***
278. Moving on to the analysis of the issue of corrective measures as required by the objections found to
be relevant and reasoned above, the EDPB recalls that when a violation of the Regulation has been
established, competent supervisory authorities are required to react appropriately to remedy this
infringement in accordance with the means provided to them by Article 58(2) GDPR528.
Article 58(2) GDPR provides a wide choice of effective tools for the authorities to take action against
infringements of the Regulation and which can be imposed in addition to or instead of a fine.
According to Recital 129 GDPR, every corrective measure applied by a supervisory authority under
Article 58(2) GDPR should be “appropriate, necessary and proportionate in view of ensuring
compliance with the Regulation” in light of all the circumstances of each individual case. Recital
148 GDPR shows the duty for supervisory authorities to impose corrective measures that are
proportionate to the seriousness of the infringement529. This highlights the need for the corrective
measures and any exercise of powers by supervisory authorities to be tailored to the specific case530.
279. Considering the nature and gravity of the infringement of Article 6(1)(b) GDPR established above in
Section 4.4.2, as well as the number of data subjects affected, the EDPB shares the view of the AT, FR,
523
See EDPB Guidelines on RRO, paragraph 33.
524
Art. 65(1)(a) GDPR.
525
See EDPB Guidelines on Article 65(1)(a) GDPR, paragraph 92.
526
AT SA Objection, Section C.2., p. 8. See also above footnote 481.
527
AT SA Objection, p. 8.
528
C-311/18 Schrems II, paragraph 111.
529
Recital 148 GDPR states, for instance: “in a case of a minor infringement or if the fine likely to be imposed
would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine”.
The EDPB confirmed that “the indications provided by this Recital can be relevant for the imposition of corrective
measures in general and for the choice of the combination of corrective measures that is appropriate and
proportionate to the infringement committed”. EDPB Binding Decision 1/2021, paragraph 256.
530
EDPB Binding Decision 1/2021, paragraph 256.
Adopted 69
IT and PT SAs that it is particularly important that appropriate corrective measures be imposed, in
addition to a fine, in order to ensure that Meta IE complies with this provision of the GDPR.
280. In respect of which measure should be imposed, as stated, the NL SA argues that the IE SA's proposal
to order Meta IE to comply with Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR within a period
of three months is not appropriate, considering these breaches in conjunction with the gravity of the
additional breaches of Article 6(1)(b) and Article 9(2) GDPR identified in its objection531. Instead, the
NL SA is of the opinion that only a temporary ban imposed in respect of all these infringements can
effectively protect the rights of the data subjects during the transition period in which the controller
remedies to these violations532. In addition, the AT SA calls on the IE SA to use its corrective powers
under Article 58(2) GDPR in order to bring the processing operations of Meta IE into line with the
GDPR, and suggests “that the DPC prohibits Facebook the processing of a user’s data for behavioural
advertising by relying on Article 6(1)(b)” stating that “otherwise, Facebook could simply continue to
unlawfully rely on Article 6(1)(b) GDPR”533. Finally, the IT SA argues that the finding of the new
infringement of Article 6(1)(b) GDPR should result in the taking of appropriate corrective measures
under Article 58(2)(d) GDPR by the LSA534.
281. Meta IE argues that a temporary ban would not be necessary as less onerous measures could be
imposed, avoiding significant impact on its business and third parties 535, and that it would be unfair
and disproportionate536.
282. The EDPB agrees with the observations made by the NL SA that the infringement found in the case at
hand constitutes a “very serious situation of non-compliance’’537 with the GDPR, in relation to
processing of “extensive amounts of [...] data, which is essential to the controller’s business model”,
thus harming “the rights and freedoms of millions of data subjects in the EEA”538. As a result, the EDPB
shares the NL SA’s concern that the corrective measure chosen in the circumstances of this case should
aim to bring the processing into compliance with the GDPR thus minimising the potential harm to data
subjects created by the violations of the GDPR.
283. In addition, the EDPB recalls that contrary to Meta IE’s contention, it is not necessary to establish an
“urgent necessity”539 for imposing a temporary ban, in that nothing in the GDPR limits the application
of Article 58(2)(f) GDPR to exceptional circumstances 540.
284. At the same time, the EDPB notes that in assessing the appropriate measure to be applied, Recital
129 GDPR provides that consideration should be given to ensuring that the measure chosen does not
create “superfluous costs” and “excessive inconveniences” for the persons concerned in light of the
531
NL SA Objection, paragraph 56. In this respect, the EDPB recalls that, as stated in Sections 4.4.2 and 5.4.2
above, while the EDPB finds that the IE SA should have found an infringement of Art. 6(1)(b) GDPR in its Draft
Decision, it does not have sufficient factual evidence allowing it to find a possible infringement by Meta IE of its
obligations under Art. 9(2) GDPR.
532
NL SA Objection, paragraphs 56-57.
533
AT SA Objection, p. 8.
534
IT SA Objection, paragraph 2.7.
535
Meta IE Article 65 Submissions, paragraph 8.21-8.22, p. 57.
536
Meta IE Article 65 Submissions, paragraph 8.25.
537
NL SA Objection, paragraph 53.
538
NL SA Objection, paragraph 57.
539
Meta IE Article 65 Submissions, paragraph 8.25.
540
See a contrario Art. 4 Implementing Decision 2010/87, in its version prior to the entry into force of
Implementing Decision 2016/2297; C-311/18 Schrems II, paragraph 114.
Adopted 70
objective pursued. When choosing the appropriate corrective measure, there is a need to assess
whether the chosen measure is necessary to enforce the GDPR and achieve protection of the data
subjects with regard to the processing of their personal data, which is the objective being pursued541.
Compliance with the principle of proportionality requires ensuring that the chosen measure does not
create disproportionate disadvantages in relation to the aim pursued.
285. The EDPB takes note of the elements raised by the objections, particularly the NL SA, to justify the
need for imposing a temporary ban, consisting in essence in the need to halt the processing activities
that are being undertaken in violation of the GDPR until compliance is ensured in order to avoid further
prejudicing data subject rights. However, the EDPB considers that the objective of ensuring
compliance and bringing the harm to the data subjects to an end can, in this particular case, be
adequately met also by amending the order to bring processing into compliance envisaged in the Draft
Decision to reflect Meta IE’s infringement of Article 6(1) GDPR identified in Section 4 of this Binding
Decision. In addition to the fines that will be imposed, this measure would require Meta IE to put in
place the necessary technical and operational measures to achieve compliance within a set timeframe.
286. In respect of the imposition of an order to bring processing into compliance, Meta IE submits that any
such order should “afford a reasonable period of time” to Meta IE to comply542. When determining
the transition period for bringing Meta IE’s processing into compliance with GDPR, the EDPB requests
that the IE SA gives due regard to the harm caused to the data subjects by the continuation of Meta
IE’s infringement of Article 6(1) GDPR during this period. More specifically, the order should require
Meta IE to restore compliance within a short period of time. In this respect, the EDPB notes that, in
response to Meta IE’s submission, the IE SA considered the three-month deadline for compliance for
the infringements of Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR necessary and
proportionate in light of the potential for harms to the data subjects rights that such a measure entails,
considering that the interim period for compliance “will involve a serious ongoing deprivation of their
rights”543. The IE SA also points out the significant financial, technological, and human resources, as
well as the clear instructions provided to Meta IE to comply with GDPR544. The EDPB considers that
this line of reasoning applies all the more to the corrective measures imposed in relation to Meta IE’s
infringement of Article 6(1) GDPR.
287. Finally, the EDPB recalls that non-compliance with an order issued by a supervisory authority can be
relevant both in terms of it being subject to administrative fines up to 20.000.000 euros or, in the case
of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year in
line with Article 83(6) GDPR, and in terms of it being an aggravating factor for the imposition of
administrative fines545. In addition, the investigative powers of supervisory authorities allow them to
541
C-311/18 Schrems II, paragraph 112: “Although the supervisory authority must determine which action is
appropriate and necessary and take into consideration all the circumstances [...] in that determination, the
supervisory authority is nevertheless required to execute its responsibility for ensuring that the GDPR is fully
enforced with all due diligence”.
542
Meta IE Article 65 Submissions, paragraph 8.37.
543
Draft Decision, paragraph 8.4. In this regard, Meta IE argues that this was not a reasonable period of time
within which to make the necessary changes, as the changes would be resource-intensive and would require
“sufficient lead in time for preparing the relevant changes, conducting and taking account of user testing of the
proposed changes, internal cross-functional engagement as well as of course engagement with the Commission,
and localisation and translation of the information for countries in the European Region.” Draft Decision,
paragraph 8.3.
544
Draft Decision, paragraph 8.4
545
See Art. 83(2)(i) GDPR.
Adopted 71
order the provision of all the information necessary for the performance of their tasks including the
verification of compliance with one of their orders 546.
288. The EDPB therefore instructs the IE SA to include in its final decision an order for Meta IE to bring its
processing of personal data for the purpose of behavioural advertising in the context of the Facebook
service into compliance with Article 6(1) GDPR within three months.
289. In addition, the EDPB notes that the current wording of the order “to bring the Data Policy and Terms
of Service into compliance with Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR as regards
information provided on data processed pursuant to Article 6(1)(b) GDPR” should be modified in order
to reflect the EDPB’s findings in Section 4.4.2 that Meta IE is not allowed to rely on Article 6(1)(b) GDPR
for the processing of personal data for the purpose of behavioural advertising.
290. The EDPB also instructs the LSA to adjust its order to Meta IE to bring its Facebook Data Policy and
Terms of Service into compliance with Articles 5(1)(a), 12(1) and 13(1)(c) GDPR within three months,
to refer not only to information provided on data processed pursuant to Article 6(1)(b) GDPR, but also
to data processed for the purposes of behavioural advertising in the context of Facebook service (to
reflect the finding of the EDPB in Section 4.4.2 that for this processing the controller cannot rely on
Article 6(1)(b) GDPR).
9 ON THE DETERMINATION OF THE ADMINISTRATIVE FINE
291. The EDPB recalls that the consistency mechanism may also be used to promote a consistent
application of administrative fines547.
9.1 On the determination of the administrative fine for the transparency
infringements
9.1.1 Analysis by the LSA in the Draft Decision
The application of the criteria under Article 83(2) GDPR
292. In its Draft Decision, the IE SA explains how it considered all the criteria in Article 83(2) GDPR in
deciding whether to impose an administrative fine and determine its amount in the circumstances of
this case548. The most pertinent criteria for the present dispute are summarised below.
The nature, gravity and duration of the infringement, taking into account the nature scope or purpose
of the processing concerned as well as the number of data subjects affected and level of damage
suffered by them (Article 83(2)(a) GDPR)
293. The IE SA explains that it assesses the infringements of Article 5(1)(a), Article 12(1) and
Article 13(1)(c) GDPR identified in the Draft Decision simultaneously in the context of the
546
Art. 58(1) GDPR.
547
See GDPR, Recital 150; EDPB Guidelines on RRO, paragraph 34 and EDPB Guidelines on Article 65(1)(a) GDPR,
paragraph 91.
548
Draft Decision, paragraphs 9.3 - 9.44.
Adopted 72
Article 83(2) GDPR criteria549. Further, the IE SA explains that ‘the processing concerned’ refers to ‘all
of the processing operations that [Meta IE] carries out on the personal data under its controllership for
which it relies on Article 6(1)(b) GDPR’, in line with the scope of the inquiry (permissibility in principle
of processing personal data for behavioural advertising)550.
294. In terms of the nature of the infringements, the Draft Decision explains that they concern a
cornerstone of data subject rights, namely the right to information. The IE SA argues that ‘the provision
of the information concerned goes to the very heart of the fundamental right of the individual to
protection of personal data which stems from the free will and autonomy of the individual to share
their personal data in a voluntary situation such as this. If the required information has not been
provided, the data subject has been deprived of the ability to make a fully informed decision as to
whether they wish to use a service that involves the processing of their personal data and engages
their associated rights. Furthermore, the extent to which a data controller has complied with its
transparency obligations has a direct impact on the effectiveness of the other data subject rights. If
data subjects have not been provided with the prescribed information, they may be deprived of the
knowledge they need in order to consider exercising one of the other data subject rights’551. Further,
the IE SA notes that the European legislator included infringements on the right to information in
Article 83(5) GDPR, which carries the highest maximum fine552.
295. In terms of the gravity of the infringements, the IE SA explains that Meta IE is found to also have
infringed Article 12(1) and Article 5(1)(a) GDPR because the company has not provided the required
information in the required manner under Article 13(1)(c) GDPR. The IE SA adds that ‘this represents
a significant level of non-compliance, taking into account the importance of the right to information,
the consequent impact on the data subjects concerned and the number of data subjects potentially
affected’553.
296. With regard to the nature, scope or purpose of the processing concerned, the IE SA considers that
the “personal data processing carried out by [Meta IE] pursuant to Article 6(1)(b) GDPR is extensive.
[Meta IE] processes a variety of data in order to serve users personalised advertisements, tailor their
‘News Feed’, and to provide feedback to advertising partners on the popularity of particular
advertisements. The processing is central to and essential to the business model offered, and, for this
reason, the provision of compliant information in relation to that processing becomes even more
important. This, indeed, may include location and IP address data”554.
297. With reference to the number of data subjects affected, the IE SA points out that, as Meta IE
confirmed, “as of the date of the Complaint, [Meta IE] had approximately monthly active
users and, as of May 2021, it had approximately monthly active users in the European
555
Economic Area” and that, while it is not possible to identify the precise number of users affected,
549
“While each is an individual ‘infringement’ of the relevant provision, they all concern transparency and, by
reason of their common nature and purpose, are likely to generate the same, or similar, outcomes in the context
of some of the Article 83(2) GDPR assessment criteria.” Draft Decision, paragraphs 9.3.
550
Draft Decision, paragraph 9.4.
551
Draft Decision, paragraphs 9.6.
552
Draft Decision, paragraph 9.7.
553
Draft Decision, paragraph 9.9.
554
Draft Decision, paragraph 9.14.
555
Draft Decision, paragraph 9.15.
Adopted 73
approximately of the population of the EEA (including the UK) seems to be potentially
affected, by reference to the Eurostat556.
298. In terms of damages suffered by affected data subjects, the IE SA finds that “the failure to provide all
of the prescribed information undermines the effectiveness of the data subject rights and,
consequently, infringes the rights and freedoms of the data subjects concerned. A core element of
transparency is empowering data subjects to make informed decisions about engaging with activities
that cause their personal data to be processed, and making informed decisions about whether to
exercise particular rights, and whether they can. This right is undermined by a lack of transparency on
the part of a data controller”557.
299. On Article 83(2)(a) GDPR, the IE SA concludes that “[the] infringements are serious in nature. The lack
of transparency goes to the heart of data subject rights and risks undermining their effectiveness by
not providing transparent information in that regard. While the infringements considered here relate
to one lawful basis, it nonetheless concerns vast swathes of personal data impacting millions of data
subjects. When such factors are considered, it is clear that the infringements are serious in their
gravity” and “Over of the population of the EEA seems to be impacted by the infringements. This
is a very large figure”558. The IE SA further notes “in particular the impact a lack of transparency has
on a data subject’s ability to be fully informed about their data protection rights, or indeed about
whether in their view they should exercise those rights”559.
300. The IE SA does not attach significant weight to the duration of the infringements560, considering that
the complaint - and therefor the inquiry - was made against a specific set of documents (Facebook’s
Data Policy and Terms of Service) and that more recent versions of the relevant documents are outside
the scope of the inquiry561.
The intentional or negligent character of the infringements (Article 83(2)(b) GDPR)
301. The IE SA notes the Complainant’s view that the infringement arose from “a decision made knowingly
to present information in a particular way”562 but states that there is no evidence of an “intentional
and knowing breach” of a provision of the GDPR563. The IE SA notes that the EDPB Guidelines on
Administrative Fines refer to two requirements, “knowledge” and “willfulness”, adding “this suggests
a controller must infringe the GDPR both in full knowledge of the infringement’s characteristics and
also in a deliberate manner. Having considered the nature of the infringements further in the context
of the Fining Guidelines, [the IE SA] accept[s] [Meta IE’s] submissions, that any intentional breach must
be an intentional and knowing breach of a provision of the GDPR.” The IE SA finds there was no
evidence of an intentional and knowing breach of a provision of the GDPR. In terms of the impact of
this assessment on the decision whether or not to impose an administrative fine, the IE SA stated that
556
Draft Decision, paragraph 9.17.
557
Draft Decision, paragraph 9.20.
558
Draft Decision, paragraphs 9.17 and 9.45.
559
Draft Decision, paragraph 9.45.
560
Draft Decision, paragraph 9.45.
561
Draft Decision, paragraphs 9.11 and 9.45. The IE SA notes, however, that “In imposing corrective powers [...]
the GDPR requires that the broader impact of infringements be considered” (Draft Decision, paragraph 9.11).
562
Draft Decision, paragraph 9.24.
563
Draft Decision, paragraph 9.25. In its analysis, the IE SA takes into consideration the EDPB Guidelines on
Administrative Fines on the notions of ‘intentional’ and ‘negligent’. Draft Decision, paragraphs 9.22 - 9.23.
Adopted 74
“While I am not calling into question Facebook’s right to come to a genuine view on this matter 564, I
am taking into account the failure of an organisation of this size to provide sufficiently transparent
materials in relation to the core of its business model”565.
The action taken by the controller or processor to mitigate the damage suffered by data subjects
(Article 83(2)(c) GDPR)
302. The IE SA notes Meta IE’s position that “its approach to transparency, in the context in which
infringements have been found, complies fully with the GDPR”. Notwithstanding their disagreement
with this position the IE SA “accept[s] that it represents a genuinely held belief on [Meta IE’s] part. This
does not alter the fact that infringements have occurred. On that basis, there has been no effort to
mitigate the damage to data subjects, given [Meta IE’s] position was that no damage was taking
place”566. The IE SA is not swayed by Meta IE’s argument that their efforts to comply with the GDPR
should be taken into consideration, as - in general - compliance with the GDPR is a duty imposed on
each controller. In the present case, the IE SA finds this factor is neither mitigating nor aggravating
insofar as “beyond simply complying with the GDPR, there are no obvious mitigating steps that could
have been taken”567. Notwithstanding this, the IE SA identifies a mitigating factor in Meta IE’s
willingness to engage in steps to bring its processing into compliance on a voluntary basis pending the
conclusion of the inquiry568.
The degree of responsibility of the controller taking into account technical and organisational
measures implemented pursuant to Articles 25 and 32 (Article 83(2)(d) GDPR)
303. The IE SA does not expressly mention whether it considers this factor as aggravating or mitigating in
the Draft Decision569. The IE SA takes the view that “[Meta IE]’s responsibility is certainly at a high
level”, noting Meta IE’s “genuine effort to implement compliance based on [their] genuinely held
belief” which “however, has ultimately fallen short in terms of compliance in significant respects”.
Moreover, the IE SA finds “that it concerns serious data processing, and that it was deliberate act, in
spite of the genuinely held belief that the modes of implementation were compliant”570. On this basis,
the IE SA concluded that the degree of responsibility on Meta IE’s part was therefore responsibility of
a high level571.
The categories of personal data affected by the infringements (Article 83(2)(g) GDPR)
304. The IE SA notes that “[the] lack of transparency concerned broad categories of personal data relating
to users who sign up to the service. I have set out several times in this Draft Decision that the
assessment of data processing in this Inquiry was, by its nature, rather generalised. Indeed, the lack of
564
In this regard, the IE SA noted Meta IE’s arguments that the infringements arose from a good faith difference
of opinion but considered that this does not alter the infringements’ objectively serious character (Draft
Decision, paragraph 9.8) and pointed out the “clear inconsistencies between the [EDPB Transparency Guidelines]
and the manner in which Facebook attempted to comply with its obligations” (Draft Decision, paragraph 9.10).
565
Draft Decision, paragraph 9.45.
566
Draft Decision, paragraph 9.28.
567
Draft Decision, paragraph 9.29.
568
Draft Decision, paragraph 9.30.
569
Draft Decision, paragraphs 9.32-9.33.
570
Draft Decision, paragraph 9.33.
571
Draft Decision, paragraph 9.33.
Adopted 75
transparency on Meta IE’s part has itself contributed to a lack of clarity on precisely what categories
of personal data are involved”572.
305. The IE SA concludes this factor is neither aggravating nor mitigating573.
The manner in which the infringements became known to the supervisory authority
(Article 83(2)(h) GDPR)
306. The IE SA notes that “[the] subject matter became known to the Commission due to an Inquiry
conducted on foot of the Complaint. The subject matter did not give rise to any requirement of
notification, and I have already acknowledged several times that the controller’s genuinely held belief
is that no infringement is/was occurring”574.The IE SA does not mention this factor as an aggravating
or mitigating factor in the Draft Decision575.
Any other aggravating or mitigating factor (Article 83(2)(k) GDPR)
307. The IE SA considers whether the “lack of transparency has the potential to have resulted in financial
benefits for Facebook” based on the view that a “more transparent approach to processing operations
carried out on foot of that contract would represent a risk to Facebook’s business model”, which would
be the case “if existing or prospective users were dissuaded from using the service by clearer
explanations of the processing operations carried out, and their purposes”576. The IE SA concludes that
this factor is neither aggravating nor mitigating, arguing that “any general consideration of this [factor]
ultimately involves an element of speculation on both [Meta IE]’s and the Commission’s part”577.
The application of the criteria under Article 83(1) GDPR
308. The IE SA considers that administrative fines pursuant to Article 58(2)(i) and Article 83 GDPR, totalling
an amount not less than €28 million and an amount not more than €36 million should be issued on
Meta IE for the infringement of Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR578.
309. The LSA considers the proposed administrative fines are effective, proportionate and dissuasive taking
into account all of the circumstances of the Inquiry579. Regarding the effectiveness, the IE SA argues
that the “infringements are serious, both in terms of the extremely large number of data subjects
potentially affected, the categories of personal data involved, and the consequences that flow from
572
Draft Decision, paragraph 9.39.
573
Draft Decision, paragraph 9.39. The IE SA notes their agreement with Meta IE’s submission that this is not an
aggravating factor. Draft Decision, paragraph 9.39.
574
Draft Decision, paragraph 9.40.
575
Draft Decision, paragraph 9.45.
576
Draft Decision, paragraph 9.43.
577
Draft Decision, paragraph 9.44.
578
Draft Decision, sections 9 and 10.
More specifically, the IE SA proposes the following administrative fines (Draft Decision, paragraph 9.47):
- a fine of between €18 million and €22 million for the failure to provide sufficient information in relation to the
processing operations carried out on foot of Art. 6(1)(b) GDPR, thereby infringing Art. 5(1)(a) and 13(1)(c) GDPR;
- a fine of between €10 million and €14 million for the failure to provide the information that was provided on
the processing operations carried out in foot of Art. 6(1)(b) GDPR, in a concise, transparent, intelligible and easily
accessible form, using clear and plain language, thereby infringing Art. 5(1)(a) and Art. 12(1) GDPR.
The proposed administrative fines are to be applied cumulatively, as they do not surpass the maximum provided
for in Art. 83(5) GDPR. See Draft Decision, paragraphs 10.6, 10.41 and 10.42.
579
Draft Decision, paragraph 9.51.
Adopted 76
the failure to comply with the transparency requirements for users”580. Concerning the dissuasiveness,
the LSA states that the fine must “dissuade both the controller/processor concerned as well as other
controllers/processors carrying out similar processing operations from repeating the conduct
concerned”581. As regards the proportionality, the IE SA considers that the fines proposed “do not
exceed what is necessary to enforce compliance with the GDPR, taking into account the size of
Facebook’s user base, the impact of the infringements on the effectiveness of the data subject rights
enshrined in Chapter III of the GDPR and the importance of those rights in the context of the GDPR as
a whole”582.
310. The IE SA refers to the need to take into account the undertaking’s turnover in the calculation of the
fine amounts583. The notion of “undertaking” is determined to refer to Meta Platforms, Inc. 584. The IE
SA takes into consideration revenue reported by Meta Platforms, Inc. for the year ending 31
December 2020 ($84.169 billion)585.
9.1.2 Summary of the objections raised by the CSAs
311. The DE, FR, NL, NO and PL SAs586 object to the envisaged action taken by the LSA with regard to the
administrative fine proposed in the Draft Decision with respect to the infringements of the
transparency obligations by asking the IE SA to impose a significantly587 higher administrative fine
with reference to the established infringements.
312. The dispute arising from these objections concerns whether the proposed fine is effective,
proportionate and dissuasive pursuant to Article 83(1) GDPR588. With reference to these three criteria,
the above mentioned SAs, specifically, argue as follows.
313. The DE SAs argue that the envisaged fine of at most 36 million euros is not proportionate compared
to the undertaking’s worldwide annual turnover and its profitability, which is higher than an average
undertaking. Moreover, the fine cannot be deemed proportionate taking into account that a most
relevant information was not provided to data subjects, also in light of the consideration that Meta IE
acted with “(only) negligence and any efforts of the controller to abide to the law after committing the
infringements”589. The DE SAs point out that “The envisaged maximum fine is about 0.05 % of the
global annual turnover, about 0.15 % of the year’s 2020 profit and about 1.29 % of the fining range.
Thus, the envisaged fine moves at the lowest edge of the corridor. Converted to a single person of the
about data subjects (section 9.15 DD) affected by the infringements, the fine would be EUR
580
Draft Decision, paragraph 9.48.
581
Draft Decision, paragraph 9.49.
582
Draft Decision, paragraph 9.50.
583
Draft Decision, paragraph 10.7, referring to Binding Decision 1/2021.
584
Draft Decision, paragraphs 10.23 - 10.41. The Draft Decision refers to Facebook, Inc. The company has
subsequently changed its name to Meta Platforms, Inc.
585
Draft Decision, paragraph 10.41
586
DE SAs Objection, pp. 10-16; FR SA Objection, paragraphs 38-51; NL SA Objection, paragraphs 38-52; NO SA
Objection, pp. 8-11; PL SA Objection, pp. 4-5.
587
All SAs specified that the fine should be increased significantly except the NL SA (which stated the fine should
be increased). See DE SAs Objection, p. 16; FR SA Objection, paragraph 48; NO SA Objection, p. 11; PL SA
Objection, p. 4-5 ; NL SA Objection, paragraph 50.
588
DE SAs Objection, p. 12-14; FR SA Objection, paragraphs 50-51; NL SA Objection, paragraph 45 and following;
NO SA Objection, p. 9-10; PL SA Objection, p. 5.
589
DE SAs Objection, pp. 13.
Adopted 77
”590. With regard to effectiveness, the DE SAs consider that the fine proposed by the LSA would
be hardly noticeable for Meta IE due to its business situation591. Lastly, with respect to dissuasiveness,
the DE SAs state that the envisaged fine would not have neither special nor general preventive effect.
With reference to this latter, the DE SAs state that the envisaged fine would likely have the opposite
effect, as “Other controllers may orientate their compliance with data protection law taking into
account such a low fine. They will relate their own turnover and profit to those of the Facebook Group
and find that there would be little risk, if at all, if they violate data subjects’ rights”592.
314. The FR SA argues that the amount of the envisaged fine “seems low and hardly compatible with the
objective set by Article 83(1) GDPR of ensuring to impose dissuasive fines” taking into account “the
number of data subjects concerned, the particularly intrusive nature of the processing operations in
question, the breaches observed, the position of Facebook Ireland Limited as a quasi-monopolist and
its financial situation”593. Moreover, the FR SA notes that the fine proposed by the IE SA is not
proportionate since “the cumulative amount of the two breaches of the provisions of Articles 5-1-a)
and 13-1-c) of the GDPR, on the one hand, and the provisions of Articles 5-1-a) and 12-1 of the GDPR,
on the other hand, represents only about 0.04% of the turnover of Facebook Inc. and about 1% of the
maximum fine”594
315. The NL SA doubts, also referring to the WP29 Guidelines on Administrative Fines, that the fines
proposed by the IE SA meet the objective to be effective “particularly considering the strong financial
position of the controller and the finding that the identified lack of transparency likely has had financial
benefits for the controller”595. As regard to dissuasiveness, the NL SA argues, also referring to the
established CJEU case law, that Meta IE “generates a turnover of over 83 billion dollars (approximately
72 billion euros) per annum, therefore it would be able to generate a daily revenue of approximately
228 million dollars. Instead of dissuading future behaviour, the penalty would be simply regenerated
in a few hours” (specific deterrence)596. With reference to proportionality, the NL SA questions the
lack of reasoning in the Draft Decision as to why the amounts proposed are commensurate to the
seriousness of the infringements597.
316. The NO SA argues that the envisaged amount of the fine is not effective nor dissuasive neither to Meta
IE nor to other controllers, considering the financial benefits accrued because of the violations and
the worldwide annual turnover of Meta Platform Inc. for 2020, NO SA points out that Meta IE “would
likely have no issue paying the proposed fine, and the amount of the fine it is not likely to affect [it] in
such a way that it would see a need to substantially change its practices.”598.
317. The PL SA states that “in order to ensure that the administrative fine is effective, proportionate and
dissuasive, the proposed amount of administrative fine should be adapted to the very high turnover of
the Controller and the large amount of cash it saved”599 and it argues that “taking into account the
high turnover of the company, it is difficult to conclude that the proposed financial penalty in such a
590
DE SAs Objection, pp. 12-13.
591
DE SAs Objection, p. 13.
592
DE SAs Objection, p. 13-14.
593
FR SA Objection, paragraph 40.
594
FR Objection, paragraph 42.
595
NL SA Objection, paragraph 47.
596
NL SA Objection, paragraph 48.
597
NL SA Objection, paragraph 49.
598
NO SA Objection, p. 10.
599
PL SA Objection, p. 4.
Adopted 78
low amount can effectively deter the punished entity from committing similar violations in the future.
Moreover, for other entities achieving a similar turnover, a fine in this amount will be a clear signal
that it is not worth paying much attention to compliance with the provisions of the GDPR, because the
costs of implementing appropriate technical and organizational measures may exceed the amount of
a possible fine”600.
318. In addition, the objections raise arguments with regard to the weight afforded to some of the criteria
listed in Article 83(2) GDPR.
319. The DE SAs argue that the significant level of non-compliance established by the LSA601 and the
number of data subjects602 should by themselves have resulted in a fine in the range of at least some
permille of the annual turnover603. Moreover, the DE SAs argue that an even higher number of data
subjects may be affected than the number taken into consideration in the Draft Decision considering
that “Whilst Facebook reported 2.80 billion monthly active users, they report 3.30 billion ‘family
monthly active people’ for 2020. Applying this increase of about 18 % there could be about
affected data subjects ( plus 18 % = )” as a consequence “the possibility of almost
(the difference between and ) more affected data subjects should
604
have considerable weight regarding the calculation” .
320. The FR SA argues that the fine is in contradiction with the seriousness of the violations identified and
the nature of the processing (Article 83(2)(a) GDPR)605
321. The NL SA argues that the fine is not commensurate with the seriousness of the infringements
established (Article 83(2)(a) GDPR) and is inconsistent with the IE SA's qualifications as such 606.
322. The NO SA argues that “the suggested fine is not proportionate to the seriousness of the violations and
the aggravating factors identified”, the “number of data subjects affected in the EEA amounts to
hundreds of millions” and agrees with the LSA that the controller’s “level of responsibility is high” 607.
323. The PL SA considers that “In determining the gravity of the infringements identified in the draft decision
by the LSA, account must be taken not only of the massive nature of the data processing carried out
by Controller, but also of the fact that the data processing is the essential part of Controller’s business
activity” (Article 83(2)(a) GDPR)608. Moreover, the PL SA states that the mitigating factor concerning
the fact that Meta IE expressed its willingness to engage in steps to bring its processing into
compliance on a voluntary basis during the inquiry stage, “should not result in the reduction of the
proposed administrative fine, due to the fact that the cooperation with the LSA is a legal obligation of
the controller and its intention to bring the processing operations into the compliance with the
provisions of GDPR, as a future and uncertain event, should not be taken into account during the
assessment of the administrative fine” (Article 83(2)(c) GDPR)609.
600
PL SA Objection, p. 5.
601
The DE SAs refer to paragraphs 9.9, 9.19, 9.21, 9.33 of the Draft Decision (DE SAs Objection, p.14)
602
The DE SAs quote paragraph 9.15 of the Draft Decision indicating monthly users (DE SAs
Objection, p. 14).
603
DE SAs Objection, pp. 14-15.
604
DE SAs Objection, p. 15.
605
FR SA Objection, paragraph 50.
606
NL SA Objection, paragraphs. 40, 43 and 49.
607
NO SA Objection, p. 10.
608
PL SA Objection, p. 4.
609
PL SA Objection, p. 4.
Adopted 79
324. The DE and FR SAs put forward some further factual and legal arguments for the proposed change in
legal assessment.
325. Specifically the DE SAs raise that the profitability of the undertaking is one of the elements that should
be relied upon to calculate the amount of the fine610, The DE SAs highlight that “the Facebook Group
is an extreme profitable undertaking. The group has an annual profit (net income) of USD 29.146 billion
(EUR 23.752 billion per 31st December 2020) with a turnover of USD 85.965 billion (EUR 70.055 billion)
in 2020. According to the financial report for the second quarter of 2021, the turnover and net income
are further increasing rapidly (+56% turnover and +101 % net income compared to the equivalent
second quarter of 2020)” and that “Facebook’s return is significantly better than the return in the
overall economic field; in relation to German/European companies by a factor of about 9 or higher”611.
326. The DE SAs also argue that Meta Platforms, Inc.’s total turnover should be taken into account for the
determination of the fine. This total turnover amounts to USD 85.965 billion in 2020 and it is higher
than the USD 84.169 billion (turnover generated through advertising) referred to by the LSA 612.
327. The FR SA notes that the amount of the fine proposed by the IE SA “seems to be underestimated in
comparison with the amount retained in the deliberation of the CNIL’s restricted committee No. SAN-
2019-001 of 21 January 2019 imposing a penalty of 50 million euros on the company Google LLC,
adding that “this case is comparable because it is also based on a referral filed by the association
‘NOYB’ with the CNIL, relating to a similar issue and formulated against Google, and that the restricted
committee has identified a breach of Article 6 of the GDPR and a breach of the provisions of Articles 12
and 13 of the GDPR. However, the amount retained against Google LLC is close to that proposed by
the Irish data protection authority, even though the processing operations in question concern all
European users, which was not the case in the above-mentioned CNIL’s decision, for which only French
users were taken into account”613. The FR SA states that the amount proposed appears low also in
comparison with the one retained by the LU SA in its decision of 15 July 2021 against the company
Amazon Europe Core, where an administrative fine of 746 million euros has been imposed for the
infringement of Articles 6, 12 and 13 GDPR. This case was also based on a complaint that the
processing operations carried out by the companies of the Amazon group relating to behavioural
advertising did not have a valid legal basis614. Also, the FR SA argues that expressing the proposed fine
as a range and not as a fixed amount is not in line with Article 60 GDPR615.
328. On risks posed by the Draft Decision, the DE, FR, NL, NO and PL SAs consider that, if adopted, the Draft
Decision would lead to a significant risk for the protection of the fundamental rights and freedoms of
the data subjects616. The DE, FR, NL, NO and PL SAs explain that it would not ensure an effective
enforcement of the GDPR, as the proposed fine is unable to create a deterrent effect (either
specifically towards the controller, or in general towards other controllers)617. The NO SA considers
this would mean “that the complainant and the affected data subjects would in practice be denied the
610
DE SAs Objection, p. 11.
611
DE SAs Objection, p. 12.
612
DE SAs Objection, p. 14.
613
FR SA Objection, paragraph 43.
614
FR SA Objection, paragraph 45.
615
FR SA Objection, paragraph 47.
616
DE SAs Objection, pp. 15 and 16; FR SA Objection, paragraph 50; NL SA Objection paragraph 51; PL SA
Objection, p. 5.
617
DE SAs Objection, pp. 12, 15-16 ; FR SA Objection paragraph 40, 49 and 50 - 51; NL SA Objection,
paragraphs 48 and 51; NO SA Objection, pp. 10-11; PL SA Objection, p. 5.
Adopted 80
level of data protection set out in the GDPR”618. The FR SA argues the Draft Decision as it stands would
“lead to a levelling down of the level of administrative fines imposed by European data protection
authorities, thereby reducing the authorities' coercive power and, consequently, their ability to ensure
effective compliance with the protection of the personal data of European residents”619. The DE SAs
add that the Draft Decision does not promote a consistent application of administrative fines620 and
argue that “using of the incorrect turnover figure would create a dangerous precedent since other
controllers could ‘choose’ that supervisory authorities use a lower turnover figure as well”,
undermining the effectiveness of sanctions and resulting eventually in a significant risk to the rights
and fundamental freedoms of the data subjects concerned “since controllers could adjust their level
of compliance to the data protection”621.
9.1.3 Position of the LSA on the objections
329. The LSA considers none of the objections relating to the quantum of the proposed administrative fine
as relevant and reasoned622.
330. In relation to objections calling for an increase of the amount of the fine set out in the Draft Decision,
the LSA states it is “satisfied that it has fully taken into account the criteria at Article 83(2) GDPR, and
that the proposed administrative fines meet the requirements of Article 83(1) GDPR, taking into
account all the circumstances of this matter, and as set out Part 10 of the Draft Decision” and considers
that “the proposal as to the fine to be meaningful in terms of both the financial significance of it on
any view, as well as the significant publicity that a fine in this region will attract”623. The LSA refutes
that including a fining range in the Draft Decision is incompatible with Article 60 GDPR624.
331. With reference to the objections relating to the mode of calculating the proposed administrative fine
(assessment of the Article 83(2) GDPR criteria), the LSA does not accept that these objections are
relevant625. The LSA refutes that for the purposes of Article 83(2) GDPR it should have considered a
larger number of users, namely the reported number of users for the wider Facebook “family” of apps
insofar such apps are not covered by the Facebook Terms of Service, and so are not relevant to the
present circumstances 626.
332. While agreeing that “the full turnover figure should be used when calculating the administrative fine”,
the IE SA considers the objection not relevant “as the turnover figure in the final decision will in any
event refer to the 2021 turnover for Meta Platforms, Inc. and Meta Ireland”627.
618
NO SA Objection, p. 11.
619
FR SA Objection, paragraph. 51.
620
DE SAs Objection, p. 14.
621
DE SAs Objection, p. 14.
622
Composite Response, paragraph 114-115.
623
Composite Response, paragraph 115.
624
Composite Response, paragraphs 112-113.
625
Composite Response, paragraph 118.
626
Composite Response, paragraph 118.
627
Composite Response, paragraph114.
Adopted 81
9.1.4 Analysis of the EDPB
9.1.4.1 Assessment of whether the objections were relevant and reasoned
333. The objections raised by the DE, FR, NL, NO and PL SAs concern “whether the action envisaged in the
Draft Decision complies with the GDPR”628.
334. The EDPB takes note of Meta IE’s view that not a single objection put forward by the CSAs meets the
threshold of Article 4(24) GDPR629.
335. With specific regard to these objections on the determination of the administrative fine for the
transparency infringements, Meta IE acknowledges that objections as to whether envisaged corrective
measures comply with the GDPR fall within the scope of the dispute resolution mechanism 630,
however in their view objections solely protesting the amount of a fine are out of its scope631. Meta IE
argues that “in the context of a matter relating to cross-border processing, the power to impose an
administrative fine under the GDPR lies within the sole competence of the LSA, in this case the DPC,
and not the CSAs or the EDPB”632. Moreover, in their view only the LSA is competent to determine
whether the administrative fine is effective, proportionate and dissuasive633. The EDPB does not share
this reading of the GDPR, as explained above (see Section 8.4.2, paragraphs 275 - 277) and considers
that CSAs may object to the fine amount proposed by an LSA in its Draft Decision634.
628
EDPB Guidelines on RRO, paragraph 32.
629
Meta IE Article 65 Submissions, Annex 1, p. 70.
630
Meta IE Article 65 Submissions, paragraphs 8.14 and 9.2.
631
Meta IE Article 65 Submissions, paragraph 9.2.
632
Meta IE Article 65 Submissions, paragraph 9.2.
633
Meta IE Article 65 Submissions, paragraph 9.2. Meta IE adds that “the EDPB may not give instructions as to
whether a fine ought to be imposed or as to its amount (including, for the avoidance of doubt, any instruction to
the LSA to increase the fine)” The argument is reiterated in Meta IE Article 65 Submissions, Annex I - Response
to each of the objections, see p. 85 (SE SA), p. 91 (NO SA), p. 110 (FR SA), p. 123 (IT SA), p. 129-130 and 132 (DE
SAs).
634
In this regard, Recital 150 GDPR can be recalled, as it states that the consistency mechanism may also be used
to promote a consistent application of administrative fines. Consequently, an objection can challenge the
elements relied upon to calculate the amount of the fine, and if the assessment of the EDPB within this context
identifies shortcomings in the reasoning leading to the imposition of the fine at stake, the LSA will be instructed
to re-assess the fine and remedy the identified shortcomings (EDPB Guidelines on Art. 65(1)(a), paragraph 91;
EDPB Guidelines on RRO, paragraph 34. The EDPB found several objections on this subject matter admissible in
the past, see e.g. Binding Decision 1/2020, paragraphs 175-178 and 180-181, Binding Decision 1/2021,
paragraphs 310-314, Binding Decision 1/2022 paragraphs 53-55, Binding Decision 2/2022, paragraphs 186-190.
Consequently, within its mission of ensuring a consistent application of the GDPR, the EDPB is fully competent
to resolve the dispute arisen among supervisory authorities and remedy the shortcomings in the Draft Decision
concerning the calculation of the amount of the fine, which will in any event be quantified and imposed by the
LSA in its national decision adopted on the basis of the EDPB’s binding decision.
Adopted 82
336. The EDPB takes note of further arguments put forward by Meta IE, aiming to demonstrate lack of
relevance of the objections raised by the DE635, FR636, NL637, NO638 and PL639 SAs. Meta IE disagrees
with the content of these objections, which concerns its merits and not its admissibility.
337. The EDPB finds that the DE, FR, NL, NO and PL SAs disagree with a specific part of the IE SA’s Draft
Decision, namely Chapter 9 “Administrative fine” and Chapter 10 “Other relevant factors”, arguing
that the fine proposed for the transparency infringements identified is too low 640. If followed, these
objections would lead to a different conclusion in terms of the corrective measures imposed641. In
consequence, the EDPB considers the objections raised by the DE, FR, NL, NO and PL SAs to be
relevant.
635
Meta IE dismisses the DE SAs Objection to the fine proposed in the Draft Decision as not relevant nor
reasoned, because it “does not challenge the factors relied upon to calculate the amount of the fine, given
turnover is relevant only to determining the maximum fine that can be lawfully imposed and not the fine
amount”. See Meta IE Article 65 Submissions, p. 129.
636
Meta IE dismisses the FR SA’s objection as not relevant, because it criticises the amount of the proposed fine,
“rather than the factors the DPC relied on to calculate the fine - which are the relevant legal and factual content
of the Draft Decision”. See Meta IE Article 65 Submissions, p. 110. Besides noting that the FR SA does criticise
the weight given to the gravity of the infringement and the nature and scope of the processing (see FR SA
Objection, paragraph 50) the EDPB recalls it is entirely possible to argue an administrative fine is not ‘effective,
proportionate and dissuasive’ in the meaning of Art. 83(1) GDPR without referring to a specific criterion listed in
Art. 83(2) GDPR. Thus, Meta IE disagrees with the content of the objection, which concerns the merits and not
the admissibility of the objection.
637
Meta IE argues the NL SA’s objection “raises general criticisms of the DPC’s approach but fails to engage with
the specific factual and legal content of the Draft Decision” as articulated in paragraphs 9.47 to 9.52 therein.
Meta IE Article 65 Submissions, p. 99. The EDPB notes that the IE SA explains in paragraphs 9.48 to 9.50 why it
is “satisfied that the fines proposed above would, if imposed on Facebook, be effective, proportionate and
dissuasive, taking into account all of the circumstances of the Inquiry”, which the NL SA expressly disagrees with
in their objection. See NL SA Objection, paragraphs 37 - 52.
638
Meta IE reiterates its position that “the LSA has sole competence and discretion to determine the level of the
fine” to conclude the NO SA’s objection is not relevant. See Meta IE Article 65 Submissions, p. 91. The EDPB
responds to this argument above (Section 8.4.2, paragraphs 275 - 277 as well as footnote 634).
639
Meta IE rejects that turnover is relevant for determining the fine amount, to conclude on this basis the PL
SA’s objection “does not challenge the elements relied upon to calculate the amount of the fine” and this is not
relevant. Meta IE Article 65 Submissions, p. 105.
640
DE SAs Objection, p. 11; FR SA Objection, paragraph 40; NL SA Objection, paragraphs 37-52; NO SA Objection,
p. 8-11; PL SA Objection, p. 4.
641
DE SAs Objection, p. 16; FR SA Objection, paragraph 48; NL SA Objection, paragraphs 50 - 52; NO SA Objection,
p. 8 and 11; PL SA Objection, p. 5.
Adopted 83
338. Meta IE dismisses as unsubstantiated the reasoning put forward by the DE 642, FR643, NL644, NO645 and
PL646 SAs. In doing so, Meta IE disagrees with the content of the objections, which concerns their
merits and not their admissibility. Meta IE argues that the FR and NL SAs’ objections do not
demonstrate they could lead to a different conclusion in the Draft Decision647, thus not recognising an
increase of the administrative fine proposed as constituting a different conclusion.
339. Meta IE further argues that the DE, FR, NO and PL objections lack sufficient reasoning because they
introduce ‘additional’ criteria for the determination of the fine that have no basis in Article 83 GDPR648.
The EDPB understands that Meta IE disagrees with the reasoning provided in the objection, which thus
concerns the merits and not the admissibility of the objection.
340. The EDPB finds that the DE, FR, NL, NO and PL SAs argue why they propose amending the Draft
Decision and how this leads to a different conclusion in terms of administrative fine imposed, i.e. why
they propose to impose a higher fine for the transparency breaches 649.
642
Meta IE disagrees with DE SAs argument that profitability should have been considered as an aggravating
factor (under Art. 83(2)(k) GDPR), takes issue with the DE SAs calculating the size of the fine on a per data subject
basis, and rejects the DE SAs argument that a fine should have a general preventative effect. In addition, Meta
IE argues the DE SAs did not challenge the elements the IE SA relied on to determine the fine, while also repeating
the IE SA has sole discretion on this matter. See Meta IE Article 65 Submissions, p. 129-130.
643
Meta IE considers the FR SA’s objections to contain “unsubstantiated and theoretical reasons”, which “do not
provide sound and substantiated factual and legal reasoning as to why the DPC should alter its determination of
the fines”. At the same time, Meta IE cites specific reasoning from the FR SA’s, namely “the number of data
subjects concerned, the particularly intrusive nature of the processing operations in question, the breaches
observed, the position of Facebook Ireland Limited as a quasi-monopolist and its financial situation” (FR SA
Objection, paragraph 40) and the comparison the FR SA makes with other cases (FR SA Objection, paragraph 43).
See Meta IE Article 65 Submissions, p. 110.
644
Meta IE acknowledges that the NL SA provides reasoning as well as alleges inconsistencies in the Draft
Decision, but dismisses the objection as being unsubstantiated, speculative and insufficient to satisfy
Article 4(24) GDPR. In particular, Meta IE takes issue with the NL SA “noting that it ‘doubts’ the fines meet the
required objectives - without more concrete reasoning being provided”. First, the NL SA provides two reasons for
its ‘doubt’, namely “particularly considering the strong financial position of the controller and the finding that
the identified lack of transparency likely has had financial benefits for the controller (See paragraph 9.43 of the
Draft Decision)”. Second, the EDPB finds that using the verb ‘doubt’ does not void the reasoning that follows,
especially read in conjunction with the affirmative sentences laying out the grounds for the disagreement. See
Meta IE Article 65 Submissions, p. 99.
645
Meta IE’s arguments mainly concern the administrative fine the NO SA asks for processing without a valid
legal basis. These arguments are addressed below (see paragraph 420 and following). In connection with the
reasoning of the NO SA asking for an increase of the administrative fine for transparency infringements, Meta IE
disagrees “that Meta Ireland would not be affected by the fine in a way to substantially change its practices, and
that neither would
other controllers” by stating this is mere speculation by the NO SA. Meta IE Article 65 Submissions, p. 92.
646
Meta IE considers the objection ‘entirely speculative’ alleging the PL SA “speculates, without providing any
factual basis, that Meta’s profits depend on the volume of data processed”. Meta IE Article 65 Submissions,
p. 106.
647
Meta IE Article 65 Submissions, p. 99 (NL SA); p. 110 (FR SA).
648
Meta IE Article 65 Submissions p. 92 (NO SA), p. 106 (PL SA), p. 110-111 (FR SA), p. 129 (DE SAs).
649
The DE, FR, NL, NO and PL SAs argue the fine proposed for the transparency infringements is too low. DE SAs
Objection, p. 17-20; FR SA Objection, paragraph 40; NL SA Objection, paragraphs 37-52; NO SA Objection, p. 8-
11; PL SA Objection, p. 4.
Adopted 84
341. In terms of risks, Meta IE claims the Draft Decision does not pose any risk, let alone a significant risk
to fundamental rights and argues the objections of the DE 650, FR651, NL652, NO653 and PL654 SAs fail to
demonstrate the contrary, as required.
342. Meta IE argues not every GDPR infringement is likely to pose a significant risk to fundamental rights,
alleging the NO and PL SAs fail to address this655. The EDPB notes the NO and PL SAs actually do not
refer to ‘any infringement’ but advance their objection in relation to the transparency infringements
identified in the Draft Decision656, which the NO SA adds are considered serious by the IE SA 657.
343. Meta IE argues the NO and PL SA’s objections rest on unsubstantiated potential future behaviour of
controllers, which could only be an indirect and remote risk658. The EDPB notes that any risk
assessment addresses future outcomes, which are to some degree uncertain. Contrary to Meta IE’s
view659, the objections reflect specifically on the likely effects to be generated by the Draft Decision in
the event it is adopted as it stands and thus go beyond mere speculation about controllers at large660.
344. Meta IE takes issue with the DE SA’s argument that the proposed fine would be “hardly noticeable for
the undertaking” and thus lack special preventive effect 661 as well as with the similar argument raised
by the PL SA662. Further, Meta IE dismisses the concerns the DE, FR, NL SAs articulate about the
precedent the Draft Decision sets in terms of use of corrective powers in terms of general deterrent.
Meta IE claims a significant risk should be demonstrated in the context of the case at hand 663, adding
that fines require “a case-by-case assessment under Article 83 GDPR, which in respect of cross-border
cases will be subject to the cooperation and consistency mechanism” (apparently contradicting Meta
IE’s position that determining the fine lies “within the sole competence of the LSA”)664. Finally, Meta IE
650
Meta IE argues the risks identified by the DE SAs are ‘abstract and unsubstantiated’. See Meta IE Article 65
Submissions, p. 130-132.
651
Meta IE Article 65 Submissions, p. 112.
652
Meta IE argues that the NL SA “vaguely refers to the risk for data subjects remaining subject to illegal
processing in the future, rather than showing the significance of such risks based on the facts of this case”.
Meta IE Article 65 Submissions, p. 100.
653
Meta IE Article 65 Submissions, p. 92-93.
654
Meta IE Article 65 Submissions, p. 106.
655
Meta IE Article 65 Submissions, p. 92 (NO SA) ; p. 106 (PL SA).
656
See PL SA Objection, p. 4. NO SA Objection, p. 10.
657
NO SA Objection, p. 10. See also Draft Decision, paragraph 9.45.
658
Meta IE Article 65 Submissions, p. 92 (NO SA), p. 106 (PL SA).
659
Meta IE Article 65 Submissions, p. 106 (PL SA).
660
Meta IE Article 65 Submissions, p. 92 (NO SA), p. 106 (PL SA). See NO SA Objection, p. 10, PL SA Objection, p.
5.
661
On the one hand, Meta IE “submits the German SA is operating under the misconception that turnover is not
only a relevant factor to consider when calculating a fine under GDPR, but that unless turnover is calculated in
the manner the German SA suggests, the fining system will be weakened to such an extent that fines are not
effective, proportionate, and dissuasive. This is incorrect and untenable as Article 83(2) GDPR does not mention,
let alone require consideration of turnover for setting the fine amount” On the other hand, Meta IE appears to
argue the fine is dissuasive as it is, due to reputational costs of fines. See Meta IE Article 65 Submissions, p. 130-
131. See DE SAs Objection, p. 12-16 on specific and general deterrence.
662
See Meta IE Article 65 Submissions, p. 106 in response to the PL SA’s argument that it is “difficult to conclude
that the proposed financial penalty in such a low amount can effectively deter the punished entity from
committing similar violations in the future”, PL SA Objection, p. 5.
663
In response to the FR SA. See Meta IE Article 65 Submissions, p. 113
664
In response to the DE SA. See Meta IE Article 65 Submissions, p. 131. The ‘sole competence’ argument is put
forward in Meta IE Article 65 Submissions, paragraphs 8.3, 9.2 and reiterated in Annex I - Response to each of
the objections. The EDPB responds in Section 8.4.2, paragraphs 275 - 277 as well as in footnote 634.
Adopted 85
dismisses these objections as not based on any facts or legal demonstration665, going so far as to claim
“‘precedent’ is a concept foreign to EU law”666.
345. First, the EDPB notes that any risk assessment addresses future outcomes, which are to some degree
uncertain, and finds there is no basis in the GDPR to limit the notion of risks to the boundaries of the
particular case at hand. Article 4(24) GDPR refers to the risks posed to the “fundamental rights and
freedoms of data subjects” and “where applicable, the free flow of personal data within the Union”.
Both of these aspects are phrased in a general way. The wording of this provision does not in any way
limit the demonstration of the risks to showing the risks posed to the data subjects affected by the
concrete processing carried out by the specific controller, in light of the objective of guaranteeing a
“high level of protection in the EU for the rights and interests of the individuals”667. Therefore, the risks
posed by a draft decision to be demonstrated by a relevant and reasoned objection might also concern
data subjects, whose personal data might be processed in the future, including by other controllers.
346. Second, the EDPB points out that final decisions taken by SAs belong to the realm of facts, as do court
rulings. Moreover, Meta IE itself refers to specific pre-existing decisions to argue their current case668
and expresses its general expectation that SAs take into account pre-existing decisions in new cases669,
thus illustrating the concern raised by the DE, FR, NL SA is rooted in the reality of legal practice and
argument.
347. The EDPB notes that the DE and FR SA considered both of the aspects that are entailed by
dissuasiveness of the fine, i.e. specific deterrence and general deterrence670.
348. The EDPB finds that the DE, FR, NL, NO, PL SAs articulate an adverse effect on the rights and freedoms
of data subjects if the Draft Decision is left unchanged, by referring to a failure to guarantee a high
level of protection in the EU for the rights and interests of the individuals671.
665
In response to the FR SA (and using very similar wording in response to the NL SA) Meta IE adds that “[in]
fact, no fine imposed by the DPC could prevent other SAs from imposing higher fines if they consider that this is
appropriate and lawful given the specific circumstances of the case they are investigating and the evidence they
have examined in the context of their investigation”. See Meta IE Article 65 Submissions, p. 112-113. In response
to the NL SA, see Meta IE Article 65 Submissions, p. 100.
666
In response to the DE SA. See Meta IE Article 65 Submissions, p. 131.
667
Judgement of the Court of Justice of 6 November 2003, Lindqvist, Case C-101/01, ECLI:EU:C:2003:596,
paragraph 95; C-524/06 Huber, paragraph 50; Judgement of the Court of Justice of 24 November 2011,
Asociación Nacional de Establecimientos Financieros de Crédito, C-468/10 and C-469/10, ECLI:EU:C:2011:777,
paragraph 28.
668
For instance, Meta IE argues a ban on processing would be disproportionate and refers to precedents, namely
a Luxembourg court decision and decision taken by the BE SA. Meta IE Article 65 Submissions, p. 57.
669
Meta IE states that “the DPC itself has the possibility to impose higher amounts in other cases, provided it
explains why such other cases would warrant such higher fines” (emphasis added). At the same time, Meta IE
dismisses the FR SA’s objection for not indicating “why any fine imposed by the DPC could prevent other SAs from
imposing higher fines if they consider that this is more appropriate given the specific circumstances of the case
they are investigating and the evidence they have examined in the context of their investigation.” See Meta IE
Article 65 Submissions, p. 112-113.
670
The CJEU has consistently held that a dissuasive fine is one that has a genuine deterrent effect, encompassing
both specific deterrence (discouraging the addressee of the fine from committing the same infringement again)
and general deterrence (discouraging others from committing the same infringement in the future). See, inter
alia, Judgement of the Court of Justice of 13 June 2013, Versalis Spa v European Commission, C-511/11 P,
ECLI:EU:C:2013:386, (hereinafter ‘C-511/11 Versalis’), paragraph 94.
671
DE SAs Objection, p. 14-16, FR SA Objection, paragraphs 50-51; NL SA Objection, paragraph 51; NO SA
Objection, p. 10-11; PL SA Objection, p. 4-5. See also EDPB Guidelines on RRO, paragraph 37.
Adopted 86
349. Therefore, the EDPB considers the DE, FR, NL, NO, PL SAs objections to be reasoned.
9.1.4.2 Assessment on the merits
350. In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning all the
matters that are the subject of the relevant and reasoned objections, in particular whether the
envisaged action in relation to the controller complies with the GDPR.
351. The EDPB recalls that the consistency mechanism may also be used to promote a consistent
application of administrative fines672. A fine should be effective, proportionate and dissuasive, as
required by Article 83(1) GDPR, taking account of the facts of the case 673. In addition, when deciding
on the amount of the fine, the LSA shall take into consideration the criteria listed in Article 83(2) GDPR.
352. The EDPB responds to Meta IE’s argument that the LSA has sole discretion to determine the
appropriate corrective measures in the event of a finding of infringement above (see Section 8.4.2,
paragraphs 275 - 277 as well as footnote 634).
353. The finding in the Draft Decision of a transparency infringement for the processing concerned still
stands. The EDPB recalls that, on substance, no objections were raised on this finding. Meta IE
infringed its general transparency obligations by being unclear on the link between the purposes of
processing, the lawful bases of processing and the processing operations involved674, irrespective of
the validity of the legal basis relied on for the ‘processing concerned’. It remains the case that, for the
transparency infringements, ‘the processing concerned’ should be understood as meaning all of the
processing operations that Meta IE carries out on the personal data under its controllership for which
Meta IE indicated it relied on Article 6(1)(b) GDPR675, including for the purposes of behavioural
advertising. This is without prejudice to the fact that Meta IE inappropriately relied on 6(1)(b) as a
legal basis to process personal data for the purpose of behavioural advertising as part of the delivery
of its Facebook service under the Facebook Terms of Service. Whether or not Meta IE appropriately
chose its legal basis for processing, the transparency infringement as assessed in the Draft Decision
still stands. Therefore, the IE SA must not modify this description retroactively in light of the
assessment of the validity of the legal basis, including for the purpose of carrying out any reassessment
of the administrative fines originally proposed by the Draft Decision, as might be required by this
Binding Decision.
354. In light of the objections found relevant and reasoned, the EDPB addresses whether the Draft Decision
proposes a fine for the transparency infringements that is in accordance with the criteria established
by Article 83(2) GDPR and the criteria provided for by Article 83(1) GDPR. In doing this, the EDPB will
first look into a preliminary matter, then assess the disputes arisen in respect of the analysis of specific
criteria under Article 83(2) performed by the LSA, and then examine whether the proposed fine meets
the requirements of effectiveness, dissuasiveness and proportionality set in Article 83(1) GDPR,
including by affording adequate weight to the relevant factors and to the circumstances of the case.
672
Recital 150 GDPR. EDPB Guidelines on RRO, paragraph 34; EDPB Guidelines on Administrative Fines, p. 7
(“When the relevant and reasoned objection raises the issue of the compliance of the corrective measure with
the GDPR, the decision of EDPB will also discuss how the principles of effectiveness, proportionality and
deterrence are observed in the administrative fine proposed in the draft decision of the competent supervisory
authority”).
673
EDPB Guidelines on Administrative Fines, p. 7. EDPB Guidelines on calculation of fines, paragraphs 132-134.
674
Draft Decision, paragraph 5.72.
675
Draft Decision, paragraph 9.4.
Adopted 87
Preliminary matter: the total turnover of the undertaking
355. The DE SAs does not contest the identification of the relevant undertaking in the IE SAs Draft Decision,
but contests the turnover figure cited in the Draft Decision. Though the IE SA deems the objection not
relevant, in the Composite Response the IE SA agrees with the DE SAs on the principle that the total
turnover figure should be used when calculating the administrative fine676. Moreover, the IE SA adds
that “the turnover figure in the final decision will in any event refer to the 2021 turnover for
Meta Platforms, Inc. and Meta Ireland”677.
356. For the avoidance of doubt, the EDPB instructs the IE SA to take into consideration the total turnover
of all the entities composing the single undertaking, i.e. the consolidated turnover of the group of
companies headed by Meta Platforms, Inc.678. On the notion of ‘preceding financial year’, the EDPB
recalls the decision taken in its Binding Decision 1/2021 (paragraph 298) and takes note of the IE SA’s
intention to take the same approach in the current case.
357. On the notion of “preceding financial year”, the EDPB recalls the decision taken in its Binding Decision
1/2021 (paragraph 298) and takes note of the IE SA’s intention to take the same approach in the
current case.
358. In addition, the EDPB agrees with the approach taken by the IE SA for the present case to include in
the Draft Decision a provisional turnover figure based on the most up to date financial information
available at the time of circulation to the CSAs pursuant to Article 60(3) GDPR. The final decision will
have to refer to the whole undertaking’s annual turnover corresponding to the financial year
preceding the date of the final decision.
The number of data subjects affected (Article 83(2)(a) GDPR)
359. The DE SAs puts forward that the number of affected data subjects may be even higher679 than the
monthly users as of May 2021 in the European Economic Area confirmed by Meta IE to
the IE SA 680. The DE SAs refer to a Meta Platforms, Inc. press release of 27 January 2021, inferring from
that “whilst [Meta Platforms, Inc.] reported 2.80 billion monthly active users, they report 3.30 billion
‘family monthly active people’ for 2020. Applying this increase of about 18 % there could be about
affected data subjects ( plus 18 % = )”681.
360. The IE SA is “satisfied that the reference to the number of users of the ‘family’ of apps refers to the
total number of users across all apps owned by Meta Platforms Inc., (i.e. also including users of
WhatsApp and Instagram) and not solely the number of users of the Facebook App. Such apps are not
covered by the Facebook Terms of Service, and so are not relevant to the present circumstances”682.
676
Composite Response, paragraph 114.
677
Composite Response, paragraph 114. Meta IE argues that “[turnover] is not a relevant consideration when
determining the amount of the fine under Article 83(2) GDPR”, see Meta IE Article 65 Submissions, paragraph 9.4.
On principle, this matter is not within the scope of the dispute as no CSA raised an objection disputing the
consideration of turnover as such.
678
Binding Decision 01/2021, paragraph 291.
679
DE SAs Objection, p. 15.
680
Draft Decision, paragraph 9.15.
681
DE SAs Objection, p. 15, citing Meta Platforms, Inc.’s press release dated 27 January 2021 (“Facebook Reports
Fourth Quarter and Full Year 2020 Results”).
682
Composite Response, paragraph 118.
Adopted 88
Meta IE confirms the IE SA’s response, adding that the 2020 figures cited in the DE SAs’ objection
“relate to the global number of unique people using at least one of the Meta Family of Apps”683.
361. From the elements put forward, the EDPB sees no reason to question the response given by the IE SA
on this objection. Therefore, the EDPB is of the view that the Draft Decision does not need to be
amended with regard to the number of data subjects affected. This is without prejudice to the
conclusions reached below on whether the fine is in line with Article 83, taking into consideration all
the circumstances of the case, including the number of data subjects.
On any action taken by the controller to mitigate the damage suffered by data subjects
(Article 83(2)(c) GDPR)
362. The PL SA disagrees with the mitigating factor identified by the IE SA by reference to Meta IE’s
willingness to engage in steps to bring its processing into compliance on a voluntary basis pending the
conclusion of the inquiry684.
363. The IE SA states that “[Meta IE]’s willingness to engage in steps to bring its processing into compliance
on a voluntary basis” should be understood as actions taken to mitigate the damage to data subjects,
distinct from actions taken to comply685. In the present case, the EDPB fails to see how such a
distinction can be made. Additionally, drawing this distinction seems inconsistent with the IE SA’s
position that the negative impact on data subjects lies precisely in the transparency infringements and
thus in the “the risks to data subjects in being unable to effectively exercise their rights by being unable
to discern what specific data processing is being done on what legal basis and for what objective”686.
In other words, the damage caused to data subjects is, in these circumstances, consubstantial with
the finding of the infringement itself687.
364. In addition, the EDPB agrees with the PL SA that the expression of an “intention to bring the processing
operations into the compliance with the provisions of GDPR” as such cannot serve as evidence of
actions already taken to mitigate damage suffered. In order for this element to serve as a mitigating
factor, further evidence would be necessary for instance demonstrating that the controller did
whatever they could in order to reduce the consequences of the breach for the individuals
concerned688.
365. The EDPB agrees with the IE SA that “[taking] steps to attempt to comply with legal obligations is a
duty, and has no mitigating impact on a sanction for a breach of those obligations”. In any case, Meta
IE’s “decision to begin preparation for voluntary compliance on the basis of the views set out in the
Preliminary Draft Decision” is merely a first step of a longer process towards full compliance with the
GDPR. The information available in the file does not include indications that the actions taken by the
683
Meta IE Article 65 Submissions, paragraph 10.2.
684
PL SA Objection, p. 4, in response to Draft Decision, paragraph 9.30. Meta IE does not address this aspect of
the PL SA’s objection in particular, but argues the PL SA’s objection in relation to administrative fines is not
relevant or reasoned, see Meta IE Article 65 Submissions, p. 105 - 106.
685
Draft Decision, paragraph 9.29.
686
Draft Decision, paragraph 9.10. The IE SA refers also to Section 5 of the Draft Decision.
687
Non-material damage is explicitly regarded as relevant in Recital 75, which states that such damage may
result from situations “where data subjects might be deprived of their rights and freedoms or prevented from
exercising control over their personal data”.
688
EDPB Guidelines on calculation of fines, paragraph 75, referring to EDPB Guidelines on Administrative Fines,
p. 12.
Adopted 89
controller have gone beyond willingness to prepare to change its practices in case this appeared
necessary.
366. The EDPB finds the IE SA does not provide sufficient justification for the mitigating factor identified,
and instructs the IE SA to modify its Draft Decision on this matter, by considering this factor as neither
aggravating nor mitigating.
On other factors and the non-exhaustive nature of the criteria in Article 83(2) GDPR
367. Meta IE argues some CSAs “introduce criteria that are not provided for by Article 83(2) GDPR”689,
which “amounts to a breach of the principle of legal certainty, which is of particular importance with
respect to the imposition of administrative fines which are criminal in nature”690. Meta IE
acknowledges that Article 83(2)(k) GDPR is open-ended as it refers to any other aggravating or
mitigating factor applicable to the circumstances of the case, arguing however that the criteria of
Article 83(2) GDPR focus only on the data controller or processor, or on the infringement691.
368. The EDPB does not share such a restrictive reading of Article 83(2)(k) GDPR, which it deems leaves
room for “all the reasoned considerations regarding the socio-economic context in which the controller
or processor operates, those relating to the legal context and those concerning the market context”692.
The EDPB considers this provision “of fundamental importance for adjusting the amount of the fine to
the specific case” and that “it should be interpreted as an instance of the principle of fairness and
justice applied to the individual case”693. The EDPB recalls that Article 83(2) GDPR contains a non-
exhaustive list of assessment criteria to be considered, if appropriate, by the LSA in determining the
amount of the fine corresponding to what is necessary to be effective, proportionate, and dissuasive
in accordance with Article 83(1) GDPR.
369. Given the open-ended nature of Article 83(2), the EDPB disagrees with the argument by Meta IE
contending that the principle of legal certainty was breached. In any case, the EDPB recalls that it is
settled case law that legal certainty is not absolute694. All cases of application of a general norm can
“not be determined in advance by the legislature”695. Therefore, legal certainty “cannot be interpreted
as prohibiting the gradual clarification of rules of criminal liability by means of interpretations in the
689
Meta IE Article 65 Submissions, paragraphs 8.4, 9.1, 10.2, Annex 1, p. 85-86, 92, 105-106.
690
Meta IE Article 65 Submissions, paragraph 9.1.
691
Meta IE Article 65 Submissions, paragraph 9.4 and 9.5. This acknowledgement is put forward as part of Meta
IE’s reasoning that “[turnover] is not a relevant consideration when determining the amount of the fine under
Article 83(2) GDPR”. On principle, this matter is not within the scope of the dispute as no CSAs raised an objection
on the consideration of turnover, other than the DE SAs objection on the turnover figure used.
692
EDPB Guidelines on calculation of fines, paragraph 109.
693
EDPB Guidelines on calculation of fines, paragraph 108.
In this regard, the EDPB also notes that at the same time “given the overarching nature of Article 83(1) GDPR,
the LSA must ensure that the circumstances taken into account when calculating the fine are not counted twice”,
meaning that for instance if a factor is already to be considered within the assessment under Art. 83(1) GDPR,
the LSA should not take it into account under Art. 83(2)(k) GDPR too. Binding Decision 1/2022, paragraph 70.
694
Judgement of the Court of Justice of 14 April 2005, Belgium v. Commission, C-110/03, ECLI:EU:C:2005:223,
paragraph 31; Judgement of the General Court of 17 May 2013, Trelleborg Industrie SAS, T-147/09,
ECLI:EU:T:2013:259, paragraph 96; Judgement of the General Court of 13 July 2011, Schindler, T-138/07,
ECLI:EU:T:2011:362, paragraph 99.
695
Judgement of the Court of Justice of 20 July 2017, Marco Tronchetti Provera SPA a.o. v Commissione
Nazionale per le Società e la Borsa (Consob), C-206/16, ECLI:EU:C:2017:572, paragraph 42; Judgement of the
General Court of 5 October 2020, HeidelbergCement AG, T-380/17, ECLI:EU:T:2020:471, paragraph 130.
Adopted 90
case-law”696 and undertakings are expected to take appropriate legal advice to anticipate the possible
consequences of a rule and to assess the risk of infringement with “special care”697. Finally, even if
were the case that supervisory authorities had previously issued conflicting views, such a circumstance
would not be relevant when assessing the predictability of an infringement698. The ECtHR has also
ruled that the fact that a point of law is ruled on for the first time does not undermine legal certainty
“if the meaning given is both foreseeable and consistent with the essence of the offence”699.
The financial benefit obtained from the infringement (Article 83(2)(k) GDPR)
370. As explicitly stated in Article 83(2)(k) GDPR, financial benefits gained directly or indirectly from the
infringement can be considered an aggravating element for the calculation of the fine. When applying
this provision, the supervisory authorities must “assess all the facts of the case in a manner that is
consistent and objectively justified”700. Therefore, financial benefits from the infringement could be
an aggravating circumstance if the case provides information about profit obtained as a result of the
infringement of the GDPR701.
371. The aim of Article 83(2)(k) is to ensure that the sanction applied is effective, proportionate and
dissuasive in each individual case702. With regard to the financial benefits obtained from the
infringement, the EDPB considers that when there is a benefit, the sanction should aim at
“counterbalancing the gains from the infringement” while keeping an effective, dissuasive and
proportionate fine703.
372. The financial benefit obtained by Meta IE was considered by the IE SA in the Draft Decision with regard
to the transparency infringements704. The IE SA found it had insufficient elements to conclude - beyond
speculating - that Meta IE benefited from the infringement705.
373. The DE SAs disagree with the IE SA’s decision to set aside this factor. The DE SA describes a
counterfactual - where there would be 1 million less monthly users (= of the monthly
696
Judgement of the Court of Justice of 25 March 2021, H. Lundbeck A/S, C-591/16 P, ECLI:EU:C:2021:243,
(hereinafter ‘C-591/16 Lundbeck’), paragraph 166.
697
Judgement of the Court of Justice of 22 October 2015, AC-Treuhand AG, C-194/14 P, ECLI:EU:C:2015:717,
paragraph 42. The AG Campos Sanchez-Bordona also recently emphasized that there are domains where “legal
advice tends to be the rule and not the exception” (Opinion of the Advocate-General of 9 December 2021, French
Court of Cassation, C-570/20, ECLI:EU:C:2021:992, paragraph 81), which is the case of data protection. See also,
ECtHR (Gd ch.), Kononov v. Latvia, 17 May 2010, paragraphs 185 and 215.
698
C-591/16 P, H. Lundbeck A/S, paragraph 170.
699
ECtHR, Georgouleas and Nestoras v. Greece, 26 May 2020, paragraph 57; Khodorkovskiy and Lebedev v. Russia
(No. 2), 14 January 2020, paragraph 570. Judgement of the General Court of 12 December 2018, Servier SAS, T-
691/14, ECLI:EU:T:2018:922, paragraph 1660.
700
EDPB Guidelines on Administrative Fines, p. 6 (emphasis added), quoted in Binding Decision 1/2021,
paragraph 403.
701
EDPB Guidelines on calculation of fines, paragraph 110.
702
EDPB Guidelines on calculation of fines, paragraph 107.
703
EDPB Guidelines on calculation of fines, examples 7c and 7d.
704
Draft Decision, paragraphs 9.43 - 9.44.
705
The IE SA finds this factor is neither aggravating nor mitigating. Draft Decision, paragraph 9.44. Initially, in the
Preliminary Draft Decision, the IE SA had indicated the lack of transparency had the potential to have resulted
in financial benefits for Meta IE (see Draft Decision, paragraph 9.44). The DE SAs expressed their agreement with
this conclusion (see DE SAs objection, p. 13).
Adopted 91
users according to paragraph 9.15 of the Draft Decision if the transparency violations had
not occurred) - which would amount to an estimated EUR less in turnover 706.
374. Considering the need to have fines that are effective, proportionate and deterrent, and in light of
common accepted practice in the field of EU competition law 707, which inspired the fining framework
under the GDPR, the EDPB is of the view that, when calculating the administrative fine, the supervisory
authority could take account of the financial benefits obtained from the infringement, in order to
impose a fine that exceeds that amount.
375. In the present case, neither the IE SA nor the DE SAs have provided an estimation of the financial
benefit gained by Meta IE with the transparency infringements. The DE SAs’ calculation presents an
example and is still largely based on assumptions on a lower number of monthly users. Due to this,
the EDPB does not have sufficiently precise information to evaluate the specific weight of the financial
benefit obtained from the infringement.
376. Therefore, the EDPB considers that it does not have objective elements to conclude whether the fine
envisaged in relation to the transparency infringements takes sufficient account of the financial
benefit obtained from the infringement and, therefore, has a deterrent effect in this respect.
377. Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no effect if they
are disproportionally low compared to the benefits obtained with the infringement. The EDPB
considers that the IE SA should ascertain if further estimation of the financial benefit from the
infringement of transparency obligations is possible in this case. Insofar as this results in the need to
increase the amount of the fine proposed, the EDPB requests the IE SA to increase the amount of the
fine proposed.
The profitability of the undertaking - other factor (Article 83(2)(k) GDPR)
378. The DE SAs request the IE SA to consider, in addition to turnover, the annual profit of the undertaking
in its assessment708. The DE SAs position is that the undertaking’s sensitivity to administrative fines is
significantly influenced by profitability, not only turnover. The DE SAs argue that the Draft Decision
does not demonstrate that profitability was taken into account to assess “sensitivity to administrative
fines” and does not ensure the fine is effective, proportionate and dissuasive709.
379. Meta IE argues Article 83(2) GDPR does not identify annual profit as a factor to which the LSA should
have regard in calculating the amount of the administrative fine710. The EDPB has explained its view
on the open-ended character of Article 83(2)(k) GDPR above (see paragraphs 367-369).
380. The EDPB recalls that in determining administrative fines under Article 83 GDPR the total worldwide
annual turnover of the undertaking should be considered, as this “gives an indication, albeit
approximate and imperfect, of the size of the undertaking and of its economic power”711. The EDPB
706
The DE SA notes that “[per] worldwide monthly active user (2.80 billion) Facebook generates a turnover of
about EUR 25.02” (on the basis of a report from Meta Platforms, Inc. ) and - for the sake of the argument -
makes the assumption that this value is applicable for European data subjects using facebook.com . See DE SAs
objection, p. 13.
707
See the CJEU rulings cited in Binding Decision 2/2022, paragraph 219.
708
DE SAs objection, p. 12-13.
709
DE SAs objection, p. 12-13.
710
Meta IE Article 65 Submissions, Annex 1, p. 105-106, p. 128-130.
711
Judgement of the Court of Justice of 7 June 1983, Musique Diffusion, Joined Cases C-100-103/80,
ECLI:EU:C:1983:158, paragraph 121.
Adopted 92
does not find that in the case at hand the LSA should be requested to amend its Draft Decision to
additionally consider the annual profit of the undertaking. At the same time, the EDPB reiterates that
the imposition of an appropriate fine cannot be the result of a simple calculation based on the total
turnover712 and that as stated above all the circumstances of the specific case have to be considered
in order to assess if the administrative fine is effective, proportionate and dissuasive as required by
Article 83(1) GDPR.
381. Moreover, the size of the undertaking concerned and its financial capacity713 are elements that should
be taken into account in the calculation of the amount of the fine in order to ensure its dissuasive
nature714. Taking into consideration the size and global resources of the undertaking in question is
justified by the impact sought on the undertaking concerned, in order to ensure that the fine has
sufficient deterrent effect, given that the fine must not be negligible in the light, particularly, of its
financial capacity715. The EDPB recalls that a fine to be imposed on an undertaking may need to be
increased to take into account a particularly large turnover of the undertaking, so the fine is
sufficiently dissuasive716. In this respect, the EDPB further notes that in order to ensure a sufficiently
deterrent effect, the global turnover of the undertaking can be considered also in light of the
undertaking’s ability to raise the necessary funds to pay its fine717.
The effectiveness, proportionality and dissuasiveness of the administrative fine (Article 83(1) GDPR)
382. With regard to effectiveness of the fines, the EDPB recalls that the objective pursued by the corrective
measure chosen can be to re-establish compliance with the rules, or to punish unlawful behaviour, or
both718. In addition, the EDPB notes that the CJEU has consistently held that a dissuasive penalty is
one that has a genuine deterrent effect. In that respect, a distinction can be made between general
deterrence (discouraging others from committing the same infringement in the future) and specific
deterrence (discouraging the addressee of the fine from committing the same infringement again)719.
Therefore, in order to ensure deterrence, the fine must be set at a level that discourages both the
controller or processor concerned as well as other controllers or processors carrying out similar
processing operations from repeating the same or a similar unlawful conduct. Proportionality of the
fine needs also to be ensured as the measure must not go beyond what is necessary to attain that
712
See, inter alia, judgement of the General Court of 22 September 2021, Altice Europe NV v Commission,
T-425/18, ECLI:EU:T:2021:607, (hereinafter ‘T-425/18 Altice Europe’), paragraph 362; judgement of the General
Court of 5 October 2011, Romana Tabacchi v Commission, T‑11/06, ECLI:EU:T:2011:560, (hereinafter ‘T-11/06
Romana Tabacchi’), paragraph 266.
713
Judgement of the Court of Justice of 17 June 2010, Lafarge v European Commission, C-413/08 P,
ECLI:EU:C:2010:346, (hereinafter, ‘C-413/08 P Lafarge’), paragraph 104.
714
Binding Decision 1/2021, paragraphs 408-412.
715
Judgement of the Court of Justice of 4 September 2014, YKK and Others v Commission, C‑408/12 P,
ECLI:EU:C:2014:2153, paragraph 85; C-413/08 P Lafarge, paragraph 104. In addition, the EDPB recalls that in
some circumstances the imposition of a deterrence multiplier can be justified and that the exceptional financial
capacity of an undertaking may be one such circumstance (see EDPB Guidelines on Administrative Fines,
paragraph 144; and Judgement of the Court of Justice of 29 June 2006, Showa Denko v Commission, C-289/04 P,
ECLI:EU:C:2006:431, paragraphs 29, 36-38).
716
The same approach is suggested in the European Commission Guidelines on the method of setting fines
imposed pursuant to Art. 23(2)(a) of Regulation No 1/2003, C210/02, 1.9.2006, paragraph 30.
717
C-413/08 P Lafarge, paragraph 105.
718
EDPB Guidelines on Administrative Fines, p. 6.
719
See, inter alia, C-511/11 Versalis, paragraph 94.
Adopted 93
objective720. In this respect, the EDPB disagrees with Meta IE’s views that there is no basis to conclude
that the amount of the fine must have a general preventive effect721.
383. The EDPB reiterates that it is incumbent upon the supervisory authorities to verify whether the
amount of the envisaged fines meets the requirements of effectiveness, proportionality and
dissuasiveness, or whether further adjustments to the amount are necessary, considering the entirety
of the fine imposed and all the circumstances of the case, including e.g. the accumulation of multiple
infringements, increases and decreases for aggravating and mitigating circumstances and
financial/socio-economic circumstances722. Further, the EDPB recalls that the setting of a fine is not an
arithmetically precise exercise723, and supervisory authorities have a certain margin of discretion in
this respect724.
384. The DE, FR, NL, NO and PL SAs, object to the level of the fine envisaged in the Draft Decision as they
consider the proposed fine not effective, proportionate and dissuasive (Article 83(1) GDPR)725. These
SAs argue that the elements of Article 83(2) GDPR are not weighed correctly by the LSA when
calculating the administrative fines in the present case, in light of the requirements of
Article 83(1) GDPR726.
385. Specifically, the DE, FR, NL and NO SAs refer to the nature and gravity of the infringement and the
number of data subjects concerned727. The PL SA adds that the gravity of the infringement is
compounded by the fact that the data processing is an essential part of Meta IE’s business model728.
The DE SAs also refer to the infringement’s duration and the negligence identified by the IE SA 729.
386. The EDPB takes note Meta IE’s disagreement with the fine proposed by the IE SA 730 and their view that
any objections aiming to increase the quantum of fines are not compatible with Article 83 GDPR731.
720
MT v Landespolizeidirektion Steiermark (Case C‑231/20, judgment delivered 14 October 2021,
ECLI:EU:C:2021:845), paragraph 45 (“the severity of the penalties imposed must […] be commensurate with the
seriousness of the infringements for which they are imposed, in particular by ensuring a genuinely deterrent
effect, while not going beyond what is necessary to attain that objective”).
721
Meta IE Article 65 Submissions, Annex 1, p. 113, 130 and 133.
722
EDPB Guidelines on calculation of fines, paragraph 132, and EDPB Guidelines on Administrative Fines, p. 6,
specifying that ”administrative fines should adequately respond to the nature, gravity and consequences of the
breach, and supervisory authorities must assess all the facts of the case in a manner that is consistent and
objectively justified”.
723
See T-425/18 Altice Europe, paragraph 362; T-11/06 Romana Tabacchi, paragraph 266.
724
See, inter alia, judgement of the General Court of 16 June 2011, Caffaro Srl v Commission, T-192/06,
ECLI:EU:T:2011:278, paragraph 38. See also EDPB Guidelines on calculation of fines, p. 2.
725
DE SAs Objection, p. 11-14; FR SA Objection, paragraph 38 - 51, in particular paragraph 50; NL SA Objection,
paragraph 38, 45 and following; NO SA Objection, pp. 8-10; PL SA Objection, pp. 4-5.
726
DE SAs Objection, p. 14-15; FR SA Objection, paragraph 50; NL SA Objection, paragraph 40 and 49; NO SA
Objection, p. 8-9; PL SA Objection, p. 4.
727
DE SAs Objection, p. 13 -15; FR SA Objection, paragraph 40 ; NL SA Objection, paragraph 40- 41 and 49; NO
SA Objection, p. 10.
728
PL SA Objection, p. 4.
729
DE SAs Objection, p. 13.
730
Meta IE Article 65 Submissions, 10.1
731
Meta IE Article 65 Submissions, paragraphs 9.2-9.11. Meta IE’s argument that the LSA has sole competence
to determine corrective measures including administrative fines is addressed above. See Section 8.4.2,
paragraphs 275 - 277 as well as footnote 634. Meta IE’s argument that “[turnover] is not a relevant consideration
when determining the amount of the fine under Article 83(2) GDPR” is not within the scope of the dispute as no
CSAs raised an objection on the consideration of turnover, other than the DE SAs objection on the turnover
Adopted 94
387. The EDPB notes that in the Draft Decision the IE SA indicates being satisfied the proposed fine is
effective, proportionate and dissuasive, taking into account all the circumstances of the IE SA’s
inquiry732. The IE SA assessed the different criteria of Article 83(2) GDPR in relation to the transparency
infringements found733. The IE SA considered the infringements as serious in nature734, and in terms
of gravity of the infringements found a significant level of non-compliance735. Furthermore, the EDPB
underlines that, as established by the IE SA, the infringements affect a significant number of data
subjects736 and are extensive737. The EDPB also observes that the infringements is considered negligent
in character738. Further, the IE SA considered the level of damage suffered by data subjects as being
significant739. In addition, the IE SA identifies only one mitigating factor, however without articulating
the weight accorded to it740.
388. Meta IE argues that reputation costs should also be taken into consideration, citing the IE SA’s remark
on “the significant publicity that a fine in this region will attract” 741. On principle, the EDPB agrees
that reputation costs could be taken into consideration to some extent, if credible arguments are be
put forward about the grave detriment that would ensue. Meta IE does not present such arguments742.
The EDPB is of the view that in this case other incentives would offset any reputational costs. As far as
advertisers are concerned, Meta IE puts forward that “[the] personalised nature of the Facebook
Service is also the reason why it has been instrumental in the success of small and medium sized
businesses (‘SMEs’) worldwide, including across the EU. Personalisation on the Facebook Service
enables SMEs to compete for customers through ‘customizing products and services, [...] building a
unique brand image, tailoring marketing to a specific audience and developing a strong one-to-one
connection with a community of customers’”743. As far as users of the Facebook service are concerned,
there are network effects at play which leads to incentives to join - or not leave - the platform, so as
not to be excluded from participating in discussions, corresponding with and receiving information
from others744.
389. The FR SA compares the proposed fine with the fine of 225 million euros decided upon by the IE SA in
its decision dated 20 August 2021 against WhatsApp Ireland Limited for transparency infringements
(breaches of Articles 12 and 13 GDPR)745. The FR SA also compares with the fine of 746 million euros
figure used. Meta’s argument that there is no “evidence in this Inquiry that Meta Ireland gained financial benefits
or avoided losses” has been taken into consideration above.
732
Draft Decision, paragraphs 9.48 - 9.51.
733
Draft Decision, paragraphs 9.3 - 9.44.
734
Draft Decision, paragraphs 9.6 - 9.8.
735
Draft Decision, paragraphs 9.9 - 9.10.
736
Draft Decision, paragraphs 9.15 - 9.17.
737
Draft Decision, paragraph 9.14.
738
Draft Decision, paragraphs 9.22 - 9.27.
739
The IE SA finds it sufficiently shown that “rights have been damaged in a significant manner, given the lack of
an opportunity to exercise data subject rights while being fully informed”, Draft Decision, paragraphs 9.22 - 9.21.
740
Draft Decision, paragraph 9.30 and 9.45.
741
Composite Response, paragraph 115. See Meta IE Article 65 Submissions, p. 131.
742
Meta IE states that “even if Meta Ireland or other companies could ever consider that multi-million fines are
negligible from a financial point of view (a statement that is unsubstantiated and disputed), such companies
would obviously be concerned by the reputational cost of such fines.” Meta IE Article 65 Submissions, p. 131.
743
Meta IE Article 65 Submissions, paragraph 6.18.
744
NO SA Objection, p. 5. In the same vein, the FR SA argues Meta IE is a quasi-monopolist. See FR SA Objection,
p. 40.
745
FR SA objection, paragraph 44. The IE SA’s decision in this case (case IN-18-12-2) is under appeal before the
Irish courts.
Adopted 95
decided by the LU SA in its decision of 15 July 2021 against the company Amazon Europe Core for
carrying out behavioural advertising without a valid legal basis and for transparency infringements
(Articles 6, 12 and 13 GDPR)746. While the EDPB agrees with both the IE SA and Meta IE that imposing
fines requires a case-by-case assessment under Article 83 GDPR747, the EDPB notes that the cases cited
by the FR SA do show marked similarities with the current case, as they both refer to large internet
platforms run by data controllers with multi-national operations and significant resources available to
them, including large, in-house, compliance teams. Moreover, there are similarities with regard to the
infringements involved. Thus, these cases can give an indication on the matter.
390. The DE SAs calculate that the envisaged upper limit of the fine range is about 0.05 % of the global
annual turnover748, which it notes is 80 times lower than the maximum ceiling provided for in
Article 83(5) GDPR. For illustrative purposes, the DE SAs add that this upper limit would amount to a
fine of EUR per person (on the basis of data subjects affected according to
749
paragraph 9.15 of the Draft Decision) . Also illustrative is the amount of time, on average, it took
Meta IE to generate 36 million euros in turnover in 2020, which was about 4 hours and 30 minutes750.
391. The EDPB agrees with the objections raised that - if the proposed fine was to be imposed for the
transparency infringements - there would be no sufficient special preventive effect towards the
controller, nor a credible general preventive effect751. The proposed fine amount, even where a final
amount at the upper limit of the range would be chosen, is not effective, proportionate and dissuasive,
in the sense that this amount can simply be absorbed by the undertaking as an acceptable cost of
doing business752. As behavioural advertising is at the core of Meta IE’s business model753, the risk of
this occurring is all the greater754. By bearing the cost the administrative fine, the undertaking can
avoid bearing the cost of adjusting their business model to one that is compliant as well as any future
losses that would follow from the adjustment755.
392. Though the IE SA touches upon the notions of effectiveness, proportionality and dissuasiveness in
relation to the proposed fine756, there is no justification based on elements specific to the case to
explain the modest fine range chosen. Moreover, the EDPB notes that while the IE SA takes into
consideration the turnover of the undertaking to ensure that the fine it proposed does not exceed the
maximum amount of the fine provided for in Article 83(5) GDPR757, the Draft Decision does not
articulate how and to what extent the turnover of this undertaking is considered to ascertain that the
746
FR SA objection, paragraph 45.
747
Draft Decision, paragraph 9.12-9.13.
748
DE SAs objection, p. 13. The DE SAs explain that that they have converted dollar amounts into euro using the
ECB euro reference exchange rate of USD 1.2271 per EUR 1 per 31st December 2020.
749
DE SAs objection, p. 13. Meta IE protests that this “‘per affected data subject’ logic has no basis in the GDPR
(nor is it an element that is present in the Draft Decision)”, see Meta IE Article 65 Submissions, paragraph 10.2.
The EDPB notes that no basis in law is needed for the DE SA to illustrate their argument in this way.
750
Based on the total annual turnover of 2020 being EUR 70,055 billion, this is on average EUR 7 975 295,99
turnover generated per hour. Thus, a fine of EUR 36 million would have taken 4h30m50s to generate. The NL SA
provides an estimate of ‘daily revenue’, see NL SA Objection, paragraph 48.
751
DE SAs objection, p. 12-13 and 15-16. NO SA Objection, p. 8-11. FR SA Objection, paragraph 50.
752
NO SA Objection, p. 10.
753
Draft Decsion, paragraph 4.41 and 4.44. DE SAs objection, p. 5. NO SA Objection, p. 6. PL SA Objection, p. 4.
754
NO SA Objection, p. 10.
755
PL SA Objection, p. 5.
756
Draft Decision, paragraphs 9.48 - 9.51.
757
Draft Decision, paragraph 10.41.
Adopted 96
administrative fine meets the requirement of effectiveness, proportionality and dissuasiveness758. In
this regard the EDPB recalls that the turnover of the undertaking concerned is not exclusively relevant
for the determination of the maximum fine amount in accordance with Article 83(4)-(6) GDPR, but
should also be considered for the calculation of the fine itself, where appropriate, to ensure the fine
is effective, proportionate and dissuasive in accordance with Article 83(1) GDPR759. The EDPB
therefore instructs the IE SA to elaborate on the manner in which the turnover of the undertaking
concerned is considered for the calculation of the fine.
393. While a single mitigating factor identified by the IE SA is mentioned760, there is no indication the weight
that has been attributed to this factor in the context of the Article 83(2) assessment. As indicated
above (see paragraph 366), the EDPB finds the Draft Decision does not sufficiently justify this
mitigating factor, hence it should not be considered an aggravating or mitigating factor.
394. In light of the above, the EDPB considers that the proposed fine does not adequately reflect the
seriousness and severity of the infringements nor has a dissuasive effect on Meta IE. Therefore, the
fine does not fulfil the requirement of being effective, proportionate and dissuasive in accordance
with Article 83(1) and (2) GDPR. In light of this, the EDPB directs the IE SA to set out a significantly
higher fine amount for the transparency infringements identified, in comparison with the upper limit
for the administrative fine envisaged in the Draft Decision. In doing so, the IE SA must remain in line
with the criteria of effectiveness, proportionality, and dissuasiveness enshrined in Article 83(1) GDPR
in its overall reassessment of the amount of the administrative fine.
9.2 On the determination of an administrative fine for further infringements
9.2.1 Analysis by the LSA in the Draft Decision
395. The IE SA in the Draft Decision concludes that Meta IE has not sought to rely on consent in order to
process personal data to deliver its service as outlined in the Facebook Terms of Service and it is not
legally obliged to rely on consent in order to do so (Finding 1)761. Alongside, the IE SA concludes that
Meta IE can rely on Article 6(1)(b) GDPR as a legal basis to carry out the personal data processing
activities involved in the provision of its service to users, including behavioural advertising insofar as
that forms a core part of the service (Finding 2)762. In these terms, the IE SA did not propose to
establish an infringement of Article 6(1) GDPR.
396. In addition, no infringement of Article 9(1) GDPR has been found as the IE SA has not identified and
separately assessed any processing of special categories of personal data by Meta IE in the context of
the Facebook Terms of Service.
397. The IE SA in its Draft Decision concludes that Meta IE has infringed Article 5(1)(a), Article 13(1)(c) and
Article 12(1) GDPR due to the lack of transparency in relation to the processing for which
Article 6(1)(b) GDPR has been relied on (Finding 3)763.
758
EDPB Guidelines on calculation of fines, paragraph 120.
759
Binding Decision 01/2021, paragraphs 405-412.
760
Draft Decision, paragraphs 9.30 and 9.45.
761
Draft Decision, p. 23.
762
Draft Decision, paragraph 4.52 and 4.55 and p. 39.
763
Draft Decision, p. 67.
Adopted 97
9.2.2 Summary of the objections raised by the CSAs
398. The AT, DE, FR, IT, NO, PL and SE SAs764 object to the LSA’s failure to take action with respect to one
or more specific infringements they deem should have been found and ask the IE SA to impose a
higher administrative fine as a result of these additional infringements.
Objections requesting the imposition of a fine for the additional infringement of Article 6(1) GDPR or
Article 6(1)(b) GDPR
399. The DE, FR and PL SAs ask for the administrative fine to be increased 765 as a consequence of the
proposed finding of infringement of Article 6(1) GDPR766. The AT, NO and SE SAs argue that the fine
should be increased following the proposed finding of an infringement of Article 6(1)(b) GDPR767.
400. The DE SAs state that the fact that Article 6(1) GDPR was infringed is not properly reflected in the
calculation of the fine in the Draft Decision768. The DE SAs list a variety of arguments concerning the
criteria provided for in Article 83(2) GDPR concerning the infringement of Article 6(1)(b) GDPR769.
Specifically, the DE SA argues that several factors are to be considered as aggravating, namely: the
gravity and duration of the infringement770, taking into account it regards “personal data of about
data subjects were affected over a period of at least three years”771 (Article 83(2)(a) GDPR),
the categories of personal data affected by the infringement (Article 83(2)(g) GDPR)772, the manner in
which the infringement became known (Article 83(2)(h) GDPR)773, and other factors, namely financial
benefits gained from the infringement as well as profitability and turnover (Article 83(2)(k) GDPR)774.
The DE SA also highlights that the fine imposed needs to aim to prevent further infringements of the
GDPR; first, it should be “special preventive” meaning that the amount imposed needs to be such that
“it is not to be expected that the specific controller will commit similar infringements again” by having
“such a noticeable impact on the profits of the undertaking that future infringements of data
protection law would not be ‘discounted’ into the processing performed by the undertaking lightly”;
second, it should be “general preventive” by leading other controllers to “make a significant effort to
avoid similar violations”775.
401. The FR SA considers that some violations are wrongly not included in the Draft Decision776 and argues
that “since it considers that breaches of Articles 6 and 9 of the GDPR have been committed, which are
added to the other breaches found by the Irish data protection authority, the amount proposed by the
764
AT SA Objection, pp. 11-12; DE SAs Objection, pp. 16-21; FR SA Objection, pp. 9-10; IT SA Objection, paragraph
2.7 ; NO SA Objection, pp. 7-8; PL SA Objection, p. 4 ; SE SA Objection, pp. 4-5.
765
FR SA Objection, paragraph 46; DE SAs Objection, p.17, PL SA Objection, p. 4.
766
DE SAs Objection, pp. 1-6 and pp.9-10; FR SA Objection, paragraphs 5-14, 33 and 52; PL SA Objection, pp. 1-
2.
767
AT SA Objection, pp. 11-12 ; NO SA Objection, pp. 7-8 ; SE SA Objection, pp. 4-5.
In addition, also the IT SA (IT SA Objection, paragraph 2.7) argued that an administrative fine should be imposed
for the infringement of Art. 6(1)(b) GDPR; however, this aspect of the objection raised by the IT SA was deemed
to be not relevant and reasoned by the EDPB in paragraph 82 above.
768
DE SAs Objection, p. 17.
769
DE SAs Objection, pp. 18-19.
770
DE SAs Objection, p. 18.
771
DE SAs Objection, p. 17.
772
DE SAs Objection, p. 18.
773
DE SAs Objection, p. 19.
774
DE SAs Objection, p. 19.
775
DE SAs Objection, p. 20.
776
FR SA Objection, paragraph 53.
Adopted 98
latter should be increased accordingly”777. The FR SA recalls that the same approach of cumulating the
amounts of the fine has been adopted by the EDPB in points 324 to 327 of its Binding Decision
01/2021778.
402. The PL SA believes that the proposed amount of the administrative fine is too low, also because the
PL SA proposed the establishment of the additional infringement of Article 6(1) GDPR, which means
“the administrative fine should be significantly increased by the LSA”779.
403. On risks posed by the Draft Decision, the DE SAs explain that without an effective, proportionate and
dissuasive fine, the Draft Decision would lack any deterrent effect with regard to Meta IE in such a
way that it would see a need to substantially change its practices 780. Moreover, the DE SAs raise that
it would induce controllers to consider - from an economical point of a view - that non-compliance
with the GDPR could be a reasonable option 781 and this would lead to a significant risk for the
protection of the fundamental rights and freedoms of the data subjects 782. The DE SAs argue that an
administrative fine is, in the present case, essential in order to achieve a deterrent effect (either
specifically towards the controller, or in general towards other controllers)783. The DE SAs add that not
imposing a fine would have the opposite effect on controllers in general784. The FR SA considers that
adopting the IE SA's Draft Decision as it stands “presents a risk to the fundamental rights and freedoms
of the data subjects, in accordance with Article 4(24) of the GDPR”785 and “would lead to a levelling
down of the level of administrative fines imposed by European data protection authorities, thereby
reducing the authorities' coercive power and, consequently, their ability to ensure effective compliance
with the protection of the personal data of European residents”786. The PL SA highlights that “the
unchanged draft decision entails a risk for the fundamental rights and freedoms of data subjects, and
in particular the risk of violation of Art. 8 of the Charter of Fundamental Rights”, and that “the failure
to apply a proportionate, dissuasive and effective remedy may prevent the controller from being
discouraged from committing further breaches”787.
***
404. The AT, NO and SE SAs, considering that the IE SA should have found an infringement of
Article 6(1)(b) GDPR788, ask for the administrative fine to be increased as a consequence of that
infringement.
405. The AT SA argues that “the additional infringement [of Article 6(1)(b) GDPR] must be properly reflected
in the envisaged amount of the administrative fine” and that the IE SA’s Draft Decision is not in
777
FR SA Objection, paragraph 46.
778
FR SA Objection, paragraph 46.
779
PL SA Objection, p. 4.
780
DE SAs Objection, p. 20.
781
DE SAs Objection, p. 20.
782
DE SAs Objection, pp. 17 and 20
783
DE SAs Objection, pp. 17 and 20.
784
DE SAs Objection, p. 17.
785
FR SA Objection, paragraph 50.
786
FR SA Objection, paragraph 51.
787
PL SA Objection, p. 5.
788
AT SA Objection, pp. 1-7; IT SA Objection, pp 1-7; NL SA Objection, paragraphs 4, 25-36; NO SA Objection,
pp.1-2 and 7; PT SA Objection, paragraphs 65-68; SE SA Objection, pp. 2-3.
Adopted 99
compliance with Article 83 GDPR insofar as it does not consider the additional infringement of
Article 6(1)(b) GDPR when calculating the amount of the administrative fine789.
406. The NO SA states that an administrative fine should be imposed for Meta IE’s processing of personal
data in the context of online behavioural advertising without a valid legal basis790. The NO SA analyses
several of the criteria listed in Article 83(2) GDPR in order to prove the need of the imposition of an
administrative fine791. Specifically, the NO SA argues that an administrative fine of a substantial
amount is needed, in light of the nature and gravity of the infringement (given that “the principle of
lawfulness [...] is a fundamental pillar of the GDPR” and “processing personal data without a legal
basis is a clear violation of the data subjects’ fundamental right to data protection because no one
should have to tolerate processing of their personal data save for when it is legitimised by the
legislators”792), as well as the scope of the processing (“wide”, as it took place “on and off the Facebook
platform”), the number of data subjects affected in the EEA (“hundreds of millions”) and the intangible
damage suffered by them (Article 83(2)(a) GDPR), the high level of responsibility of Meta IE
(Article 83(2)(d) GDPR), the categories of personal data involved (“of a very personal and private
nature”, able to “reveal intimate details of the data subjects’ lifestyle, mindset, preferences,
psychological wellbeing et cetera”) (Article 83(2)(g) GDPR) and an additional aggravating factor (high
likelihood of contribution to development of harmful algorithms, Article 83(2)(k) GDPR)793.
407. The SE SA argues that “the Draft Decision is not in compliance with Article 83 insofar as the additional
infringement of Article 6(1)(b) is not considered in calculating the administrative fine” and that “[an]
administrative fine pursuant to Article 83 GDPR cannot be regarded as ‘effective, proportionate and
dissuasive’ when the provision that the processing is based on, namely Article 6(1)(b) GDPR, was
infringed and when this infringement is not properly reflected in the envisaged amount of the
administrative fine”794. The SE SA takes the view that that the intentional character of the infringement
(Article 83(2)(b) GDPR) and the financial benefits gained from the infringement (Article 83(2)(k) GDPR)
must be found as aggravating factors795. As to intentionality, the SE SA argues that the switch from
consent to Article 6(1)(b) in 2018 suggests this act was done with the intention of circumventing the
new rights afforded to users by the GDPR when the processing relies upon consent, and that in any
way the infringement needs to be considered as intentional at least as of the moment of adoption of
the EDPB Guidelines on Article 6(1)(b) GDPR which “clearly gives doubt to the legality of the
processing”796. As to the financial benefits gained, the SE SA argues “[Meta IE] has made significant
financial gain from being able to provide personal advertising as part of a whole take it or leave it offer
for its social media platform service” and that due to the unclear information provided to data subjects
it can be reasonably assumed that more data subjects have been misled into being subject to the
processing797. Furthermore, the SE SA considers that Meta IE’s dominant market position (“[It] is the
provider of the largest social media network in the world”) and its “methods for collective and
processing personal data relating to personalised advertising and profiling” (which are “vast,
789
AT SA Objection, p. 11.
790
NO SA Objection, p. 8.
791
NO SA Objection, p. 8-9.
792
The NO SA also highlights that “[behavioural advertising] entails profiling, which inherently constitutes risks
for the data subjects’ integrity”.
793
NO SA Objection, p. 8-9.
794
SE SA Objection, p. 4.
795
SE SA Objection, p. 4.
796
SE SA Objection, p. 4.
797
SE SA Objection, p. 4.
Adopted 100
aggressive and inadequate with regard to the fulfillment of data subjects’ rights”) should be properly
taken into account798. Lastly, the SE SA considers it would be appropriate to take into account Meta
IE’s turnover for the calculation of the fine in order to make it effective and dissuasive799.
408. On risks posed by the Draft Decision, the AT SA argues that “[should] the Draft Decision be approved
in its current version, the risks for the fundamental rights and freedoms of data subjects lie in the fact
that the action envisaged in relation to the controller is likely to fall short of the proportionality and –
above all – dissuasiveness requirements set forth in Article 83 GDPR” and that “ignoring infringements
of the GDPR when calculating fines would lead to lesser compliance with the GDPR and ultimately to
lesser protection of data subjects in relation to the processing of personal data”800. The NO SA explains
that not imposing a fine for the lack of legal basis creates that risk that the violated provisions are not
respected by Meta IE or other controllers and the LSA would not be able to effectively safeguard the
data subjects’ rights, and that “In absence of corrective measures that create the appropriate
incentives for [Meta IE] and other controllers to change their behaviour, the same or similar violations
are likely to reoccur to the detriment of the complainant and other data subjects” and argues that
controllers will be induced to consider administrative fines as expected expenditure items in their
budgets as the financial advantage gained through the violation would surpass the estimated value of
an expected fine801. The SE SA argues the infringement of Article 6(1)(b) GDPR “is not properly
reflected in the envisaged amount of the administrative fine, it shows controllers (Facebook included)
that enforcement of the GDPR and its provisions is not effective. This threatens compliance with the
GDPR on a general level, seeing as how non-compliance could be a viable option for controllers when
the costs for compliance are greater. Given the proposed changed findings regarding legal basis, there
are significant risks to the fundamental rights of data subjects if these does not also merits a
substantive increase in fines to dissuade Facebook and other controllers”802.
Objections requesting the imposition of a fine for the additional infringement of Article 9 GDPR
409. As stated in Section 5.2, paragraph 141, the DE and FR SAs, considering that the IE SA should have
identified and separately assessed any processing of special categories of personal data under
Article 9 GDPR in the context of the Facebook Terms of Service803 and that Meta IE processes the entire
amount of data it holds, including special categories of data, in breach of Articles 6 and 9 GDPR804,
argue that the amount of the fine should be increased accordingly.
410. The DE SA states that “the infringement of Articles 5(1)(a), 6(1) and 9(1) GDPR [...] also entails an
administrative measure and a fine according to Art. 83(2)(5) GDPR”805, and argues that these
infringements are ‘serious’”806. The FR SA considers that the breaches of Articles 6 and 9 GDPR are
wrongly not included in the Draft Decision 807 and that the amount of the fine proposed by the LSA
798
SE SA Objection, p. 4.
799
SE SA Objection, p. 4.
800
AT SA Objection, p. 11.
801
NO SA Objection, p. 10.
802
SE SA Objection, p. 5.
803
AT SA Objection, pp.8-10; DE SAs Objection, pp.6-7; FR SA Objection, paragraph 30; NL SA Objection,
paragraphs 10 and 33 ; PT SA Objection, paragraphs 45-47 ; SE SA Objection, pp.1 and 3.
804
DE SAs Objection, p.8 ; FR SA Objection, paragraph 33.
805
DE SAs Objection, p. 16.
806
DE SAs Objection, p. 17.
807
FR SA Objection, paragraph 53.
Adopted 101
should be increased in light of the addition of such infringements to those already established808. The
FR SA recalls that the same approach of cumulating the amounts of the fine has been adopted by the
EDPB in points 324 to 327 of Binding Decision 01/2021809.
411. On risks posed by the Draft Decision, the DE SA explains that without an effective, proportionate and
dissuasive fine, the Draft Decision would lack any deterrent effect with regard to Meta IE in such a
way that it would see a need to substantially change its practices 810. Moreover, the DE SA raises that
it would induce controllers to consider - from an economical point of a view - that non-compliance
with the GDPR could be a reasonable option 811 and this would lead to a significant risk for the
protection of the fundamental rights and freedoms of the data subjects 812. The DE SA argues that an
administrative fine is, in the present case, essential in order to achieve a deterrent effect (either
specifically towards the controller, or in general towards other controllers)813. The DE SA adds that not
imposing a fine would have the opposite effect on controllers in general814. The FR SA considers that
adopting the IE SA's Draft Decision as it stands “presents a risk to the fundamental rights and freedoms
of the data subjects, in accordance with Article 4(24) of the GDPR”815 and “would lead to a levelling
down of the level of administrative fines imposed by European data protection authorities, thereby
reducing the authorities' coercive power and, consequently, their ability to ensure effective compliance
with the protection of the personal data of European residents”816.
Objections requesting the imposition of a fine for the additional infringement of Article 5(1)(a) and
5(1)(b)-(c) GDPR
412. The IT SA817 argues that the fine should be increased following the finding of an infringement of
Article 5(1)(a) GDPR, and of Article 5(1)(b) and (c) GDPR818. As stated in Section 6.2, the IT SA agrees
to a large extent with the Draft Decision’s Finding 3 on the infringement of Article 12(1),
Article 13(1)(c), and Article 5(1)(a) GDPR in terms of transparency819 but it argues that Meta IE has also
failed to comply with the more general principle of fairness under Article 5(1)(a) GDPR, which, in the
view of the IT SA, entails separate requirements from those relating specifically to transparency 820.
Moreover, as analysed in Section 7.2, the IT SA states that there is an additional infringement of points
(b) and (c) of Article 5(1) GDPR on account of Meta IE’s failure to comply with the purpose limitation
and data minimisation principles821. The IT SA asks for a fine to be issued for those two additional
infringements. With regard to Article 5(1)(a) GDPR the IT SA argues that the finding of such
infringement “should result into the imposition of the relevant administrative fine as per
Article 83(5)(a) GDPR” as far as “the infringement of the fairness principle in addition to the
transparency one [...] should result into increasing the amount of the said fine substantially by having
808
FR SA Objection, paragraph 53.
809
FR SA Objection, paragraph 46.
810
DE SAs Objecion, p. 20.
811
DE SAs Objection, p. 20.
812
DE SAs Objection, pp. 17 and 20
813
DE SAs Objection, pp. 17 and 20.
814
DE SAs Objection, p. 17.
815
FR SA Objection, paragraph 50.
816
FR SA Objection, paragraph 51.
817
IT SA Objection, paragraph 2.7 on p 6-7, paragraph 2.4 on p. 10;
818
IT SA Objection, paragraph 2.7 on p 6-7, paragraph 2 on p. 9. paragraph 3 on p. 11.
819
IT SA Objection, paragraph 1 on p.9.
820
IT SA Objection, paragraph 2.4 on p. 10.
821
IT SA Objection, paragraph 2 on p. 9.
Adopted 102
regard to the requirement that each fine should be proportionate and dissuasive. Indeed, the gravity
of the infringement would be factually compounded”822. With reference to Article 5(1)(b) and
(c) GDPR, the IT SA considers that “the infringement of purpose limitation and data minimisation
principles [...] should result into increasing the amount of the said fine substantially by having regard
to the requirement that each fine should be proportionate and dissuasive. Indeed, the gravity of the
infringement would be factually compounded”823.
413. On the significance of risks posed by the Draft Decision, the IT SA argues that “the failure to find an
infringement of Article 5(1)(a) GDPR as for the fairness principle may become a dangerous precedent
with a view to future decisions concerning other digital platform operators – more generally, other
controllers that rely on the same business model – and markedly weaken the safeguards to be provided
by way of the effective, comprehensive implementation of the data protection framework including
the fairness of processing principle”824 and, with reference to Article 5(1)(b) and (c) GDPR, should the
Draft Decision approved as its current version the infringement of two key principles of the whole data
protection framework as introduced by the GDPR will not punished, “which would seriously jeopardise
the safeguards the data subjects (Facebook users) are entitled to”825.
9.2.3 Position of the LSA on the objections
414. The LSA considers none of the objections requesting the imposition of a fine for the proposed
additional infringements as meeting the threshold set by Article 4(24) GDPR of being relevant and
reasoned826. Given that these objections were premised upon the requirement for the Draft Decision
to include findings of infringement of Article 6(1)(b), Article 9, Article 5(1)(a), Article 5(1)(b) and
Article 5(1)(c) GDPR, on which the IE SA expressed its disagreement – the IE SA does not consider the
objections requesting exercise of a corrective power in response to these findings of infringement as
being relevant and reasoned827.
9.2.4 Analysis of the EDPB
9.2.4.1 Assessment of whether the objections were relevant and reasoned
415. The objections raised by the AT, DE, FR, IT, NO, PL, SE SAs concern “whether the action envisaged in
the Draft Decision complies with the GDPR”828.
416. The EDPB takes note of Meta IE’s view that not a single objection put forward by the CSAs meets the
threshold of Article 4(24) GDPR829. In addition to the primary argument levelled against all CSA’s
objections830, Meta IE rejects the objections in this section based on its view that the LSA has sole
discretion to determine corrective measures831. The EDPB responds to these arguments above (see
822
IT SA Objection, paragtraph 3 on p. 11.
823
IT SA Objection, paragraph 2 on p. 9.
824
IT SA Objection, paragraph 3 on p. 12.
825
IT SA Objection, paragraph 2 on p. 9.
826
Composite Response, paragraph 103.
827
Composite Response, paragraphs 30, 41 and 103.
828
EDPB Guidelines on RRO, paragraph 32.
829
Meta IE Article 65 Submissions, Annex 1, p. 70.
830
Meta IE argues that “Objections which raise matters which are not within the Defined Scope of Inquiry are not
‘relevant and reasoned’ within the meaning of Article 4(24) GDPR” and such objections “ought to be disregarded
in their entirety by the EDPB”. The EDPB does not share this understanding, as explained above. See paragraphs
71 - 73.
831
See Binding Decision 2/2022, paragraph 74.
Adopted 103
Section 8.4.2, paragraphs 275 - 277 as well as footnote 634) and is of the view that CSAs may ask for
specific corrective measures to be taken by the LSA, whether this concerns infringements already
identified in the Draft Decision or identified by the CSA in an objection raised 832. Meta IE refutes the
allegations of additional infringements put forward in the objections, and by consequence any
demands for further corrective measures833. The EDPB recalls that the assessment of admissibility of
objections and the assessment of the merits are two distinct steps 834.
417. The EDPB finds that the objections concerning the increase of the administrative fine in connection
with the additional infringement of Article 6(1)/6(1)(b) GDPR and/or Article 9 GDPR raised by the AT,
DE, FR, NO, PL and SE SAs stand in direct connection with the substance of the Draft Decision, as they
concern the imposition of a corrective measure for an additional infringement, which would be found
as a consequence of reversing the conclusions in the Draft Decision also in scope of this dispute 835.
Clearly, the decision on the merits of the demands to take corrective measures for a proposed
additional infringement is affected by the EDPB’s decision on whether to reverse the findings in the
Draft Decision and whether to instruct the LSA to establish additional infringements.
418. The EDPB takes note of further arguments put forward by Meta IE aiming to demonstrate lack of
relevance of these objections, specifically with regard to the objections raised by the AT 836 and DE837
SAs. However, the EDPB notes that Meta IE disagrees with the content of these objections, which
832
EDPB Guidelines on RRO, paragraph 34. See also recital 150 GDPR. The EDPB found several objections on this
subject matter admissible in the past, see Binding Decision 2/2022, paragraphs 186-190.
833
See Meta IE Article 65 Submissions,paragraph 8.2. Meta IE refutes the AT SA’s allegation of infringement of
Art. 6(1) GDPR as inadmissible and without merit, and argues by consequence that AT SA’s demand for an
“amendment of the administrative fine to reflect such Article 6(1)(b) GDPR infringement has no direct connection
with the Draft Decision”. See Meta IE Article 65 Submissions, Annex 1, p. 79-80. Meta IE refutes the allegation
of infringement of Art. 5(1), 6(1) and 9(1) GDPR, considering that aspect of the DE SA’s objection inadmissible
and without merit, and by consequence also their demand for an additional fine. See Meta IE Article 65
Submissions, p. 132.
834
EDPB Guidelines on Article 65(1)(a), paragraph 63.
835
AT SA Objection, p. 11-12; DE SAs Objection, p. 16-17; FR SA Objection, paragraph 46; NO SA Objection, p. 8-
11; SE SA Objection, p. 4.
The EDPB also recalls that the aspect of the IT SA objection concerning the imposition of an administrative fine
for the infringement of Art. 6(1)(b) GDPR has already been deemed to not meet the threshold set by Art. 4(24)
GDPR above in paragraph 82.
836
Meta IE takes issue with additional reasoning provided by the AT SA under the heading ‘relevance’ of their
objection. The AT SA states “In addition, it must be taken into account that Facebook is the provider of the biggest
social media network in the world. Not properly reflecting such an infringement in the envisaged amount of the
administrative fine weakens the position of supervisory authorities and endangers compliance with the GDPR on
a general level. Specifically, it shows controllers (including Facebook) that enforcement of the GDPR and its
provisions is not as effective. Ultimately, lesser compliance with the GDPR results in lesser protection of data
subjects in relation to the processing of personal data.” See AT SA Objection, p. 11. Meta IE responds “While the
Austrian SA has very briefly attempted to link this objection generally to requirements of Article 83(1) GDPR, it
has not done so concretely, and this speculative and high level commentary cannot be considered sufficiently
relevant.” Meta IE Article 65 Submissions, p. 80. The EDPB does not rely on this additional reasoning from the
AT SA in order to assess whether the objection is relevant, as the aspect raised pertains to the significance of
the risks posed by the Draft Decision to the fundamental rights and freedoms of data subjects.
837
Meta IE takes issue with the DE SA challenging “the elements relied upon to calculate the amount of the fine”
stating - since no fine was imposed for any such infringements - “there are no ‘elements relied upon’ for the
calculation of the ‘fine’ to be challenged”. See Meta IE Article 65 Submissions, p. 132.
Adopted 104
concerns its merits and not its admissibility. The EDPB also notes Meta IE’s arguments pertaining to
the objection raised by the PL SA in this context 838.
419. These objections set out how, if followed, they would lead to a different conclusion in terms of
corrective measures imposed839. In consequence, the EDPB considers the objections raised by the AT,
DE, FR, PL, NO and SE SAs in connection to imposing an administrative fine for the alleged breach of
Article 6/6(1)(b) GDPR and/or Article 9 GDPR to be relevant.
420. Meta IE argues that the AT, DE, FR, NO, PL and SE SAs objections lack sufficient reasoning because
introduce ‘additional’ criteria for the determination of the fine that have no basis in Article 83 GDPR840.
Where the SE SA does refer to criteria from Article 83(2) GDPR, Meta IE alleges is “speculative with
respect to the alleged facts on which it is premised”841. On the matter of profiling raised by the NO SA,
Meta IE dismisses the concern as unsound as the NO SA “does not explain on which legal basis it
concludes that the advertising in question entails profiling”842. Meta IE alleges the DE SAs’ objection is
unsubstantiated, by referring back to the fact that no infringement of Article 6(1)(b) GDPR was found
by the IE SA843 and thus “there are no ‘elements relied upon’ for the calculation of the ‘fine’ to be
challenged”844. In contradiction to this, Meta IE argues the PL SA’s objection is not reasoned, as it does
not name “any parameters that would have been misapplied” by the IE SA845. The EDPB understands
that Meta IE disagrees with the reasoning provided in the objections, which thus concerns their merits
and not their admissibility of the objection.
421. Meta IE argues that the AT and FR SA’s objections do not explain how the change would lead to a
different conclusion in the Draft Decision846, thus not recognising a higher fine amount for the
infringements identified as constituting a different conclusion847. Meta IE further argues the AT SAs
and FR SAs reasoning is so brief that it is not possible to understand the legal arguments the AT or FR
SAs wish to put forward in relation to the calculation of the fine. Meta IE takes issue with the AT SA’s
objection’s argument that the Draft Decision is “not in compliance with Article 83 GDPR”, without also
838
Meta IE argues the the Polish SA’s objection in relation to administrative fines is irrelevant as it “does not
challenge the elements relied upon to calculate the amount of the fine, given that turnover is relevant only to
determining the maximum fine that can be lawfully imposed and not the fine amount.” See Meta IE Article 65
Submissions, p. 132. The EDPB notes this argument pertains to the PL SA’s disagreement with the fine the IE SA
proposed for the transparency infringements, and moreover recalls that whether turnover should be considered
in the determination of the fine is out of scope of this dispute.
839
AT SA Objection, p. 11-12; DE SAs Objection, p. 16 and p. 20-21; FR SA Objection, paragraph 48; NO SA
Objection, p. 8 and 11; SE SA Objection, p. 4.
840
Meta IE Article 65 Submissions, p. 80 (AT SA), p. 85-86 (SE SA), p. 92 (NO SA), p. 106 (PL SA), p. 110-111 (FR
SA), p. 129 (DE SAs).
841
Meta IE Article 65 Submissions, p. 86.
842
Meta IE Article 65 Submissions, p. 92.
843
Meta IE submits that “reasoning is unclear, given the fact that the DPC did not impose a fine because it found
it would be inappropriate to find Meta Ireland infringed Article 6(1)(a) GDPR for processing data purposes of
providing behavioural advertising”. See Meta IE Article 65 Submissions, p. 133. The EDPB responds to this
argument above, see paragraph 417 above.
844
Meta IE Article 65 Submissions, p. 132.
845
Meta IE argues the PL SAs objection in relation to administrative fines “is vague regarding the criteria for
calculation of the fine proposed for the alleged additional infringement of Article 6(1) GDPR. It only concludes
that the fine should be significantly increased, without naming any parameters that would have been misapplied
by the DPC” Meta IE Article 65 Submissions, p 106.
846
Meta IE Article 65 Submissions, p. 80 (AT SA) and p. 110 (FR SA).
847
AT SA Objection, p. 11; FR SA Objection, paragraph 48.
Adopted 105
specifying “a certain paragraph or criterion that would risk being infringed by the Draft Decision”848.
The EDPB recalls that the criteria listed in Article 83(2) GDPR are not exhaustive, thus it is entirely
possible to argue an administrative fine is not “effective, proportionate and dissuasive” in the meaning
of Article 83(1) GDPR without referring to a specific criterion listed in Article 83(2) GDPR. In addition,
as the objection raised by the AT SA refers to taking into account in the calculation of the final amount
of the fine the finding of an additional infringement of Article 6(1)(b) GDPR and puts forward several
arguments showing that not doing so would lead to a fine which is not effective, proportionate and
dissuasive849.
422. Similarly, Meta IE argues the FR SA “does not substantiate how a fine for the additional purported
infringements would be calculated, whether this fine would need to be added to the proposed fine and
how this would affect the overall fine”850. First, CSAs are not required to engage in a full assessment
of all the aspects of Article 83 GDPR in order for an objection on the appropriate administrative fine
to be considered reasoned. It is sufficient to lay out which aspect of the Draft Decision that, in their
view, is deficient/erroneous851. Second, the EDPB recalls that the criteria listed in Article 83(2) GDPR
are not exhaustive, thus it is entirely possible to argue an administrative fine is not “effective,
proportionate and dissuasive” in the meaning of Article 83(1) GDPR without referring to a specific
criterion listed in Article 83(2) GDPR. The AT and FR SA’s position is that a fine amount that does not
reflect the lack of legal basis for the processing cannot possibly be “effective, proportionate and
dissuasive”852. The EDPB understands that Meta IE disagrees with the contents of the objections,
which concerns its merits and not its admissibility.
423. The EDPB finds that the AT, DE, FR, NO and SE SAs adequately argue why they propose amending the
Draft Decision and how this leads to a different conclusion in terms of administrative fine imposed853.
424. The EDPB considers that the PL SA’s reference to the increase of the administrative fine in connection
to the establishment of the infringement of Article 6(1) GDPR854 as not being sufficiently detailed and
articulated to be considered as ‘reasoned’ for the purposes of meeting the requirements set by
Article 4(24) GDPR, in the absence of legal or factual arguments that would justify including this
specific corrective measure in the Draft Decision for this proposed additional infringement855.
Therefore, the EDPB does not consider this aspect of the PL SA’s objection to be relevant and
848
Meta IE Article 65 Submissions, p. 80.
849
AT SA Objection, p. 11.
850
Meta IE Article 65 Submissions, p. 111-112.
851
EDPB Guidelines on RRO, paragraph 17.
852
AT SA Objection, p. 11-12 in conjunction with p. 7-8 (on the infringement of Art. 6(1)(b) GDPR and the
requirement to make use of corrective powers) and with FR SA Objection, paragraph 46, 48 and 53 in
conjunction with paragraph 33.
853
The AT and SE SAs argue the LSA should have found an infringement of Art. 6(1)(b) GDPR and should have
properly reflected this finding in the administrative fine, see AT SA Objection, p. 11-12 and SE SA Objection, p. 4.
The DE SA argues that a fine should have been included following a finding of infringement of Art. 5(1), 6(1)
and 9(1) GDPR to ensure an effective, proportionate and dissuasive fine is imposed taking into account the facts
of the case, see DE SAs Objection, p. 17-20. The FR SA argues the administrative fine should be increased to
reflect the breaches of Art. 6 and 9 GDPR, see FR SA Objection, paragraph 46 and 48. The NO SA argues that a
fine should have been included following a finding of infringement of Art. 6(1)(b) GDPR, see NO SA Objection,
p. 8-11.
854
PL SA Objection, p. 4.
855
Meta IE argues the PL SA’s objection is “vague regarding the criteria for calculation of the fine proposed for
the alleged additional infringement of Article 6(1) GDPR”. Meta IE Article 65 Submissions, p. 106.
Adopted 106
reasoned, without prejudice to the analysis of the admissibility of the other aspects of this objection
carried out above.
425. In terms of risks, Meta IE claims the Draft Decision does not pose any risk, let alone a significant risk
to fundamental rights and argues the objections of the AT856, DE857, FR858, NO859 and SE860 SAs fail to
demonstrate the contrary, as required.
426. Meta IE dismisses the concerns the FR, NO, and SE SAs articulate about the precedent the Draft
Decision sets in terms of use of corrective powers in terms of general deterrent. Meta IE claims a
significant risk should be demonstrated in the context of the case at hand, dismissing the FR SA’s
concerns about “reducing the authorities’ coercive power”861. In this context, Meta IE argues the NO
and SE SA’s objections rest on unsubstantiated potential future behaviour of controllers, which could
only be an indirect and remote risk862. The EDPB notes that any risk assessment addresses future
outcomes, which are to some degree uncertain. Contrary to Meta IE’s view863, the objections reflect
specifically on Meta IE’s future approach in the event the Draft Decision is adopted as it stands and go
beyond providing “generalised assertions regarding notional controllers knowingly breaching GDPR
for economic benefit”864.
427. Meta IE further considers the NO SA’s objection lacking because “not every infringement carries a
concrete, significant risk to fundamental rights and freedoms”865. In the same vein, Meta IE dismisses
the concerns put forward by the AT SA, because “not every disagreement on a provision of the GDPR
will necessarily pose a significant risk to fundamental rights and freedoms”866 The EDPB notes these
CSAs do not refer to “any infringement” or “any disagreement”, but specifically refer to a “lack of legal
basis” and the consequences thereof867.
856
Meta IE considers the AT SA’s objection merely speculative because it asserts “that there would be a ‘lesser
protection of data subjects’ without actually pointing towards a specific risk to fundamental rights or freedoms’s
arguments on risk”. Meta IE Article 65 Submissions, p. 80-81.
857
Meta IE essentially argues “no risks arise from the DPC’s in principle finding related to Article 6(1)(b) GDPR”.
Meta IE further dismisses the risk identified by the DE SA on the basis that “this risk is premised on the
misconception that the Draft Decision permits Meta Ireland and others to engage in processing without a lawful
basis, which is not correct as made clear from the Draft Decision”. Meta IE Article 65 Submissions, p. 133. The
EDPB fails to see wording by which the DE SA might have suggested it understands the Draft Decision as
permission or as a mandate for Meta Ireland to unlawfully process data.
858
Meta IE Article 65 Submissions, p. 112.
859
Meta IE argues the NO SA “states without any explanation that the risks would be ‘substantial’ and ‘serious’”.
See Meta IE Article 65 Submissions, p. 92-93.
860
Meta IE Article 65 Submissions, p. 86.
861
In response to the FR SA. See Meta IE Article 65 Submissions, p. 113.
862
Meta IE Article 65 Submissions, p. 86-87 (SE SA), p. 92 (NO SA). 134.160. Meta IE also reiterates its argument
that “the Draft Decision does not provide a mandate for future controllers to breach the GDPR” (Meta IE
Article 65 Submissions, p. 87), a line of reasoning the EDPB does not find in the SE SAs objection and in any case
concerns a different topic.
863
Meta IE Article 65 Submissions, p. 86-87 (SE SA).
864
Meta IE Article 65 Submissions, p. 86-87 (SE SA). See NO SA Objection, p. 10, SE SA Objection, p. 5, PL SA
Objection, p. 5.
865
Meta IE Article 65 Submissions, p. 92.
866
Meta IE Article 65 Submissions, p. 80-81.
867
AT SA Objection, p. 11. NO SA Objection, p. 10.
Adopted 107
428. The EDPB finds that the AT, DE, FR, NO, and SE SAs articulate an adverse effect on the rights and
freedoms of data subjects if the Draft Decision is left unchanged, by referring to a failure to guarantee
a high level of protection in the EU for the rights and interests of the individuals868.
429. Therefore, the EDPB considers the AT, DE, FR, NO, and SE SAs objections concerning the imposition of
a fine for the alleged additional infringements of Article 6/6(1)(b) GDPR and/or Article 9 GDPR to be
reasoned.
***
430. With respect to the objection raised by the IT SA concerning the imposition of an administrative fine
for the infringement of the fairness principle enshrined in Article 5(1)(a), the EDPB finds that it stands
in connection with the substance of the Draft Decision, as it concerns the imposition of a corrective
measure for an additional infringement, which would be found as a consequence of incorporating the
finding put forward by the objection. Clearly, the decision on the merits of the demand to take
corrective measures for a proposed additional infringement is affected by the EDPB’s decision on
whether to instruct the LSA to include an additional infringement.
431. If followed, the IT SA’s objection sets out how it would lead to a different conclusion in terms of
corrective measures imposed869. Taking note of Meta IE’s position870, the EDPB finds the objections
raised by the IT SA to be relevant.
432. Meta IE argues the IT SA’s objection is too brief to be considered sufficiently reasoned, adding that it
is not possible to identify the legal arguments the IT SA wishes to put forward in respect of the
fine871.The EDPB finds that the IT SA adequately argues why they propose amending the Draft Decision
and how this leads to a different conclusion in terms of administrative fine imposed872.
433. Meta IE argues the objection of the IT SA fails to demonstrate the risk posed by the Draft Decision, as
required873 and, in doing so, Meta IE dismisses the concerns articulated by the IT SA on the precedent
the Draft Decision sets874.
434. The EDPB finds that the IT SA articulates an adverse effect on the rights and freedoms of data subjects
if the Draft Decision is left unchanged, by referring to a failure to guarantee a high level of protection
in the EU for the rights and interests of the individuals875.
868
AT SA Objection, p. 11-12; DE SAs Objection, p. 17 and 20; FR SA Objection, paragraphs 50-51; NO SA
Objection, p. 10-11; SE SA Objection, p. 5. See also EDPB Guidelines on RRO, paragraph 37.
869
IT SA Objection, p.9-12.
870
Meta IE argues that the LSA has sole discretion to determine which corrective measures are appropriate, see
Meta IE Article 65 Submissions, p. 123. The EDPB responds to this argument above (Section 8.4.2, paragraphs
275 - 277 as well as footnote 634).
871
Meta IE Article 65 Submissions, p. 124.
872
The IT SA argues that the finding of such infringement “should result into the imposition of the relevant
administrative fine as per Article 83(5)(a) GDPR” as far as “the infringement of the fairness principle in addition
to the transparency one [...] should result into increasing the amount of the said fine substantially by having
regard to the requirement that each fine should be proportionate and dissuasive. Indeed, the gravity of the
infringement would be factually compounded”, see IT SA Objection, p. 11, paragraph 3.
873
Meta IE Article 65 Submissions, p. 125
874
Meta IE Article 65 Submissions, p. 125. On this, the EDPB has set out its position above (see paragraphs
345 - 346).
875
IT SA Objection, paragraph 3 on p. 12.
Adopted 108
435. Therefore, the EDPB considers the IT SA’s objection concerning the imposition of a fine for the
additional infringement of the principle of fairness enshrined in Article 5(1)(a) GDPR to be reasoned.
***
436. The EDPB recalls its analysis of whether the objection raised by the IT SA in respect of the proposed
additional infringements of Article 5(1)(b) and 5(1)(c) GDPR meets the threshold set by
Article 4(24) GDPR (see Section 7.4.1 above). In light of the conclusion that such objection is not
relevant and reasoned, the EDPB does not need to further examine this linked objection.
9.2.4.2 Assessment on the merits
437. In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning all the
matters that are the subject of the relevant and reasoned objections, in particular whether the
envisaged action in relation to the controller or processor complies with the GDPR.
438. The EDPB recalls that the consistency mechanism may also be used to promote a consistent
application of administrative fines876 and that the objective pursued by the corrective measure chosen
can be to re-establish compliance with the rules or to punish unlawful behaviour (or both)877. The
EDPB responds above to Meta IE’s position that the LSA has sole discretion to determine which
corrective measures are appropriate (see Section 8.4.2, paragraphs 275 - 277 as well as footnote 634).
9.2.4.2.1 Assessment of whether an administrative fine should be imposed for the infringement of
Article 6(1) GDPR
439. The EDPB recalls its conclusion in this Binding Decision on the infringement of Article 6(1) GDPR878 and
that the objections raised by the AT, DE, FR, NO and SE SAs found to be relevant and reasoned
requested the IE SA to exercise its power to impose an administrative fine879.
440. The EDPB takes note of Meta IE’s views that, even if an infringement is found, no additional fine is
warranted880. Meta IE argues that the “nature of the infringement cannot be regarded as serious in
circumstances where Meta Ireland has in good faith relied on a legal basis openly” and “users have
been on notice of such reliance and continued to use the Facebook Service without any harm or
detriment being suffered (and none identified by the CSAs or the DPC) over and above what is alleged
in respect of the transparency infringements”881
441. The EDPB concurs that the decision to impose an administrative fine needs to be taken on a case-by-
case basis in light of the circumstances and is not an automatic one 882. In the case at hand, however,
876
Recital 150 GDPR. EDPB Guidelines on RRO, paragraph 34; EDPB Guidelines on Administrative Fines, p. 7
(“When the relevant and reasoned objection raises the issue of the compliance of the corrective measure with
the GDPR, the decision of EDPB will also discuss how the principles of effectiveness, proportionality and
deterrence are observed in the administrative fine proposed in the draft decision of the competent supervisory
authority”). See also paragraph 351 above.
877
EDPB Guidelines on Administrative Fines, p. 6. See also paragraph 351 above.
878
Section 4.4.2 of this Binding Decision.
879
Paragraph 81 of this Binding Decision.
880
Meta IE Article 65 Submissions, paragraph 8.4.
881
Meta IE Article 65 Submissions, paragraph 8.4.
882
EDPB Guidelines on Administrative Fines, p. 6 (“Like all corrective measures in general, administrative fines
should adequately respond to the nature, gravity and consequences of the breach, and supervisory authorities
must assess all the facts of the case in a manner that is consistent and objectively justified. The assessment of
what is effective, proportional and dissuasive in each case will have to also reflect the objective pursued by the
corrective measure chosen, that is either to re-establish compliance with the rules, or to punish unlawful
Adopted 109
the EDPB agrees with the reasoning put forward by the AT, DE, FR, NO and SE SAs in their objections.
The EDPB reiterates that lawfulness of processing is one of the fundamental pillars of the data
protection law and considers that processing of personal data without an appropriate legal basis is a
clear and serious violation of the data subjects’ fundamental right to data protection 883.
442. Several of the factors listed in Article 83(2) GDPR speak strongly in favour of the imposition of an
administrative fine for the infringement of Article 6(1) GDPR.
The nature, gravity and duration of the infringement (Article 83(2)(a) GDPR)
443. As mentioned above and outlined below884, the nature and gravity of the infringement clearly tip the
balance in favour of imposing an administrative fine.
444. With respect to the scope of processing, the EDPB notes the IE SA’s assessment that the personal data
processing carried out by Meta IE on the basis of Article 6(1)(b) GDPR is extensive, adding that “[Meta
IE] processes a variety of data in order to serve users personalised advertisements, tailor their ‘News
Feed’, and to provide feedback to advertising partners on the popularity of particular advertisements.
The processing is central to and essential to the business model offered”885.
445. In this respect, the EDPB also recalls that the infringement at issue relates to the processing of personal
data of a significant number of people886 and that the impact on them has to be considered.
446. Though the damage is very difficult to express in terms of a monetary value, it remains the case that
data subjects have been faced with data processing that should not have occurred (by relying
inappropriately on Article 6(1)(b) as a legal basis as established in section 4.4.2). The data processing
in question - behavioural advertising - entails decisions about information that data subjects are
exposed to or excluded from receiving. The EDPB recalls that non-material damage is explicitly
regarded as relevant in Recital 75 and that such damage may result from situations “where data
subjects might be deprived of their rights and freedoms or prevented from exercising control over their
personal data”. Given the nature and gravity of the infringement of Article 6(1)(b), a risk of damage
caused to data subjects is, in such circumstances, consubstantial with the finding of the infringement
itself.
The intentional or negligent character of the infringement (Article 83(2)(b) GDPR)
447. The SE SA argues the infringement of Article 6(1)(b) GDPR should be considered intentional on Meta
IE’s part, which is an aggravating factor887.
behaviour (or both)”), p. 7 (“The Regulation requires assessment of each case individually”; “Fines are an
important tool that supervisory authorities should use in appropriate circumstances. The supervisory authorities
are encouraged to use a considered and balanced approach in their use of corrective measures, in order to
achieve both an effective and dissuasive as well as a proportionate reaction to the breach. The point is to not
qualify the fines as last resort, nor to shy away from issuing fines, but on the other hand not to use them in such
a way which would devalue their effectiveness as a tool.”).
883
Art. 8(2), EU Charter of Fundamental Rights. See NO SA objection, p. 8 - 9.
884
In particular, Section 4.4.2 of this Binding Decision as well as paragraphs 439, 444 - 446.
885
Draft Decision, paragraphs 9.14.
886
Draft Decision, paragraph 9.15 (referring to “ monthly active users in the EEA”) and 9.17 (adding
that this amounts to roughly of the population). This aspect was also highlighted by the objections raised
by the NO SA and DE SAs.
887
SE SA Objection, p. 4.
Adopted 110
448. The EDPB takes note of Meta IE’s position that it did not act intentionally with the aim to infringe the
GDPR, nor was negligent - but “has relied on what it has consistently considered in good faith to be a
valid legal basis for the purpose of processing of personal data for behavioural advertising and which
now requires escalation to the EDPB for resolution”888. Before addressing each of the elements of this
claim, the EDPB first notes that establishing either intent or negligence is not a requirement for
imposing a fine, but deserves ‘due regard’. Second, contrary to what Meta IE implies, the mere
circumstance that a dispute between the LSA and the CSAs has escalated to the EDPB does not serve
as evidence that a controller acted in good faith with respect to the disputed issues. First, the dispute
arises only (long) after the controller has decided on its course of action, and therefore cannot inform
it. Second, a dispute may simply bring to light that an LSA has decided to challenge a position
commonly held by (a majority of) the CSAs.
449. The EDPB Guidelines on calculation of fines confirm that there are two cumulative elements on the
basis of which an infringement can be considered intentional: the knowledge of the breach and the
willfulness in relation to such act889. By contrast, an infringement is “unintentional” when there was a
breach of the duty of care, without having intentionally caused the infringement.
450. The characterisation of an infringement as intentional or negligent shall be done on the basis of
objective elements of conduct gathered from the facts of the case 890. It is worth noting the broader
approach adopted with respect to the concept of negligence, since it also encompasses situations in
which the controller or processor has failed to adopt the required policies, which presumes a certain
degree of knowledge about a potential infringement891. This provides an indication that non-
compliance in situations in which the controller or processor should have been aware of the potential
breach (in the example provided, due to the lack of the necessary policies) may amount to negligence.
451. The SE SA argues that Meta IE “has continued to rely on Article 6(1)(b) for the processing, despite the
aforementioned Guidelines [2/2019 on the processing of personal data under Article 6(1)(b) GDPR in
the context of the provision of online services to data subjects] – which clearly gives doubt to the
legality of the processing – which were first adopted on 9 April 2019 and made final on 8
October 2019. The infringement must in all cases be considered intentional from that later date.”
452. The EDPB recalls that even prior to the adoption Guidelines 2/2019, there were clear indicators that
spoke against relying on contract as legal basis. First, in WP29 Opinion 02/2010 on online behavioural
advertising, only consent - as required by Article 5(3) ePrivacy Directive - is put forward as possible
legal basis for this activity. As Article 6 GDPR resembles Article 7 of the Data Protection Directive to a
large extent, WP29 Opinion 02/2010 remained a relevant source on this matter for controllers
preparing for the GDPR to enter into application. Second, WP29 Opinion 06/2014 on the notion of
888
Meta IE Article 65 Submissions, paragraph 8.25 and Annex 1, p. 86 and p. 134.
889
The main elements to be taken into account in this regard were already established in the EDPB Guidelines
on Administrative Fines, endorsed by the EDPB. The EDPB Guidelines on calculation of fines rely heavily on the
EDPB Guidelines on Administrative Fines in this respect. The EDPB Guidelines on calculation of fines, quoting the
EDPB Guidelines on Administrative Fines, refer to the fact that “in general, ‘intent’ includes both knowledge and
wilfulness in relation to the characteristics of an offence, whereas ‘unintentional’ means that there was no
intention to cause the infringement although the controller/processor breached the duty of care which is required
in the law”.
890
EDPB Guidelines on calculation of fines, paragraph 57 and EDPB Guidelines on Administrative Fines, p. 12.
891
The EDPB Guidelines on calculation of fines, paragraph 56 (Example 4) quote the EDPB Guidelines on
Administrative Fines, which mention, among the circumstances indicative of negligence, “failure to adopt
policies (rather than simply failure to apply them)”.
Adopted 111
legitimate interests explicitly states that “the fact that some data processing is covered by a contract
does not automatically mean that the processing is necessary for its performance. For example,
Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices
based on his click-stream on a website and the items purchased. This is because the data controller
has not been contracted to carry out profiling, but rather to deliver particular goods and services, for
example. Even if these processing activities are specifically mentioned in the small print of the contract,
this fact alone does not make them ‘necessary’ for the performance of the contract”892.
453. It stems from the above that Meta IE had (or should have had) knowledge about the infringement of
Article 6(1)(b) GDPR. However, this mere element is not sufficient to consider an infringement
intentional, as stated above, since the “aim” or “wilfulness” of the action should be demonstrated.
454. The EDPB recalls that that having knowledge of a specific matter does not necessarily imply having the
“will” to reach a specific outcome. This is in fact the approach adopted in the EDPB Guidelines on
calculation of fines and WP29 Guidelines on Administrative Fines, where the knowledge and the
“wilfulness” are considered two distinctive elements of the intentionality893. While it may prove
difficult to demonstrate a subjective element such as the “will” to act in a certain manner, there need
to be some objective elements that indicate the existence of such intentionality894.
455. The EDPB recalls that the CJEU has established a high threshold in order to consider an act intentional.
In fact, even in criminal proceedings the CJEU has acknowledged the existence of “serious negligence”,
rather than ‘intentionality’ when “the person responsible commits a patent breach of the duty of care
which he should have and could have complied with in view of his attributes, knowledge, abilities and
individual situation”895. In this regard, the EDPB confirms that a company for whom the processing of
personal data is at the core of its business activities is expected to have sufficient measures in place
for the safeguard of personal data 896: this does not, however, per se change the nature of the
infringement from negligent to intentional.
456. In this regard, the SE SA puts forward that Meta IE based its processing of personalised advertisement
on consent until the GDPR came into force on 25 May 2018, and at this time switched to relying on
Article 6(1)(b) GDPR for the processing in question instead. The timing and the logistics for this switch
suggests this act was done with the intention of circumventing the new rights of users under
Article 6(1)(a) GDPR. The SE SA adds that “[the] proposed finding of infringement concerning
information deficits about the processing, namely on what legal basis it is based, further supports this
conclusion, since it goes to show that Facebook was aware of the questionable legality of that basis
and tried to conceal the infringement to avoid scrutiny by supervisory authorities and data subjects”897.
457. The EDPB considers the timing of the changes made by Meta IE to its Facebook Terms of Service as an
objective element; however, this alone does not indicate intention. Around this time period, many
controllers updated their data protection policies. The objection suggests that the conclusion on
intentionality is corroborated by the shortcomings to the transparency obligations: in the EDPB’s view,
892
WP29 Opinion 06/2014 on the notion of legitimate interests, p. 16-17.
893
EDPB Guidelines on calculation of fines, paragraph 56, and EDPB Guidelines on Administrative Fines, p. 11.
894
See EDPB Guidelines on calculation of fines, paragraphs 56 and 57, and EDPB Guidelines on Administrative
Fines, p. 12.
895
Judgement of the Court of Justice of 3 June 2008, The Queen, on the application of International Association
of Independent Tanker Owners (Intertanko) and Others v Secretary of State for Transport, C-308/06,
ECLI:EU:C:2008:312), paragraph 77.
896
Binding Decision 01/2020, adopted on 9 November 2020, paragraph 195.
897
SE SA Objection, p. 4.
Adopted 112
the combination of the timing of the change of legal basis with the lack of transparency is not sufficient
to indicate intention either.
458. Therefore, on the basis of the available information, the EDPB is not able to identify a will of Meta IE
to act in breach of the law, as it cannot be concluded that Meta IE intentionally acted to circumvent
its legal obligations.
459. Therefore, the EDPB considers that the arguments put forward by the SE SAs do not meet the
threshold to demonstrate the intentionality of the behaviour of Meta IE. Accordingly, the EDPB is of
the view that the Draft Decision does not need to include this element.
460. At the same time, the EDPB notes that, even establishing that the infringement was committed
negligently, a company for whom the processing of personal data is at the core of its business activities
should have in place sufficient procedures for ensuring compliance with the GDPR898.
461. The EDPB does not accept Meta IE’s claim of “good faith”, but is of the view that Meta IE was certainly
seriously negligent in not taking adequate action, within a reasonable time period, following the
adoption of Guidelines 2/2019 on 9 April 2019. Even before that date, the EDPB considers there was
at the very least negligence on Meta IE’s part considering the contents of WP29 Opinion 02/2010 on
online behavioural advertising and WP29 Opinion 06/2014 on the notion of legitimate interests (see
paragraphs 452 - 453 above), which mean Meta IE had (or should have had) knowledge about the
infringement of Article 6(1)(b) GDPR, the fact that processing of personal data is at the core of its
business practices, and the resources available to Meta IE to adapt its practices so as to comply with
data protection legislation.
The degree of responsibility of the controller taking into account technical and organisational
measures implemented pursuant to Articles 25 and 32(Article 83(2)(d) GDPR)
462. The EDPB considers the degree of responsibility of Meta IE’s part to be of a high level, on the same
grounds as set in the Draft Decision with regard to the transparency infringements899.
The manner in which the infringement became known (Article 83(2)(h) GDPR)
463. The DE SAs identify an aggravating factor in the fact that the “infringement became known by a
complaint of a data subject, not by chance or report by the controller itself”900.
464. The EDPB considers that, as a rule, the circumstance that the infringement became known to the LSA
by way of a complaint should be considered neutral 901. The DE SAs do not put forward reasons that
would justify a departure from the rule in the present case.
465. Therefore, the EDPB is of the view that the Draft Decision does not need to include this element as an
aggravating or mitigating factor.
898
See Binding Decision 01/2020, paragraph 195.
899
Draft Decision, paragraphs 9.32 - 9.33.
900
DE SAs Objection, p. 19.
901
EDPB Guidelines on calculation of fines, paragraph 99. The EDPB Guidelines on Administrative Fines (p. 15)
do not identify this element as being, as a rule, an aggravating element.
Adopted 113
The financial benefit obtained from the infringement (Article 83(2)(k) GDPR)
466. The DE SAs and SE SA argue Meta IE gained financial benefits from their decision to rely on contract
as legal basis for behavioural advertising, rather than obtaining consent from the users of Facebook 902.
The DE SAs engaged in a detailed calculation to justify their estimation of the benefit, although
acknowledging it was based on assumptions903. While not providing an estimate of its size, the SE SA
considers the existence of financial benefit sufficiently proven on the basis of “the self-evident fact
that Facebook has made significant financial gain from being able to provide personal advertisement
as part of a whole take it or leave it offer for its social media platform service, as opposed to
establishing a separate legal basis for it. By also being unclear in the information to data subjects, it is
a reasonable assumption that more data subjects have been misled into being subject to the
processing, thus increasing the financial benefits gained by Facebook pursuant to personal
advertisement”904.
467. The EDPB recalls that financial benefits from the infringement could be an aggravating circumstance
if the case provides information about profit obtained as a result of the infringement of the GDPR905.
468. In the present case, the EDPB considers that it does not have sufficiently precise information to
evaluate the specific weight of the financial benefit obtained from the infringement.
469. Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no effect if they
are disproportionally low compared to the benefits obtained with the infringement. The EDPB
considers that the IE SA should ascertain if an estimation of the financial benefit from the infringement
is possible in this case. Insofar as this results in the need to increase the amount of the fine proposed,
the EDPB requests the IE SA to increase the amount of the fine proposed.
The profitability of the undertaking - other factor (Article 83(2)(k) GDPR)
470. For the reasons stated above (paragraphs 378 - 381), the EDPB is of the view that the Draft Decision
does not need to include this element as aggravating or mitigating factor as put forward by the DE
SAs906.
Competitive advantage - other factor (Article 83(2)(k) GDPR)
471. The NO SA identifies an aggravating factor in that “that the unlawful processing of personal data in all
likelihood has contributed to the development of algorithms which may be harmful on an individual
or societal level, and which may have considerable commercial value to FIL. The algorithms may have
contributed to giving FIL a competitive advantage vis-à-vis its competitors”907.
472. On principle, the EDPB agrees that a competitive advantage could be an aggravating factor if the case
provides objective information that this was obtained as a result of the infringement of the GDPR 908.
In the present case, the EDPB considers that it does not have sufficiently precise information to
evaluate the existence of a competitive advantage resulting from the infringement. The EDPB
considers that the IE SA should ascertain if an estimation of the competitive advantage derived from
902
DE SAs Objection, p. 19 in conjunction with p. 2-10; SE SA Objection, p. 4.
903
DE SAs Objection, p. 19.
904
SE SA Objection, p. 4.
905
EDPB Guidelines on calculation of fines, paragraph 110. See also paragraphs 370 - 377.
906
DE SAs Objection, p. 19.
907
NO SA Objection, p. 9
908
EDPB Guidelines on calculation of fines, paragraph 109. See also paragraphs 367-369.
Adopted 114
the infringement is possible in this case. Insofar as this results in the need to increase the amount of
the fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.
***
473. Taking into account the nature and gravity of the infringement as well as other aspects in accordance
with Article 83(2) GDPR, the EDPB considers that the IE SA must exercise its power to impose an
additional administrative fine. Also, covering this additional infringement with a fine would be in line
with the IE SA’s (proposed) decision to impose administrative fines in this case for the transparency
infringements relating to processing carried out in reliance on Article 6(1)(b) GDPR909. The EDPB
underlines that, in order to be effective, proportionate and dissuasive, a fine should reflect the
circumstances of the case. Such circumstances not only refer to the specific elements of the
infringement, but also those of the controller or processor who committed the infringement, namely
its financial position.
9.2.4.2.2 Assessment of whether an administrative fine should be imposed for the infringement of
the fairness principle under Article 5(1)(a) GDPR
474. The EDPB recalls its conclusion in this Binding Decision on the infringement by Meta IE of the fairness
principle under Article 5(1)(a) GDPR910 and that the objection raised by the IT SA, which was found to
be relevant and reasoned, requested the IE SA to exercise its power to impose an administrative
fine911.
475. The EDPB takes note of Meta IE’s view that the IT SA objection is not relevant and reasoned 912 and
also notes that Meta IE does not provide further arguments on the content of the IT SA objection in
this regard913.
476. The EDPB recalls that the decision to impose an administrative fine needs to be taken on a case-by-
case basis in light of the circumstances and is not an automatic one 914. In the same vein, the EDPB’s
assessment of Meta IE’s compliance with the principle of fairness is carried out by taking into account
the specificities of the case, of the particular social networking service at hand and of the processing
of personal data carried out, namely for the purpose of online behavioural advertising915.
477. As previously established, the principle of fairness under Article 5(1)(a) GDPR, although intrinsically
linked to the principles of lawfulness and transparency under the same provision, has an independent
meaning916. It underpins the whole data protection framework and plays a key role for securing a
balance of power in the controller-data subject relationship917.
478. Considering the EDPB’s findings in Section 6 that Meta IE has not complied with key requirements of
the principle of fairness as defined by the EDPB, namely allowing for autonomy of the data subjects as
to the processing of their personal data, fulfilling data subjects’ reasonable expectation, ensuring
power balance, avoiding deception and ensuring ethical and truthful processing918, as well as the
909
Draft Decision, paragraphs 9.45 - 9.51.
910
Section 6.4.2 of this Binding Decision.
911
Paragraph 214 of this Binding Decision.
912
See paragraphs 207 - 208 above.
913
See paragraphs 212 - 213 above.
914
See paragraph 441 above.
915
See paragraph 225 above.
916
See paragraph 220 above.
917
See paragraph 223 above.
918
See paragraphs 222-230 above.
Adopted 115
overall effect of the infringement by Meta IE of the transparency obligations and of Article 6(1) GDPR,
the EDPB reiterates its view that Meta IE has infringed the principle of fairness under
Article 5(1)(a) GDPR and agrees with the IT SA that this infringement should be adequately taken into
account by the IE SA in the calculation of the amount of the administrative fine to be imposed
following the conclusion of this inquiry.
479. Therefore, the EDPB instructs the IE SA to take into account the infringement by Meta IE of the fairness
principle enshrined in Article 5(1)(a) GDPR as established above when, re-assessing the administrative
fines for the transparency infringements and the determination of the fine for the lack of legal basis.
If, however, the IE SA considers an additional fine for the breach of the principle of fairness is an
appropriate corrective measure, the EDPB requests the IE SA to include this in its final decision. In any
case, the IE SA must take into account the criteria provided for by Article 83(2) GDPR and ensuring it
is effective, proportionate and dissuasive in line with Article 83(1) GDPR.
Adopted 116
10 BINDING DECISION
480. In light of the above, and in accordance with the task of the EDPB under Article 70(1)(t) GDPR to issue
binding decisions pursuant to Article 65 GDPR, the EDPB issues the following Binding Decision in
accordance with Article 65(1)(a) GDPR.
481. The EDPB addresses this Binding Decision to the LSA in this case (the IE SA) and to all the CSAs, in
accordance with Article 65(2) GDPR.
On the objections concerning whether the LSA should have found an infringement for lack of
appropriate legal basis/unlawful data processing
482. The EDPB decides that the objections of the AT, DE, FR, IT, NL, NO, PL, PT and SE SAs regarding Meta
IE’s reliance on Article 6(1)(b) GDPR in the context of its offering of the Facebook Terms of Service
meet the requirements of Article 4(24) GDPR.
483. On the parts of the DE SAs objection requesting the finding of an infringement of Article 5(1)(a) GDPR,
and the parts of the DE, IT and NO SAs objections requesting specific corrective measures under
Article 58 GDPR for the infringement of Article 6(1) or 6(1)(b) GDPR, namely the imposition of an
administrative fine, a ban of the processing of personal data for the purpose of behavioural
advertising, an order to delete personal data processed under Article 6(1)(b) GDPR, and an order to
identify a valid legal basis for future behavioural advertising or to abstain from such processing
activities, the EDPB decides that these parts of their objections do not meet the threshold of
Article 4(24) GDPR.
484. The EDPB instructs the IE SA to alter its Finding 2 of its Draft Decision, which concludes that Meta IE
may rely on Article 6(1)(b) GDPR in the context of its offering of the Facebook Terms of Service, and
to include an infringement of Article 6(1) GDPR, on the basis of the conclusion reached by the EDPB in
this Binding Decision.
On the objections concerning whether the LSA’s Draft Decision includes sufficient analysis and evidence
to conclude that Meta IE is not obliged to rely on consent to process the Complainant’s personal data
485. The EDPB decides that the objections of the AT, DE, FR, NL, and PT SAs regarding the LSA’s Finding 1
that Meta IE is not legally obliged to rely on consent to process personal data to deliver the Facebook
Terms of Service meet the requirements of Article 4(24) GDPR.
486. On the part of the NL SA objection asking the IE SA to include in its Draft Decision the elements
concerning the need to rely on consent for the placing of tracking technology on end users devices
under ePrivacy legislation, the EDPB decides that this part falls outside the scope of the EDPB’s
mandate.
487. The EDPB instructs the IE SA to remove from its Draft Decision its conclusion on Finding 1. The EDPB
decides that the IE SA shall carry out a new investigation into Meta IE’s processing operations in its
Facebook service to determine if it processes special categories of personal data (Article 9 GDPR), and
complies with the relevant obligations under the GDPR, to the extent that this new investigation
complements the findings made in the IE SA’s Final Decision adopted on the basis of this Binding
Decision, and based on the results of this investigation, issue a new draft decision in accordance with
Article 60(3) GDPR.
Adopted 117
On the objection concerning the potential additional infringement of the principle of fairness
488. The EDPB decides that the objection of the IT SA regarding the infringement by Meta IE of the principle
of fairness under Article 5(1)(a) GDPR, meets the requirements of Article 4(24) GDPR.
489. The EDPB instructs the IE SA to find in its final decision an additional infringement of the principle of
fairness under Article 5(1)(a) GDPR by Meta IE.
On the objection concerning the potential additional infringement of the principles of purpose
limitation and data minimisation
490. On the objection by the IT SA concerning the possible additional infringements of the principles of
purpose limitation and data minimisation under Article 5(1)(b) and (c) GDPR, the EDPB decides this
objection does not meet the requirements of Article 4(24) GDPR.
On the objections concerning corrective measures other than administrative fines
491. The EDPB decides that the objections of the AT and NL SAs requesting additional and/or alternative
specific corrective measures to be imposed meet the requirements of Article 4(24) GDPR.
492. On the objection by the PL SA concerning the order to bring processing into compliance with the GDPR,
the EDPB decides that this objection does not meet the requirements of Article 4(24) GDPR.
493. The EDPB instructs the IE SA to include in its final decision an order for Meta IE to bring its processing
of personal data for behavioural advertising purposes in the context of the Facebook service into
compliance with Article 6(1) GDPR within three months.
494. The EDPB also instructs the LSA to adjust its order to Meta IE to bring its Facebook Data Policy and
Terms of Service into compliance with Articles 5(1)(a), 12(1) and 13(1)(c) GDPR within three months,
to refer not only to information provided on data processed pursuant to Article 6(1)(b) GDPR, but also
to data processed for the purposes of behavioural advertising in the context of Facebook service (to
reflect the finding of the EDPB that for this processing the controller cannot rely on
Article 6(1)(b) GDPR).
On the objections concerning the determination of the administrative fine for the transparency
infringements
495. The EDPB decides that the objections of the DE, FR, NL, NO and PL SAs regarding the determination of
the administrative fine for the transparency infringements, meet the requirements of
Article 4(24) GDPR.
496. Regarding the turnover of the undertaking, the EDPB instructs the IE SA to take into consideration the
total turnover of all the entities composing the single undertaking (i.e. consolidated turnover of the
group headed by Meta Platforms, Inc.) for the financial year preceding the date of the final decision.
497. On the number of data subjects affected (Article 83(2)(a) GDPR), the EDPB finds that the IE SA is not
required to amend its Draft Decision in this regard.
498. Concerning any action taken by the controller to mitigate the damage suffered by data subjects
(Article 83(2)(c) GDPR), the EDPB finds the IE SA does not provide sufficient justification for the
mitigating factor identified, and instructs the IE SA to modify its Draft Decision on this matter by
considering this criterion as neither aggravating nor mitigating.
Adopted 118
499. Regarding the financial benefit gained from the infringements (Article 83(2)(k) GDPR), the EDPB
instructs the IE SA to ascertain if further estimation of the financial benefit from the infringement of
transparency obligations is possible in this case. Insofar as further estimation of the financial benefit
from the infringement is possible in this case and results in the need to increase the amount of the
fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.
500. Concerning the relevance of the profit of the undertaking (Article 83(2)(k) GDPR), the EDPB finds that
in the present case the IE SA does not have to amend its Draft Decision to additionally consider the
annual profit of the undertaking pursuant to Article 83 GDPR.
501. The EDPB instructs the IE SA to modify its Draft Decision to elaborate on the manner in which the
turnover of the undertaking concerned has been taken into account for the calculation of the fine, as
appropriate, to ensure the fine is effective, proportionate and dissuasive in accordance with
Article 83(1) GDPR.
502. The EDPB considers that the proposed fine does not adequately reflect the seriousness and severity
of the infringements nor has a dissuasive effect on Meta IE. Therefore, the fine does not fulfil the
requirement of being effective, proportionate and dissuasive in accordance with Article 83(1) and
(2) GDPR. In light of this, the EDPB directs the IE SA to set out a significantly higher fine amount for
the transparency infringements identified, in comparison with the upper limit for the administrative
fine envisaged in the Draft Decision. In doing so, the IE SA must remain in line with the criteria of
effectiveness, proportionality, and dissuasiveness enshrined in Article 83(1) GDPR in its overall
reassessment of the amount of the administrative fine.
On the objections concerning the imposition of an administrative fine for the lack of legal basis
503. The EDPB decides that the objections of the AT, DE, FR, NO, and SE SAs regarding the imposition of an
administrative fine for the infringement of Article 6(1) or Article 6(1)(b) GDPR meet the requirements
of Article 4(24) GDPR.
504. The EDPB decides that the relevant parts of the objections of the IT and PL SAs specifically relating to
an administrative fine for the lack of legal basis do not meet the threshold of Article 4(24) GDPR.
505. In relation to intentionality under Article 83(2)(b) GDPR, the EDPB considers that the arguments put
forward by the SE SA in their objection do not contain sufficient objective elements to demonstrate
the intentionality of the behaviour of Meta IE.
506. Concerning the manner in which the infringement became known (Article 83(2)(h) GDPR), the EDPB
decides the IE SA has no cause to amend the Draft Decision.
507. Regarding the possible financial benefit obtained from the infringement as well as the competitive
advantage (Article 83(2)(k) GDPR), the EDPB instructs the IE SA to ascertain if an estimation of the
financial benefit from the infringement is possible in this case. Insofar as further estimation of the
financial benefit from the infringement is possible in this case and results in the need to increase the
amount of the fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.
508. Concerning the relevance of profit of the undertaking (Article 83(2)(k) GDPR), the EDPB finds that in
the present case the IE SA does not have to amend its Draft Decision to additionally consider the
annual profit of the undertaking pursuant to Article 83 GDPR.
509. The EDPB instructs the IE SA to cover the additional infringement of Article 6(1) GDPR with an
administrative fine that is effective, proportionate and dissuasive in accordance with
Adopted 119
Article 83(1) GDPR. In determining the fine amount, the IE SA must give due regard to all the applicable
factors listed in Article 83(2) GDPR, in particular the nature and gravity of the infringement, the
number of data subjects affected and the seriously negligent character of the infringement.
On the objection concerning the imposition of an administrative fine for the infringement of the
fairness principle under Article 5(1)(a) GDPR
510. The EDPB decides that the objection of the IT SA regarding the imposition of an administrative fine for
the infringement of Article 5(1)(a) GDPR meets the requirements of Article 4(24) GDPR.
511. The EDPB instructs the IE SA to factor the additional infringement of the principle of fairness enshrined
in Article 5(1)(a) GDPR into its adoption of appropriate corrective measures. In this respect, the IE SA
is instructed to take due account of this infringement when re-assessing the administrative fines for
the transparency infringements and the determination of the fine for the lack of legal basis. If,
however, the IE SA considers an additional fine for the breach of the principle of fairness is an
appropriate corrective measure, the EDPB requests the IE SA to include this in its final decision. In any
case, the IE SA must take into account the criteria provided for by Article 83(2) GDPR and ensuring it
is effective, proportionate and dissuasive in line with Article 83(1) GDPR.
On the objection concerning the imposition of an administrative fine for the infringement of
Article 5(1)(b) and (c) GDPR
512. The EDPB decides that it does not need to examine the objection of the IT SA regarding the imposition
of an administrative fine for the infringement of Article 5(1)(b) and (c) GDPR.
11 FINAL REMARKS
513. This Binding Decision is addressed to the IE SA and the CSAs. The IE SA shall adopt its final decision on
the basis of this Binding Decision pursuant to Article 65(6) GDPR.
514. Regarding the objections deemed not to meet the requirements stipulated by Article 4(24) GDPR, the
EDPB does not take any position on the merit of any substantial issues raised therein. The EDPB
reiterates that its current decision is without any prejudice to any assessments the EDPB may be called
upon to make in other cases, including with the same parties, taking into account the contents of the
relevant draft decision and the objections raised by the CSAs.
515. According to Article 65(6) GDPR, the IE SA shall adopt its final decision on the basis of the Binding
Decision without undue delay and at the latest by one month after the Board has notified its Binding
Decision.
516. The IE SA shall inform the Board of the date when its final decision is notified to the controller or the
processor919. This Binding Decision will be made public pursuant to Article 65(5) GDPR without delay
after the IE SA has notified its final decision to the controller920.
919
Article 65(6) GDPR.
920
Article 65(5) and (6) GDPR.
Adopted 120
517. The IE SA will communicate its final decision to the Board921. Pursuant to Article 70(1)(y) GDPR, the IE
SA’s final decision communicated to the EDPB will be included in the register of decisions that have
been subject to the consistency mechanism.
For the European Data Protection Board
The Chair
(Andrea Jelinek)
921
Article 60(7) GDPR.
Adopted 121