Instagram'da Davranışsal Reklamcılığın Hukuki Dayanağı

Binding Decision 4/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its Instagram service (Art. 65 GDPR)

Türkçe özet

Hukuki mesele

Meta'nın Instagram'daki davranışsal reklamcılık için sözleşmenin ifası şartına dayanıp dayanamayacağı ve işlemenin adillik ilkesine uygun olup olmadığı değerlendirilmiştir.

Sonuç

Avrupa Veri Koruma Kurulu, İrlanda Denetim Otoritesine Meta'nın GDPR'nin 6(1) maddesini ve adillik ilkesini ihlal ettiğini nihai kararına eklemesini, işlemeyi üç ay içinde hukuka uygun hale getirmesini ve etkili bir idari para cezası belirlemesini emretmiştir. Kurul ayrıca rızaya dayanma zorunluluğuna ilişkin sonucun taslaktan çıkarılmasını ve bu konuda yeni bir inceleme yapılmasını istemiştir.

Meta'nın Instagram'daki davranışsal reklamcılık için sözleşmenin ifası şartına dayanıp dayanamayacağı ve işlemenin adillik ilkesine uygun olup olmadığı değerlendirilmiştir. EDPB, İrlanda Denetim Otoritesinin Meta'ya ilişkin taslak kararına yöneltilen itirazları incelemiştir. İtirazların bir kısmını ilgili ve gerekçeli bulmuş, bir kısmını ise reddetmiştir. EDPB, Meta'nın kişisel verileri işlemek için rızaya dayanmak zorunda olmadığına karar vermiştir. Avrupa Veri Koruma Kurulu, İrlanda Denetim Otoritesine Meta'nın GDPR'nin 6(1) maddesini ve adillik ilkesini ihlal ettiğini nihai kararına eklemesini, işlemeyi üç ay içinde hukuka uygun hale getirmesini ve etkili bir idari para cezası belirlemesini emretmiştir. Kurul ayrıca rızaya dayanma zorunluluğuna ilişkin sonucun taslaktan çıkarılmasını ve bu konuda yeni bir inceleme yapılmasını istemiştir.

Karar metni

Binding Decision 4/2022 on the dispute submitted by the
Irish SA on Meta Platforms Ireland Limited and its Instagram
service (Art. 65 GDPR)

Adopted on 5 December 2022

Adopted

Table of contents

1 Summary of the dispute.................................................................................................. 5
2 The right to good administration...................................................................................... 9
3 Conditions for adopting a binding decision ........................................................................ 9
3.1 Objection(s) expressed by several CSA(s) in relation to a Draft Decision .......................... 9
3.2 The IE SA finds the objections to the Draft Decision not relevant or reasoned and does not
follow them.....................................................................................................................10
3.3 Admissibility of the case..........................................................................................10
3.4 Structure of the Binding Decision .............................................................................11
4 On whether the LSA should have found an infringement for lack of appropriate legal basis .....11
4.1 Analysis by the LSA in the Draft Decision ...................................................................11
4.2 Summary of the objections raised by the CSAs ...........................................................14
4.3 Position of the LSA on the objections ........................................................................19
4.4 Assessment of the EDPB..........................................................................................20
4.4.1 Assessment of whether the objections were relevant and reasoned .......................20
4.4.2 Assessment on the merits ................................................................................24
5 On whether the LSA’s Draft Decision includes enough analysis and evidence to conclude that
Meta IE is not obliged to rely on consent to process the complainant’s personal data....................39
5.1 Analysis by the LSA in the Draft Decision ...................................................................39
5.2 Summary of the objections raised by the CSAs ...........................................................40
5.3 Position of the LSA on the objections ........................................................................44
5.4 Assessment of the EDPB..........................................................................................45
5.4.1 Assessment of whether the objections were relevant and reasoned .......................45
5.4.2 Assessment on the merits ................................................................................48
6 On the potential additional infringement of the principle of fairness ....................................54
6.1 Analysis by the LSA in the Draft Decision ...................................................................54
6.2 Summary of the objection raised by the CSA ..............................................................55
6.3 Position of the LSA on the objection .........................................................................56
6.4 Analysis of the EDPB...............................................................................................56
6.4.1 Assessment of whether the objection was relevant and reasoned ..........................56
6.4.2 Assessment on the merits ................................................................................58
7 On the potential additional infringement of the principles of purpose limitation and data
minimisation .......................................................................................................................63
7.1 Analysis by the LSA in the Draft Decision ...................................................................63

2
Adopted

7.2 Summary of the objection raised by the CSAs.............................................................63
7.3 Position of the LSA on the objection .........................................................................64
7.4 Analysis of the EDPB...............................................................................................64
7.4.1 Assessment of whether the objection was relevant and reasoned ..........................64
8 On corrective measures other than administrative fines .....................................................66
8.1 Analysis by the LSA in the Draft Decision ...................................................................66
8.2 Summary of the objections raised by the CSAs ...........................................................67
8.3 Position of the LSA on the objections ........................................................................69
8.4 Assessment of the EDPB..........................................................................................69
8.4.1 Assessment of whether the objections were relevant and reasoned .......................69
8.4.2 Assessment on the merits ................................................................................71
9 On the determination of the administrative fine................................................................77
9.1 On the determination of the administrative fine for the transparency infringements .......77
9.1.1 Analysis by the LSA in the Draft Decision ............................................................77
9.1.2 Summary of the objections raised by the CSAs ....................................................82
9.1.3 Position of the LSA on the objections .................................................................85
9.1.4 Assessment of the EDPB...................................................................................86
9.2 On the determination of an administrative fine for further infringements ......................95
9.2.1 Analysis by the LSA in the Draft Decision ............................................................95
9.2.2 Summary of the objections raised by the CSAs ....................................................96
9.2.3 Position of the LSA on the objections ............................................................... 101
9.2.4 Analysis of the EDPB...................................................................................... 101
10 Binding Decision ...................................................................................................... 113
11 Final remarks .......................................................................................................... 116

3
Adopted

The European Data Protection Board

Having regard to Article 63 and Article 65(1)(a) of the Regulation 2016/679/EU of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(hereinafter “GDPR”) 1 ,

Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as
amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 2 ,

Having regard to Article 11 and Article 22 of its Rules of Procedure (hereinafter “EDPB RoP”) 3 ,
Whereas:
(1) The main role of the European Data Protection Board (hereinafter the “EDPB”) is to ensure the
consistent application of the GDPR throughout the EEA. To this effect, it follows from Article 60 GDPR
that the lead supervisory authority (hereinafter “LSA”) shall cooperate with the other supervisory
authorities concerned (hereinafter “CSAs”) in an endeavour to reach consensus, that the LSA and CSAs
shall exchange all relevant information with each other, and that the LSA shall, without delay,
communicate the relevant information on the matter to the other supervisory authorities concerned.
The LSA shall without delay submit a draft decision to the other CSAs for their opinion and take due
account of their views.
(2) Where any of the CSAs expressed a reasoned and relevant objection on the draft decision in
accordance with Article 4(24) and Article 60(4) GDPR and the LSA does not intend to follow the
relevant and reasoned objection or considers that the objection is not reasoned and relevant, the LSA
shall submit this matter to the consistency mechanism referred to in Article 63 GDPR.
(3) Pursuant to Article 65(1)(a) GDPR, the EDPB shall issue a binding decision concerning all the matters
which are the subject of the relevant and reasoned objections, in particular whether there is an
infringement of the GDPR.

(4) The binding decision of the EDPB shall be adopted by a two-thirds majority of the members of the
EDPB, pursuant to Article 65(2) GDPR in conjunction with Article 11(4) EDPB RoP, within one month
after the Chair of the EDPB and the competent supervisory authority have decided that the file is
complete. The deadline may be extended by a further month, taking into account the complexity of
the subject-matter upon decision of the Chair of the EDPB on own initiative or at the request of at
least one third of the members of the EDPB.

(5) In accordance with Article 65(3) GDPR, if, in spite of such an extension, the EDPB has not been able
to adopt a decision within the timeframe, it shall do so within two weeks following the expiration of
the extension by a simple majority of its members.
(6) In accordance with Article 11(6) EDPB RoP, only the English text of the decision is authentic as it is
the language of the EDPB adoption procedure.

1 OJ L 119, 4.5.2016, p. 1.
2
References to “Member States” made throughout this decision should be understood as references to “EEA
Member States”.
3 EDPB Rules of Procedure, adopted on 25 May 2018.

4
Adopted

HAS ADOPTED THE FOLLOWING BINDING DECISION

1 SUMMARY OF THE DISPUTE
1. This document contains a Binding Decision adopted by the EDPB in accordance with
Article 65(1)(a) GDPR. The decision concerns the dispute arisen following a draft decision (hereinafter
“Draft Decision”) issued by the Irish supervisory authority (“Data Protection Commission”, hereinafter
the “IE SA”, also referred to in this context as the “LSA”) and the subsequent objections expressed by
a number of CSAs (“Österreichische Datenschutzbehörde” hereinafter the “AT SA”; “ Der
Hamburgische Beauftragte für Datenschutz und Informationsfreiheit” also on behalf of other German
SAs 4 , hereinafter the “DE SAs”; “Agencia Española de Protección de Datos”, hereinafter the “ES SA”;
“Office of the Data Protection Ombudsman”, hereinafter the “FI SA”; “Commission Nationale de
l'Informatique et des Libertés", hereinafter the “FR SA”; “Hungarian National Authority for Data
Protection and Freedom of Information, hereinafter “HU SA”; “Garante per la protezione dei dati
personali", hereinafter the “IT SA”; “Autoriteit Persoonsgegevens”, hereinafter the “NL SA” ;
“Datatilsynet”, hereinafter the “NO SA”; and “Integritetsskyddsmyndigheten”, hereinafter the “SE
SA”).

2. The Draft Decision at issue relates to a “complaint-based inquiry” which was commenced by the IE SA
on 20 August 2018 into the Instagram social media processing activities (hereinafter “Instagram
service”) of Facebook Ireland Limited, a company established in Dublin, Ireland. The company has
subsequently changed its name to “Meta Platforms Ireland Limited” and hereinafter it is referred to
as “Meta IE”. Any reference to Meta IE in this Binding Decision means a reference to either Facebook
Ireland Limited or Meta Platforms Ireland Limited, as appropriate.

3. The complaint was lodged on 25 May 2018 with the Belgian supervisory authority (“Autorité de
protection des données”), hereinafter the “BE SA” by a data subject who requested the non-profit
NOYB - European Center for Digital Rights (hereinafter, “NOYB”) to represent them under Article 80(1)
GDPR (both hereinafter referred to as the “Complainant”). The Complainant alleged a violation of the
right to data protection and especially infringements of “all the particular requirements set out in
Article 4(11), Article 6(1)(a), Article 7 and/or Article 9(2)(a) of the GDPR”, by arguing that the controller
relied on a “forced consent”, as well as alleging misrepresentations of the controller with regard to
consent and the legal basis for the processing, and consequently, an infringement of Article 5(1)(a)
GDPR 5 . The complaint articulated its requests into a request to investigate, and a request to impose
corrective measures 6 .

4
Objections raised on behalf of the Hamburg Commissioner for Data Protection and Freedom of Information,
the Bavarian State Office for Data Protection Supervision, the Berlin Commissioner for Data Protection and
Freedom of Information, the Brandenburg Commissioner for Data Protection and Freedom of Information, the
Federal Commissioner for Data Protection and Freedom of Information, the State Commissioner for Data
Protection in Lower Saxony and the State Commissioner for Data Protection North Rhine-Westphalia.
5 Complaint, paragraphs 2.2.5. and 2.3.2.
6 Within its request to investigate in paragraph 3.1 of the Complaint, the Complainant requested that a full

investigation be made to determine “which processing operations the controller engages in, in relation to the
data subject”, “for which purpose they are performed”, “on which legal basis for each specific processing
operation the controller relies on”, and to acquire “a copy of any records of processing activities”. The complaint
also requested “that the results of this investigation [be] made available to [them]”. As regards the request to

5
Adopted

4. On 31 May 2018, the BE SA transferred the complaint to the IE SA. The IE SA stated in its “Schedule to
the Draft Decision” 7 that it was satisfied that the IE SA is the LSA, within the meaning of the GDPR, for
Meta IE, as controller, for the purpose of the cross-border processing of personal data in the context
of the Instagram service.

5. The following table presents a summary timeline of the events part of the procedure leading to the
submission of the matter to the consistency mechanism:

The scope and legal basis of the inquiry were set out in the notice
20.08.2018 of commencement of inquiry that the IE SA sent to the parties on
20 August 2018. The IE SA commenced the inquiry and requested
information from this date.
Inquiry Report stage:
20.08.2018 - 07.04.2021 • the IE SA commenced work on the draft inquiry report
• the IE SA prepared a draft inquiry report and issued it to
Meta IE and to the Complainant to allow them to make
submissions in relation to the draft inquiry report;
• Meta IE provided its submissions in relation to the draft
inquiry report;
• The Complainant provided its submissions in relation to
the draft inquiry report;
• Meta IE and the Complainant were furnished with each
other’s submissions and the final report was provided to
the decision-maker;
• The IE SA issued a copy of its final inquiry report to Meta
IE and the Complainant.
• The IE SA issued a letter to Meta IE and to the
Complainant to confirm the commencement of the
decision-making stage.
The IE SA issued a Preliminary Draft Decision (hereinafter “the
23.12.2021 Preliminary Draft Decision”) (including a Schedule) to Meta IE
and to the Complainant.
The Complainant provided submissions on the Preliminary Draft
04.02.2022 Decision to the IE SA (“Complainant’s Preliminary Draft
Submissions dated 4 February 2022” 8 ).
Meta IE made submissions on the Preliminary Draft Decision to
the IE SA (“Meta IE’s Preliminary Draft Submissions”).
The IE SA shared its Draft Decision with the CSAs in accordance
01.04.2022 with Article 60(3) GDPR.

impose corrective measures, more specifically, the complaint requested in paragraph 3.2 that the SA “stop any
processing operations that are based on invalid consent by the data subject”, and in paragraph 3.3 that an
“effective, proportionate and dissuasive fine” be imposed.
7 IE SA Schedule to the Draft Decision of 1 April 2022 in the matter of TSA (through NOYB) v Meta Platforms Ltd

(formerly Facebook Ireland Limited) in respect of the Instagram Service, paragraphs 58- 72.
8 This document is mistakenly dated “11.06.2020”.

6
Adopted

Between Several CSAs (AT, DE , ES, FI, FR, HU, IT, NL, NO, and SE SAs) raised
objections in accordance with Article 60(4) GDPR.
28 and 29.04.2022

The IE SA issued a Composite Response setting out its replies to
01.07.2022 such objections and shared it with the CSAs (hereinafter,
“Composite Response”). The IE SA requested the relevant CSAs
to confirm whether, having considered the IE SA’s position in
relation to the objections as set out in the Composite
Memorandum, the CSAs intended to maintain their objections.
In light of the arguments put forward by the IE SA in the
Composite Response, the DE, ES, FI, HU, NL, NO, and SE SAs),
confirmed to the IE SA that they maintain their remaining
objections 9 .
The IE SA invited Meta IE to exercise its right to be heard in
08.07.2022 respect of the objections (and comments) that the IE SA
proposed to refer to the EDPB under Article 65(1) GDPR along
with the IE SA’s Composite Response and the communications
received from the CSAs in reply to the Composite Response.
Meta IE furnished the requested submissions (“Meta IE Article
09.08.2022 65 Submissions of 9 August 2022”).

The IE SA referred the matter to the EDPB in accordance with
11.08.2022 Article 60(4) GDPR, thereby initiating the dispute resolution
procedure under Article 65(1)(a).

6. The IE SA triggered the dispute resolution process in the Internal Market Information system
(hereinafter “IMI”) 10 on 11 August 2022 in accordance with Article 60(4) GDPR.

7. The EDPB Secretariat assessed the completeness of the file on behalf of the Chair of the EDPB in line
with Article 11(2) EDPB RoP in order to ensure that all the necessary documents were included in the
file.

8. The EDPB Secretariat contacted the IE SA on 23 and 27 September 2022, asking for the transmission
via IMI of specified documents pertaining to the investigation conducted by the IE SA 11 . The request

9
Response of the DE SAs to Composite Response dated 11 July 2022; Response of the ES SA to IE SA Composite
Response dated 8 July 2022; Response of the FI SA to Composite Response dated 8 July 2022; Response of the
HU SA to Composite Response dated 7 July 2022; Response of the NL SA to Composite Response dated 5 July
2022; Response of the NO SA to Composite Response dated 11 July 2022; Response of the SE SA to Composite
Response dated 8 July 2022
10 The Internal Market Information (IMI) is the information and communication system mentioned in Article 17

of the EDPB Rules of Procedure.
11 The following documents were requested:

Letter of DPC to NOYB of 23/11/2018 outlining the scope of the inquiry.
NOYB's reply to DPC of 03/12/2018 outlining procedural concerns

7
Adopted

was made to allow the EDPB to come to a fully informed decision on the objections raised by some
CSAs on the scope and conduct of the investigation. From the schedule to the Draft Decision, the EDPB
Secretariat concluded that both Meta IE and the Complainant were given access to the documents
requested and invited the IE SA to confirm this was indeed the case.

9. The IE SA declined the request, as it considered that the material already provided as sufficient to
enable the EDPB to determine the objections referred to it, as the draft decision provides information
about the scope of the inquiry commenced for the purpose of examining the complaint, the
procedural steps taken in the inquiry, the information that was collected during the course of the
inquiry process, the allegations that were put to the data controller, the submissions made by the
parties to the inquiry and the assessments and views of the IE SA. Further, the IE SA expressed its
concern over the possibility of the EDPB concluding its decision on the basis of material which was
never put to the controller concerned as part of the formulation of any allegation of potential
wrongdoing. Finally, the IE SA underlined that, in accordance with Article 11(2) of the EDPB RoP, they
would provide documents the Board deems necessary.

10. A matter of particular importance that was scrutinised by the EDPB Secretariat was the right to be
heard, as required by Article 41(2)(a) of the Charter of Fundamental Rights. Further details on this are
provided in Section 2 of this Binding Decision.

11. On 5 October 2022, the decision on the completeness of the file was taken, and it was circulated by
the EDPB Secretariat to all the members of the EDPB.

12. The Chair of the EDPB decided, in compliance with Article 65(3) GDPR in conjunction with Article 11(4)
EDPB RoP, to extend the default timeline for adoption of one month by a further month on account
of the complexity of the subject-matter

DPC's reply to NOYB of 16/01/2019
DPC letter to Meta of 30/01/2019 outlining views on the scope;
Meta IE response to DPC of 05/02/2019, raising procedural questions;
DPC's response to Meta of 08/02/2019;
Email exchanges between DPC and Meta on 08/02 and 15/02/2019 regarding scope and procedural issues raised
by NOYB;
Meta IE’s Submissions of 22/02/2019 including Meta Submission of 28/09/2018 (marked up copy, of which parts
Meta considered out of scope of complaint);
DPC letter to NOYB of 28/03/2019 which included an update on the scope;
Letter from NOYB to the IE SA dated 19 April 2019 which included further submissions on the scope
NOYB's letter to DPC of 24/02/2020 raising procedural issues;
DPC's reply to NOYB of 23/03/2020;
Draft Inquiry report of 20/05/2020;
DPC letter to NOYB of 20/05/2020;
NOYB's response to DPC of 03/06/2020;
NOYB submissions on the Draft Inquiry Report of 19/08/2020;
Meta IE’s Submissions on the Draft Inquiry Report of 22/06/2020;
Final Inquiry report of 18 January 2021;
NOYB’s Submissions on the Preliminary Draft Decision in IN-18-08-05 dated 11 June 2021;
NOYB’s submission to the IE SA containing the Gallup study in attachment.

8
Adopted

2 THE RIGHT TO GOOD ADMINISTRATION
13. The EDPB is subject to Article 41 of the EU Charter of Fundamental Rights, in particular Article 41 (right
to good administration). This is also reflected in Article 11(1) EDPB RoP. Further details were provided
in the EDPB Guidelines on Article 65(1)(a) GDPR 12 .

14. The EDPB Decision “shall be reasoned and addressed to the lead supervisory authority and all the
supervisory authorities concerned and binding on them” (Article 65(2) GDPR). It is not aiming to
address directly any third party. However, as a precautionary measure to address the possible need
for the EDPB to offer the right to be heard at the EDPB level to Meta IE, the EDPB assessed if Meta IE
was offered the opportunity to exercise its right to be heard in relation to the procedure led by the
LSA and the subject matter of the dispute to be resolved by the EDPB. In particular, the EDPB assessed
if all the documents containing the matters of facts and law used by the EDPB to take its decision had
been previously shared with Meta IE.

15. The EDPB notes that Meta IE has received the opportunity to exercise its right to be heard regarding
all the documents containing the matters of facts and of law considered by the EDPB in the context of
this decision and provided its written observations 13 , which have been shared with the EDPB by the
LSA.

16. Considering that Meta IE has been already heard by the IE SA on all matters of facts and of law
addressed by the EDPB in its decision, the EDPB is satisfied that the Article 41 of the EU Charter of
Fundamental Rights has been respected.

17. The EDPB considers that the Complainant is not likely to be adversely affected by this Binding Decision,
and consequently does not meet the conditions to be granted a right to be heard by the EDPB in line
with Article 41 of the EU Charter of Fundamental Rights, applicable case law, and Article 11 of the
EDPB RoP. This is without prejudice to any right to be heard or other related rights the Complainant
may have before the competent national supervisory authority(/-ies).

3 CONDITIONS FOR ADOPTING A BINDING DECISION
18. The general conditions for the adoption of a binding decision by the EDPB are set forth in Article 60(4)
and Article 65(1)(a) GDPR 14 .

3.1 Objection(s) expressed by several CSA(s) in relation to a Draft Decision
19. The EDPB notes that several CSAs (AT, DE, ES, FI, FR, HU, IT, NL, NO and SE SAs) raised objections to
the Draft Decision via IMI. The objections were raised pursuant to Article 60(4) GDPR.

12
EDPB Guidelines 3/2021 on the application of Article 65(1)(a) GDPR, adopted on 13 April 2021 (version for
public consultation) (hereinafter, “EDPB Guidelines on Art. 65(1)(a)”), paragraphs 94-108.
13 In particular, Meta IE Preliminary Draft Submissions dated 4 February 2022, Meta IE Article 65 Submissions

dated 9 August 2022.
14 According to Art. 65(1)(a) GDPR, the EDPB will issue a binding decision when a supervisory authority has raised

a relevant and reasoned objection to a draft decision of the LSA and the LSA has not followed the objection or
the LSA has rejected such an objection as being not relevant or reasoned.

9
Adopted

3.2 The IE SA finds the objections to the Draft Decision not relevant or reasoned and
does not follow them
20. On 1 July 2022, the IE SA provided to the CSAs an analysis of the objections raised by the CSAs in the
Composite Response.

21. The IE SA concluded that it would not follow the objections, as it did not consider them “relevant”
and/or “reasoned”, within the meaning of Article 4(24) GDPR for the reasons set out in the Composite
Response and below 15 .

3.3 Admissibility of the case
22. The case at issue fulfils the elements listed by Article 65(1)(a) GDPR, since several CSAs raised
objections to a draft decision of the LSA (the IE SA) within the deadline provided by Article 60(4) GDPR,
and the IE SA has not followed objections or rejected them for being, in its view, not relevant or
reasoned.

23. The EDPB takes note of Meta IE’s position that the current Article 65 GDPR dispute resolution should
be suspended due to pending preliminary ruling proceedings before the Court of Justice of the EU
(hereinafter, “CJEU”) 16 . Meta IE refers in particular to cases C-252/21 17 and C-446/21 18 . Following its
assessment, the EDPB decides to continue its proceedings on this Article 65 GDPR dispute resolution,
as there is no explicit legal basis for a stay of the dispute resolution procedure in EU law, nor are
existing CJEU rulings on the matter conclusive for the situation of the EDPB 19 . Also, the EDPB takes
into consideration the data subjects’ right to have their complaints handled within a “reasonable
period” (Article 57(1)(f) GDPR), and to have their case handled within a reasonable time by EU bodies
(Article 41 Charter). Moreover, ultimately there are remedies available to the affected parties in case
of a discrepancy between the EDPB Binding Decision and CJEU rulings in the aforementioned cases20 .

24. Considering the above, in particular that the conditions of Article 65(1)(a) GDPR are met, the EDPB is
competent to adopt a binding decision, which shall concern all the matters which are the subject of

15 The IE SA letter to the EDPB Secretariat dated 11 August 2022.
16 Meta IE Article 65 Submissions, paragraphs 3.4 - 3.8.
17 Request for a preliminary ruling of 22 April 2021, Meta Platforms and Others, C-252/21 (hereinafter ‘C-252/21

Oberlandesgericht Düsseldorf request’).
18 Request for a preliminary ruling of 20 July 2021, Schrems, C- 446/21 (hereinafter ‘C-446/21 Austrian

Oberster Gerichtshof request’).
19 C-234/89 Judgement of the Court of Justice of 28 February 1991, Delimitis, C-234/89, ECLI:EU:C:1991:91; C-

344/98 Judgement of the Court of Justice of 14 December 2000, Masterfoods, C-344/98, ECLI:EU:C:2000:689.
These cases concerned proceedings before the national courts, where the parties faced the risk of being
confronted with a conflicting decision of the national judge that could be seen as de facto nullifying the
Commission decision – a power which is retained by the CJEU. The current dispute resolution procedure
concerns the adoption of an administrative decision, which can be subject to full judicial review.
20 In case an action for annulment is brought against the EDPB decision(s) and found admissible, the General

Court/CJEU has the opportunity to invalidate the decision of the EDPB. In addition, and if the General Court/CJEU
were to deliver any judgment in the time between the adoption of the EDPB’s Art. 65 decision and the adoption
the IE SA’s final decision, the IE SA may ultimately decide to revise the final national decision it takes following
the EDPB's binding decision - if the CJEU’s rulings give cause to do so - in accordance with the principle of
cooperation as elaborated by the CJEU in the C-453/00 Judgement of the Court of Justice of 12 January 2004,
Kühne & Heitz NV, ECLI:EU:C:2004:17.

10
Adopted

the relevant and reasoned objection(s), i.e. whether there is an infringement of the GDPR or whether
the envisaged action in relation to the controller or processor complies with the GDPR 21 .

25. The EDPB recalls that its current Decision is without any prejudice to any assessments the EDPB may
be called upon to make in other cases, including with the same parties, taking into account the
contents of the relevant draft decision and the objections raised by the CSA(s).

3.4 Structure of the Binding Decision
26. For each of the objections raised, the EDPB decides on their admissibility, by assessing first whether
they can be considered as a “relevant and reasoned objection” within the meaning of Article 4(24)
GDPR as clarified in the Guidelines on the concept of a relevant and reasoned objection 22 .

27. Where the EDPB finds that an objection does not meet the requirements of Article 4(24) GDPR, the
EDPB does not take any position on the merit of any substantial issues raised by that objection in this
specific case. The EDPB will analyse the merits of the substantial issues raised by all objections it deems
relevant and reasoned 23 .

4 ON WHETHER THE LSA SHOULD HAVE FOUND AN INFRINGEMENT
FOR LACK OF APPROPRIATE LEGAL BASIS
4.1 Analysis by the LSA in the Draft Decision
28. The IE SA concludes that the GDPR, the jurisprudence and the EDPB Guidelines do not preclude Meta
IE from relying on Article 6(1)(b) GDPR as a legal basis to carry out the personal data processing
activities involved in the provision of its service to users, including behavioural advertising insofar as
that forms a core part of the service 24 . Finding 2 reads “I find the Complainant’s case is not made out
that the GDPR does not permit the reliance by Meta Ireland on 6(1)(b) GDPR in the context of its
offering of Terms of Use 25 ”

29. The IE SA states that it does not have competence to consider substantive issues of contract law and,
accordingly, its analysis is limited to the specific contract entered into by the complainant and Meta
IE in respect of the Instagram service 26 .

30. The IE SA understands the complainant’s allegations as 27 : being that, firstly, they were given a binary
choice: i.e. either accept the Instagram Terms of Use and the associated Data Policy by selecting the

21
Art. 65(1)(a) and Art. 4(24) GDPR. Some CSAs raised comments and not per se objections, which were,
therefore, not taken into account by the EDPB.
22 EDPB Guidelines 9/2020 on the concept of relevant and reasoned objection, version 2 adopted on 9 March

2021, (hereinafter, “EDPB Guidelines on RRO”).
23 See EDPB Guidelines on Art. 65(1)(a), paragraph 63 (“The EDPB will assess, in relation to each objection raised,

whether the objection meets the requirements of Article 4(24) GDPR and, if so, address the merits of the objection
in the binding decision.”)
24 Draft Decision, paragraphs 112 and 115.
25 Draft Decision, Finding 2, p. 40.
26 Draft Decision, paragraph 84.
27 Draft Decision, paragraph 10.

11
Adopted

“accept” button, or deleting their Instagram account 28 , lack of clarity on which specific legal basis Meta
IE relies on for each processing operation 29 , and their concern on Meta IE’s reliance on Article 6(1)(b)
to deliver the Instagram Terms of Use 30 .

31. While the IE SA acknowledges that the EDPB considers in its Guidelines 2/2019 31 that, as a general
rule, processing for online behavioural advertising is not necessary for the performance of a contract
for online service under Article 6(1)(b) GDPR 32 , in this particular case, having regard to the specific
terms of the contract and the nature of the service provided and agreed upon by the parties, IE SA
concluded that Meta IE may in principle rely on Article 6(1)(b) as legal basis of the processing of users’
data necessary for the provision of its service, including through the provision of behavioural
advertising insofar as this forms a core part of that service offered to and accepted by users 33 . Further,
the IE SA states that while the examples provided in any form of EDPB guidance are helpful and
instructive, they are not necessarily conclusive of the position in any specific case and indeed do not
purport to be 34 .

32. The IE SA disagrees with what it defines as a “strict threshold of ‘impossibility’ in the assessment of
necessity” proposed by the complainant and the EDPB 35 . By “impossibility”, IE SA refers to the
argument put forward that a particular term of a contract (here, behavioural advertising) is not
necessary to deliver an overall service or contract 36 . The IE SA is of the view that “it is not for an
authority such as the Commission, tasked with the enforcement of data protection law, to make
assessments as to what will or will not make the performance of a contract possible or impossible” and
that the general principles set out in the GDPR and explained by the EDPB in the guidelines must be
applied on a case-by-case basis 37 . The IE SA considers that Article 6(1)(b) GDPR cannot be interpreted
as requiring that it is impossible to perform the contract without the data processing operations in
question 38 .

33. The IE SA refers to Meta IE’s position that in the specific context of the Instagram service, personalised
advertising may constitute a distinguishing feature of said service which is an “exact rationale” and
one of the “essential elements of the Terms of Use” for which the ordinary user would reasonably
expect their personal data to be processed so as to receive the Instagram service as advertised39 .
Further, the IE SA refers to Meta IE’s submission regarding whether the necessity test encompasses
an impossibility threshold, and Meta IE’s argument that were impossibility an aspect of necessity, it

28
Draft Decision, paragraph 11.
29
Draft Decision, paragraph 17.
30 Draft Decision, paragraph 77.
31 EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the

provision of online services to data subjects Version 2.0, adopted on 8 October 2019 (hereinafter, “EDPB
Guidelines 2/2019 on Article 6(1)(b) GDPR”).
32 Draft Decision, paragraph 113.
33 Draft Decision, paragraph 113.

34 Draft Decision, paragraph 108.
35 Draft Decision, paragraphs 107 and 112.
36 Draft Decision, paragraph 107
37 Draft Decision, paragraph 108.
38 Draft Decision, paragraphs 107-109 and 112.
39 Draft Decision paragraph 109.

12
Adopted

would not, in any case operate as a “blanket prohibition” on relying on Article (1)(b) GDPR as the legal
basis for the processing in this context 40 .

34. The IE SA considers personalised advertising a core part of the service offered to and accepted by the
users, having regard to the specific terms of the contract and the nature of the service provided and
agreed upon by Meta IE and the user 41 . The IE SA points out that the nature of the service being
offered to Instagram users is set out in the Terms of Use which describe the Instagram service as being
“personalised” and connects users with brands, including by means of providing “relevant” advertising
and content 42 .

35. The IE SA considers this as the Instagram service is advertised in the Terms of Use as being predicated
on personalised advertising, any reasonable user would understand and expect that this is part of the
core bargain that is being struck with Meta IE, even if they might prefer that the market would offer
them better alternative choices 43 .

36. The IE SA considers that as personalised advertising forms part of the core bargain struck between
Meta Ireland and Instagram users, any processing necessary for the delivery of such advertising is
deemed to fall within the scope of Article 6(1)(b) GDPR 44 .

37. The IE SA thus concludes that Meta IE may in principle rely on Article 6(1)(b) GDPR as a legal basis of
the processing of users’ data necessary for the delivery of a service based on behavioural advertising
of the kind provided for under the contract between Meta IE and Instagram’s users 45 .

38. The IE SA clarified that, having regard to the scope of the complaint and its inquiry, the above
conclusion ought not to be construed as an indication that all processing operations carried out on
users’ personal data are necessarily covered by Article 6(1)(b) GDPR 46 .

39. The IE SA also notes that other provisions of the GDPR such as transparency act to strictly regulate the
manner in which this service is to be delivered and the information that should be given to users and
decides to address it separately in its Draft Decision 47 .The IE SA considers that there have been
significant failings of transparency in relation to the processing 48 .

40. The IE SA considers that these failings of transparency, having regard to the specific terms of the
contract and the nature of the service provided and agreed upon by the parties, do not, in principle
prevent Meta IE from relying on Article 6(1)(b) GDPR as a legal basis of the processing of users’ data

40
Draft Decision paragraph 109.
41
Draft Decision, paragraph 104.
42 Draft Decision, paragraph 104.

43 Draft Decision, paragraph 105.
44 Draft Decision, paragraph 105.
45 Draft Decision, paragraph 111.
46 Draft Decision, paragraph 114.
47 Draft Decision, paragraph 111.
48 Draft Decision, p. 71.

13
Adopted

necessary for the provision of the Instagram service, including through the provision of behavioural
advertising insofar as this forms a core part of that service offered to and accepted by users 49 .

4.2 Summary of the objections raised by the CSAs
41. The AT, DE, ES, FI, FR, HU, NL, NO and SE SAs object to Finding 2 of the draft decision and the
assessment leading up to it.

42. The AT, ES, FI, HU, NL, NO and SE SAs 50 consider that, the IE SA should have found an infringement
of Article 6(1)(b) of the GDPR, in line with the EDPB’s interpretation of this provision 51 . The DE and FR
SAs argue that the IE SA should have found an infringement of Article 6(1) GDPR 52 .

43. The DE SAs, in their objection, further argue that the IE SA should find an infringement of Article 5(1)(a)
GDPR and make use of corrective powers of Article 58(2)(f) and (i) GDPR and order to erase the
unlawfully processed personal data, impose a ban of the respective processing of data for the purpose
of behavioural advertising until a valid legal basis is in place and impose an administrative fine
pursuant to Article 83 GDPR 53 .

44. The FI SA, in its objection, also argues that the finding that Meta IE was not entitled to rely on Article
6(1)(b) GDPR as a legal basis for all the processing operations in the scope of the Instagram Service
should lead to the conclusion that corrective powers pursuant to Article 58(2) GDPR must be exercised
to bring the processing operations of Meta IE into compliance with the GDPR 54 . Furthermore, the FI
SA considers that this additional infringement should be properly reflected in the amount of the
administrative fine imposed pursuant to Article 83 GDPR 55 .

45. The FR SA notes that reversing the findings concerning the infringements of Article 6(1) GDPR also
affects the scope of the corrective actions proposed by the IE SA, in addition to the administrative
fine 56 .

46. The HU SA, in its objection, argues that in light of the infringement, the legal consequences of Article
58(2) (d) (order to bring processing operations into compliance) GDPR should be applied, and the
controller should be instructed to indicate another alternative legal basis 57 .

47. The NO SA, in its objection, also argues that the IE SA should take concrete corrective measures. More
specifically, the NO SA considers that the IE SA should order Meta IE to delete personal data processed
under Article 6(1)(b) GDPR, unless those data were also collected for other purposes with a valid legal
basis, as well as order Meta IE to identify a valid legal basis for future online behavioural advertising

49
Draft Decision, paragraph 113.
50
AT SA Objection, pp. 1-7; ES SA Objection pp. 1-3 ; FI SA Objection pp. 2-7; HU SA Objection pp. 2-4; NL SA
Objection, pp. 1-12; NO SA Objection, pp. 1-9; SE SA Objection, pp. 2-4.
51 EDPB Guidelines 02/2019 on Article 6(1)(b) GDPR.

52 DE SAs Objection, pp. 2-7, FR SA Objection, pp.2-7.
53 DE SAs Objection, p. 10.
54 FI SA Objection, paragraph 23.
55 FI SA Objection, paragraph 26.
56 FR SA Objection, paragraph 50.
57 HU SA Objection, p. 3.

14
Adopted

or abstain from such processing activities and impose an administrative fine against Meta IE for
unlawfully processing personal data in the context of online behavioural advertising 58 .

48. The AT, DE, ES, FI, FR, HU, NL, NO and SE SAs put forward several factual and legal arguments for the
proposed change in legal assessment 59 . Specifically they argue that Meta IE cannot rely on Article
6(1)(b) GDPR as a legal basis to process an Instagram user’s data for behavioural advertising.

49. In addition, in the context of their objection, the AT and FR SAs argue that the factual background of
the Draft Decision does not include all relevant facts. They request amending the factual background
to include a definition of “behavioural advertising” 60 . The AT SA suggests mentioning also the technical
possibilities Meta IE uses to conduct it, such as collecting data from other group services, third-party
websites, apps, cookies or similar storage technologies placed on the user’s computer or mobile device
and linking that data with the user’s Instagram account 61 . The AT SA also suggests including the fact
that on 25 May 2018 Meta IE switched its legal basis to process data for behavioural advertising from
consent to contractual performance 62 .

50. The DE and NL SAs 63 question the validity of the contract between Meta IE and the Instagram service’s
user to ground the said processing on Article 6(1)(b) GDPR in light of the transparency issues identified
by the IE SA 64 . The DE SAs question whether the parties reached an agreement if the user did not
know that they would enter into a contract, because Meta IE did not clearly communicate in a
transparent manner that the use of its services would in the future be based on a contract 65 . The NL
SA argues that, as a general rule, both parties must be aware of the substance of a contract in order
to willingly enter into it 66 and considers that “the established serious lack of transparency on behalf of
the controller, leads, at the very least, to a reasonable doubt whether data subjects have indeed been
able to enter into a contract with the controller both willingly and sufficiently informed" 67 . The DE and
NL SAs therefore considered that Meta IE’s statement that it relies on Article 6(1)(b) GDPR, in
combination with documents with general descriptions of the service provided, and the IE SA’s
reference to the controller’s right to choose its own legal basis to process data are insufficient to
accept the performance of a contract as a legal basis 68 .

58 NO SA Objection, p. 9.
59 AT SA Objection, pp. 3-6; DE SAs Objection, pp. 2-9 ; ES SA Objection, pp. 1-3 ; FI SA Objection, pp. 3-7 ; FR SA
Objection, pp. 2-4 ; HU SA Objection, pp. 2-3 ; NL SA Objection, pp. 2-6 ; NO SA Objection, pp. 2-8 ; SE SA
Objection, pp. 2-3.
60 AT SA Objection, pp. 6-7 ; FR SA Objection, paragraph 6.
61 AT SA Objection, pp. 6-7.
62 AT SA Objection, p. 7.
63 DE SAs Objection, p. 3-4; NL SA Objection, pp. 3-5.
64 In Finding 3, the IE SA states that “In relation to processing for which Article 6(1)(b) GDPR is relied on, Articles

5(1)(a), 12(1) and 13(1)(c) GDPR have been infringed”. The IE SA considered, among other, that “Meta Ireland
have not provided meaningful information as to the processing operation(s) and/or set(s) of operations that
occur in the context of the Instagram service, either on basis of Article 6(1)(b) GDPR or any other legal basis.
Indeed, I would go so far as to say that it is impossible for the user to identify with any degree of specificity what
processing is carried out on what data, on foot of the specified lawful bases, in order to fulfil these objectives”
(Draft Decision, par. 185).
65 DE SAs Objection, p. 4.
66 NL SA Objection, paragraph 12.
67 NL SA Objection, paragraph. 17.
68 DE SA Objection, pp. 3-4 ; NL SA Objection, paragraph 7.

15
Adopted

51. The DE SAs contend that the IE SA is competent to assess the validity of contracts in the context of the
GDPR, which is a prerequisite for controllers to base the processing of personal data on Article 6(1)(b)
GDPR 69 . Would that not be the case, the assessment of Article 6(1)(b) GDPR would practically be
deducted from Supervisory Authorities’ tasks provided for in Article 57(1)(a) GDPR 70 . The DE and NL
SAs argue that the IE SA should assess whether a valid contract is in place as required under Article
6(1)(b) GDPR 71 .

52. Without prejudice to any arguments made on the existence of a valid contract above, the AT, DE, ES,
FI, FR, HU, NL, NO and SE SAs are not satisfied by the assessment of necessity in the Draft Decision72 .
They assert that the data processing for the delivery of personalised advertising is objectively not
necessary for the performance of Meta IE’s contract with the data subject to deliver the Instagram
service and it is not an essential or core element of it. To highlight the unnecessity of behavioural
advertising to perform the contract with the Instagram user, the AT, DE, NL and SE SAs argue that this
contract of providing personalised advertisement is a contract between Meta IE and a specific
advertiser, in which Meta IE would presumably have this obligation towards the advertisers, yet not
towards Instagram users that are not party to this contract 73 . The DE SAs support this assertion by
pointing out that there is no obligation to offer personalised advertising to the user, and contractual
sanctions for the failure to provide it, as it can be seen from the terms of use 74 . The AT, DE, HU, FI, FR,
HU, NO and SE SAs consider, while referring to the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR,
that the business models to offer “free” services and in return generate income by behavioural and
personalised advertisement, inter alia, to support the service, cannot be necessary to perform a
contract and fail to comply with data protection regulations 75 . The DE, FR and HU SAs also cite the
EDPB Guidelines 8/2020 to underscore that processing cannot be rendered lawful by Article 6(1)(b)
GDPR simply because such advertising indirectly funds the provision of the service and that while
personalisation of content, may, in certain circumstances, constitute an intrinsic and expected
element of certain online services, Article 6(1)(b) GDPR in the context of targeting of social media
users is hardly applicable 76 . The AT, ES and SE SAs argue that advertisements can still be displayed on
Instagram using alternative methods to behavioural advertising not involving profiling and tracking77 .
The SE SA adds that some degree of targeting for increased relevance is possible, such as geography,
language and context 78 .

53. In addition, the AT, ES, FI, FR, HU, NO and SE SAs argue, also while referring to EDPB Guidelines 2/2019
on Article 6(1)(b) GDPR, that the IE SA should have considered the EDPB’s argument that behavioural

69
DE SAs Objection, p. 3.
70
DE SAs Objection, p. 3.
71 DE SAs Objection, p. 3; NL SA Objection, paragraph 11.
72 AT SA Objection, p. 3; DE SAs Objection, pp 4-7 ; ES SA Objection, pp. 1-2 ; FI SA Objection, pp. 3-5 ; FR SA

Objection, pp. 3-4 ; HU SA Objection, pp. 1-3 ; NL SA Objection, pp. 4-8 ; NO SA Objection, pp. 5-6 ; SE SA
Objection, p. 3.
73 AT SA Objection, p. 4; DE SAs Objection, p. 5 ; NL SA Objection, paragraphs 12 and 19 : SE SA Objection, p. 3.
74 DE SAs Objection, p. 5.
75 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR. AT SA Objection, p. 5; DE SAs Objection, pp. 6-7; HU SA

Objection, p. 3; FI SA Objection, paragraphs 13 and 16; FR SA Objection, paragraphs 9 and 11; NO SA Objection,
pp. 3 and 6-7; SE SA Objection, p. 3.
76 EDPB Guidelines 8/2020 on the targeting of social media users, version 2.0, adopted on 13 April 2021,

paragraph 49. DE SAs Objection, p. 6 ; FR SA Objection, paragraph 11; HU SA Objection, p. 3.
77 AT SA Objection p. 4; ES SA Objection, p. 2; SE SA Objection, p.3.
78 SE SA Objection, p.3.

16
Adopted

advertising cannot be “necessary” within the meaning of Article 6(1)(b) GDPR while a data subject can
object to the processing of his/her personal data for direct marketing purposes at any time without
any reason, in accordance with Article 21(2) GDPR 79 .

54. The AT, DE, FR, NO, NL and SE SAs also point out some arguments on data subjects’ expectations
about the processing of their personal data for personalised advertising as a necessary element of the
contract entered into between users and Meta IE 80 . The AT, DE, NL, and SE SAs contend that data
subjects do not reasonably expect that their data is being processed for personalised advertising
simply because Meta IE briefly refers to it in the Instagram Terms of Use 81 . The NO SA takes into
account how Meta IE markets its Instagram platform towards potential users (“A simple, fun & creative
way to capture, edit & share photos, videos & messages with friends & family”) and considers that
Instagram users (including those with prior knowledge of data protection, technical means for
profiling or the ad tech industry) should not be deemed to reasonably expect online behavioural
advertising, especially to the extent as it is carried out by Meta IE 82 . The FR and NO SAs consider that
the particularly massive and intrusive nature of the processing of the users’ data cannot meet the
reasonable expectations of the users 83 . The AT, NL and SE SAs also consider that the Draft Decision is
inconsistent in finding that information on specific processing operations should have been provided,
linked with a specific or lawful basis, and described in an unambiguous manner, while considering that
data subjects had a perspective or expectation or were well informed that their data was being
processed for behavioural advertising 84 .

55. In addition to the arguments made above on the existence of a valid contract and the necessity of
behavioural advertising for the performance of that contract, several SAs raise other considerations
in their objections.

56. The NO SA argues that the IE SA’s interpretation of Article 6(1)(b) is contrary to the fairness principle,
since data subjects face the dilemma of approving contractual terms possibly entailing intrusive and
harmful processing practices, and being excluded from services on which they are de facto dependent,
due to a lack of realistic alternatives to them 85 .

57. On the risks posed by the Draft Decision, the AT, DE, ES, HU, FI, NL, NO and SE SAs explain that the
proposed interpretation of Article 6(1)(b) GDPR leads to a situation where data protection principles
are either undermined or bypassed entirely with regards to data subjects using the Instagram
service 86 .

79
See paragraph 52. AT SA Objection, p. 4; ES SA Objection, p.2 ; FI SA Objection, paragraph 19 ; FR SA Objection,
paragraph 11; HU SA Objection, p. 3, NO SA Objection, p. 7; SE SA Objection, p. 3.
80 AT SA Objection, p. 4; DE SAs Objection p. 5; FR SA Objection, paragraph 9; NL SA Objection, paragraph 19; NO

SA Objection, pp. 7-8; SE SA Objection p. 3.
81 AT SA Objection, p.4; DE SAs Objection, p. 5; NL SA Objection, paragraph 19; SE SA Objection, p. 3.

82 NO SA Objection, p. 8.
83 FR SA Objection, paragraph 18; NO SA Objection, p. 8.
84 AT SA Objection, p. 4; NL SA Objection, paragraph 12; SE SA Objection, p.3.
85 NO SA Objection, p. 5.
86 AT SA Objection, p. 6; DE SAs Objection, p. 9; ES SA Objection, p. 3 ; HU SA Objection, p. 4 ; FI SA Objection,

paragraphs 31-33; NL SA Objection, paragraph 29; NO SA Objection, p. 8 ; SE SA Objection, p. 5.

17
Adopted

58. Specifically, the AT, DE and NO SAs point to the conditions of consent pursuant to Article 7 GDPR as
being bypassed 87 . The NL SA considers that the Draft Decision allows Meta IE to engage in online
behavioural advertising in a way that bypasses informed consent of data subjects 88 . The NO SA
considers that users ‘would face a dilemma between approving (though not by way of valid consent)
contractual terms possibly entailing intrusive and harmful processing practices, and being excluded
from services’, which ultimately would also ‘adversely affect data subjects’ freedom of expression and
information’ 89 . The FI, FR and NO SAs considered that the Draft Decision poses a risk to the
fundamental rights and freedoms of the individuals concerned, insofar as using the legal basis of the
contract for the processing of the personal data for personalised advertising, would prevent European
users of the social network to have control over their data 90 .

59. Further, the AT SA sees the risk materialise as in its view Article 25(2) GDPR (privacy by default) is not
applied, “since Meta Ireland – at least in its contract – declares that behavioural advertising is
‘necessary’ for the contractual performance” 91 .

60. The DE SAs argue the Draft Decision allows Meta IE to “bypass the requirements of a valid legal basis
for the processing that cannot be based on contract performance” 92 . The NL SA considers the Draft
Decision lowers the threshold for legality of data processing on the basis of Article 6(1)(b) severely 93 .
The NO SA considers that the Draft Decision erodes the lawfulness principle, as in the Draft Decision
“it is not the legislation which sets the boundaries for lawfulness under Article 5(1)(a) GDPR, but
instead the individual contract”, which is incompatible with Article 8 of the Charter of Fundamental
Rights and Article 5(1)(a) GDPR 94 .

61. FR, HU, NL and SE SAs take the view that the Draft Decision, as it stands, sets a dangerous precedent
contrary to the GDPR 95 . The FR SA notes that it could be understood as reflecting the common position
of the European supervisory authorities on this matter, since it is issued following the cooperation
procedure among SAs 96 . Moreover, the AT, DE, FI, HU and SE SAs raise that this interpretation of
Article 6(1)(b) GDPR could essentially be used by every controller and therefore endanger the rights
of nearly every data subject within the EEA 97 .

62. The DE SAs specify that the risks concern the complainant in person but it argues that there is also a
significant risk as regard the fundamental rights and freedoms of all Meta IE’s users in the European
Union that their personal data are processed without any legal basis 98 ; the FI SA adds that the risks

87
AT SA Objection, p. 2 and 5; DE SAs Objection, p. 9; NO SA Objection, p. 4.
88
NL SA Objection, paragraph 30.
89 NO SA Objection, p. 5.
90 FI SA Objection, paragraph 35 ; FR SA Objection, paragraph 34 ; NO SA Objection, p. 8.
91 AT SA Objection, p. 6;
92 DE SAs Objection, p. 9.
93 NL SA Objection, paragraph 30.

94 NO SA Objection, pp. 2 and 8;
95 FR SA Objection, paragraph 35; HU SA Objection, p. 3 ; NL SA Objection, paragraph 31; SE SA Objection, p. 5.
96 FR SA Objection, paragraph 35.
97 AT SA Objection, p 6; DE SAs Objection, p. 9; FI SA Objection, paragraph 34; HU SA Objection, p. 3 ; SE SA

Objection, p. 5.
98 DE SAs Objection, p. 9.

18
Adopted

include fundamental right and freedom of data subjects whose personal data might be processed in
the future 99 .

63. Finally, the AT, DE, FI, NL and NO SAs explain that the Draft Decision creates a loophole, allowing Meta
IE and any other controllers to make lawful virtually any collection and reuse of personal data by, as
long as they declare that it is processed for the performance of a contract 100 .

4.3 Position of the LSA on the objections
64. The IE SA considers that the objections above are not relevant and/or not reasoned for the purpose
of Article 60(4) GDPR and decides not to follow them 101 .

65. The IE SA contends that a broad, direct competence in contract law to assess the validity of contracts
cannot be inferred from the GDPR tasks of supervisory authorities. It argues that this inference would
create a very extensive power for SAs to regulate private law, without an appropriate basis in EU
law 102 .

66. The IE SA argues that the core or fundamental aspects of the Terms of Use, including behavioural
advertising processing, reflects the mutual expectations of the parties on contractual performance.
The IE SA contends that a reasonable user would have had sufficient understanding that the Instagram
service was provided on the basis of personalised advertising, based also on a “recognised public
awareness” of behavioural advertising as a form of processing 103 .

67. On the necessity of the processing to perform the contract, the IE SA considers that it does not adopt
a merely formal approach to Article 6(1)(b) that relies only on the textual content of the Terms of Use.
The IE SA states that it does not take the view that all written contractual terms are necessary for the
performance of the contract. The IE SA contends that it focuses in its Draft Decision on the
fundamental purpose or core function of the contract that is necessary for its performance 104 .

68. The IE SA argues that the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR do not prohibit behavioural
advertising processing under Article 6(1)(b) GDPR if it falls within the core or essential aspects of the
service 105 . In relation to Meta IE’s processing of personal data, the IE SA differs from the SAs in that it
considers online behavioural advertising as necessary for the performance of the contract (as
described in the Instagram Terms of Use) between Instagram and the data subject 106 .

69. The IE SA also disagrees with the interpretation of Article 21 GDPR making behavioural advertising
optional and not indispensable 107 . The IE SA argues that Article 6(1)(b) GDPR is not limited to aspects
of contractual performance which are expressly mandatory and unconditional obligations of the

99
FI SA Objection, p. 7.
100
AT SA Objection, p. 5; DE SAs Objection, p. 9; FI SA Objection, paragraph 32; NL SA Objection, paragraphs 30-
31; NO SA Objection, p. 2-3 and 7; SE SA Objection, p. 5.
101 Composite Response, paragraphs 51, 57, 77, 85, 88, 95.

102 Composite Response, paragraph 51.
103 Composite Response, paragraphs 72 and 73.
104 Composite Response, paragraphs 55 and 56.
105 Composite Response, paragraphs 84.
106 Composite Response, paragraph 71.
107 Composite Response, paragraph 74.

19
Adopted

parties 108 . The IE SA contends that the CJEU has in the past held that processing which exceeds the
most minimal level of processing possible may be regarded as necessary, where it renders a lawful
objective “more effective”. The IE SA affirms that the necessity in the context of Article 6(1)(b) GDPR
cannot be assessed by reference to hypothetical alternative forms of the Instagram service and that
it is not the role of SAs to impose specific business models on controllers 109 .

70. The IE SA considers EDPB Guidelines as not binding on supervisory authorities, yet it acknowledges
that they should be taken into account 110 . However, the IE SA argues that the EDPB has not been
provided with the legal power to mandate that certain categories of processing must be based on
consent, to the exclusion of any other legal bases for processing. The IE SA’s view is that such a power
is properly exercised from time to time by the EU legislator, in the form of specific legislative measures.
The IE SA is therefore not satisfied that the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR can be
construed as a binding and specific prohibition on processing for online behavioural advertising on the
basis of Article 6(1)(b)GDPR. The IE SA considers that under these Guidelines, where processing for
behavioural advertising is a distinguishing characteristic of the service in question, it can support the
business objectives and interests of the controller and be based on Article 6(1)(b) GDPR. The IE SA
considers that to be the case regarding Meta IE’s processing with reference to the Instagram
service 111 .

71. The IE SA argues that compliance with GDPR transparency obligations under Article 13(1)(c) GDPR
involves a separate and different legal assessment to that required in Article 6(1)(b) GDPR. The IE SA
acknowledges that the necessity test under Article 6(1)(b) GDPR may require considering contractual
terms and other relevant information, and that the information provided under Article 13(1)(c) GDPR
could, in some cases, inform a data subject’s expectations as to a contractual service. However, in the
present case, the IE SA considers that the transparency infringements it proposes for its Draft Decision
do not impact its findings on the legal basis, as it considers that the expectations and understanding
of the parties on the Terms of Use include personalised advertising 112 .

4.4 Assessment of the EDPB

4.4.1 Assessment of whether the objections were relevant and reasoned
72. The objections raised by the AT, DE, ES, FI, FR, HU, NL, NO and SE SAs concern “whether there is an
infringement of the GDPR” 113 .

73. The EDPB takes note of Meta IE’s view that not a single objection put forward by the CSAs meets the
threshold of Article 4(24) GDPR 114 . Meta IE’s primary argument is that “it is not open to the EDPB to
now decide on the lawfulness of Meta Ireland’s actual processing as the Objections suggest. Such an
assessment is not within the scope of the Inquiry as defined by the DPC 115 .” In Meta IE’s view, “the
EDPB cannot expand the scope of the Inquiry in the manner suggested by the CSAs through Objections

108
Composite Response, paragraph 74.
109
Composite Response, paragraph 76.
110 Composite Response, paragraph 78.
111 Composite Response, paragraphs 82-83.
112 Composite Response, paragraph 87.
113 EDPB Guidelines on RRO, paragraph 24.
114 Meta IE Article 65 Submissions, paragraph 2.4 and Annex I, p. 65.
115 Meta IE Article 65 Submissions, paragraph 2.4.

20
Adopted

that are not relevant to the substance of the Complaint.” and “such objections ‘ought to be disregarded
in their entirety by the EDPB” 116 . In this context, Meta IE cites EDPB Binding Decision 2/2022, adopted
on 28 July 2022 (hereinafter, “EDPB Binding Decision 2/2022”), and in particular, the EDPB’s analysis
of some of the objections in that case, which were found to be not relevant or reasoned, due to the
fact that these objections “fail[ed] to establish a direct connection with the specific legal and factual
content of the draft decision” 117 .

74. Contrary to Meta IE’s position on relevance, as described above, objections can have bearing on the
“specific legal and factual content of the Draft Decision”, despite not aligning with the scope of the
inquiry as defined by an LSA 118 .

75. In essence, Meta IE argues that CSAs may not, under any circumstance, express disagreement with
the scope of the inquiry as decided by the LSA by way of an objection. The EDPB does not share this
reading of Article 65 GDPR, as is explicitly stated in the EDPB RRO Guidelines 119 .

76. Further, Meta IE states that “several CSAs now propose to expand the scope of the Inquiry even further
to include many other unrelated issues.” and that in this regard Meta IE “agrees with the DPC’s position
in the Composite Memo that these unrelated issues raised by the CSAs are irrelevant to the resolution
of this Inquiry and that expanding the scope of the Inquiry at this point would seriously infringe Meta
Ireland’s procedural rights under both Irish and EU law 120 .” Meta IE also agrees with the IE SA’s position
in the Composite Response that “expanding the scope of the Inquiry at this point as the CSAs propose
would seriously infringe Meta Ireland’s legitimate expectations, right to fair procedures (including the

116 Meta IE Article 65 Submissions, paragraph 4.9.
117 In respect of Meta IE’s arguments in paragraph 4.9 of its Article 65 Submissions on these objections not being
“relevant”, the EDPB recalls that the analysis of whether a given objection meets the threshold set by Art. 4(24)
GDPR is carried out on a case-by-case basis. Meta IE refers to the EDPB’s Binding Decision 2/2022 and specifically
to the paragraphs where the EDPB established that specific objections raised by the DE SAs and NO SA in that
case were not relevant and reasoned. There are several differences between those objections and the objections
which are analysed in this section.
More specifically, in the Binding Decision 2/2022 the objections referred to by Meta IE did not “establish a direct
connection with the specific legal and factual content of the Draft Decision” (Binding Decision 2/2022 paragraphs
139, 147, 164) whereas each CSA here has made several clear links with the content of the Draft Decision, as is
described in paragraph 77 of this Binding Decision.
118 Meta IE does not consider that any of the objections are reasoned, as set out in their replies to each of the

objections in Annex 1. Meta IE Article 65 Submissions, Annex 1, pp. 66 - 124. In respect of Meta IE’s arguments
in paragraph 4.9 of its Article 65 Submissions on these objections not being reasoned, the EDPB notes that the
objections that were found to be not relevant and/or not reasoned in the Binding Decision 2/2022 did “not
provide sufficiently precise and detailed legal reasoning regarding infringement of each specific provision in
question”, did not explain sufficiently clearly, nor substantiate in sufficient detail how the conclusion proposed
could be reached, or did not sufficiently demonstrate the significance of the risk posed by the Draft Decision for
the rights and freedoms of the data subjects or the free flow of data within the EU (Binding Decision 2/2022,
paragraphs 140, 148, 165). Here, each CSA provides a number of legal and factual arguments and explanations
as to why an infringement for lack of appropriate legal basis is to be established, and adequately identifies the
risk posed by the Draft Decision if it was adopted unchanged (paragraphs 79-81 of this Binding Decision).
119 “For instance, if the investigation carried out by the LSA unjustifiably fails to cover some of the issues raised

by the complainant or resulting from an infringement reported by a CSA, a relevant and reasoned objection may
be raised based on the failure of the LSA to properly handle the complaint and to safeguard the rights of the data
subject.” EDPB Guidelines on RRO, paragraph. 27.
120 Meta IE Article 65 Submissions, paragraph 4.2.

21
Adopted

right to be heard) and rights of defence 121 ”. Despite claiming it this has been explained “clearly” in the
Composite Response, Meta IE does not demonstrate in which manner its procedural rights would be
inevitably breached by the mere fact that the EDPB finds specific objections admissible122 .
Admissibility determines the competence of the EDPB, but not the outcome of the dispute between
the LSA and the CSAs. Likewise, Meta IE does not explain how the mere act of considering the merits
of admissible objections inevitably and irreparably breaches the procedural rights cited by Meta IE 123 .
Accepting Meta IE’s interpretation would severely limit the EDPB possibility to resolve disputes arising
in the one-stop-shop, and thus undermine the consistent application of the GDPR.

77. The objections of the AT, DE, ES, FI, HU, FR, NL, NO and SE SAs all have a direct connection with the
LSA Draft Decision and refer to a specific part of the Draft Decision, i.e. Finding 2. All of those
objections concern “whether there is an infringement of the GDPR” as they argue that the IE SA should
have found an infringement of Article 6, 6(1) or (1)(b) of the GDPR. As the LSA considered that Article
6(1)(b) of the GDPR was not breached, the objections entail a need of a change of the LSA decision
leading to a different conclusion. Consequently, the EDPB finds that the AT, DE, ES, FI, HU, FR, NL, NO
and SE SAs objections relating to the infringement of Article 6, 6(1) or 6(1)(b) GDPR are relevant.

78. As regards the part of the DE SAs’ objection arguing that the IE SA should find an infringement of
Article 5(1)(a) GDPR and impose the erasure of unlawfully processed personal data and the ban of the
processing of data for the purpose of behavioural advertising until a valid legal basis is in place, the
part of the FI SA objection asking that the infringement of Article 6(1) be properly reflected in the
amount of the administrative fine, as well as the part of the NO SA objection arguing the IE SA should
order Meta IE to delete personal data processed under Article 6(1)(b) GDPR, as well as order Meta IE
to identify a valid legal basis for future online behavioural advertising or from now on abstain from
such processing activities, the EDPB notes that these parts of the objections concern “whether the
envisaged action in relation to the controller complies with the GDPR.” These parts of the objections
are linked to the IE SA’s Finding 2 with regard to Article 6(1)(b) GDPR. Therefore, they are directly
connected with the substance of the Draft Decision and, if followed, would lead to a different
conclusion. Thus, the EDPB considers that these parts of the DE, FI and NO SAs objections are relevant.

79. The objections of the AT, DE, ES, FI, FR, HU, NL, NO and SE SAs on the finding of an infringement are
reasoned because they all include clarifications and arguments on legal/factual mistakes in the LSA’s
Draft Decision that require amending. More specifically, the AT, DE, ES, FI, HU, FR, NL, NO and SE SAs
provide detailed arguments to challenge the Draft Decision’s consideration of behavioural advertising
as a necessary, core or fundamental aspect of a contract leading to the need to change the decision
and to find an infringement of Article 6(1)(b) GDPR 124 . Some of them provide detailed arguments

121
Meta IE Article 65 Submissions, paragraph 4.10, where Meta IE makes reference to paragraphs 32-33 of the
Composite Response.
122 Meta IE Article 65 Submissions, paragraph 4.10.
123 The EDPB fails to see how, for instance, declaring an objection admissible but rejecting it on merits could

impinge on the procedural rights of the controller involved in the underlying case.
124 AT SA Objection, pp. 4-5; DE SAs Objection, p. 5-6, ES SA Objection, p. 2, FI SA Objection, paragraphs 16 and

18, FR SA Objection, paragraphs 8-9, HU SA Objection, p. 3, NL SA Objection, paragraphs 18-19; NO SA Objection,
p. 7, SE SA Objection, pp. 3.

22
Adopted

challenging the validity of the contract on which the use of Article 6(1)(b) as a legal basis depends and
which the IE SA accepts 125 .

80. Some SAs recall, while referring to the terms of the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR,
that it is the fundamental and mutually understood contractual purpose, which justifies that the
processing is necessary 126 . This purpose is not only based on the controller’s perspective but also on
a reasonable data subject’s perspective when entering into the contract and thus on “the mutual
perspectives and expectations of the parties to the contract”. The AT, NL, and SE SAs contend that data
subjects do not reasonably expect that their data is being processed for personalised advertising
simply because Meta IE briefly refers to it in the Instagram Terms of Use 127 . The FR and NO SAs also
support this finding and add that data subjects cannot be presumed to be aware of the particularly
massive and intrusive nature of this processing 128 . Several SAs also consider that the Draft Decision is
inconsistent in finding that information on specific processing operations should have been provided,
linked with a specific or lawful basis, and described in an unambiguous manner, while considering that
data subjects had a perspective or expectation or were well informed that their data was being
processed for behavioural advertising 129 .

81. The AT, DE, ES, FI, FR, HU, NL, NO and SE SAs objections also identify risks posed by the Draft Decision,
in particular an interpretation of Article 6(1)(b) that could be invoked by any controller and would
undermine or bypass data protection principles, and thus endanger the rights of data subjects within
the EEA 130 .

82. Meta IE’s contends that in terms of risk, the objections must “demonstrate the likelihood of a direct
negative impact of a certain significance of the Draft Decision on fundamental rights and freedoms
under the Charter and not just any data subject rights 131 .” Meta IE thus adds a condition to Article
4(24) GDPR, which is not supported by the GDPR 132 .

83. As regards the parts of the DE and NO SAs’ objections requesting the finding of an infringement of
Article 5(1)(a) GDPR, and the parts of the DE, FI and NO SAs’ objections requesting specific corrective
measures under Article 58 GDPR for the infringement of Article 6(1) or 6(1)(b) GDPR, namely the
imposition of an administrative fine, a ban of the processing of personal data for the purpose of
behavioural advertising, an order to delete personal data processed under Article 6(1)(b) GDPR and
an order to identify a valid legal basis for future online behavioural advertising or to abstain from such
processing activities, the EDPB considers that these parts of the objections do not sufficiently
elaborate the legal or factual arguments that would justify a change in the Draft Decision leading to
the finding of an infringement of Article 5(1)(a) GDPR or to the imposition of the specific corrective

125 DE SAs Objection, pp. 3-4 ; NL SA Objection, paragraphs 7 and 10-12.
126 AT SA Objection, p.4; DE SAs Objection pp.5-6 ; FR SA Objection, paragraphs 9-11; NL SA Objection paragraph
18; NO SA Objection, p. 7-8; SE SA Objection, p. 3. EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs
32 and 33.
127 AT SA Objection, pp.3-4; NL SA Objection, paragraph 28, 30 - 32 ; SE SA Objection, p.3.
128 FR SA Objection, paragraph 18; IT SA Objection, paragraph 2.6, NO SA Objection, pp.6-7.
129 AT SA Objection, p.4; NL SA Objection, paragraph 30; SE SA Objection, p.3.
130 See their description of the risks in paragraphs 57-63 above.
131 Meta IE Article 65 Submissions, p. 64.
132 Article 1(2) GDPR provides that the GDPR itself “protects fundamental rights and freedoms of natural persons

and in particular their right to protection of personal data”, which directly stems from Article 8(1) of the Charter.
Therefore, there is no reason to draw a distinction between the data subject rights protected by the GDPR and
the fundamental rights protected under the Charter when interpreting Article 4(24) GDPR.

23
Adopted

measures mentioned above. Likewise, the significance of the risk for the data subjects, which stems
from the IE SA’s decision not to conclude on the infringement of Article 5(1)(a) GDPR and not to impose
the requested corrective measures, is not sufficiently demonstrated.

84. Considering the above, the EDPB finds that the objections of the AT, DE, ES, FI, FR, HU, NL, NO and SE
SAs are relevant and reasoned in accordance with Article 4(24) GDPR.

85. However, the parts of the DE and NO SAs’ objections concerning the additional infringement of Article
5(1)(a) GDPR and the imposition of specific corrective measures, namely the imposition of an
administrative fine, a ban on the processing of personal data for the purpose of behavioural
advertising, an order to delete personal data processed under Article 6(1)(b) GDPR and an order to
identify a valid legal basis for future behavioural advertising or to abstain from such processing
activities are not reasoned and do not meet the threshold of Article 4(24) GDPR Similarly, the part of
the FI SA’s objection concerning the imposition of a specific corrective measure, namely an
administrative fine is not reasoned and does not meet the threshold of Article 4(24) GDPR.

4.4.2 Assessment on the merits
86. In accordance with Article 65(1)(a) GDPR, in the context of a dispute resolution procedure, the EDPB
shall take a binding decision concerning all the matters which are the subject of the relevant and
reasoned objections, in particular whether there is an infringement of the GDPR.

87. The EDPB considers that the objections found to be relevant and reasoned in this subsection require
an assessment of whether the Draft Decision needs to be changed insofar as it rejects the
Complainant’s claim that the GDPR does not permit Meta IE’s reliance on Article 6(1)(b) GDPR to
process personal data in the context of its offering of the Instagram Terms of Use 133 . When assessing
the merits of the objections raised, the EDPB also takes into account Meta IE’s position on the
objections and its submissions.

Meta IE’s position on the objections and its submissions
88. In its submissions, Meta IE argues that the objections lack merit. Meta IE considers that they are based
on incorrect factual assumptions and are legally flawed 134 . Meta IE states that its reliance on Article
6(1)(b) GDPR does not ‘bypass’ the GDPR. Nor would it, according to Meta IE, jeopardise data subject
rights, be limited to individually negotiated agreements or be affected by Meta IE’s purported pre-
GDPR legal basis for processing conducted pre-GDPR 135 .

89. Meta IE argues that there is a lack of factual material and evidence on the issues on which the CSAs
raise objections, including on its reliance on Article 6(1)(b) GDPR for the specific processing operations
it conducts in its Instagram service for the purposes of behavioural advertising 136 . Meta IE notes that
in its inquiry, the IE SA “only addresses the issue of whether Meta Ireland may in principle rely on
Article 6(1)(b) GDPR for purpose of behavioural advertising, but not the issue of whether Meta Ireland

133 These objections being those of the AT, DE, ES, FI, FR, HU, NL, NO and SE SAs arguing that the IE SA should
have found an infringement of Article 6(1)(b), 6(1) or 6 GDPR.
134 Meta IE Article 65 Submissions, paragraph 2.4.
135 Meta IE Article 65 Submissions, paragraph 2.5.
136 Meta IE Article 65 Submissions, paragraph 4.24 and 4.25.

24
Adopted

may in fact rely on Article 6(1)(b) GDPR, which would have required a detailed factual assessment of
all of Meta Ireland’s data processing. 137 “

90. At the same time, Meta IE contends that, to address the complaint, the IE SA did not have to reach
any conclusions as to whether the actual processing conducted by Meta IE to deliver behavioural
advertising based on Article 6(1)(b) GDPR was lawful. 138 Meta IE supports the IE’s position that “it
would not be appropriate to undertake substantial factual findings for an open-ended assessment of
all processing operations by Meta Ireland. 139 ”

91. Meta IE thus agrees with the finding the IE SA reached on Meta IE’s not being precluded from relying
on Article 6(1)(b) GDPR for the processing of data necessary to deliver behavioural advertising upon
the IE SA’s review of the Instagram Terms of Use and the nature of the Instagram service as described
in those terms 140 .

92. Meta IE defends that Article 6(1)(b) GDPR can be relied on as a legal basis for behavioural
advertising 141 . Meta IE argues that its application requires the assessment of whether a given data
processing operation, when properly investigated and analysed, is actually necessary for the
performance of a contract 142 . Meta IE notes that the provision of a personalised experience, including
in the form of behavioural advertising, is “core” to the Instagram Service (as per the Terms of Use
which govern the contractual relationship between Meta IE and Instagram users) 143 .

93. Meta IE argues that the Terms of Use make clear that users will be shown advertising personalised to
their interests under the heading “Connecting you with brands, products, and services in ways you
care about” 144 . Meta IE supports the DPC’s finding, based on its review of the Instagram Terms of Use
and that Instagram is “promoted as such”, that an average user who accepts the Terms of Use would
have the expectation that personalisation, including in the form of behavioural advertising, forms a
core and integral part of the Instagram of Service 145 . Meta IE backs this argument with a reference to
a survey and a study conducted by a private entity and a digital industry association 146 . Meta IE
considers that its compliance with the GDPR’s transparency obligations involves a separate and
different legal assessment from Article 6(1)(b) GDPR 147 . Meta IE considers demonstrated in this case
that Meta IE and its users have a mutual expectation that personalisation, including in the form of
behavioural ads, is core to its Terms of Use 148 .

94. Meta IE recalls that the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR do not categorically prohibit
reliance on Article 6(1)(b) GDPR for behavioural advertising 149 . Meta IE further adds, referring to the

137
Meta IE Article 65 Submissions, paragraph 4.23.
138
Meta IE Article 65 Submissions, paragraph 2.3.
139 Meta IE Article 65 Submissions, paragraph 4.23.
140 Meta IE Article 65 Submissions, paragraphs 2.3 and 4.7.
141 Meta IE Article 65 Submissions, paragraph 6.4.
142 Meta IE Article 65 Submissions, paragraph 6.7.
143 Meta IE Article 65 Submissions, paragraphs 6.13 and 6.17.

144 Meta IE Article 65 Submissions, paragraph 6.18.
145 Meta IE Article 65 Submissions, paragraphs 6.20 and 6.21.
146 Meta IE Article 65 Submissions, paragraph 6.21.
147 Meta IE Article 65 Submissions, paragraph 6.29.
148 Meta IE Article 65 Submissions, paragraph 6.29.
149 Meta IE Article 65 Submissions, paragraph 6.34.

25
Adopted

CJEU’s Huber judgment, that “processing beyond the most minimal required to achieve the processing
purpose could still be deemed ‘necessary’ if it allowed the relevant processing purpose to be ‘more
effectively’ achieved” 150 . Meta IE submits that even if Article 6(1)(b) GDPR required the processing to
be absolutely essential to perform the contract, it would be impossible to provide the Instagram
Service in accordance with the Term of Use without providing behavioural advertising 151 . Meta IE
states that the EDPB may not dictate the nature of the services Meta IE provides. Meta IE would view
this as a violation of Article 16 of the Charter on the freedom to conduct a business, enabling service
providers to determine what measures to take in order to achieve the result they seek, based on their
resources, abilities, and compatibility with other obligations and challenges they may encounter in the
exercise of their activity 152 .

95. Meta IE further argues that its reliance on the contractual necessity legal basis does not jeopardise
data subject rights 153 . Meta IE considers that these would also be protected by contract and consumer
protection legislations in the EU Member States 154 . Meta IE defends that the contractual necessity
legal basis is not limited to individually negotiated agreements and can also be used for standard form
contracts 155 . Meta IE further adds that it would be improper for CSAs and the EDPB to analyse the
validity of Instagram Terms of Use under applicable laws of contract or to draw inferences from
them 156 . In response to what Meta IE considers mischaracterisations in certain objections of national
contract law Meta IE provides expert reports on the validity of its Terms of Use in 10 Member States157 .

96. Meta IE concludes its arguments in support of its reliance on Article 6(1)(b) GDPR stating that its pre-
GDPR legal basis for data processing does not affect its flexibility to rely on other legal bases post GDPR
if it complies with the relevant requirements 158 . Meta IE also distinguishes behavioural advertising on
the Instagram Service from direct marketing pursuant to Article 21(2) GDPR and thus considers this
provision not applicable to behavioural advertising 159 .

The EDPB’s assessment of the merits
97. The EDPB considers it necessary to begin its assessment on the merits with a general description of
the practice of behavioural advertising carried out in the context of the Instagram service before
determining whether the legal basis of Article 6(1)(b) GDPR is appropriate for this practice in the
present case, based on the Instagram Terms of Use and the nature of its products and features as
described in those terms. The requests for preliminary rulings made to the CJEU in the cases C-252/21
and C-446/21 to which some of the documents in the file refer contain helpful descriptions of Meta’s

150
Judgement of the Court of Justice of 16 December 2008, Heinz Huber v Bundesrepublik Deutschland,
C-524/06, ECLI:EU:C:2008:724, (hereinafter ‘C-524/06 Huber’), paragraphs 62 and 66. Meta IE Article 65
Submission, paragraph 6.37.
151 Meta IE Article 65 Submissions, paragraph 6.38.
152 Meta IE Article 65 Submissions, paragraph 6.25.
153 Meta IE Article 65 Submissions, paragraph 6.8.

154 Meta IE Article 65 Submissions, paragraph 6.8.
155 Meta IE Article 65 Submissions, paragraphs 6.40 - 6.46.
156 Meta IE Article 65 Submissions, paragraphs 6.43 and 6.44.
157 Meta IE Article 65 Submissions, paragraphs 6.44 and 6.45 and Annex 2.
158 Meta IE Article 65 Submissions, paragraphs 6.47 - 6.49.
159 Meta IE Article 65 Submissions, paragraphs 6.50 - 6.57.

26
Adopted

behavioural advertising practices in the context of its Facebook services 160 . Given that behavioural
advertising is also carried out in the context of the Instagram service, and given the similarities
between the two services, relying on the same Data Policy 161 , the EDPB considers that these cases are
also useful in gaining an understanding of the practice of behavioural advertising in relation to the
Instagram service. Furthermore, in the request for a preliminary ruling in case C-252/21, it is
mentioned that if the CJEU answers the question 7 positively (regarding the competence of a Member
State national competition authority to determine, when assessing the balance of interests whether
data processing and their terms comply with the GDPR) that the questions 3 to 5 must be answered
in relation to data from the use of the group’s Instagram service. 162 In addition, Meta IE makes
reference to both of these requests for preliminary rulings in its submissions, and therefore clearly
considers them relevant to this case 163 .

98. These requests for preliminary rulings mention that Meta IE collects data on its individual users and
their activities on and off its Facebook service via numerous means such as the service itself, other
services of the Meta group including Instagram, WhatsApp and Oculus, third party websites and apps
via integrated programming interfaces such as Facebook Business Tools or via cookies, social plug-ins,
pixels and comparable technologies placed on the internet user’s computer or mobile device164 .
According to the descriptions provided, Meta IE links these data with the user’s Facebook account to
enable advertisers to tailor their advertising to Facebook’s individual users based on their consumer
behaviour, interests, purchasing power and personal situation. This may also include the user’s
physical location to display content relevant to the user’s location. Meta IE offers its services to its

160 C-252/21 Oberlandesgericht Düsseldorf request, pp. 6-7, available at:
https://curia.europa.eu/juris/showPdf.jsf?text=&docid=242143&pageIndex=0&doclang=en&mode=req&dir=&
occ=first&part=1&cid=644235 and C-446/21 Austrian Oberster Gerichtshof request, paragraphs 2-3, 6-13, 15-
23, available at
https://curia.europa.eu/juris/showPdf.jsf?text=&docid=247308&pageIndex=0&doclang=EN&mode=lst&dir=&
occ=first&part=1&cid=766249 ; see also the references to these requests for a preliminary ruling in the AT SA
Objection p. 1-2. and Meta IE Article 65 Submission, paragraphs 3.4-3.9.
161 See the similarities of the Instagram and Facebook services described in the Data Policy. The Instagram Data

Policy refers to both “Facebook settings” and “Instagram settings” (“This policy describes the information we
process to support Facebook, Instagram, Messenger and other products and features offered by Facebook
(Facebook Products or Products). You can find additional tools and information in the Facebook Settings and
Instagram Settings.”) Section I of this policy refers to the “Facebook products” when describing the kinds of
information collected for the processing. Instagram Data Policy of 22.05.2018, annex 2 of the Instagram
Complaint. Similarly, according to Instagram Terms of Use “Instagram is part of the Facebook Companies, which
share technology, systems, insights, and information-including the information we have about you (...) in order
to provide services that are better, safer, and more secure. We also provide ways to interact across the Facebook
Company Products that you use, and designed systems to achieve a seamless and consistent experience across
the Facebook Company Products.”
162 Question 3 reads “Can an undertaking, such as Facebook Ireland, which operates a digital social network

funded by advertising and offers personalised content and advertising, network security, product improvement
and continuous, seamless use of all of its group products in its terms of service, justify collecting data for these
purposes from other group services and third-party websites and apps via integrated interfaces such as Facebook
Business Tools, or via cookies or similar storage technologies placed on the internet user’s computer or mobile
device, linking those data with the user’s Facebook.com account and using them, on the ground of necessity for
the performance of the contract under Article 6(1)(b) of the GDPR or on the ground of the pursuit of legitimate
interests under Article 6(1)(f) of the GDPR?”
163 Meta IE Article 65 Submissions, paragraphs 3.2 - 3.9.
164 C-252/21 Oberlandesgericht Düsseldorf request, pp. 6-7.

27
Adopted

users free of charge and generates revenue through this personalised advertising that targets them,
in addition to static advertising that is displayed to every user in the same way.

99. The EDPB considers that these general descriptions signal by themselves the complexity, massive scale
and intrusiveness of the behavioural advertising practice that Meta IE conducts through the Facebook
service, as well as off the Facebook service itself, through third party websites and apps which are
connected to Facebook.com via programming interfaces (“Facebook Business Tools”), including the
Instagram service 165 . Furthermore, among the aspects described in the Instagram Terms of Use is
“Providing consistent and seamless experiences across other Facebook Company Products.” which
involves “shar[ing] technology, systems, insights, and information-including the information we have
about you.” It is therefore clear that personal data is shared between Facebook companies (”We use
data from Instagram and other Facebook Company Products, as well as from third-party partners, to
show you ads (...)”

100. These are relevant facts to consider to assess the appropriateness of Article 6(1)(b) GDPR as a legal
basis for behavioural advertising and to what extent reasonable users may understand and expect
behavioural advertising when they accept the Instagram Terms of Use and perceive it as necessary for
Meta IE to deliver its service 166 . Accordingly, the EDPB further considers that the IE SA could have
added to its Draft Decision a description of behavioural advertising that Meta IE conducts through the
Instagram service to appropriately substantiate its reasoning leading to its acceptance of Article
6(1)(b) GDPR as a legal basis for that practice in accordance with the IE SA’s duty to state the reasons
for an individual decision 167 .

101. Notwithstanding the EDPB’s considerations above, the EDPB considers that there is sufficient
information in the file for the EDPB to decide whether the IE SA needs to change its Draft Decision
insofar as it rejects the complainant’s claim that the GDPR does not permit Meta IE’s reliance on Article
6(1)(b) GDPR to process personal data in the context of its offering of the Instagram service, based on
its Terms of Use.

102. As described above in section 4.1., the IE SA concludes in Finding 2 of its Draft Decision that the
Complainant’s case was not made out that the GDPR does not permit the reliance by Meta IE on Article
6(1)(b) GDPR in the context of its offering of Terms of Use, neither Article 6(1)(b) GDPR nor any other
provision of the GDPR precludes Meta IE from relying on Article 6(1)(b) GDPR as a legal basis to deliver

165
C-252/21 Oberlandesgericht Düsseldorf request, pp. 6-7. Facebook Business Tools is also mentioned in
Instagram’s Data Policy.
166 In the same vein, the Advocate General also provides a description of behavioural advertising in his Opinion

on the case C-252/21 Oberlandesgericht Düsseldorf request, see Opinion of the Advocate General on 20
September 2022), ECLI:EU:C:2022:704, paragraphs 9 and 10.
167 See EDPB Guidelines on Art. 65(1)(a) GDPR, paragraph 84 and EDPB Guidelines 2/2022 on the application of

Article 60 GDPR (Version 1.0, Adopted on 14 March 2022), para. 111 (stating: “[…] every decision that is aimed
at legal consequences needs to include a description of relevant facts, sound reasoning and a proper legal
assessment. These requirements essentially serve the purpose of legal certainty and legal protection of the
parties concerned. Applied to the area of data protection supervision this means that the controller, processor
and complainant should be able to acknowledge all the reasons in order to decide whether they should bring
the case to trial. Having regard to the decision making process within the cooperation mechanism, CSAs
likewise need to be in the position to decide on possibly taking actions (e.g. agree to the decision, provide their
views on the subject matter)”).See also by analogy C-50/12 P Judgement of the Court of Justice of 26
November 2013, Kendrion NV v European Commission, ECLI:EU:C:2013:771.

28
Adopted

a service, including behavioural advertising insofar as that forms a core part of the service 168 . The IE
SA considers that, having regard to the specific terms of the contract and the nature of the service
provided and agreed upon by the parties, Meta IE may in principle rely on Article 6(1)(b) GDPR as a
legal basis of the processing of users’ data necessary for the provision of its Instagram service,
including through the provision of behavioural advertising insofar as this forms a core part of its service
offered to and accepted by its users 169 . The IE SA considers the core of the service offered by Meta IE
is premised on the delivery of personalised advertising 170 . The IE SA considers a reasonable user would
understand and expect this having read the Terms of Use 171 . Meta IE supports this conclusion of the
IE SA 172 .

103. To assess these claims of the IE SA and Meta IE, the EDPB considers it necessary to recall the general
objectives that the GDPR pursues, which must guide its interpretation, together with the wording of
its provisions and its normative context 173 .

104. The GDPR develops the fundamental right to the protection of personal data found in Article 8(1) of
the EU Charter of Fundamental Rights and Article 16(1) of the TFEU, which constitute EU primary
law 174 . As the CJEU clarified, “an EU act must be interpreted, as far as possible, in such a way as not to
affect its validity and in conformity with primary law as a whole and, in particular, with the provisions
of the Charter. Thus, if the wording of secondary EU legislation is open to more than one interpretation,
preference should be given to the interpretation which renders the provision consistent with primary
law rather than to the interpretation which leads to its being incompatible with primary law” 175 . In the
face of rapid technological developments and increases in the scale of data collection and sharing, the
GDPR creates a strong and more coherent data protection framework in the Union, backed by strong
enforcement, and built on the principle that natural persons should have control of their own personal
data 176 . By ensuring a consistent, homogenous and equivalent high level of protection throughout the
EU, the GDPR seeks to ensure the free movement of personal data within the EU 177 . The GDPR
acknowledges that the right to data protection needs to be balanced against other fundamental rights
and freedoms, such as the freedom to conduct a business, in accordance with the principle of
proportionality and has these considerations integrated into its provisions 178 . The GDPR, pursuant to
EU primary law, treats personal data as a fundamental right inherent to a data subject and his/her
dignity, and not as a commodity data subjects can trade away through a contract 179 . The CJEU provided

168
Draft Decision, paragraphs 112 and 115. Finding 2 reads: “I find the Complainant’s case is not made out that
the GDPR does not permit the reliance by Meta Ireland on 6(1)(b) GDPR in the context of its offering of Terms of
Use.”
169 Draft Decision, paragraph 113.
170 Draft Decision, paragraph 104.
171 Draft Decision, paragraph 105.
172 Meta IE Article 65 Submissions, paragraphs 6.21 and 6.30.
173 Judgement of the Court of Justice of 1 August 2022, Vyriausioji tarnybinės etikos komisija, Case C-184/20,

ECLI:EU:C:2022:601, (hereinafter ‘C-184/20 Vyriausioji tarnybinės etikos komisija’), paragraph 121.
174 Recitals 1 and 2 GDPR.
175 Judgement of the Court of Justice of 21 June 2022, Ligue des droits humains v. Conseil des ministres, C 817/19,

ECLI:EU:C:2022:491, (hereinafter ‘C-817/19 Ligue des droits humains'), paragraph 86; and Judgement of the
Court of Justice of 2 February 2021, Consob, C-481/19, ECLI:EU:C:2021:84, paragraph 50 and the case-law cited.
176 Article 1(1)(2) and Recital 6 and 7 GDPR.
177 Article 1(3) and Recitals 9, 10 and 13 GDPR.
178 Recital 4 GDPR.
179 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 54.

29
Adopted

additional interpretative guidance by asserting that the fundamental rights of data subjects to privacy
and the protection of their personal data override, as a rule, a controller’s economic interests 180 .

105. The principle of lawfulness of Article 5(1)(a) and Article 6 GDPR is one of the main safeguards to the
protection of personal data. It follows a restrictive approach whereby a controller may only process
the personal data of individuals if it is able to rely on one of the bases found in the exhaustive and
restrictive lists of the cases in which the processing of data is lawful under Article 6 GDPR 181 .

106. The principle of lawfulness goes hand in hand with the principles of fairness and transparency in Article
5(1)(a) GDPR. The principle of fairness includes, inter alia, recognising the reasonable expectations of
the data subjects, considering possible adverse consequences processing may have on them, and
having regard to the relationship and potential effects of imbalance between them and the
controller 182 .

107. The EDPB agrees with the IE SA and Meta IE that there is no hierarchy between these legal bases183 .
However, this does not mean that a controller, as Meta IE in the present case, has absolute discretion
to choose the legal basis that suits better its commercial interests. The controller may only rely on one
of the legal bases established under Article 6 GDPR if it is appropriate for the processing at stake184 . A
specific legal basis will be appropriate insofar as the processing can meet its requirements set by the
GDPR and fulfil the objective of the GDPR to protect the rights and freedoms of natural persons and
in particular their right to the protection of personal data 185 . The legal basis will not be appropriate if
its application to a specific processing defeats this practical effect “effet utile” pursued by the GDPR
and Article 5(1)(a) and Article 6 GDPR 186 . These criteria stem from the content of the GDPR and the
interpretation favourable to the rights of data subjects to be given thereto described in paragraph 104
above 187 .

108. The GDPR makes Meta IE, as a data controller for the processing at stake, directly responsible for
complying with the Regulation’s principles, including the processing of data in a lawful, fair and
transparent manner, and any obligations derived therefrom 188 . This obligation applies even where the

180 Judgement of the Court of Justice of 13 May 2014, Google Spain SL, C-131/12, ECLI:EU:C:2014:317,
paragraphs 97 and 99.
181 Judgement of the Court of Justice of 11 December 2019, TK v Asociaţia de Proprietari bloc M5A-ScaraA, C

708/18, ECLI:EU:C:2019:1064, (hereinafter ‘C 708/18 TK v Asociaţia de Proprietari'), paragraph 37.
182 See, Recital 39 GDPR and EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 11 and 12.
183 Draft Decision paragraph 48 and Meta IE Article 65 Submission paragraph 5.10.
184 As mentioned in the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 18, the identification of the

appropriate lawful basis is tied to the principles of fairness and purpose limitation. It will be difficult for
controllers to comply with these principles if they have not first clearly identified the purposes of the processing,
or if processing of personal data goes beyond what is necessary for the specified purposes. See also Section 6 of
this Binding Decision on the potential additional infringement of the principle of fairness.
185 C 708/18 TK v Asociaţia de Proprietari, paragraph 37.
186 See C-524/06 Huber, paragraph 52 on the concept of necessity being interpreted in a manner that fully

reflects the objective of Directive 95/46). On the importance of considering the practical effect (effet utile)
sought by EU law in its interpretation, see also for instance: C-817/19 Ligue des droits humains, paragraph 195
and Judgement of the Court of Justice of 17 September 2002, Muñoz and Superior Fruiticola, C 253/00,
ECLI:EU:C:2002:497, paragraph 30.
187 Article 1(1)(2) and (5) GDPR.
188 Article 5 (2) GDPR “Principle of accountability” of data controllers; see also C-252/21 Oberlandesgericht

Düsseldorf request, Opinion of the Advocate General on 20 September 2022, ECLI:EU:C:2022:704, paragraph 52.

30
Adopted

practical application of GDPR principles such as those of Article 5(1)(a) and Article (5)(2) GDPR is
inconvenient or runs counter to the commercial interests of Meta IE and its business model. The
controller is also obliged to be able to demonstrate that it meets these principles and any obligations
derived therefrom, such as that it meets the specific conditions applicable to each legal basis 189 .

109. The first condition to be able to rely on Article 6(1)(b) GDPR as a legal basis to process the data
subject’s data is that a controller, in line with its accountability obligations under Article 5(2) GDPR,
has to be able to demonstrate that (a) a contract exists and (b) the contract is valid pursuant to
applicable national contract laws 190 .

110. Both the IE SA and Meta IE consider that the Terms of Use make up the entire agreement between
the Instagram user and Meta IE and that the Data Policy is simply a compliance document setting out
information to fulfil the GDPR transparency obligations 191 . The IE SA thus considers that the contract
for which the analysis based on Article 6(1)(b) GDPR takes place, is the Terms of Use 192 .

111. The IE SA and Meta IE argue that the GDPR does not confer a broad and direct competence to
supervisory authorities to interpret or assess the validity of contracts 193 .

112. The EDPB agrees that SAs do not have under the GDPR a broad and general competence in contractual
matters. However, the EDPB considers that the supervisory tasks that the GDPR bestows on SAs imply
a limited competence to assess a contract’s general validity insofar as this is relevant to the fulfilment
of their tasks under the GDPR. Otherwise, the SAs would see their monitoring and enforcement task
under Article 57(1)(a) GDPR limited to actions such as verifying whether the processing at stake is
necessary for the performance of a contract (Article 6(1)(b) GDPR), and whether a contract with a
processor under Article 28(3) GDPR and data importer under Article 46(2) GDPR includes appropriate
safeguards pursuant to the GDPR. Pursuant to the IE SA’s interpretation, the SAs would thus be obliged
to always consider a contract valid, even in situations where it is manifestly evident that it is not, for
instance because there is no proof of agreement between the two parties, or because the contract
does not comply with its Member State’s rules on the validity, formation or effect of a contract in
relation to a child 194 .

113. As the DE and NL SAs 195 argue, the validity of the contract for the Instagram service between Meta IE
and the complainant is questionable, given the strong indications that the Complainant was unaware
of entering into a contract, and (as the IE SA establishes with its Finding 3 of its Draft Decision) serious
transparency issues in relation to the legal basis relied on. In contract law, as a general rule, both
parties must be aware of the substance of the contract and the obligations of both parties to the
contract in order to willingly enter into such contract.

189
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 26.
190
EDPB Binding Decision 2/2022, paragraph 84.
191 Draft Decision, paragraphs 72 and 73.
192 Draft Decision, paragraph 73.
193Composite Response, paragraph 51; Draft Decision, paragraph 95, Meta IE Article 65 Submissions, paragraph

6.43.
194 Article 8(3) GDPR.
195 DE SAs Objection, p.4 and NL SA Objection, paragraph 11.

31
Adopted

114. Notwithstanding the possible invalidity of the contract, the EDPB, refers to its previous interpretative
guidance on this matter to provide below its analysis on whether behavioural advertising is
objectively necessary for Meta IE to provide its Instagram service to the user based on its Terms of
Use and the nature of the service 196 .

115. The EDPB recalls 197 that for the assessment of necessity under Article 6(1)(b) GDPR, “[i]t is important
to determine the exact rationale of the contract, i.e. its substance and fundamental objective, as it is
against this that it will be tested whether the data processing is necessary for its performance”198 . As
the EDPB has previously stated, regard should be given to the particular aim, purpose, or objective of
the service and, for applicability of Article 6(1)(b) GDPR, it is required that the processing is objectively
necessary for a purpose and integral to the delivery of that contractual service to the data subject 199 .

116. Moreover, the EDPB notes that the controller should be able to justify the necessity of its processing
by reference to the fundamental and mutually understood contractual purpose. This depends not only
on the controller’s perspective, but also on a reasonable data subject’s perspective when entering into
the contract 200 .

117. The IE SA accepts the EDPB’s position that, as a general rule, processing of personal data for
behavioural advertising is not necessary for the performance of a contract for online services201 .
However, the IE SA considers that in this particular case, having regard to the specific terms of the
contract and the nature of the Instagram service provided and agreed upon by the parties, Meta IE
may in principle rely on Article 6(1)b) GDPR to process the user’s data necessary for the provision of
its service, including through the provision of behavioural advertising insofar as this forms a core part
of that service offered to and accepted by users 202 .

118. The IE SA views behavioural advertising as “the core of both Meta Ireland’s business model and the
bargain struck between Meta Ireland and Instagram users” 203 . In support of this consideration, the IE
SA refers to the ”first and sixth clauses” of “the specific contract entered into between Meta IE and
Instagram users” 204 . The IE SA considers that from the text of these “clauses” it is “clear that the core
of the service offered by Meta Ireland is premised on the delivery of personalised advertising. 205 ” The
IE SA considers that this position is supported by the fact that “the Terms of Use describe the Instagram
service as being ‘personalised’ and connects users with brands, including by means of providing
‘relevant’ advertising and content.” Based on this, the IE SA is of the view that “It is clear that the
Instagram service is advertised as offering a 'personalised' experience, including by way of the
advertising it delivers to users 206 .” The IE SA considers that as the Instagram service is “advertised” in
its Terms of Use “as being predicated on personalised advertising (...) any reasonable user would

196
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR.
197
See Binding Decision 2/2022, paragraph 89.
198 WP29 Opinion 6/2014 on the notion of legitimate interests, p. 17
199 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 30.
200 See Binding Decision 2/2022, paragraph 90.

201 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 52. Draft Decision, paragraph 113.
202 Draft Decision, paragraph 113.
203 Draft Decision, paragraph 102 and Finding 2.
204 Draft Decision, paragraph 103.
205 Draft Decision, paragraph 104.
206 Draft Decision, paragraph 104.

32
Adopted

expect and understand that this is part of the core bargain that is being struck (...)” but acknowledges
that “users may prefer that the market offer alternative choices 207 .”

119. On this issue, the EDPB recalls that the concept of necessity has its own independent meaning under
EU law. It must be interpreted in a manner that fully reflects the objective pursued by an EU
instrument, in this case, the GDPR 208 . Accordingly, the concept of necessity under Article 6(1)(b) GDPR
cannot be interpreted in a way that undermines this provision and the GDPR’s general objective of
protecting the right to the protection of personal data or contradicts Article 8 of the Charter 209 . On
the processing of data in the Facebook services, Advocate General Rantos supports a strict
interpretation of Article 6(1)(b) GDPR among other legal bases, particularly to avoid any circumvention
of the requirement for consent 210 . Given the similarities between the Facebook and Instagram
services, as explained above in paragraph 97, and the fact that this case may concern the legal basis
for processing of personal data for the Instagram service 211 .

120. As the IE SA states in its Draft Decision, “Instagram is a global online social network service which
allows registered users to communicate with other registered users through messages, audio, video
calls and video chats, and by sending images and video files 212 .” Meta IE promotes among its
prospective and current users the perception that the main purpose of the Instagram service and for
which it processes its users’ data is to enable them to share content and communicate with others.
Meta IE presents its Instagram service on its “About” page of its website as a platform which “give[s]
people the power to build community and bring[s] the world closer together 213 .” At the beginning of
its Terms of Use, Meta IE presents its mission for the Instagram service as “To bring you closer to the
people and things you love 214 .” The description of the aspects of the service includes “Offering
personalized opportunities to create, connect, communicate.”

121. The fact that the Terms of Use do not provide for any contractual obligation binding Meta IE to offer
personalised advertising to the Instagram users and any contractual penalty if Meta IE fails to do so
shows that, at least from the perspective of the Instagram user, this processing is not necessary to
perform the contract 215 . Providing personalised advertising to its users may be an obligation between

207 Draft Decision, paragraph 105.
208 See paragraphs 103-104 above on the principles guiding the interpretation of the GDPR and its provisions.
The CJEU also stated in Huber that “what is at issue is a concept [necessity] which has its own independent
meaning in Community law and which must be interpreted in a manner which fully reflects the objective of that
Directive, [Directive 95/46], as laid down in Article 1(1) thereof”. C-524/06 Huber, paragraph 52.
209 Article 1(2) GDPR.
210 C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,

ECLI:EU:C:2022:704, paragraph 51. (The EDPB refers to the Advocate General’s Opinion in its Binding Decision
as an authoritative source of interpretation to underline the EDPB’s reasoning on the processing of data in the
Facebook Service, without prejudice to the case-law that the CJEU may create with its future judgments on the
Cases C-252/21 and C-446/21).
211 Paragraph 97 and footnote 161 of this Binding Decision.
212 Draft Decision, paragraph 5.
213 https://about.instagram.com/

214 Both the IE SA and Meta IE consider the Instagram Terms of Use as constituting the entire contract between

Meta IE and the Instagram users (see paragraphs 92, 110 and 118 of this Binding Decision).
215 The Instagram Terms of Use are formulated in one-sided terms as follows: “These Terms of Use govern your

use of Instagram and provide information about the Instagram Service (...).“ While under the first heading of the
Terms of Use (“The Instagram Service”), Instagram announces that it “provide[s]“ the Instagram service. After
describing the aspects of the service and referencing the Data Policy, the Instagram Terms of Use include a

33
Adopted

Meta IE and the specific advertisers that pay for Meta IE’s targeted display of their advertisements in
the Instagram service to Instagram users, but it is not presented as an obligation towards the
Instagram users.

122. Nor does Meta IE’s business model of offering services, at no monetary cost for the user to generate
income by behavioural advertisement to support its Instagram service make this processing necessary
to perform the contract. Under the principle of lawfulness of the GDPR and its Article 6, it is the
business model which must adapt itself and comply with the requirements that the GDPR sets out in
general and for each of the legal bases and not the reverse. As the Advocate General Rantos stressed
recently in his opinion on Meta IE’s processing in Facebook, based on Article 5(2) GDPR, it is the
controller (Meta IE) in this case who is responsible for demonstrating that the personal data are
processed in accordance with the GDPR 216 .

123. As the EDPB provided in its guidance, “Assessing what is ‘necessary’ involves a combined, fact-based
assessment of the processing ‘for the objective pursued and of whether it is less intrusive compared to
other options for achieving the same goal’. If there are realistic, less intrusive alternatives, the
processing is not ‘necessary’. Article 6(1)(b) will not cover processing which is useful but not objectively
necessary for performing the contractual service or for taking relevant pre-contractual steps at the
request of the data subject, even if it is necessary for the controller’s other business purposes. 217 ”

124. On the question of whether here there are realistic, less intrusive alternatives to behavioural
advertising that make this processing not “necessary” 218 , the EDPB considers that there are. The AT
and SE SAs mention as examples contextual advertising based on geography, language and content,
which do not involve intrusive measures such as profiling and tracking of users 219 . In his recent opinion
on Facebook, Advocate General Rantos also refers to the Austrian Government’s “pertinent”
observation that in the past, Meta IE allowed Facebook users to choose between a chronological
presentation and a personalised presentation of newsfeed content, which, in his view, proves that an
alternative method is possible 220 . By considering the existence of alternative practices to behavioural
advertising that are more respectful of the Instagram users’ right to data protection, the EDPB, as the
Advocate General did in relation to Facebook users, aims to assess if this processing is objectively

section which is headed with “Your Commitments”. While Instagram itself only “offers” various services, it makes
clear that the Instagram Terms of Use unilaterally impose duties and obligations on the user. Otherwise, the
user may face suspension or termination of their account, as described under “Content Removal and Disabling
or Terminating Your Account” of the Instagram Terms of Use. No (contractual) sanctions appear to apply in the
event that Meta IE fails to provide or poorly performs one or more of these services.
216 C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,

ECLI:EU:C:2022:704, paragraph 52.
217 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 25.
218 In Schecke, the CJEU held that, when examining the necessity of processing personal data, the legislature

needed to take into account alternative, less intrusive measures. Judgement of the Court of Justice of 9
November 2010, Volker und Markus Schecke GbR, C-92/09 and C 93/09, ECLI:EU:C:2010:662, (hereinafter ‘Case
C-92/09 and C 93/09 Schecke’), paragraph 52. This was repeated by the CJEU in the Rīgas case where it held that
“As regards the condition relating to the necessity of processing personal data, it should be borne in mind that
derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly
necessary”. Judgement of the Court of Justice of 4 May 2017, Valsts policijas Rīgas reģiona pārvaldes Kārtības
policijas pārvalde v Rīgas pašvaldības SIA ‘Rīgas satiksme’, C 13/16, ECLI:EU:C:2017:336, paragraph 30..
219 AT SA Objection, p.5; SE SA Objection, p.3.
220 C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,

ECLI:EU:C:2022:704, footnote 80.

34
Adopted

necessary to deliver the service offered, as perceived by the Instagram user whose personal data is
processed, and not to dictate the nature of Meta IE’s service or impose specific business models on
controllers, as Meta IE and the IE SA respectively argue 221 . The EDPB considers that Article 6(1)(b)
GDPR does not cover processing which is useful but not objectively necessary for performing the
contractual service, even if it is necessary for the controller’s other business purposes 222 .

125. The EDPB considers that the absolute right available to data subjects, under Article 21(2)(3) GDPR to
object to the processing of their data (including profiling) for direct marketing purposes further
supports its consideration that, as a general rule, the processing of personal data for behavioural
advertising is not necessary to perform a contract. The processing cannot be necessary to perform a
contract if a data subject has the possibility to opt out from it at any time, and without providing any
reason.

126. The EDPB finds that a reasonable user cannot expect that their personal data is being processed for
behavioural advertising simply because Meta IE briefly refers to this processing in its Instagram Terms
of Use (which Meta IE and the IE SA consider as constituting the entirety of the contract), or because
of the “wider circumstances” or “recognised public awareness of this form of processing” derived from
its “widespread prevalence of OBA processing” to which the IE SA refers 223 . Behavioural advertising,
as briefly described in paragraph 98 above, is a set of processing operations of personal data of great
technical complexity, which has a particularly massive and intrusive nature. In view of the
characteristics of behavioural advertising, coupled with the very brief and insufficient information that
Meta provides about it in the Instagram Terms of Use and Data Policy (a separate document that the
IE SA and Meta IE do not even consider part of the contractual obligations), the EDPB finds it extremely
difficult to argue that an average user can fully grasp it, be aware of its consequences and impact on
their rights to privacy and data protection, and reasonably expect it solely based on the Instagram
Terms of Use. The EDPB recalls its Guidelines 2/2019 on Article 6(1)(b) GDPR, in which it argues that
the expectations of the average data subject need to be consider in light, not only of the terms of
service but also the way this service is promoted to users 224 . Advocate General Rantos expresses
similar doubts where he says in relation to Facebook behavioural advertising practices “I am curious
as to what extent the processing might correspond to the expectations of an average user and, more
generally, what ‘degree of personalisation’ the user can expect from the service he or she signs up
for” 225 and adds in a footnote that he does not “believe that the collection and use of personal data
outside Facebook are necessary for the provision of the services offered as part of the Facebook
profile” 226 .

127. The EDPB notes that the mission of the Instagram service, as expressed in its Terms of Use, is
formulated in a vague and broad manner (“To bring you closer to the people and things you love.”)
When using the Instagram service, a user is primarily confronted with the possibility of viewing

221
Meta IE Article 65 Submissions, paragraph 6.25 and Composite Response, paragraph 76. On the relevance of
this Opinion for assessing Instagram’s reliance on Article 6(1)(b) GDPR, see paragraph 97 of this Binding Decision.
222 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 25.

223 Composite Response, paragraphs 72 and 73.
224 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 57.
225 C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,

ECLI:EU:C:2022:704, paragraph 56.
226 Ibid, footnote 81. On the relevance of this Opinion for assessing Instagram’s reliance on Article 6(1)(b) GDPR,

see paragraph 97 of this Binding Decision.

35
Adopted

photographs and videos by people or organisations that they follow, as well as sharing such content
with their followers. This is acknowledged by the IE SA which provides the following description of the
Instagram service in its Draft Decision: “Instagram is a global online social network service which
allows registered users to communicate with other registered users through messages, audio, video
calls and video chats, and by sending images and video files 227 .”

128. Based on the considerations above, the EDPB considers that the main purpose for which users use
Instagram and accept its Terms of Use is to share content and communicate with others, not to receive
personalised advertisements.

129. Meta IE infringed its transparency obligations under Article 5(1)(a), Article 12(1) and Article 13(1)(c)
GDPR by not clearly informing the complainant and other users of the Instagram Service specific
processing operations, the personal data processed in them, the specific purposes they serve, and the
legal basis on which each of the processing operations relies, as the IE SA concludes in its Draft
Decision 228 . The EDPB considers that this fundamental failure of Meta IE to comply with its
transparency obligations contradicts the IE SA’s finding that Instagram users could reasonably expect
online behavioural advertising as being necessary for the performance of their contract (as described
in the Instagram Terms of Use) with Meta IE 229 .

130. The EDPB recalls that “controllers should make sure to avoid any confusion as to what the applicable
legal basis is” and that this is “particularly relevant where the appropriate legal basis is Article 6(1)(b)
GDPR and a contract regarding online services is entered into by data subjects”, because “[d]epending
on the circumstances, data subjects may erroneously get the impression that they are giving their
consent in line with Article 6(1)(a) GDPR when signing a contract or accepting terms of service”230 .
Article 6(1)(b) GDPR requires the existence, validity of a contract, and the processing being necessary
to perform it. These conditions cannot be met where one of the Parties (in this case the data subject)
is not provided with sufficient information to know that they are signing a contract, the processing of
personal data that it involves, for which specific purposes and on which legal basis, and how this
processing is necessary to perform the services delivered. These transparency requirements are not
only an additional and separate obligation, as the IE SA seems to imply, but also an indispensable and
constitutive part of the legal basis 231 .

131. The risks to the rights of data subjects derived from this asymmetry of information and an
inappropriate reliance on this legal basis are higher in situations such as in the present case, in which
the Complainant and other Instagram users face a “take it or leave it” situation resulting from the
standard contract pre-formulated by Meta IE and the lack of few alternative services in the market.
The EU legislator has regularly identified and aimed to address with multiple legal instruments these
risks and the imbalance between the parties to consumer contracts. For example, Directive 93/13/EEC

227 Draft Decision, paragraph 5.
228 Draft Decision, paragraphs 184 and 185 and Finding 3, which reads “In relation to processing for which Article
6(1)(b) GDPR is relied on, Articles 5(1)(a), 12(1) and 13(1)(c) GDPR have been infringed.”
229 Draft Decision, paragraph 105 and Finding 2.
230 EDPB Binding Decision 1/2021, paragraph 214 and EDPB Guidelines 2/2019 on Article 6(1)(b), paragraph 20.
231 Draft Decision, paragraph 111.

36
Adopted

on unfair terms in consumer contracts 232 mandates, as the transparency obligations under the GDPR,
the use of plain, intelligible language in the terms of the contracts offered to consumers 233 . This
Directive even provides that where there is a doubt about the meaning of a term, the interpretation
most favourable to the consumer shall prevail 234 . Processing of personal data that is based on what is
deemed to be an unfair term under this Directive will generally not be consistent with the requirement
under Article 5(1)(a) GDPR that the processing is lawful and fair 235 .

132. Advocate General Rantos concludes in reference to Meta IE that the fact that an undertaking providing
a social network enjoys a dominant position in the domestic market for online social network for
private users “does play a role in the assessment of the freedom of consent within the meaning of that
provision, which it is for the controller to demonstrate, taking into account, where appropriate, the
existence of a clear imbalance of power between the data subject and the controller, any requirement
for consent to the processing of personal data other than those strictly necessary for the provision of
the services in question, the need for consent to be specific for each purpose of processing and the
need to prevent the withdrawal of consent from being detrimental to users who withdraw it 236 .” In line
with the logic of this argument, the EDPB considers that the dominant position of Meta IE also plays
an important role in the assessment of Meta IE’s reliance on Article 6(1)(b) GDPR for its Instagram
service and its risks to data subjects, especially considering how deficiently Meta IE informs the
Instagram users of the data it strictly needs to process to deliver the service.

133. Given that the main purpose for which a user uses Instagram service is to share and receive content,
and communicate with others 237 , and that Meta IE conditions their use to the user’s acceptance of a
contract and the behavioural advertising they include, the EDPB cannot see how a user would have
the option of opting out of a particular processing which is part of the contract as the IE SA seems to
argue 238 . The users’ lack of choice in this respect would rather indicate that Meta IE’s reliance on the
contractual performance legal basis deprives users of their rights, among others, to withdraw their
consent under Articles 6(1)(a) and 7 and/or to object to the processing of their data based on Article
6(1)(f) GDPR.

134. The EDPB agrees with the AT, DE, ES, FI, FR, HU, NL, NO and SE SAs that there is a risk that the Draft
Decision’s failure to establish Meta IE’s infringement of Article 6(1)(b) GDPR, pursuant to the IE SA’s
interpretation of it, nullifies this provision and makes lawful theoretically any collection and reuse of
personal data in connection with the performance of a contract with a data subject 239 . Meta IE
currently leaves the complainant and other users of the Instagram service with a single choice. They
may either contract away their right to freely determine the processing of their personal data and

232 A contractual term that has not been individually negotiated is unfair under the Directive 93/13/EEC “if,
contrary to the requirement of good faith, it causes a significant imbalance in the parties’ rights and obligations
arising under the contract, to the detriment of the consumer” Article 3(1).
233 Articles 4(2) and 5 Directive 93/13/EEC.
234 Article 5 Directive 93/13/EEC.
235 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, footnote 10.
236 C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,

ECLI:EU:C:2022:704, Conclusion, paragraph 78 (4). On the relevance of this Opinion for assessing Instagram’s
reliance on Article 6(1)(b) GDPR, see paragraph 97 of this Binding Decision
237 See paragraphs 127-128 of this Binding Decision.
238 Composite Response, paragraph 69.
239 AT SA Objection, pp.5-6; DE SAs Objection, p. 9; ES SA Objection, p. 3 ; FI SA Objection paragraphs 31-35 ; FR

SA Objection, paragraphs 34-35; HU SA Objection, p. 4 ; NL SA Objection, paragraphs 30-31 ; NO SA Objection,
p. 8; SE SA Objection, p.5.

37
Adopted

submit to its processing for the obscure, and intrusive purpose of behavioural advertising, which they
can neither expect, nor fully understand based on the insufficient information Meta IE provides to
them. Or, they may decline accepting Instagram Terms of Use and thus be excluded from a service
that enables them to communicate, share content with and receive content from millions of users and
for which there are currently few realistic alternatives. This exclusion would thus also adversely affect
their freedom of expression and information.

135. This precedent could encourage other economic operators to use the contractual performance legal
basis of Article 6(1)(b) GDPR for all their processing of personal data. There would be the risk that
some controllers argue some connection between the processing of the personal data of their
consumers and the contract to collect, retain and process as much personal data from their users as
possible and advance their economic interests at the expense of the safeguards for data subjects.
Some of the safeguards from which data subjects would be deprived due to an inappropriate use of
Article 6(1)(b) GDPR as legal basis, instead of others such as consent (Article 6(1)(a) GDPR) and
legitimate interest (Article 6(1)(f) GDPR), are the possibility to specifically consent to certain
processing operations and not to others and to the further processing of their personal data (Article
6(4) GDPR); their freedom to withdraw consent (Article 7 GDPR); their right to be forgotten (Article 17
GDPR); and the balancing exercise of the legitimate interests of the controller against their interests
or fundamental rights and freedoms (Article 6(1)(f) GDPR). As a result, owing to the number of users
of the Instagram service, the market power, and influence of Meta IE and its economically attractive
business model, the risks derived from the current findings of the Draft Decision could go beyond the
Complainant and the millions of users of Instagram service in the EEA and affect the protection of the
hundreds of millions of people covered by the GDPR 240 .

136. The EDPB thus concurs with the objections of the AT, DE, ES, FI, FR, HU, NL, NO and SE SAs 241 to Finding
2 of the Draft Decision in that the behavioural advertising performed by Meta IE in the context of
the Instagram service is objectively not necessary for the performance of Meta IE’s alleged contract
with data users for the Instagram service and is not an essential or core element of it.

137. In conclusion, the EDPB decides that the Meta IE has inappropriately relied on Article 6(1)(b) GDPR to
process the complainant’s personal data in the context of Instagram Terms of Use and therefore lacks
a legal basis to process these data for the purposes of behavioural advertising. Meta IE has not relied
on any other legal basis to process personal data in the context of the Instagram Terms of Use for the
purposes of behavioural advertising. Meta IE has consequently infringed Article 6(1) GDPR by
unlawfully processing personal data. The EDPB instructs the IE SA to alter its Finding 2 of its Draft
Decision which concludes that Meta IE may rely on Article 6(1)(b) GDPR in the context of its offering

240 In the Draft Decision, the IE SA quotes Meta IE’s submissions dated 28 September 2018, in which it states
that it “provides the Instagram service to hundreds of millions of users across the European region.” Draft
Decision, paragraph 223. In its submissions on the Preliminary Draft Decision, Meta IE stated that the correct
figure for monthly active accounts for the Instagram Service as of 31 August 2018 (the date of commencement
of the Inquiry) is approximately , while clarifying that this number represents active accounts on
Instagram rather than unique users and thus does not represent the number of unique users. This figure does
not include UK-based accounts as Meta IE considered accounts in that territory were not relevant for the Inquiry.
The IE SA does not share this view, on the grounds that the GDPR was applicable in the UK at the date of the
Complaint. Meta IE’s Reponse to the Preliminary Draft Decision, paragraph 14.13. Draft Decision, paragraph 223.
241 AT SA Objection, pp. 4-5; DE SAs Objection, p. 5-6, ES SA Objection, p. 2, FI SA Objection, paragraphs 16 and

18, FR SA Objection, paragraphs 8-9, HU SA Objection, p. 3, NL SA Objection, paragraphs 18-19; NO SA Objection,
p. 7, SE SA Objection, pp. 3.

38
Adopted

of the Instagram Terms of Use and to include an infringement of Article 6 (1) GDPR based on the
shortcomings that the EDPB has identified.

5 ON WHETHER THE LSA’S DRAFT DECISION INCLUDES ENOUGH
ANALYSIS AND EVIDENCE TO CONCLUDE THAT META IE IS NOT
OBLIGED TO RELY ON CONSENT TO PROCESS THE COMPLAINANT’S
PERSONAL DATA
5.1 Analysis by the LSA in the Draft Decision
138. The IE SA concludes as a matter of fact, in its Draft Decision that Meta IE did not rely, and did not seek
to rely, on the complainant’s consent to process personal data in connection with the Terms of Use242
and is not legally obliged to rely on consent to do so 243 .

139. The IE SA accepts that Meta IE never sought to obtain consent from users through the clicking of the
“Agree to Terms” button, based also on Meta IE’s confirmation thereto 244 .

140. The IE SA distinguishes between agreeing to a contract (which may involve the processing of data) and
providing consent to personal data processing specifically for the purposes of legitimising that
personal data processing under the GDPR 245 . The IE SA observes that, as noted by the EDPB, these are
entirely different concepts which “have different requirements and legal consequences” 246 .

141. The IE SA also emphasises that there is no hierarchy between the legal basis that controllers may use
to process personal data under the GDPR 247 . The IE SA further argues that neither Article 6(1) GDPR
nor any other provision in the GDPR require that the processing of data in particular contexts must
necessarily be based on consent 248 . The IE SA argues the GDPR does not provide that the specific
nature and content of a contract, freely entered into by two parties, requires a higher category or
“default” legal basis. The IE SA includes reference to the EDPB Guidelines 2/2019 on Article 6(1)(b)
GDPR which assert that where data processing is necessary to perform a contract, consent is not an
appropriate lawful basis on which to rely 249 .

142. The IE SA considers Article 7 GDPR and its conditions do not in and of themselves indicate the legal
basis on which a controller should rely on in a particular context. The IE SA contends that these
conditions would only be relevant where the controller relies upon consent as the legal basis for its
processing, which it views as not being the case for the processing of data by Meta IE in question 250 .

242
Draft Decision, paragraphs 43 and 60.
243
Draft Decision, paragraphs 59-60.
244 Draft Decision, paragraphs 40 and 42, as well as 56.

245 Draft Decision, paragraph 52.
246 Draft Decision, paragraph 47.
247 Draft Decision, paragraphs 48-50.
248 Draft Decision, paragraph 50.
249 Draft Decision, paragraph 52.
250 Draft Decision, paragraph 57.

39
Adopted

5.2 Summary of the objections raised by the CSAs
143. The AT, DE, ES, FI, FR and NL SAs object to the assessment in the Draft Decision on consent, leading to
Finding 1 of the IE SA 251 . These SAs put forward several factual and legal arguments for the changes
they propose to the Draft Decision.

144. The SE SA holds that if the EDPB were to find that the processing can rely on Article 6(1)(b) GDPR, the
investigation needs to encompass whether special categories of personal data pursuant to Article 9(1)
GDPR are processed, since the performance of a contract is not an exemption pursuant to Article 9(2)
GDPR. Since the SE SA presents its objection as being contingent on whether the EDPB finds that the
data processing in Instagram, based on its Terms of Use, can rely on Article 6(1)(b) GDPR 252 and the
EDPB finds that Meta IE inappropriately relied on Article 6(1)(b) GDPR (see above in Section 4.4.2), the
SE SA objection is no longer applicable.

Arguments on the finding of the LSA that Meta IE is not legally obliged to rely on consent
145. The AT, DE and NL SAs consider that the IE SA has not included enough analysis, evidence and research
in the Draft Decision to conclude that Meta IE is not legally obliged to rely on consent to process the
complainants’ data 253 .

146. The AT SA points out that the IE SA limits its facts and its legal assessment to the general question
whether Article 6(1)(b) GDPR can be used as legal basis, specifically for behavioural advertising. The
Draft Decision does not clarify which data categories are being used for behavioural advertising and
where Meta IE relies on Articles 6(1)(a) and 6(1)(b) GDPR for behavioural advertising. Also
unaddressed is, if and to which extent Meta IE relies on Article 9(2)(a) GDPR for behavioural
advertising as far as sensitive data are concerned and whether Meta IE respected the GDPR conditions
(for example, Article 7 GDPR) when obtaining the consent pursuant to Article 6(1)(a) and Article 9(2)(a)
GDPR. The AT SA argues that the Draft Decision did not address the part of the complaint on the
differences between “consent” and “contractual performance” and regarding Article 9 GDPR 254 .

147. Even though the DE SAs share the IE SA’s finding that Meta IE did not rely on consent for the processing
of data as described in the Instagram Terms of Use, the DE SAs objects against the IE SA’s assessment
that in the specific case at issue Meta IE was not legally obliged to obtain consent from the
Complainant 255 . The DE SAs further add, also in relation to the potential use of Article 6(1)(f) GDPR as
a legal basis, that further investigations on the specific processing activities, purposes and their risks
for rights and freedoms of the Complainant would be necessary to conclude an assessment on the
applicable legal basis 256 .

148. The NL SA notes its view that there is lack of any substantive investigation into what kind of personal
data is being processed besides relying on information submitted by the controller 257 . The NL SA

251
AT SA Objection, p. 9-11; DE SA Objection, p. 2-9; ES SA Objection, p. 2-3; FI SA Objection, paragraphs 36-44;
FR SA Objection, paragraphs 21-31; NL SA Objection, paragraphs 20-27.
252 SE SA Objection, p. 3-4.
253 AT SA Objection, p. 10; DE SA Objection, p. 7-9; NL SA Objection, paragraph 21.
254 AT SA Objection, p. 10.
255 DE SAs Objection, p. 7-8.
256 DE SAs Objection, p. 8-9.
257 NL SA Objection, paragraph 25.

40
Adopted

considers that there are clear indications that consent is legally required for (parts of) the processing
operations of the controller, and that the IE SA could thus draw a different conclusion on the basis of
further inquiries and analysis 258 . The NL SA considers that the Draft Decision should be amended if a
further inquiry by the IE SA establishes that the reliance on consent as a legal ground is mandatory259 .

149. In addition, the DE and FR SAs consider that even if Meta IE had relied on consent, it would not have
met the requirements of Article 7(1) GDPR as being “freely given”, as it is conditional on the use of
their services as a whole (“take it or leave it”). Nor would consent meet the requirements of Article
7(2) GDPR since, as the IE SA finds, information on the processing of data as described in the Terms of
Use, is not provided in a concise, transparent, intelligible and easily accessible form, using clear and
plain language 260 .

Arguments on the possible breach of the obligation to rely on consent to process special categories of
personal data (Article 9 GDPR)

150. The AT, DE, ES, FI, FR and NL SAs consider that the IE SA should have identified and separately assessed
any processing of special categories of personal data under Article 9 GDPR in the context of Instagram
Terms of Use 261 . The DE SAs conclude that Meta IE processes the complainant’s special categories of
data in breach of Article 9 (1) GDPR 262 . The AT, ES, FI, FR and NL SAs take the view that the IE SA should
broaden the scope of its investigation and examine whether the conditions for the processing of
special categories of personal data have been met by Meta IE 263 .

151. The AT, ES, FI, FR and NL SAs consider that the factual background of the Draft Decision misses facts
on whether Meta IE relies on Article 9(1)(a) GDPR to process special categories of personal data for
the purpose of behavioural advertising and whether Meta IE respects the requirements of the GDPR,
such as those of Article 7, in obtaining consent to that end 264 .

152. The FR and NL SAs argue that the data that Meta IE processes may include special categories of
personal data under Article 9 GDPR 265 . The DE SAs contend that nothing indicates that Meta IE
excludes these categories of data from its processing for advertising purposes 266 .

153. The FR SA notes that Instagram users can provide various sensitive data about themselves, including
their sexual orientation, religious views and political opinions in the description of their profile. The
FR SA considers that the IE SA cannot simply state that it has no evidence that Meta IE processes such
data in the context of the Instagram service. In order to deal with the complaint, the FR SA asks for

258
NL SA Objection, paragraph 25.
259
NL SA Objection, paragraph 25.
260 DE SAs Objection, p. 8; FR SA Objection, paragraphs 24-29.
261 AT SA Objection, p. 9-10; DE SAs Objection, p. 7; ES SA Objection, p. 2-3; FI SA Objection, paragraphs 36-38,

41; FR SA Objection, paragraphs 30-31; NL SA Objection, paragraphs 24-26.
262 DE SAs Objection, p. 7, 10.

263 AT SA Objection, p. 9; ES SA Objection, p. 2-3; FI SA Objection, paragraphs 41-42; FR SA Objection, paragraph

31; NL SA Objection, paragraph 25.
264 AT SA Objection, p. 9; ES SA Objection, p. 2-3; FI SA Objection, paragraph 41; FR SA Objection, paragraph 30;

NL SA Objection, paragraph 25.
265 FR SA Objection, paragraph 30; NL SA Objection, paragraph 24.
266 DE SAs Objection, p. 7.

41
Adopted

further investigation, in particular it asks the LSA to examine whether sensitive data are processed by
the controller and, if so, whether one of the conditions of Article 9(2) GDPR is met in this case 267 .

154. The NL SA argues that there is strong indication that some data processed in the context of the
Instagram service actually belongs to a special category of data considering “photographs and other
images that are, or were, potentially processed with use of facial recognition technology and other
artificial intelligence technologies in the context of Facebook services” 268 . The NL SA highlights that
according to the CJEU ruling in case C-136/17 the mere indexing of certain data could already suffice
to conclude that Article 9 GDPR applies 269 .

155. The DE and NL SAs recall that only consent may be used in this context among the exceptions that
Article 9 (2) GDPR lays down to the general prohibition of processing special categories of data270 . The
FI SA recalls that the performance of a contract is not an exception pursuant to Article 9(2) GDPR 271 .

Arguments on other types of data requiring consent
156. The NL SA identifies as another indicator contradicting the IE SA’s conclusion that there is no obligation
to seek consent the fact that the controller processes a significant amount of personal data that has
been collected through cookies for online advertising purposes and of location data 272 .

Risks
157. On the risks posed by the Draft Decision, the DE SAs consider that, as the subject of the complaint was
the processing as described in the Instagram Terms of Use there is also a significant risk for the
fundamental rights and freedoms of all Instagram users in the European Union that their personal
data, including data of special categories are processed without any legal basis 273 . The AT SA also
considers that the compliance of Meta IE with the GDPR rules on the processing of special categories
of data goes beyond the case at stake and affects hundreds of millions of data subjects within the EEA,
as Meta IE is the provider of the biggest media network in the world 274 .

158. The AT, DE, FI, FR and NL SAs argue that the IE SA’s conclusion that consent is not required affects the
rights of data subjects and their control over their personal data 275 .

159. The AT SA argues that the first risk is that the data subject’s right to lodge a complaint with a
supervisory authority pursuant to Article 77(1) GDPR becomes ineffective because the IE SA did not
handle the complaint in its entire scope, including sensitive data pursuant to Article 9 GPDR. The AT

267
FR SA Objection, paragraph 30.
268
NL SA Objection, paragraph 25.
269 NL SA Objection, paragraphs 26.
270 DE SAs Objection, p. 7; NL SA Objection, paragraph 24.

271 FI SA Objection, paragraph 40.
272 NL SA Objection, paragraphs 22-23, 27.
273 DE SAs Objection, p. 9.
274 AT SA Objection, p. 9.
275 AT SA Objection, p. 11; DE SAs Objection, p. 9 ; FI SA Objection, paragraph 43; FR SA Objection, paragraph 34;

NL SA Objection, paragraphs 30-31.

42
Adopted

SA argues that this is not in line with the CJEU ruling in case C-311/18, which provides that the
supervisory authority must handle complaints with all due diligence 276 .

160. The FR SA argues that the Draft Decision poses a risk to the fundamental rights and freedoms of the
individuals concerned, according to Article 4(24) GDPR, insofar as the legal basis of contractual
performance to process the personal data of Instagram users to send them targeted advertising does
not allow the European users to have control over the fate of their data 277 . The FR SA also notes that
since the Draft Decision will be taken at the end of a cooperation procedure and made public, it could
be interpreted as reflecting the common position of the European supervisory authorities on this
issue, and setting a precedent for accepting that a company may use the legal basis of the contract to
process its users’ data for targeted advertising purposes when such processing is particularly massive
and intrusive 278 .

161. The NL SA specifies the protections from which the data subjects would be deprived due to the IE SA’s
conclusion that consent is not required, such as the right to data portability (Article 20(1) GDPR); the
possibility to specifically consent to certain processing operations and not to others and to the further
processing of personal data (Article 6(4) GDPR); the freedom to withdraw consent (Article 7 GDPR)
and the subsequent right to be forgotten 279 .

162. The AT, DE, FI and NL SAs note as an additional risk that sensitive personal data falling within the scope
of Article 9 GDPR is processed without meeting the requirements of Article 9(2) GDPR 280 .

163. The FI SA highlights that the will of the legislator has been to protect the Article 9 GDPR special
category data with a duty of care and if there is any reasonable doubt that Meta IE has no legal basis
for processing operations of such sensitive data of the Instagram users, the said claim needs to be
properly investigated or otherwise the lack of investigation would negatively affect hundreds of
millions of Instagram users within the EEA and undermine their right to privacy and data protection281 .

164. The NL SA underlines the risk that allowing the bypassing of legal provisions requiring consent to
process data creates legal uncertainty that hampers the free flow of personal data within the EU 282 .

165. The NL SA also argues that not assessing the processing in a sufficiently thorough manner could create
a precedent for controllers to exclude from their privacy policies or terms of service processing
operations that must be based on consent. This would risk leaving data subjects with a reduced degree
of transparency 283 .

276
AT SA Objection, p. 10-11.
277
FR SA Objection, paragraph 34.
278 FR SA Objection, paragraph 35.
279 NL SA Objection, paragraph 33.
280 AT SA Objection, p. 11; FI SA Objection, paragraph 43; DE SAs Objection, p. 9; NL SA Objection, paragraph 33.
281 FI SA Objection, paragraph 43.
282 NL SA Objection, paragraph 33.
283 NL SA Objection, paragraph 30.

43
Adopted

5.3 Position of the LSA on the objections
166. The IE SA considers the objections not reasoned and does not follow them 284 .

167. The IE SA argues that the scope of the inquiry is appropriate and relates to the issues raised in the
complaint. It also argues that finding of additional infringements which have not been fully
investigated or put to the controller would impose a risk of procedural unfairness by depriving the
controller of its right to be heard in response to a particularised allegation of wrongdoing 285 .

168. The IE SA notes that it has discretion to determine the framework of the inquiry, taking into account
the scope of the written complaint as lodged. The IE SA argues that it would not have been possible
to assess each discrete processing operation by Meta IE, without first resolving the fundamental
dispute between the parties on the interpretation of Article 6(1) GDPR. The IE SA considers that it
would have been inappropriate and disproportionate for it to undertake an open-ended assessment
of all of Meta IE’s processing operations related to the Instagram Terms of Use to handle the
complaint 286 .

169. The IE SA argues that its analysis of Article 6(1)(b) GDPR does not preclude the possibility that certain
discrete processing operations by Meta IE may fall outside the scope of Article 6(1)(b) GDPR. The IE
SA finds it reasonable and practical to set the scope of the inquiry, focusing on the principled issues of
dispute, which it considers as not prejudicing the operation of more specific data protection rules 287 .

170. The IE SA considers that the reference to Article 9 GDPR processing by Meta IE is an element of what
it views as the Complainant’s fundamental allegation, i.e. that the agreement to the Terms of Use was
a form of GDPR consent to processing of personal data, including consent to the processing of special
categories of data. The IE SA argues that since the scope of its inquiry addresses this issue, it is not
necessary for it to also conduct an indiscriminate and open-ended assessment of Meta IE’s processing
that may otherwise fall within the scope of Article 9 GDPR 288 .

171. The IE SA notes that under Irish national law, there would be a very significant risk of procedural
unfairness to Meta IE if the IE SA assumed, without any further factual examination, that Meta IE
unlawfully processes special categories of personal data 289 .

172. According to the IE SA, the CSAs objecting to the Draft Decision intend to maximise the complainant’s
rights by requiring consent-based processing for certain processing operations and thus prioritising it
over other legal basis. The IE SA considers that very extensive data protection rights also apply under
the GDPR where the processing is based on Article 6(1)(b) or Article 6(1)(f) GDPR. The IE SA contends
that the variation in the extent of data subject rights and protections, depending on the applicable
legal basis, is an inherent element of the legislative scheme of the GDPR. The IE SA considers that
Article 6 GDPR does not provide that the “appropriate” data subject rights determine the legal basis
for processing. The IE SA notes that separate to the user’s acceptance of the Terms of Use, Meta IE

284 Composite Response, paragraphs 36 and 48.
285 Composite Response, paragraph 97.
286 Composite Response, paragraph 26.
287 Composite Response, paragaraph 27.
288 Composite Response, paragraph 28.
289 Composite Response, paragraphs 32-33.

44
Adopted

relies on different “acts” of consent for specific aspects of the service, including personalised
advertising based on users’ off-Instagram activities. In this regard, the IE SA states that the complaint
in this case was about the agreement to the Terms of Use and the processing it entails once
accepted 290 .

173. The IE SA argues that the objections are inconsistent with the principle of legal certainty, as cited in
Recital 7 GDPR. The IE SA indicates that it is not satisfied that the GDPR requires the limitation of
processing for the purposes of behavioural advertising to situations where processing is based on data
subject consent 291 . The IE SA contends that interpretative approach of the CSAs raising objections
would result in the arbitrary application of more restrictive data protection rules for reasons that are
not found in the GDPR. The IE SA also states that this approach does not take due account of the
extensive data protection rights which apply to all legal bases under the GDPR. The IE SA asserts that
it is not open to the supervisory authorities to create additional binding limitations on the applicable
legal basis for the processing of data for behavioural advertising. The IE SA states that it is the
legislator, not the supervisory authorities, which has defined the conditions for lawful processing 292 .

5.4 Assessment of the EDPB

5.4.1 Assessment of whether the objections were relevant and reasoned
174. The EDPB responds to Meta IE’s primary arguments to the contrary in Section 4.4.1 above 293 .

175. The AT, DE, ES, FI, FR and NL SAs objections analysed in this section have a direct connection with the
Draft Decision and refer to a specific part of the Draft Decision, i.e. Finding 1. The AT, DE, ES, FI, FR
and NL SAs argue that the IE SA has not carried out enough investigation and legal analysis in the Draft
Decision to conclude that Meta IE is not legally obliged to rely on consent to process the complainants’
data 294 . According to these CSAs, the IE SA should have identified and separately assessed any

290 Composite Response, paragraphs 46.
291 Composite Response, paragraph 47.
292 Composite Response, paragraph 47.
293 Meta IE argues that “Objections which raise matters which are not within the Defined Scope of Inquiry are not

‘relevant and reasoned’ within the meaning of Article 4(24) GDPR” and such objections “ought to be disregarded
in their entirety by the EDPB”. The EDPB does not share this understanding, as explained above. See paragraphs
73-75 of this Binding Decision above. In particular, the EDPB recalls that the analysis of whether a given objection
meets the threshold set by Art. 4(24) GDPR is carried out on a case-by-case basis. More specifically, in contrast
to the objections referred to by Meta IE that did not “establish a direct connection with the specific legal and
factual content of the Draft Decision” (Binding Decision 2/2022 paragraphs 139, 147, 164) here, each CSA has
made several clear links with the content of the Draft Decision, as is described in paragraphs 143, 145-147 and
150-151 of this Binding Decision. Moreover, while the objections referenced by Meta IE in paragraph 4.9 of its
Article 65 submissions were found not to be relevant and/or reasoned in the Binding Decision 2/2022 as they
did “not provide sufficiently precise and detailed legal reasoning regarding infringement of each specific
provision in question”, did not explain sufficiently clearly, nor substantiate in sufficient detail how the conclusion
proposed could be reached, or did not sufficiently demonstrate the significance of the risk posed by the Draft
Decision for the rights and freedoms of the data subjects or the free flow of data within the EU (Binding Decision
2/2022, paragraphs 140, 148, 165), as regards the objections analysed in this section, the AT, DE, FI, FR and NL
SAs provide a number of legal and factual arguments and explanations as to why an infringement for lack of
appropriate legal basis is to be established, and adequately identify the risk posed by the Draft Decision if it was
adopted unchanged (paragraphs 145-165 of this Binding Decision) .
294 AT SA Objection, p. 9; DE SAs Objection, pp. 8-9; ES SA Objection, pp. 2-3; FI SA Objection, paragraphs 36-37;

FR SA Objection, paragraph 30; NL SA Objection, paragraph 21.

45
Adopted

processing of special categories of personal data in Instagram Terms of Use 295 . The NL SA argues that
processing operations concerning location data and the use of tracking technologies on users devices
should have investigated and assessed by the IE SA as well 296 . The AT, FI, FR and NL SAs consider that
the IE SA should broaden the scope of its investigation and examine whether the conditions for the
processing of special categories of personal data have been met by Meta IE in relation to the Instagram
service 297 . The DE, FR and NL SAs argue that the data that Meta IE’s processes may include special
categories of personal data under Article 9 GDPR 298 . They contend that nothing indicates that Meta IE
excludes these categories of data from its processing for advertising purposes. The AT, DE, ES, FI and
FR SAs highlight that the issue falls within the remit of the complaint since the complainant alleged a
potential violation of Article 9 GDPR and should therefore be investigated and assessed by the LSA299 .
The AT, DE, ES, FI and FR SAs challenge the reasoning underling the conclusion reached by the LSA.
This assessment could lead to a different conclusion insofar as the IE SA would fully cover the
complaint and include facts and a legal assessment on the Instagram’s service processing operations
to which Article 6(1)(a), Articles 7 and 9 GDPR may apply, which may reveal an infringement by Meta
IE 300 .

176. Consequently, the EDPB finds that the AT, DE, ES, FI, FR and NL SAs objections relating to Finding 1,
which states that Meta IE is not required to rely on consent to deliver the Instagram Terms of Use and
its underlying reasoning, are relevant 301 .

177. The AT, DE, FI, FR and NL SAs objections are reasoned because they include clarifications and
arguments on legal/factual mistakes in the LSA’s Draft Decision that require amending. The AT, DE, FI,
FR and NL SAs consider that the IE SA should have identified and separately assessed any processing
of special categories of personal data under Article 9 GDPR in the context of Instagram Terms of
Use 302 . In particular, the DE, FR and NL SAs argue that the data that Meta IE processes may include
special categories of personal data under Article 9 GDPR and that nothing indicates that Meta IE
excludes these categories of data from its processing for advertising purposes 303 . The AT, DE, ES, FR
and NL SAs recall that only consent may be used in this context among the exceptions that Article 9
(2) GDPR lays down to the general prohibition of processing special categories of data 304 . The FI SA
recalls that EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR state that the WP29 has observed that
Article 9(2) GDPR does not recognise “necessary for the performance of a contract” as an exception to
the general prohibition to process special categories of data 305 . The NL SA identifies as another

295
AT SA Objection, p. 9; DE SAs Objection, p. 7; FI SA Objection, paragraph 37 ; FR SA Objection, paragraph 30;
NL SA Objection, paragraph 25.
296 NL SA Objection, paragraphs 22-23 and 27.
297 AT SA Objection, p. 9; FI SA Objection paragraph 41; FR SA Objection, paragraph 30; NL SA Objection,

paragraph 25.
298 DE SAs Objection, p.7; FR SA Objection, paragraph 30; NL SA Objection, paragraphs 24-25.
299 AT SA Objection, p. 9; DE SAs Objection, p. 7; ES SA Objection, p. 2; FI SA Objection, p. 42; FR SA Objection,

paragraph 30.
300 See EDPB Guidelines on RRO, paragraph 15 and EDPB Guidelines on Article 65(1)(a) GDPR, paragraphs 40 and

Sub-sections 4.2, 4.2.3 - 4.2.5.
301 See paragraphs 143, 145 and 150 of this Binding Decision.
302 AT SA Objection, p. 9; DE SAs Objection, p. 7; FR SA Objection, paragraph 30; NL SA Objection, paragraph 25.
303 DE SAs Objection, p. 7; FR SA Objection, paragraph 30; NL SA Objection, paragraphs 24-25.
304 AT SA Objection pp. 9-10; DE SAs Objection, p.7; ES SA Objection, p. 2-3; FR SA Objection, paragraph 31; NL

SA Objection, paragraph 24.
305 FI SA Objection, paragraph 40.

46
Adopted

indicator contradicting the IE SA’s conclusion that there is no obligation to seek consent the fact that
the controller processes a significant amount of personal data that has been collected through cookies
for online advertising purposes and of location data 306 . The NL SA also argues that the IE SA should
have investigated more into the safeguards that are implemented by the controller to address the
specific interests of children 307 . Lastly, the NL SA states that the information shared by users on
Instagram may contain personal data concerning the health of individual users and mentions the ruling
of the CJEU in case C-136/17 stating that the mere indexing of certain data could already suffice to
conclude that Article 9 of the GDPR applies 308 .

178. On the risks posed by the Draft Decision, the AT, DE, FI, FR and NL SAs explain that the IE SA’s Finding
1 providing that consent is not required puts at risk the rights of data subjects and their control over
their personal data 309 . The AT SA mentions the risk that the data subject’s right to lodge a complaint
with a supervisory authority pursuant to Article 77(1) GDPR becomes ineffective because the IE SA
does not handle it in its entire scope, including special categories of data under Article 9 GDPR 310 . The
FR SA argues that the Draft Decision could set a precedent for accepting the use of the contractual
performance legal basis to process users’ data for targeted advertising purposes, which it views as
particularly massive and intrusive 311 . The NL SA specifies that the data subjects could be deprived of
the following protections derived from the use of consent: the right to data portability (Article 20(1)
GDPR); the possibility to specifically consent to certain processing operations and not to others and to
the further processing of personal data (Article 6(4) GDPR); the freedom to withdraw consent (Article
7 GDPR) and the subsequent right to be forgotten 312 . The AT, DE, FI and NL SAs also note as an
additional risk that special categories of personal data falling within the scope of Article 9 GDPR are
processed without meeting the requirements of Article 9 (2) GDPR 313 . The NL SA also underlines the
data protection deficits that are foreseeable with a switch from consent to contract legal basis and
the risk that this conclusion would create legal uncertainty that hampers the free flow of personal
data within the EU 314 . The NL SA further adds the risk that the decision could create by setting a
precedent for controllers to exclude from their privacy policies or terms of service processing
operations based on consent, thus undermining the principle of transparency 315 . The ES SA does not
describe any risk on this specific topic in their objection 316 .

179. On the basis of the above considerations, the EDPB finds that the objections raised by the AT, DE, FI,
FR and NL SAs concerning the conclusions in the Draft Decision about the fact that Meta IE is not
obliged to rely on consent to process the complainant’s data, are relevant and reasoned objections
under Article 4(24) GDPR.

306
NL SA Objection, paragraphs 22-23 and 27.
307
NL SA Objection, paragraph 34.
308 NL SA Objection, paragraph 26.
309 AT SA Objection pp. 10-11; DE SAs Objection, p. 9; FI SA Objection, pp. 9-10; FR SA Objection, p. 7; NL SA

Objection, p. 9-11.
310 AT SA Objection, p. 10.

311 FR SA Objection, paragraph 35.
312 NL SA Objection, paragraph 33.
313AT SA Objection, p. 11; DE SAs Objection, p. 9; FI SA Objection, paragraph 43; NL SA Objection, paragraph 33.
314 NL SA Objection, paragraphs 32-33.
315 NL SA Objection, paragraph 30.
316 ES SA Objection, p. 3.

47
Adopted

180. However, the part of the NL SA objection asking the IE SA to include in its Draft Decision the elements
concerning the need to rely on consent for the placing of tracking technology on end users devices
under ePrivacy legislation falls outside the scope of the EDPB’s mandate 317 .

181. Finally, the EDPB considers that the objection raised by the ES SA regarding the potential infringement
of Article 9 GDPR is not sufficiently reasoned with reference to the significance of the risks posed by
the Draft Decision at stake and, therefore, the objection of the ES SA does not meet the threshold
provided for by Article 4(24) GDPR.

5.4.2 Assessment on the merits
182. In accordance with Article 65(1)(a) GDPR, in the context of a dispute resolution procedure the EDPB
shall take a binding decision concerning all the matters which are the subject of the relevant and
reasoned objections, in particular whether there is an infringement of the GDPR.

183. The EDPB considers that the objections found to be relevant and reasoned in this subsection 318 require
an assessment of whether the Draft Decision needs to be changed on its Finding 1, which concludes
that Meta IE has (a) not sought to rely on consent to process personal data to deliver the Terms of Use
and (b) is not legally obliged to rely on consent in order to do so. When assessing the merits of the
objections raised, the EDPB also takes into account Meta IE’s position on the objections and its
submissions.

Meta IE’s position on the objections and its submissions
184. In its submissions, Meta IE supports the IE SA’s conclusion that Meta IE does not rely on consent for
the purposes of behavioural advertising and is not required to rely on it 319 .

185. Meta IE states that it does not seek or rely on consent as its legal basis for purposes of processing
personal data to provide behavioural advertising, except in limited circumstances where Meta IE
separately obtains consent, yet not through users’ acceptance the Terms of Use 320 . Meta IE claims
that it explains in its Data Policy to data subjects that Meta IE relies on consent under Article 6(1)(a)
GDPR “[f]or using data that advertisers and other partners provide us about [users’] activity off of Meta
Company Products, so we can personalise ads we show [them] on Meta Company Products and on
websites, apps and devices that use our advertising services” and that it has a separate process for
obtaining this consent in a manner that satisfies the requirements of Article 4(11) and Article 7 GDPR
and which is “entirely separate from any interaction by users with the Terms of Use or Data Policy, is
not part of the Complaint and has not been examined” in the IE SA’s inquiry 321 . Meta IE submits that
the Complaint is limited to the question of whether Meta IE seeks forced consent to data processing
through acceptance of the Terms of Use. Meta IE then asserts that since it does not seek, obtain, or
rely on consent as a legal basis under Article 6(1)(a) GDPR to process user data via acceptance of the

317
NL SA Objection, paragraphs 7-8.
318 These objections being those of the AT, DE, FI, FR and NL SAs, disagreeing with the IE SA’s Finding 1, which
states that Meta IE is not required to rely on consent to deliver the Instagram Terms of Use and its underlying
reasoning.
319 Meta IE Article 65 Submissions, paragraphs 5.2 and 5.6.
320 Meta IE Article 65 Submissions, paragraph 5.4.
321 Meta IE Article 65 Submissions Footnote 61 and paragraph 6.27.

48
Adopted

186. Meta IE alleges that some CSAs suggest that behavioural advertising must in all cases be based on
consent, and in doing so, the CSAs suggest an approach that mandates Meta IE to rely on consent for
“its data processing for purposes of behavioural advertising (or any other purpose)” 323 . Meta IE agrees
with the IE SA’s assertion that any approach limiting the legal basis on which a controller could rely
would not be consistent with the principle of legal certainty 324 . Meta IE considers that the GDPR was
drafted in a way that protects data subjects while affording flexibility to controllers and that its
application is highly dependent on facts and circumstances underlying the relevant processing and the
nature of the service providers 325 . Meta IE contends that the GDPR contains no express references to
behavioural advertising and establishes no specific limitations on the available legal basis for such
processing; it is technology neutral and does not include specific derogations or rules for any one
specific industry 326 .

187. With regard to the consideration that consent as a legal basis provides more extensive data protection
rights, Meta IE argues that in defining the conditions for lawful processing, the EU legislature has
ensured that appropriate data protection rights would be afforded to data subjects no matter what
legal basis is relied on and extensive data protection rights apply to all legal bases 327 . Meta IE supports
the IE SA’s view that Article 6(1) GDPR does not require legal bases to be determined by reference to
the applicable data subject rights for each basis 328 .

EDPB’s assessment on the merits

188. The EDPB notes that the IE SA’s Draft Decision submitted via the Article 60 GDPR procedure results
from an inquiry that the IE SA conducted based on a complaint from a data subject and Instagram
user 329 . The BE SA forwarded this complaint to the IE SA as LSA in the case, given Meta IE’s main
establishment in Ireland.

189. In this complaint, the Complainant alleges that Meta IE violated Articles 5, 6, 7 and 9 GDPR. The
Complainant argues that it is unclear to what the data subject has consented when the data subject
agreed to Instagram Terms of Use and Privacy Policy 330 . More specifically, the Complainant points out
that it remains unclear which exact processing operations the controller chooses to base on each
specific legal basis under Articles 6 and 9 GDPR 331 . The Complainant argues that the Terms of Use and
Privacy Policy also include special categories of data under Article 9(1) GDPR because the data subject,
as an Instagram user, has interacted with various groups and individuals, which would accordingly
reveal the data subject’s political affiliation, sexual orientation, health condition, etc 332 . The

322
Meta IE Article 65 Submissions, paragraph 5.8.
323
Meta IE Article 65 Submissions, paragraph 5.2.
324 Meta IE Article 65 Submissions, paragraph 5.14.
325 Meta IE Article 65 Submissions, paragraph 5.15.
326 Meta IE Article 65 Submissions, paragraph 5.15.

327 Meta IE Article 65 Submissions, paragraph 5.16.
328 Meta IE Article 65 Submissions, paragraphs 5.16-5.17.
329 Draft Decision, paragraph 3; Schedule to the Draft Decision, paragraphs 12 and 19.
330 Complaint, p. 1-2.
331 Complaint, p. 1-2.
332 Complaint, p. 1-2.

49
Adopted

Complainant claims that the controller also allows to target such information for advertisement333 .
The Complainant considers that it would be necessary for the SA to investigate the concrete subject
of the alleged consent and the legal basis for all processing operations and to request the record of
processing activities under Article 30(4) GDPR 334 .

190. Based on the scope of the IE SA’s investigation into this complaint, the EDPB considers that the IE SA
decided to limit the scope of its Draft Decision to the following legal issues:

o Issue 1 – Whether clicking on the “Agree to Terms” button constitutes or must be
considered consent for the purposes of the GDPR and, if so, whether it is valid consent
for the purposes of the GDPR.

o Issue 2 – Whether Meta IE could rely on Article 6(1)(b) GDPR as a lawful basis for
processing of personal data in the context of Terms of Use and/or Data Policy.

o Issue 3 – Whether Meta IE provided the requisite information on the legal basis for
processing on foot of Article 6(1)(b) GDPR and whether it did so in a transparent
manner. 335

191. The IE SA argues that it has discretion to determine the framework of the inquiry taking into account
the scope of the written complaint as lodged 336 . The IE SA considers that it would not have been
possible to undertake an assessment of each discrete processing operation by Meta IE without first
resolving the fundamental dispute between the parties on the interpretation of Article 6(1) GDPR 337 .
In relation to the processing of Article 9 GDPR categories of data, the IE SA considers that the inquiry
has addressed the fundamental issue of principle on which the complaint depends, and this makes it
unnecessary to conduct an indiscriminate and open-ended assessment of processing falling within the
scope of this Article 338 . The IE SA thus concludes that Meta IE has (a) not sought to rely on consent in
order to process personal data to deliver the Terms of Use and (b) is not legally obliged to rely on
consent in order to do so, based on the submissions of the Parties and Instagram Terms of Use 339 . The
IE SA warns CSAs on the legal risks derived from asking through the objections to expand the material
scope of the inquiry and thus cover infringements outside of the complaint and Draft Decision that
the IE SA has not investigated (pursuant to its own decision to limit the scope of the inquiry) and put
to Meta IE 340 .

192. The EDPB notes that the Complaint makes plain the confusion of the Instagram user over which of the
user’s special categories of data are processed, for which purposes and on which basis.

193. The Instagram Terms of Use themselves note in general terms “Providing our Service requires
collecting and using your information. The Data Policy explains how we collect, use, and share

333
Complaint, p. 4.
334
Complaint, p. 7 and 16.
335 Draft Decision, paragraph 30.
336 Composite Response, paragraph 26.
337 Composite Response, paragraph 26.
338 Composite Response, paragraph 28.
339 Draft Decision, paragraph 60; Finding 1.
340 Composite Response, paragraphs 30-33 and 35.

50
Adopted

information across the Facebook Products” 341 (service which includes “Offering personalized
opportunities to create, connect, communicate, discover, and share” and “Connecting you with brands,
products, and services in ways you care about” 342 ). The Instagram Terms of Use include a reference to
a separate document “the Data Policy” 343 , which lists under the heading “Things you and others do
and provide”: “Data with special protections: You can choose to provide information in your Facebook
profile fields or Life Events, about your religious views, political views, who you are ‘interested in’ or
your health. This and other information (such as racial or ethnic origin, philosophical beliefs or trade
union membership) is subject to special protections under EU law” 344 . The Data Policy describes the
purposes for which these data are processed in very general terms such as “Provide, personalize and
improve our products” and “to select and personalize ads, offers and other sponsored content that we
show you” 345 with no specific reference to the specific processing operations and categories of data
each purpose would cover. Meta IE thus seems to acknowledge in its Data Policy 346 that it uses special
categories of data for behavioural advertising purposes, without specifying the “special protections
under EU law” that it would apply to such processing. Meta IE only includes a general reference to
consent among other legal basis in the same page 347 , which includes a link to a separate facebook.com
page mentioning the use of consent on data with special protection and referring to the Instagram
Settings 348 .

194. The IE SA finds that the way in which Meta IE provides, in relation to processing for which Article
6(1)(b) GDPR is relied upon, this information and the lack of information on the specific processing
operations, the data involved, their purposes and legal basis constitute an infringement of
transparency obligations under the GDPR (Article 5(1)(a), Article 12 (1), and Article 13(1)(c) GDPR)349 .
The IE SA considers the complaint in this case to be limited to the Terms of Use and the processing it
entails once accepted 350 . In these circumstances, the IE SA accepts at face value Meta IE’s submission
on its reliance on different “acts” of consent for discrete aspects of the service separately from the
user’s acceptance of the Terms of Use 351 . The IE SA does not engage into any further examination or
verification on how consent is sought in the case of processing carried out to provide discrete aspects
of the service. The IE SA also does not examine or verify whether special categories of data under
Article 9 GDPR are processed in the context of the Instagram service and, if so, whether they are
subject to these “acts” of consent and thus effectively treated outside the scope of the Terms of Use

341 Instagram Terms of Use, Section “The Data Policy”.
342 Instagram Terms of Use, Section “The Instagram Service”.
343 The document is titled as “Instagram Data Policy”, however it is explained in its chapeau that “[t]his policy

describes the information we process to support Facebook, Instagram, Messenger and other products and
features offered by Facebook (Facebook Products or Products)”.
344 Instagram Data Policy, Section “Things you and others do and provide”.
345 Instagram Data Policy, Section “How do we use this information? -Provide, personalize and improve our

Products”.
346 Instagram Data Policy, Section “Things you and others do and provide” and Section “How do we use this

information?-Provide, personalize and improve our Products”.
347 Data Policy, Section “What is our legal basis for processing data?”.
348 Facebook website https://www.facebook.com/about/privacy/legal bases.
349 Draft Decision, Finding 3.

350 The IE SA mentions in its Schedule to the Draft Decision, paragraphs 134-135 “My view is that [...] the

Complaint even taken at its height quite clearly only concerns data processing arising out of the act of
acceptance. On this basis, I do not accept that the processing of sensitive categories of personal data on the basis
of Article 9 GDPR consent falls within the scope of this Inquiry. There is no evidence that Meta Ireland processes
special category data at all in respect of the Instagram service”.
351 Composite Response, paragraph 46.

51
Adopted

and the legal basis of Article 6(1)(b) GDPR on which the Terms of Use purportedly rely, or whether
some special categories of personal data, as defined by the GDPR and EU case-law 352 , are treated
under the Instagram Terms of Use.

195. The CJEU asserted recently that the purpose of Article 9(1) GDPR is to ensure an enhanced protection
of data subjects for processing, which, because of the particular sensitivity of the data processed, is
liable to constitute a particularly serious interference with the fundamental rights to respect for
private life and to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter353 .
The CJEU adopts a wide interpretation of the terms “special categories of personal data” and “sensitive
data” that includes data liable indirectly to reveal sensitive information concerning a natural
person 354 . Advocate General Rantos reiterates the importance for the protection of data subjects of
Article 9 GDPR and applies the same interpretation to the data processing in social network services
for behavioural advertising by stating that “the prohibition on processing sensitive personal data may
include the processing of data carried out by an operator of an online social network consisting in the
collection of a user’s data when he or she visits other websites or apps or enters such data into them,
the linking of such data to the user account on the social network and the use of such data, provided
that the information processed, considered in isolation or aggregated, make it possible to profile users
on the basis of the categories that emerge from the listing in that provision of types of sensitive
personal data” 355 .

196. Therefore, the GDPR and the case-law pay especial attention to the processing or potential processing
of special categories of personal data under Article 9 GDPR to ensure the protection of the data
subjects. In this connection, the Complainant alleges in the Complaint, among others, a violation of
Article 9 GDPR and expressly requests the IE SA to investigate Meta IE’s processing operations in the
context of the Instagram service covered by this Article 356 . In a subsequent submission on the
Preliminary Draft Decision, the Complainant criticises the scope that the IE SA decided to give to the
Complaint and its lack of investigation of Meta IE’s processing activities and alleges that the IE SA failed
to give due consideration to processing under Article 9 GDPR and other cases in which it relies on
consent 357 .

197. In the present case, the IE SA limited its facts and legal assessment in the Draft Decision to the general
question of whether Meta IE has (a) sought to rely on consent in order to process personal data to
deliver the Terms of Use and (b) if it is legally obliged to rely on consent in order to do so. The IE SA
categorically concludes on these questions. At the same time, the IE SA acknowledges a serious lack
of transparency by Meta IE, as regards the information provided concerning the processing being
carried out in reliance on Article 6(1)(b) GDPR and does not clarify which data categories are being
processed for behavioural advertising, if Meta IE processes special categories of data, and if it does, if

352
See Article 9 GDPR and C-184/20 Vyriausioji tarnybinės etikos komisija.
353
C-184/20 Vyriausioji tarnybinės etikos komisija, paragraph 126.
354 C-184/20 Vyriausioji tarnybinės etikos komisija, paragraph 127.
355 C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,

ECLI:EU:C:2022:704, paragraph 46.
356 Complaint, p. 1-3, 7, 16.
357 Draft Decision, paragraphs 28-29; Complainant’s Submission on Preliminary Draft Decision in inquiry IN-18-

5-5 of 11 June 2021, pp. 11-13 (in a letter to the IE SA of 4 February 2022 p. 2 the Complainant explains that
their submissions in IN-18-5-5 on facebook.com should be considered as their submissions in IN-18-5-7 on
Instagram and all references should be read accordingly).

52
Adopted

Meta IE complies with the conditions of Article 9 GDPR and others relevant to the application of this
provision (for example, Articles 6(1)(a) and Article 7 GDPR).

198. By deciding not to investigate, further to the Complaint, the processing of special categories of
personal data in the context of the Instagram service, the IE SA leaves unaddressed the risks this
processing poses for the Complainant and for Instagram users. First, there is the risk that the
Complainant’s special categories of personal data are processed within the Instagram service to build
intimate profiles of them for behavioural advertising purposes without a legal basis and in a manner
not compliant with the GDPR and the strict requirements of its Article 9(2) GDPR and other GDPR
provisions relevant thereto. Second, there is also the risk that Meta IE does not consider as special
categories of personal data (in line with the GDPR and the CJEU case-law 358 ) certain categories of
personal data it processes and consequently, that Meta IE does not treat them accordingly. Third, the
Complainant and other Instagram users whose special categories of are processed may be deprived
of certain special protections derived from the use of consent, such as the possibility to specifically
consent to certain processing operations and not to others and to the further processing of personal
data (Article 6(4) GDPR); the freedom to withdraw consent (Article 7 GDPR) and the subsequent right
to be forgotten 359 . Fourth, given the great size and dominant market share of Meta IE in the social
media market, leaving unaddressed its current ambiguity in the processing of special categories of
personal data, and its limited transparency vis-à-vis Instagram users, may set a precedent for
controllers to operate in the same manner and create legal uncertainty hampering the free flow of
personal data within the EU.

199. The EDPB further considers, also in view of these risks to the Complainant and to other Instagram
users, that the IE SA did not handle the Complaint with all due diligence 360 . The EDPB sees the lack of
any further investigation into the processing of special categories of personal data as an omission, and
in the present case finds it relevant that the Complainant alleged infringements of Article 9 GDPR in
the Complaint 361 . The EDPB contends that in the present case, the IE SA should have verified on the
basis of the contract and the data processing actually carried out on which legal bases each data
processing operation at issue relies.

200. The EDPB also highlights that by limiting excessively the scope of its inquiry despite the scope of the
complaint in this cross-border case and systematically considering all the objections raised by CSAs
not relevant and/or reasoned and thus denying their formal admissibility, the IE SA as LSA in this case,
constrains the capacity of CSAs to act and tackle the risks to data subjects in sincere and effective
cooperation. As ruled by the CJEU, the LSA must exercise its competence within a framework of close
cooperation with other supervisory authorities concerned and cannot “eschew essential dialogue with

358
See C-184/20 Vyriausioji tarnybinės etikos komisija and more recently on the processing in Facebook:
C-252/21 Oberlandesgericht Düsseldorf request, Opinion of the Advocate General on 20 September 2022,
ECLI:EU:C:2022:704,.
359 Art. 17 GDPR.

360 Judgement of the Court of Justice of 16 July 2020, Data Protection Commissioner v Facebook Ireland Limited

and Maximillian Schrems, C-311/18, ECLI:EU:C:2020:559 , (hereinafter ‘C-311/18, Schrems II'), paragraph 109;
Judgement of the Court of Justice of 6 October 2015, Schrems, C-362/14, ECLI:EU:C:2015:650, paragraph 63;
Judgement of the Court of Justice of 4 April 2017, European Ombudsman v Staelen, C-337/15,
ECLI:EU:C:2017:256, paragraphs 12, 34, 43, 114.
361 Complaint, p. 1-3, 7, 16.

53
Adopted

and sincere and effective cooperation with the other supervisory authorities concerned” 362 . The limited
scope the IE SA gave to the inquiry and its consideration of all the objections made as inadmissible for
being not relevant or reasoned also impairs the EDPB’s capacity to conclude on the matter pursuant
to Article 65 GDPR and thus ensure a consistent application of EU data protection law, especially
considering that the complaint was introduced more than four years ago.

201. As a result of the limited scope of the inquiry and the fact that the IE SA did not verify and assess in
the Draft Decision Meta IE’s processing of special categories of personal data in its Instagram service,
the EDPB does not have sufficient factual evidence on Meta IE’s processing operations to enable it to
make a finding on any possible infringement by Meta IE of its obligations under Article 9 GDPR and
other GDPR provisions relevant thereto.

202. In conclusion, the EDPB decides that the IE SA cannot categorically conclude at this stage through its
Finding 1 that Meta IE is not legally obliged to rely on consent to process personal data to carry out
the personal data processing activities involved in the delivery of the Instagram Service, including
behavioural advertising as set out in the Instagram Terms of Use without further investigating its
processing operations, the categories of data processed (including to identify special categories of
personal data that may be processed), and the purposes they serve.

203. The EDPB instructs the IE SA to remove from its Draft Decision its conclusion on Finding 1. The EDPB
decides that the IE SA shall carry out a new investigation into Meta IE’s processing operations in its
Instagram service to determine if it processes special categories of personal data (Article 9 GDPR), and
complies with the relevant obligations under the GDPR, to the extent that this new investigation
complements the findings made in the IE SA’s Final Decision adopted on the basis of this Binding
Decision, and based on the results of this investigation, issue a new draft dDecision in accordance with
Article 60(3) GDPR 363 .

6 ON THE POTENTIAL ADDITIONAL INFRINGEMENT OF THE
PRINCIPLE OF FAIRNESS
6.1 Analysis by the LSA in the Draft Decision
204. The IE SA in its Draft Decision addresses the Complainant’s allegations that the unclear and misleading
nature of the Instagram Terms of Use and Data Policy, together with the mode of acceptance of the
Terms of Use, have made Instagram users believe that all processing operations were based on
consent under Article 6(1)(a) GDPR and thus constituted a breach of the Meta IE’s transparency
obligations under Articles 5(1)(a) and 13(1)(c) GDPR 364 . The IE SA analyses the submissions provided
by the Meta IE and, noting the Complaint’s focus on the alleged “forced consent” 365 , concludes that
Meta IE has breached Article 5(1)(a), Article 13(1)(c) and Article 12(1) GDPR due to the lack of

362 Judgement of the Court of Justice of 15 June 2021, Facebook Ireland Ltd v Gegevensbeschermingsautoriteit,
C-645/19, ECLI:EU:C:2021:483, (hereinafter ‘C-645/19 Facebook v Gegevensbeschermingsautoriteit),
paragraphs 53 and 63.
363 EDPB Guidelines on Article 65(1)(a) GDPR, Section 4.2.3 and paragraph 85.
364 Draft Decision, issue 3, paragraphs 116-196, in particular the conclusion in paragraph 196.
365 See also paragraph 3 of this Binding Decision

54
Adopted

transparency in relation to the processing for which Article 6(1)(b) GDPR has been relied on 366 . The IE
SA explains that, while an infringement of Article 5(1)(a) GDPR does not necessarily or automatically
flow from findings of infringement under Articles 12 and/or 13 GDPR, there is an important link
between these provisions 367 . Nevertheless, the IE SA takes the view that “[t]he factual question of
whether the data subject was misled as to the legal basis is therefore part of the broader question as
to whether there was compliance with transparency requirements and should not be considered in
isolation of this broader issue” 368 . The IE SA points out that Article 5(1)(a) GDPR links transparency to
the overall fairness of the activities of the controller 369 and concludes on the breach of this provision
in relation to the infringement of the transparency obligations 370 .

6.2 Summary of the objection raised by the CSA
205. The IT SA objects to the scope of Finding 3 of the Draft Decision and to the assessment leading up to
it. The IT SA agrees to a large extent with the Draft Decision’s Finding 3 on the infringement of Article
12(1), Article 13(1)(c), and Article 5(1)(a) GDPR in terms of transparency 371 . However, the IT SA argues
that Meta IE has also failed to comply with the more general principle of fairness under Article 5(1)(a)
GDPR, which, in the view of the IT SA, entails separate requirements from those relating specifically
to transparency 372 .

206. According to the IT SA, the relationship between Meta IE and Instagram users is markedly and
significantly unbalanced 373 and an infringement of the fairness principle resulted, first of all, from the
misrepresentation of the legal basis for processing by the controller 374 , considering that “Meta
presented its service to users in a misleading manner” and “without taking due account of users’ right
to the protection of their personal data” 375 . The IT SA argues that “the controller leaves its users in the
dark as they are expected to tell or actually ‘figure out’, from time to time, the possible connections
between purpose sought, applicable legal basis and relevant processing activities” 376 .

207. Secondly, such infringement also stems from the “high-level and all-encompassing reference to Article
6(1)(b) GDPR as relied upon to enable the massive collection of personal data [...] and their reuse for
multifarious, distinct purposes”, considering the “pervasive as well as prolonged analysis of [the users’]
online behaviour” amounting to a disproportionate interference with their private lives compared to
the pursuit of freedom of enterprise 377 .

208. The IT SA thus considers that the IE SA should have found an infringement of the fairness principle
under Article 5(1)(a) GDPR, in addition to the infringement of the transparency obligations derived

366
Draft Decision, paragraphs 180-196.
367
Draft Decision, paragraph 191.
368 Draft Decision, paragraph 25.
369 Draft Decision, paragraph 193.
370 Draft Decision, paragraphs 191-196 and Finding 3.
371 IT SA Objection, p. 4-5.

372 IT SA Objection, p. 5.
373 IT SA Objection, p. 5.
374 IT SA Objection, p. 5.
375 IT SA Objection, p. 5.
376 IT SA Objection, p. 6.
377 IT SA Objection, p. 6.

55
Adopted

from this provision, without any need for supplementary investigations 378 . According to the IT SA,
should the objection be followed, it would also impact the exercise of by corrective powers by the IE
SA, i.e. the measures to be imposed on the controller in order to bring the processing into conformity
with the GDPR 379 .

6.3 Position of the LSA on the objection
209. The IE SA does not consider the IT SA objection to be relevant and reasoned and does not follow it380 .
The IE SA examines it together with the other objections relating to the scope and conduct of the
inquiry and contends that introducing novel issues not raised by the Complainant or otherwise put to
the parties would represent a significant departure in terms of the scope of the inquiry 381 .

210. The IE SA highlights the legal consequences that would flow from making material changes concerning
infringements outside of the Complaint and Draft Decision, namely the likelihood that Meta IE would
succeed in arguing before the Irish Courts that it has been denied an opportunity to be heard on
additional and extraneous findings that are adverse to it 382 . The IE SA’s concern arose from the fact
that, according to the IE SA, Meta IE was never invited to be heard in response to an allegation that it
had infringed the fairness principle set out in Article 5(1)(a) GDPR. The IE SA notes, in this regard, that
a respondent has the right to be heard in response to the particulars of the case being made against
it and that this is a core element of a fair procedure pursuant to Irish law. The IE SA takes the view
that expanding the material scope of the inquiry is neither necessary, nor could be reconciled with the
controller’s right to a fair procedure 383 .

6.4 Analysis of the EDPB

6.4.1 Assessment of whether the objection was relevant and reasoned
211. The IT SA objection concerns “whether there is an infringement of the GDPR” 384 .

212. The EDPB takes note of Meta IE’s view that the objections categorised by the IE SA as relating to the
scope and conduct of the inquiry, among which the IT SA objection regarding the infringement of the
fairness principle, are “irrelevant to the resolution of this Inquiry” and, if accepted, would seriously
infringe Meta IE’s procedural rights under both Irish and EU law 385 . According to Meta IE, “the EDPB
cannot expand the scope of the Inquiry in the manner suggested by the CSAs through Objections that
are not relevant to the substance of the Complaint” and in relation to this Meta IE refers to the EDPB
Binding Decision 2/2022 386 .

378
IT SA Objection, p. 5-6.
379
IT SA Objection, p. 1.
380 Composite Response, paragraph 36.
381 Composite Response, paragraph 29.
382 Composite Response, paragraphs 31-32.

383 Composite Response, paragraph 35.
384 EDPB Guidelines on RRO, paragraph 24.
385 Meta IE Article 65 Submissions, paragraph 4.2 and paragraphs 4.10 to 4.20 regarding the right to fair

procedure, as well as Meta IE Article 65 Submissions, Annex 1, paragraph 7.7.
386 Meta IE Article 65 Submissions, paragraph 4.9. In particular, Meta IE refers to paragraphs 139, 140, 147, 148,

164, and 165 of the EDPB Binding Decision 2/2022.

56
Adopted

213. Meta IE further contends that the IT SA objection is not reasoned as it provides broad and
unsubstantiated allegations without presenting facts or evidence in this regard 387 and fails to address
the significance of the risk to fundamental rights and freedoms posed by the Draft Decision 388 .

214. As it was previously explained, the EDPB does not share the understanding that CSAs may not disagree
with the scope of the inquiry as decided by the LSA by way of an objection 389 .The EDPB recalls that an
objection could go as far as identifying gaps in the draft decision justifying the need for further
investigation by the LSA, for example in situations where the investigation carried out by the LSA
unjustifiably fails to cover some of the issues raised by the complainant 390 . In this regard, the EDPB
observes that, in their complaint, the Complainant alleges that the information provided in Meta IE’s
Privacy Policy “is inherently non-transparent and unfair within the meaning of Articles 5(1)(a) and 13(c)
GDPR” 391 . In addition, the Complainant alleges that “Asking for consent to a processing operation,
when the controller relies in fact on another legal basis is fundamentally unfair, misleading and non-
transparent within the meaning of Article 5(1)(a) of the GDPR” 392 . Therefore, the EDPB disagrees with
the IE SA’s finding that assessing Meta IE’s compliance with the principle of fairness would amount
addressing matters “which fall outside of the scope of the underlying complaint” 393 .

215. The EDPB notes that the IT SA agrees with the IE SA’s finding with regard to the infringement of the
principle of transparency under Article 5(1)(a) GDPR 394 . As this finding is not subject to a dispute, the
EDPB will not examine this matter.

216. After analysing the IT SA objection, the EDPB finds that the objection is relevant, as it refers to a
specific part of the Draft Decision (Finding 3 395 ), and if followed would lead to the conclusion that
there is an infringement of the general principle of fairness under Article 5(1)(a) GDPR, in addition to
the breach of the separate requirements relating to transparency under this provision 396 . The

387 Meta IE Article 65 Submissions, Annex 1, paragraph 7.8.
388 Meta IE Article 65 Submissions, Annex 1, paragraph 7.9.
389 See paragraphs 73-75 of this Binding Decision.
390 EDPB Guidelines on RRO, paragraph 27.
391 Complaint, paragraph 2.3.1.
392 Complaint, paragraph 2.3.2.
393 Composite Response, paragraph 30.
394 IT SA Objection, p. 4-5.
395 IT SA Objection, p. 4-5.

In respect of Meta IE’s arguments in paragraph 4.9 of its Article 65 Submissions on this objection not being
relevant, the EDPB recalls that the analysis of whether a given objection meets the threshold set by Art. 4(24)
GDPR is carried out on a case-by-case basis. Meta IE refers to the EDPB’s Binding Decision 2/2022 and specifically
to the paragraphs where the EDPB established that specific objections raised by the DE SAs and NO SA in that
case were not relevant and reasoned. There are several differences between those objections and the objection
of the IT SA that is being analysed in this section.
More specifically, in the Binding Decision 2/2022 the objections referred to by Meta IE did not “establish a direct
connection with the specific legal and factual content of the Draft Decision” (Binding Decision 2/2022 paragraphs
139, 147, 164) whereas the IT SA objection here makes several clear links with the content of the Draft Decision,
by referring to the analysis carried out by the IE SA in respect of the breach of the transparency obligations and
to specific observations made by the LSA and explains how the additional infringement of Art. 5(1)(a) could be
established on that basis (see, for example, p. 6 of the IT Objection referring to paragraph 185 of the Draft
Decision concerning users being left “in the dark”).
396 IT SA Objection, p. 5-6.

57
Adopted

objection, if followed, would also entail the exercise of corrective powers, i.e. the measures to be
imposed on the controller in order to bring the processing into conformity with the GDPR 397 .

217. The IT SA objection is also reasoned because it includes several specific legal and factual arguments in
support of finding an additional infringement of the principle of fairness under Article 5(1)(a) GDPR 398 .
For example, the IT SA explains that “[t]ransparency and fairness are two separate notions” and that
“transparency relates to clarity of the information provided to users via the ToS and the privacy policy”,
while “fairness relates to how the controller addressed the lawfulness of the processing activities in
connection with its social networking service” 399 . The IT SA contends that the “overall relationship
between Meta and Instagram users is markedly as well as significantly unbalanced” 400 . According to
the IT SA, the first way in which Meta IE has infringed the principle of fairness is by misrepresenting
the legal basis for processing in order to pursue its business model “without taking due account of
users’ right to the protection of personal data” and leaving “its users in the dark” 401 . Further, in the IT
SA’s view, Meta IE has breached the fairness principle, by justifying via the broad reference to the
legal basis of performance of contract a massive collection of personal data and their reuse for a wide
range of purposes, disproportionately interfering with users’ private life 402 .

218. The IT SA objection also identifies the risks posed by the absence in the Draft Decision of a finding on
the infringement of the fairness principle, namely setting a dangerous precedent for future decisions
concerning other digital platform operators - more generally, other controllers belonging to the same
business sector - and markedly weakening the safeguards that must be provided through the effective
implementation of the data protection framework on account of the comprehensive disregard of the
fairness of the processing principle 403 .

219. Therefore, the EDPB considers that the IT SA objection is relevant and reasoned (cf. Article 4(24)
GDPR).

6.4.2 Assessment on the merits
220. In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning all the
matters which are the subject of the relevant and reasoned objections, in particular whether there is
an infringement of the GDPR.

397
IT SA Objection, p. 1.
398
See paragraphs 206-208 of this Binding Decision.
399 IT SA Objection, p. 5.
400 IT SA Objection, p. 5.
401 IT SA Objection, p. 6.
402 IT SA Objection, p. 6. See also above, paragraphs 206-208. In respect of Meta IE’s arguments in paragraph 4.9

of its Article 65 Submissions on this objection not being reasoned, the EDPB notes that the objections that were
found to be not relevant and/or not reasoned in the Binding Decision 2/2022 did “not provide sufficiently precise
and detailed legal reasoning regarding infringement of each specific provision in question”, did not explain
sufficiently clearly, nor substantiate in sufficient detail how the conclusion proposed could be reached, or did
not sufficiently demonstrate the significance of the risk posed by the Draft Decision for the rights and freedoms
of the data subjects or the free flow of data within the EU (Binding Decision 2/2022, paragraphs 140, 148, 165).
The IT SA objection provides, instead, a number of legal and factual arguments and explanations as to why a
breach of the fairness principle is to be established, and adequately identifies the risk posed by the Draft Decision
if it was adopted unchanged.
403 IT SA Objection, p. 7.

58
Adopted

221. The EDPB considers that the objection found to be relevant and reasoned in this subsection requires
an assessment of whether the Draft Decision needs to be changed insofar as it contains no finding of
infringement of the fairness principle under Article 5(1)(a) GDPR. When assessing the merits of the
objection raised, the EDPB also takes into account Meta IE’s position on the objection and its
submissions.

222. The EDPB takes note of Meta IE’s view that the IT SA objection lacks merit as it goes beyond the scope
of the inquiry 404 . The EDPB also notes that Meta IE links the issue of the potential infringement of the
principle of fairness, raised in the IT SA objection, with the question of the competence of CSAs or the
EDPB to assess the validity of contracts in the context of Article 6(1)(b) GDPR and, when responding
to the merits of the IT SA objection, Meta IE refers to its submissions on application of Article 6(1)(b)
GDPR with respect to standard form contracts 405 . While taking note of Meta IE’s view on this matter,
the EDPB considers the question of Meta IE’s compliance with the principle of fairness under Article
5(1)(a) GDPR to be distinct from the question of the choice of the appropriate legal basis (although a
connected one, as explained below) and proceeds with its respective assessment below.

223. Firstly, the EDPB recalls that the basic principles relating to processing listed in Article 5 GDPR can, as
such, be infringed 406 . This is apparent from the text of Article 83(5)(a) GDPR which subjects the
infringement of the basic principles for processing to administrative fines of up to 20 million euros, or
in the case of undertaking, up to 4% of the total worldwide annual turnover of the preceding financial
year, whichever is higher.

224. The EDPB underlines that the principles of fairness, lawfulness and transparency, all three enshrined
in Article 5(1)(a) GDPR, are three distinct but intrinsically linked and interdependent principles that
every controller should respect when processing personal data. The link between these principles is
evident from a number of GDPR provisions: Recitals 39 and 42, Article 6(2) and Article 6(3)(b) GDPR
refer to lawful and fair processing, while Recitals 60 and 71 GDPR, as well as Article 13(2), Article 14(2)
and Article 40(2)(a) GDPR refer to fair and transparent processing.

225. On the basis of the above consideration, the EDPB agrees with the IE SA’s view that “Article 5(1)(a)
links transparency to the overall fairness of the activities of a controller” 407 but considers that the
principle of fairness has an independent meaning and stresses that an assessment of Meta IE’s
compliance with the principle of transparency does not automatically rule out the need for an
assessment of Meta IE’s compliance with the principle of fairness too.

404
Meta IE Article 65 Submissions, Annex 1, paragraph 7.10. In this respect see paragraphs 73-75 (section 4.4 1)
on this Binding Decision.
405 “To the extent the IT SA Objects to the lawfulness of Meta Ireland’s data processing based on the nature of

the contract between Meta Ireland and users of the Instagram Service (i.e. a standard form contract), Meta
Ireland submits that the validity of contract is not within the competence of CSAs or the EDPB. In any event, Meta
Ireland respectfully asks the EDPB to take into account its submission above with respect to standard form
contracts”. Meta IE Article 65 Submissions, Annex 1, paragraph 7.10.
406 See also Binding Decision 1/2021, paragraph 191.
407 Draft Decision, paragraph 193.

59
Adopted

226. The EDPB recalls that, in data protection law, the concept of fairness stems from the EU Charter of
Fundamental Rights 408 . The EDPB has already provided some elements as to the meaning and effect
of the principle of fairness in the context of processing personal data. For example, the EDPB has
previously opined in its Guidelines on Data Protection by Design and by Default that “[f]airness is an
overarching principle which requires that personal data should not be processed in a way that is
unjustifiably detrimental, unlawfully discriminatory, unexpected or misleading to the data subject”409 .

227. Among the key fairness elements that controllers should consider in this regard, the EDPB has
mentioned autonomy of the data subjects, data subjects’ expectation, power balance, avoidance of
deception, ethical and truthful processing 410 . These elements are particularly relevant in the case at
hand. The principle of fairness under Article 5(1)(a) GDPR underpins the entire data protection
framework and seeks to address power asymmetries between the data controllers and the data
subjects in order to cancel out the negative effects of such asymmetries and ensure the effective
exercise of the data subjects’ rights. The EDPB has previously explained that “the principle of fairness
includes, inter alia, recognising the reasonable expectations of the data subjects, considering possible
adverse consequences processing may have on them, and having regard to the relationship and
potential effects of imbalance between them and the controller” 411 .

228. The EDPB recalls that a fair balance must be struck between, on the one hand, the commercial
interests of the controllers and, on the other hand, the rights and expectations of the data subjects
under the GDPR 412 . A key aspect of compliance with the principle of fairness under Article 5(1)(a) GDPR
refers to pursuing “power balance” as a “key objective of the controller-data subject relationship”413 ,
especially in the context of online services provided without monetary payment, where users are often
not aware of the ways and extent to which their personal data is being processed 414 . Consequently,
lack of transparency can make it almost impossible in practice for the data subjects to exercise an
informed choice over the use of their data 415 which is in contrast with the element of “autonomy” of
data subjects as to the processing of their personal data 416 .

229. Considering the constantly increasing economic value of personal data in the digital environment, it is
particularly important to ensure that data subjects are protected from any form of abuse and
deception, intentional or not, which would result in the unjustified loss of control over their personal

408 Art. 8 EU Charter of Fundamental Rights states as follows: “1. Everyone has the right to the protection of
personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the
basis of the consent of the person concerned or some other legitimate basis laid down by law” (emphasis added).
409 EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, Version 2, Adopted on 20

October 2020 (hereinafter “EDPB Guidelines on Data Protection by Design and by Default”), paragraph 69.
410 EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
411 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 12.
412 On the balance between the different interests at stake see for example: Judgement of the Court of Justice

of 12 December 2013, X, C-486/12, ECLI:EU:C:2013:836; Judgement of the Court of Justice of 7 May 2009, College
van burgemeester en wethouders van Rotterdam v M. E. E. Rijkeboer, C-553/07, ECLI:EU:C:2009:293; Judgment
of the Court (Grand Chamber) of 9 November 2010, Volker und Markus Schecke GbR (C-92/09) and Hartmut
Eifert (C-93/09) v Land Hessen, ECLI:EU:C:2010:662.
413 EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
414 On online services, see EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 3-5.
415 Further EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 4.
416 EDPB Guidelines on Data Protection by Design and by Default, paragraph 70. According to this element of

fairness, “data subjects should be granted the highest degree of autonomy possible to determine the use made
of their personal data, as well as over the scope and conditions of that use or processing”.

60
Adopted

data. Compliance by providers of online services acting as controllers with all three of the cumulative
requirements under Article 5(1)(a) GDPR, taking into account the particular service that is being
provided and the characteristics of their users, serves as a shield from the danger of abuse and
deception, especially in situations of power asymmetries.

230. The EDPB has previously emphasised that the identification of the appropriate lawful basis is tied to
the principles of fairness and purpose limitation 417 . In this regard, the IT SA rightly observes that while
finding a breach of transparency relates to the way in which information has been provided to users
via the Instagram Terms of Use and Data Policy, compliance with the principle of fairness also relates
to “how the controller addressed the lawfulness of the processing activities in connection with its social
networking service” 418 . Thus the EDPB considers that an assessment of compliance by Meta IE with
the principle of fairness requires also an assessment of the consequences that the choice and
presentation of the legal basis entail for the users of the Instagram service. In addition, that
assessment cannot be made in the abstract, but has to take into account the specificities of the
particular social networking service and of the processing of personal data carried out, namely for the
purpose of online behavioural advertising 419 .

231. The EDPB notes that in this particular case the breach of Meta IE’s transparency obligations is of such
gravity that it clearly impacts the reasonable expectations of the Instagram users by confusing them
on whether clicking the “Agree to Terms” button results in giving their consent to the processing of
their personal data. The EDPB notes in this regard that one of the elements of compliance with the
principle of fairness is avoiding deception i.e. providing information “in an objective and neutral way,
avoiding any deceptive or manipulative language or design” 420 .

232. As outlined in the Draft Decision, the Complainant argues that Meta IE relied on “forced consent” as a
result of being led to believe that the legal basis for processing the controller was relying upon was
consent 421 . The Complaint demonstrates the confusion suffered by the Complainant both due to the
(lack of) information presented to Instagram users in the context of their “agreement” 422 and the
circumstances of how the act of “agreement” was sought by Meta IE 423 . The EDPB considers that the
LSA should have taken into account such Meta IE’s practices in relation to the principle of fairness,
regardless of its finding that Meta IE has not sought to rely on consent in order to process personal
data to deliver the Terms of Use 424 .

233. In addition, and as recognised by the LSA itself, further to its assessment of the information provided
concerning processing being carried out in reliance on Article 6(1)(b) GDPR, “it is impossible for the
user to identify with any degree of specificity what processing is carried out on what data, on foot of

417
EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 1.
418
IT SA Objection, p. 5.
419 See Draft Decision, paragraph 104 where the IE SA holds that “the core of the service offered by Meta Ireland

is premised on the delivery of personalised advertising” and Meta IE Article 65 Submissions, paragraph 6.38
where Meta IE claims that “It would be impossible to provide the Instagram Service in accordance with the Terms
of Use without providing behavioural advertising”.
420 EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
421 Draft Decision, paragraph 37.
422 Complaint, p. 3.
423 Complaint, p. 6-7.
424 Draft Decision, Finding 1.

61
Adopted

the specified lawful bases” 425 . Considering this, in the EDPB’s view, there are clear indications that
Instagram users’ expectations with regard to the applicable legal basis have not been fulfilled 426 .
Therefore, the EDPB shares the IT SA’s concern that Instagram users are left “in the dark” 427 and
considers that the processing by Meta IE cannot be regarded as ethical and truthful 428 because it is
confusing with regard to the type of data processed, the legal basis and the purpose of the processing,
which ultimately restricts the Instagram users’ possibility to exercise their data subjects’ rights.

234. Furthermore, the EDPB considers that the extensive analysis by the IE SA with regard to the issue of
legal basis and transparency in relation to the processing being carried out in reliance on Article 6(1)(b)
GDPR is closely linked to the issue of compliance by Meta IE with the principle of fairness. Considering
the seriousness of the infringements of the transparency obligations by Meta IE already identified in
the Draft Decision and the related misrepresentation of the legal basis relied on, the EDPB agrees with
the IT SA that Meta IE has presented its service to the Instagram users in a misleading manner429 ,
which adversely affects their control over the processing of their personal data and the exercise of
their data subjects' rights. Therefore, the EDPB is of the opinion that the IE SA’s finding of breach of
Article 5(1)(a) GDPR with regard to the principle of transparency 430 should extend to the principle of
fairness too.

235. This is all the more supported by the fact that, in the circumstances of the present case as
demonstrated above 431 , the overall effect of the infringements by Meta IE of the transparency
obligations under Article 5(1)(a), Article 12(1), Article 13(1)(c) GDPR and the infringement of Article
6(1)(b) GDPR 432 further intensifies the imbalanced nature of the relationship between Meta IE and the
Instagram users brought up by the IT SA objection. The combination of factors, such as the asymmetry
of the information created by Meta IE with regard to the Instagram service users, combined with the
“take it or leave it” situation that they are faced with due to the lack of alternative services in the
market and the lack of options allowing them to adjust or opt out from a particular processing under
the contract with Meta IE, systematically disadvantages the Instagram service users, limits their
control over the processing of their personal data and undermines the exercise of their rights under
Chapter III of the GDPR.

236. Therefore, the EDPB instructs the IE SA to include a finding of an infringement of the principle of
fairness under Article 5(1)(a) GDPR by Meta IE, in addition to the infringement of the principle of
transparency under the same provision, and to adopt the appropriate corrective measures, by
addressing, but without being limited to, the question of an administrative fine for this infringement
as provided for in Section 9 of this Binding Decision.

425
Draft Decision, paragraph 185.
426
According to the fairness element of “expectation”, “processing should correspond with data subjects’
reasonable expectations”. EDPB Guidelines on Data Protection by Design and by Default, paragraph 70.
427 IT SA Objection, p. 6.
428 See EDPB Guidelines on Data Protection by Design and by Default, paragraph 70, where the EDPB explains

that “ethical” means that “[t]he controller should see the processing’s wider impact on individuals’ rights and
dignity“ and “truthful” means that “[t]he controller must make available information about how they process
personal data, they should act as they declare they will and not mislead the data subjects”.
429 IT SA Objection, p. 5.
430 Draft Decision, paragraphs 180-196.
431 Paragraphs 223-235 of this Binding Decision.
432 Paragraph 137 of this Binding Decision.

62
Adopted

7 ON THE POTENTIAL ADDITIONAL INFRINGEMENT OF THE
PRINCIPLES OF PURPOSE LIMITATION AND DATA MINIMISATION
7.1 Analysis by the LSA in the Draft Decision
237. The IE SA refers to Article 5(1)(b) GDPR 433 and Article 5(1)(c) GDPR 434 when analysing the extent of the
controller’s obligation under Article 13(1)(c) GDPR and whether Meta IE has infringed this provision.
More specifically, the IE SA highlights that Article 13 GDPR requires that the purposes and legal bases
must be specified in respect of the intended processing and cannot just be cited in the abstract435 .
After explaining why Meta IE’s view that there is no specific obligation for the legal basis to be mapped
to the purpose of processing cannot be reconciled with a literal reading of the GDPR, the IE SA, for
completeness, also engages in a systemic reading based on the legislator’s objective and the contents
of the GDPR as a whole 436 .

238. In this context, the IE SA points out that the six principles laid down under Article 5 GDPR are
interconnected and operate in combination to underpin the whole GDPR 437 . However, the IE SA does
not assess whether Meta IE’s processing activities entail a separate infringement of the principles of
purpose limitation and data minimisation under Article 5(1)(b) and Article 5(1)(c) GDPR.

7.2 Summary of the objection raised by the CSAs
239. According to the IT SA, there is an additional infringement of points (b) and (c) of Article 5(1) GDPR on
account of Meta IE’s failure to comply with the purpose limitation and data minimisation principles. It
considers that such infringement should be found without the need for any further investigation and
should result into a substantial increase of the proposed administrative fine 438 .

240. The IT SA puts forward several factual and legal arguments for the proposed change to the Draft
Decision. First, it points out that the IE SA confines its assessment to only one of the contracts purposes
(the provision of online behavioural advertising), while the Instagram service would actually be
composed of several processing activities pursuing several purposes 439 . According to the IT SA, the
fact that Meta IE inappropriately based its multifarious processing activities only on Article 6(1)(b)
GDPR entails an infringement of the purpose limitation and data minimisation principles 440 . The IT SA
stresses the relevance of these principles in online services contracts, as they are not negotiated on
an individual basis, and refers to pages 15 and 16 of the WP29 Opinion 03/2013 on purpose
limitation 441 . The IT SA also refers to the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR and recalls
that, where the contract consists of several separate services or elements of a service that can be

433
Draft Decision, paragraphs 152-160.
434
Draft Decision, paragraph 152.
435 Draft Decision, paragraph 162.
436 Draft Decision, paragraphs 167-171.

437 Draft Decision, paragraph 152 and paragraphs 153-160 with respect to the principle of purpose limitation

under Art. 5(1)(b) GDPR.
438 IT SA Objection, p. 4.
439 IT SA Objection, p. 2.
440 IT SA Objection, p. 2.
441 IT SA Objection, p. 3.

63
Adopted

performed independently, the applicability of Article 6(1)(b) GDPR should be assessed for each of
those services separately 442 .

241. On the risks posed by the Draft Decision, the IT SA refers to the risk identified by the WP29 in its
Opinion 03/2013 on purpose limitation 443 , namely that “data controllers may seek to include
processing terms in contracts to maximise the possible collection and uses of data without adequately
specifying those purposes or considering data minimisation obligations” 444 . In addition, in the IT SA’s
view, the failure to specify and communicate the purposes of the processing to the data subject
creates a risk of artificially expanding the types of processing or the categories or personal data
considered necessary for the performance of a contract under Article 6(1)(b) GDPR, which would
nullify the safeguards afforded to data subjects under data protection law 445 .

7.3 Position of the LSA on the objection
242. The IE SA does not consider that the IT SA’s objection is relevant and reasoned 446 . Categorising the
objection as relating to the scope and conduct of the inquiry, the IE SA adopts the same approach as
with regard to the alleged infringement of the principle of fairness. More specifically, the IE SA
contends that introducing novel issues not raised by the Complainant or otherwise put to the parties
would represent a significant departure in terms of the scope of the inquiry 447 . It highlights the legal
consequences that would flow from making material changes concerning infringements outside of the
complaint and Draft Decision, namely the likelihood that Meta IE would succeed in arguing before the
Irish Courts that it has been denied an opportunity to be heard on additional and extraneous findings
that are adverse to it 448 . The IE SA’s concern arose from the fact that, according to the IE SA, Meta IE
was never invited to be heard in response to an allegation that it had infringed the fairness principle
set out in Article 5(1)(a) GDPR. The IE SA notes, in this regard, that a respondent has the right to be
heard in response to the particulars of the case being made against it and that this is a core element
of a fair procedure pursuant to Irish law. The IE SA takes the view that expanding the material scope
of the inquiry is not possible under Irish procedural law 449 . It further notes that a very significant risk
of procedural unfairness, under Irish national law, would result from the proposal to assume, without
any further factual examination, that Meta IE has infringed the purpose limitation principle 450 .

7.4 Analysis of the EDPB

7.4.1 Assessment of whether the objection was relevant and reasoned
243. The IT SA’s objection concerns “whether there is an infringement of the GDPR” 451 .

442
IT SA Objection, p. 3.
443
WP29 Opinion 03/2013 on purpose limitation, WP 203, adopted on 2 April 2013.
444 IT SA Objection, p. 3.
445 IT SA Objection, p. 3.

446 Composite Response, paragraph 36.
447 Composite Response, paragraph 29.
448 Composite Response, paragraphs 31-32.
449 Composite Response, paragraph 32.
450 Composite Response, paragraph 33.
451 EDPB Guidelines on RRO, paragraph 24.

64
Adopted

244. The EDPB takes note of Meta IE’s view that the IT SA’s objection does not meet the relevant and
reasoned thresholds because it falls outside the defined scope of the inquiry 452 . As previously
explained, the EDPB does not share the understanding that CSAs may not disagree with the scope of
the inquiry as decided by the LSA by way of an objection 453 .

245. Meta IE points out that the objection concerns matters that have not been investigated and relates to
theoretical findings on legal bases 454 . Meta IE further argues that even if the objection satisfied the
abovementioned thresholds, it should be disregarded because otherwise Meta IE’s right to fair
procedures under both Irish and EU law would be contravened 455 .

246. The EDPB considers that the IT SA objection is relevant as it refers to specific parts of the Draft
Decision, namely Finding 2 and Finding 3 456 , and argues that the IE SA should have found an
infringement of Article 5(1)(b) and Article 5(1)(c) GDPR which lay down the principles of data
minimisation and purpose limitation.

247. The objection also includes arguments on legal and factual mistakes in the IE SA’s Draft Decision that
require amending. According to the IT SA, the IE SA’s reasoning is inconsistent because the high-level,
rather unclear information provided to the data subjects is a major criticality that should have led the
IE SA not only to question the features of the information notice, but also to verify, in detail, the
application of the principles of purpose limitation and data minimisation from a substantive
perspective 457 . More specially, the IT SA takes the view that the IE SA should have had regard to the
actual configuration of the processing operations performed in order to assess whether the controller
had abided by the obligation to process personal data for specified, explicit and legitimate purposes
both when collecting those data and thereafter 458 .

248. As regards the risk posed by the Draft Decision, the EDPB takes note of the IT SA’s reference to
paragraph 16 of the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR and reiterates the particular
relevance of Article 5(1)(b) and Article 5(1) (c) GDPR in the context of contracts for online services, in
view of the risk that data controllers may seek to include general processing terms in contracts in
order to maximise the possible collection and uses of data, without adequately specifying those
purposes or considering data minimisation obligations 459 . Nevertheless, the EDPB stresses that a mere
reference to the EDPB Guidelines is not sufficient to demonstrate the risks posed by the Draft Decision
in this specific case and in these specific circumstances.

249. The IT SA also considers that the purposes for the processing “must be clearly specified and
communicated to the data subject, in line with the controller’s purpose limitation and transparency
obligations”, otherwise there is “a risk that other data protection obligations might be evaded by
artificially expanding the types of processing or the categories of personal data that are considered to

452
Meta IE Article 65 Submissions, Annex 1, paragraphs 7.1-7.4.
453
See paragraphs 73-75 of this Binding Decision.
454 Meta IE Article 65 Submissions, Annex 1 paragraphs 7.2.

455 Meta IE Article 65 Submissions, Annex 1, paragraphs 7.3.
456 The IT SA refers to the IE SA’s reasoning preceding Finding 2 and to paragraphs 122-149 and 184, 185 and

187 preceding Finding 3 of the Draft Decision.
457 IT SA Objection, p. 4.
458 IT SA Objection, p. 4.
459 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 16.

65
Adopted

be ‘necessary’ for performance of the contract under Article 6(1)(b) GDPR - which would in turn nullify
the safeguards afforded to data subjects by personal data protection law” 460 .

250. The EDPB recalls that the objection must put forward arguments or justifications concerning the
consequences of issuing the decision without the changes proposed in the objection, and how such
consequences would pose significant risks for data subjects’ fundamental rights and freedoms 461 . The
CSA needs to advance sufficient arguments to explicitly show that such risks are substantial and
plausible 462 . In addition, the demonstration of the significance of the risks cannot be implied from the
legal and/or factual arguments provided by the CSA, but has to be explicitly identified and elaborated
in the objection 463 .

251. The EDPB considers that the IT SA’s objection fails to meet these requirements as it does not
demonstrate the significance of the risk stemming from an omission in the Draft Decision of a finding
that the principles of purpose limitation and data minimisation have been infringed by Meta IE. The
risk, as described by the IT SA objection, is not substantial and plausible enough. Moreover, the risk
relates to the IE SA’s decision not to conclude on the inappropriate use of Article 6(1)(b) GDPR as a
legal basis for Meta IE’s processing activities but fails to establish a clear link with the LSA’s decision
not to make a finding on the infringement of Article 5(1)(b) and Article 5(1)(c) GDPR.

252. Therefore, the EDPB considers that the abovementioned objection by the IT SA is not reasoned (cf.
Article 4(24) GDPR) and will not assess it on the merits.

8 ON CORRECTIVE MEASURES OTHER THAN ADMINISTRATIVE FINES
8.1 Analysis by the LSA in the Draft Decision
253. The IE SA considers that an order to bring processing into compliance (Art. 58(2)(d) GDPR) should be
imposed on Meta IE, requiring them to bring their Data Policy and Terms of Service into compliance
with Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR as regards processing carried out on the
basis of Article 6(1)(b) GDPR within three months of the date of notification of any final decision 464 .

254. The LSA considers an order is necessary and proportionate, contrary to the controller’s position 465 .
Regarding the necessity, the IE SA explains that this order is the only way to guarantee that Meta IE
amends the infringements outlined in the Draft Decision, which is essential for the protection of data
subjects’ rights 466 . Concerning the proportionality, the LSA points out that the proposed measure is
the minimum action required to ensure the future compliance of the controller. Further, the IE SA

460
IT SA Objection, p. 3.
461
EDPB Guidelines on RRO, paragraph 18.
462 EDPB Guidelines on RRO, paragraph 37.
463 EDPB Guidelines on RRO, paragraph 37.
464 Draft Decision, paragraphs 200 and 203.
465 Meta IE Submissions on Preliminary Draft Decision, paragraphs 12.1, 12.2, and 12.4; Draft Decision,

paragraphs 200 and 201.
466 Draft Decision, paragraph 204.

66
Adopted

recalls Meta IE’s available resources, the specificity of the LSA’s order, and the importance of the data
subject’s rights concerned to conclude that such measure is proportionate 467 .

8.2 Summary of the objections raised by the CSAs
255. The NL SA objects to the choice of the corrective measures of the LSA in their Draft Decision468 . The
NL SA notes that the IE SA is proposing to impose an order pursuant to Article 58(2)(d) GDPR alongside
an administrative fine, and that this objection concerns the first of these two measures 469 . More
specifically, the NL SA objects to the order to bring processing into compliance (Article 58(2)(d) GDPR)
within three months proposed by the LSA, arguing that it is not appropriate, not necessary, nor
proportionate to ensure compliance with Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR, as
well as the additional infringement of Article 6(1)(b) and Article 9(2) GDPR raised in its objection470 .
The NL SA takes the view that the proposed order is insufficient to remedy the serious situation of
non-compliance arising from these infringements, since it does not remedy the illegality of the
conduct carried out during the transition period (i.e. the time between the issuance of the decision
and the expiration date of the order), bearing in mind that every day the service continues operations
as described in the Terms of Use and Data Policy, it does so in an illegal way harming the rights and
freedoms of millions of data subjects in the EEA 471 . According to the NL SA, the Draft Decision should
be modified to include a temporary ban on Meta IE’s processing of personal data for the duration
necessary for the controller to bring its processing into compliance with the GDPR (Article 58(2)(f)
GDPR), as this would be appropriate, necessary and proportionate taking into account the
circumstances of the case 472 , and would be the only measure suitable to make sure that the expansive
violation of the fundamental rights and freedoms of data subjects is not continued 473 . The NL SA also
argues that the breaches of the GDPR established by the LSA, combined with the additional breaches
put forward by the NL SA, are of a very grave nature and justify halting processing operations during
the time the controller needs to remedy its severe lack of compliance 474 . In essence, the NL SA
identifies the risk posed by the Draft Decision in that it allows the company to resume operations as
usual while amending the compliance deficits (with regard to transparency), which they argue
essentially deprives data subjects of their rights during a transition period 475 .

256. The FI SA also argues that the IE SA should “exercise effective, proportionate and dissuasive corrective
powers” and order Meta IE to “bring its processing operations into compliance with the provision of
Article 6(1) GDPR and prohibit to process users’ personal data for behavioural advertising by relying
on Article 6(1)(b) GDPR as laid down in Article 58(2)(d) GDPR” 476 . The HU SA reaches the same
conclusion, proposing to apply the legal consequences under Article 58(2)(d) GDPR and to instruct the
controller to indicate a different legal basis 477 . On the risks, both the FI and the HU SAs state that the
absence of appropriate and necessary corrective powers would amount to a dangerous precedent,

467
Draft Decision, paragraph 205.
468
NL SA Objection, paragraph 55.
469 NL SA Objection, paragraph 56.
470 NL SA Objection, paragraph 56.
471 NL SA Objection, paragraph 57.

472 NL SA Objection, paragraph 58
473 NL SA Objection, paragraph 59.
474 NL SA Objection, paragraph 63.
475 NL SA Objection, paragraphs 57, 58, and 63.
476 FI SA Objection, paragraph 25.
477 HU SA Objection, p. 3.

67
Adopted

sending a deceiving message to the market and to data subjects whose fundamental rights and
freedoms would ultimately jeopardise 478 . Moreover, the FI SA notes that the Draft Decision affects all
data subjects within the EEA and that, therefore, the consequences of not making use of the corrective
measures pursuant Article 58(2) would be enormous 479 .

257. The AT SA requests that the LSA makes use of its corrective measures pursuant to Article 58(2) GDPR
in relation to the additional infringement of Article 6(1)(b) GDPR 480 , in order to bring the processing
operations of the controller in line with the GDPR 481 and remedy the infringement 482 . According to the
AT SA, the IE SA should exercise ‘’corrective powers’’ so as to ensure that Meta IE could not continue
to unlawfully rely on Article 6(1)(b) GDPR for the processing of users’ personal data for behavioral
advertising 483 . More specifically, the AT SA suggests that the IE SA prohibits Meta IE “the processing
of a user’s data for behavioural advertising by relying on Article 6(1)(b) GDPR” 484 . In the absence of
additional corrective measures, the AT SA considers that if corrective measures are not imposed, there
is a risk “that [Meta IE] continues to unlawfully rely on Article 6(1)(b) GDPR for the processing of a
user’s data for behavioural advertising and continues to undermine or bypass data protection
principles’’ 485 , which would affect millions of data subjects within the EEA and bear vast
consequences 486 .

258. The FR SA notes that reversing the findings concerning the infringements of Article 6(1) GDPR also
affects the scope of the corrective actions proposed by the IE SA, in addition to the administrative
fine 487

259. Finally, according to the NO and DE SAs, the IE SA should take concrete corrective measures in relation
to the additional infringement of Meta IE with Article 6(1)(b) GDPR, namely to order Meta IE to delete
personal data that has been unlawfully processed on Article 6(1)(b) GDPR and to prohibit the use of
this legal basis for such processing activities 488 .

478
FI SA Objection, paragraph 28 ; HU SA Objection, p. 4.
479
FI SA Objection, paragraph 29.
480 AT SA Objection, p. 7.
481 AT SA Objection, p. 8. The AT SA also highlights that according to the CJEU where an infringement is found

during a complaint-based procedure, the SA is under an obligation to take appropriate action by exercising
corrective powers, and it cites C-311/18, paragraph 111. Additionally, the AT SA clarifies that although it takes
the position that a complainant does not have a subjective right to request from the respective supervisory
authority the exercise of a specific corrective power and it is up to the authority only to decide which action is
appropriate and necessary (referring to C-311/18, paragraph 112), it finds the exercise of corrective powers to
be necessary in the current case.
482 AT SA Objection, p. 8-9.

483 AT SA Objection, p. 7-8.
484 AT SA Objection, p. 9.
485 AT SA Objection, p. 7.
486 AT SA Objection, p. 8.
487 FR SA Objection, paragraph 50.
488 DE SAs Objection, p. 10 ; NO SA Objection, p. 9.

68
Adopted

8.3 Position of the LSA on the objections
260. The IE SA does not consider the objections above to be relevant and/or reasoned and does not follow
them 489 . Given that these objections were premised upon the requirement for the Draft Decision to
include a finding of infringement of Article 6(1)(b) GDPR on which the IE SA expressed its
disagreement, the IE SA does not consider the objections requesting the exercise of a corrective power
in response to a finding of infringement of Article 6(1)(b) GDPR as being relevant and reasoned 490 .

8.4 Assessment of the EDPB

8.4.1 Assessment of whether the objections were relevant and reasoned

261. The objections raised by the AT, DE, FI, FR, HU, NL and NO SAs concern “whether the action envisaged
in the Draft Decision complies with the GDPR” 491 .

262. In addition to the primary argument levelled against all CSA’s objections, Meta IE provides additional
arguments on whether these are relevant and/or reasoned 492 .

263. Meta IE argues the AT and NL SAs’ objection cannot be considered relevant because they are
dependent on another objection, which Meta IE deems inadmissible and without merit 493 . On the
same basis, Meta IE refutes that the AT SA’s objection is adequately reasoned 494 . As stated above, in
Section 4.4.1, the EDPB finds the AT and NL SAs’ objections on the subject of Article 6(1)(b) GDPR
relevant and reasoned 495 .

264. Additionally, Meta IE argues that the AT and NL SAs’ objections fail to set out how the Draft Decision
would pose a direct and significant risk to fundamental rights and freedoms. First, Meta IE refers to
their arguments put forward in response to the AT and NL SAs’ objections on the matter of compliance
with Article 6(1)(b) GDPR 496 . The EDPB has taken this line of reasoning into consideration above in

489 Composite Response, paragraphs 103-104 (in response to the AT and FI SAs), paragraph 105 (in response to
NL SA), paragraph 106 (in response to DE SAs), paragraph 107 (in response to NO SA) and paragraph 108 (in
response to HU SA).
490 Composite Response, paragraphs110.
491 EDPB Guidelines on RRO, paragraph 32.
492 Meta IE argues that “the EDPB cannot expand the scope of the Inquiry in the manner suggested by the CSAs

through Objections that are not relevant to the substance of the Complaint.” and “such objections ought to be
disregarded in their entirety by the EDPB”. The EDPB does not share this understanding, as explained above.
See Section 4.4.1.
493 Meta IE Article 65 Submissions, Annex 1, p. 71: “The AT SA’s Objection fails to satisfy the Sufficiently Relevant

Threshold, because it is itself based on an Objection grounded in a mistaken allegation of infringement of Article
6(1)(b) GDPR, which does not satisfy the Thresholds and lacks merit. Therefore, this Objection is not sufficiently
relevant as it has no direct connection to the substance and reasoning of the Draft Decision.” Analogous wording
is used in response to the NL SA’s objection in Meta IE Article 65 Submissions, Annex 1, p. 110.
494 Meta IE Article 65 Submissions, Annex 1, p. 71: “The AT SA’s Objection fails to satisfy the Adequately Reasoned

Threshold because it is premised on its Objection that Meta Ireland infringed Article 6(1) GDPR, which, as
analysed in the previous section, does not satisfy the Thresholds and lacks merit”. Analogous wording is used in
response to the NL SA’s objection in Meta IE Article 65 Submissions, Annex 1, p. 110.
495 Paragraph 84 above.
496 Meta IE Article 65 Submissions, Annex 1, p. 72 and p. 111.

69
Adopted

Section 4.4.1 497 . Second, Meta IE puts forward that the AT and NL SAs appear to consider that the
Draft Decision provides “a mandate for Meta Ireland to unlawfully process data” 498 . Meta IE points
out that no such inference can be drawn from the Draft Decision, going on to draw the conclusion that
“as the Draft Decision does not in any way give a blanket approval for any unlawful processing based
on Article 6(1)(b) GDPR, there is no direct and significant risk to the fundamental rights and
freedoms” 499 . As to this second line of reasoning, the EDPB fails to see wording by which the AT SA or
NL SA might have suggested it understands the Draft Decision as a mandate for Meta Ireland to
unlawfully process data, thus limiting future investigations.

265. The NL SA disagrees with the corrective measure chosen by the IE SA in addition to the administrative
fine, arguing a temporary ban on processing (Article 58(2)(f) GDPR) should have been included in the
Draft Decision instead of an order to bring processing into compliance. If followed, this objection
would lead to a different conclusion as to the choice of corrective measures. In consequence, the EDPB
considers the objection to be relevant.

266. The NL SA argues that an order to bring processing into compliance entails that Meta IE would
maintain its illegal conduct while they amend their compliance deficits 500 . Conversely, a temporary
ban on Meta IE’s processing of data would ensure that data processing is halted during the time
needed for the company to change its practices to comply with the GDPR 501 . In terms of risk, the NL
SA puts forward that ‘’not temporarily banning this processing would undermine the effectiveness of
the GDPR’’, and would continue to deprive data subjects of their rights during the transition period502 .
The NL SA considers the risk significant, as the controller provides the Instagram service to hundreds
of millions of users across Europe and because the processing involves special categories of personal
data 503 . Therefore, the EDPB considers the objection to be reasoned and to clearly demonstrate the
significance of the risks posed by the Draft Decision.

267. The AT SA disagrees with a specific part of the IE SA’s Draft Decision, namely Chapter 8 ‘’Order to bring
processing into compliance’’, arguing that the LSA should have included corrective measures in order
to remedy an infringement of Article 6(1)(b) GDPR 504 . More specifically, the AT SA suggests that the IE
SA prohibits Meta IE from relying on Article 6(1)(b) GDPR 505 . Therefore, if followed, this objection
would lead to a different conclusion as to the choice of corrective measures 506 . In consequence, the
EDPB considers the objection to be relevant.

268. Furthermore, the AT SA argues that when an infringement is found - notably in light of other objections
raised in the current case in relation to additional infringement of Articles 6(1)(b) - the supervisory
authority is under an obligation to issue appropriate corrective measures pursuant to Article 58(2)

497
Paragraph 82 above.
498
Meta IE Article 65 Submissions, Annex 1, p. 111. Analogous wording is used in response to the AT SA, Meta
IE's Article 65 Submissions, Annex 1, p. 72.
499 Meta IE Article 65 Submissions, Annex 1, p. 111. Analogous wording is used in response to the AT SA, Meta

IE's Article 65 Submissions, Annex 1, p. 72.
500 NL SA Objection, paragraph 57-58.

501 NL SA Objection, paragraph 63.
502 NL SA Objection, paragraphs 58-59.
503 NL SA Objection, paragraphs 58-59.
504 AT SA Objection, pp. 7-8.
505 AT SA Objection pp. 7-8.
506 AT SA Objection, pp. 7-8.

70
Adopted

GDPR. In terms of risk, the AT SA argues that without this amendment of the Draft Decision, Meta IE
“could simply continue to unlawfully rely on Article 6(1)(b) GDPR and to undermine data protection
principles” which would continue to affect millions of data subjects within the EEA 507 . Therefore, the
EDPB considers the objection to be reasoned and to clearly demonstrate the significance of the risks
posed by the Draft Decision.

269. Considering the above, the EDPB finds that the objections of the AT and NL SAs requesting additional
and/or alternative specific corrective measures to be imposed are relevant and reasoned pursuant to
Article 4(24) GDPR.

270. In addition, the EDPB recalls the analysis made in Section 4.4.1 above concerning the objections in
relation to the additional breach by Meta IE of its lawfulness obligation made by the FR SA (requesting
to take appropriate corrective measures), and by the FI and HU SAs (asking the LSA to take corrective
measures under Article 58(2)(d) GDPR), which were found to be relevant and reasoned.

271. The EDPB recalls that the DE and NO SAs called on the LSA to take specific corrective measures in the
event the EDPB followed their objection on compliance with Article 6(1)(b) GDPR. The EDPB considers
these to be reflections upon how, in their view, the LSA should give full effect to the binding
direction(s) as set out in the EDPB’s decision 508 . In the absence of legal or factual arguments that would
justify including these specific corrective measures in the Draft Decision as opposed to others, the
EDPB does not consider this aspect of the DE and NO SAs’ objections to meet the requirements of
Article 4(24) GDPR as they are not sufficiently reasoned.

8.4.2 Assessment on the merits

Preliminary matters

272. The EDPB considers that the objections found to be relevant and reasoned in this subsection require
an assessment of whether the Draft Decision needs to be changed in respect of the corrective
measures proposed. More specifically, the EDPB needs to assess the request to impose a ban of
processing for both the infringements of the transparency obligations found by the LSA and the
additional infringement of Article 6(1) GDPR established above in Section 4.4.2, and the connected
issue of the corrective measure to be imposed for the infringement of Article 6(1) GDPR. When
assessing the merits of the objections raised, the EDPB also takes into account Meta IE’s position on
the objection and its submissions.

273. By way of introduction, the EDPB highlights that the analysis carried out in this section does not refer
to the content of the Draft Decision and of the objections in respect of the imposition of administrative
fines, which are covered below in Section 9.

507
AT SA Objection, p. 8.
508
EDPB Guidelines on Article 65(1)(a) GDPR, paragraph 50.

71
Adopted

Meta IE’s position on the objections and its submissions

274. Meta IE considers the LSA has sole discretion to determine the appropriate corrective measures in the
event of a finding of infringement 509 and that the EDPB lacks competence to determine or adopt
decisions on appropriate corrective measures 510 .

275. While Meta IE acknowledges that “Article 65(1) GDPR allows the EDPB to consider reasoned objections
as to whether the envisaged corrective measures comply with the GDPR”, it argues that CSAs are
strictly limited to criticism of the corrective measures already put forward in the Draft Decision by the
LSA. Therefore, according to Meta IE, “should the EDPB find an infringement of Article 6(1) GDPR [...],
the appropriate course would be to refer the matter back to the LSA (i.e. the DPC) to determine whether
to impose any appropriate corrective measures. To do otherwise, including direct the DPC to make a
specific order in the terms proposed by certain Objections, would exceed the EDPB’s competence under
Article 65 GDPR” 511 .

276. With respect to the issue of the corrective measure to be imposed for the infringement of Article 6(1)
GDPR, if any, Meta IE argues that a temporary ban is neither necessary, nor proportionate to achieve
the objective of ensuring compliance with the GDPR, as there exists alternative, less onerous measures
to bring its processing operation into compliance with the GDPR 512 . In addition, Meta IE contends that
it would be both unfair and disproportionate to order an immediate ban given that it relied upon a
good faith understanding as to what it considered to be a valid legal basis 513 . Further, Meta IE
considers there is no urgent necessity for a ban based on other decisions taken under the Article 60
GDPR cooperation mechanism in similar circumstances 514 . Finally, Meta IE puts forward the significant
impact of a temporary ban not only on its activities but also on third parties’ business, such as small
and medium sized businesses across Europe, relying on the platform for behavioural advertising 515 .

EDPB’s assessment on the merits

277. First of all, according to the EDPB, the views of Meta IE amount to a misunderstanding of the GDPR
one-stop-shop mechanism and of the shared competences of the CSAs. The EDPB recalls that the
GDPR requires supervisory authorities to cooperate pursuant to Article 60 GDPR to achieve a
consistent interpretation of the Regulation 516 . The fact that the LSA will be the authority that can
ultimately exercise the corrective powers listed in Article 58(2) GDPR cannot neither limit the role of
the CSAs within the cooperation procedure nor the one of the EDPB in the consistency procedure 517 .

509
Meta IE Article 65 Submissions, paragraphs 8.4 and 8.18.
510
Meta IE Article 65 Submissions, paragraph 8.6.
511 Meta IE Article 65 Submissions, paragraph 8.13.
512 Meta IE Article 65 Submissions, paragraph 8.27.
513 Meta IE Article 65 Submissions, paragraph 8.28.
514 Meta IE Article 65 Submissions, paragraph 8.28.
515 Meta IE Article 65 Submissions, paragraph 8.29.

516 See Art. 51(2), Art. 60, Art. 61(1) GDPR, and C-645/19, Facebook v Gegevensbeschermingsautoriteit,

paragraphs 53, 63, 68, 72.
517 See Art. 63 and 65 GDPR. In this regard it should be noted that Recital 11 GDPR stresses that ‘effective

protection of personal data throughout the Union requires [...] equivalent sanctions for infringements in the
Member States’. Therefore, in order to ensure this ‘consistent monitoring and enforcement’ of the GDPR, the
legislator has decided to provide supervisory authorities with the ‘same corrective powers’ (Recital 129 GDPR).

72
Adopted

278. More specifically, when raising an objection on the existing or missing corrective measure(s) in the
Drafting Decision, the CSAs should indicate which action they believe would be appropriate for the
LSA to undertake and include in the final decision 518 . In case of disagreement on these objections, the
dispute resolution competence of the EDPB covers ‘’all the matters which are subject of the relevant
and reasoned objection’’ (emphasis added) 519 . Therefore, contrary to Meta IE’s views, the consistency
mechanism may also be used to promote a consistent application by the supervisory authorities of
their corrective powers, taking into account the range of powers listed in Article 58(2) GDPR 520 , when
a relevant and reasoned objection questions the action(s) envisaged by the Draft Decision vis-a-vis the
controller/processor, or the absence thereof.

279. In addition, the EDPB finds that Meta IE misunderstands the AT SA’s objection when it argues that it
does acknowledge that it is for the LSA alone to decide which corrective measures are appropriate
and necessary, by citing paragraph 112 of the Schrems II CJEU judgment 521 . In fact, the AT SA does no
such thing: in its objection it stated ‘’a complainant does not have a subjective right to request from
the respective supervisory authority (in this case: the DPC) the exercise of a specific corrective power
and it is for the supervisory authority alone to decide which action is appropriate and necessary (see
C‑311/18, point 112)’’ 522 and did not engage in an interpretation of how Article 58(2) GDPR is to be
understood in cross-border cases in the sections referred to. The cooperation and consistency
mechanism of the GDPR is not addressed in CJEU ruling C-311/18 (Schrems II) either.

280. Moving on to the analysis of the issue of corrective measures as required by the objections found to
be relevant and reasoned above, the EDPB recalls that when a violation of the GDPR has been
established, competent supervisory authorities are required to react appropriately to remedy this
infringement in accordance with the means provided to them by Article 58(2) GDPR 523 . Article 58(2)
GDPR provides a wide choice of effective tools for the authorities to take action against infringements
of the Regulation and which can be imposed in addition to or instead of a fine. According to Recital
129 GDPR, every corrective measure applied by a supervisory authority under Article 58(2) GDPR
should be ‘‘appropriate, necessary and proportionate in view of ensuring compliance with the
Regulation’’ in light of all the circumstances of each individual case. Recital 148 GDPR shows the duty
for supervisory authorities to impose corrective measures that are proportionate to the seriousness
of the infringement 524 . This highlights the need for the corrective measures and any exercise of
powers by supervisory authorities to be tailored to the specific case 525 .

281. Considering the nature and gravity of the infringement of Article 6(1)(b) GDPR established above in
Section 4.4.2, as well as the number of data subjects affected, the EDPB shares the view of the AT, FI,

518
See EDPB Guidelines on RRO, paragraph 33.
519
Art. 65(1)(a) GDPR.
520 See EDPB Guidelines on Article 65(1)(a) GDPR, paragraph 92.
521 Meta IE Article 65 Submissions, paragraph 8.6. See above paragraph 274.
522 AT SA Objection, p. 8.
523 C-311/18, Schrems II, paragraph 111.

524 Recital 148 GDPR states, for instance: “in a case of a minor infringement or if the fine likely to be imposed

would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine”.
The EDPB confirmed that “the indications provided by this Recital can be relevant for the imposition of corrective
measures in general and for the choice of the combination of corrective measures that is appropriate and
proportionate to the infringement committed”. EDPB Binding Decision 1/2021, paragraph 256.
525 EDPB Binding Decision 1/2021, paragraph 256.

73
Adopted

FR, HU and NL SAs that it is particularly important that appropriate corrective measures be imposed,
in addition to a fine, in order to ensure that Meta IE complies with this provision of the GDPR.

282. In respect of which measure should be imposed, as stated, the NL SA argues that the IE SA's proposal
to order Meta IE to comply with Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR within a period
of three months is not appropriate, considering these breaches in conjunction with the gravity of the
additional breaches of Article 6(1)(b) and Article 9(2) GDPR identified in its objection 526 . Instead, the
NL SA is of the opinion that only a temporary ban imposed in respect of all these infringements can
effectively protect the rights of the data subjects during the transition period in which the controller
remedies to these violations 527 . The FI SA considers that the IE SA should “exercise effective,
proportionate and dissuasive corrective powers” and, taking into account the nature of the
infringement, order Meta IE to “bring its processing operations into compliance with the provision of
Article 6(1) GDPR and prohibit to process users’ personal data for behavioural advertising by relying
on Article 6(1)(b) GDPR as laid down in Article 58(2)(d) GDPR” 528 . The HU SA proposes to apply the
legal consequences under Article 58(2)(d) GDPR in relation to violation of Article 6(1) GDPR by Meta
IE and to instruct the controller to indicate a another alternative legal basis 529 . In addition, the AT SA
calls on the IE SA to use its corrective powers under Article 58(2) GDPR in order to bring the processing
operations of Meta IE into line with the GDPR, and suggests ‘’that the DPC prohibits Facebook the
processing of a user’s data for behavioural advertising by relying on Article 6(1)(b)’ stating that
‘otherwise, Facebook could simply continue to unlawfully rely on Article 6(1)(b) GDPR’’ 530 .

283. Meta IE argues that a temporary ban would not be necessary as less onerous measures could be
imposed and that it would be unfair and disproportionate, also considering its impact on third
parties 531 .

284. The EDPB agrees with the observations made by the NL SA that the infringement found in the case at
hand constitutes a “very serious situation of non-compliance” 532 with the GDPR, in relation to
processing of “extensive amounts of [...] data, which is essential to the controller’s business mode”’ 533 ,
thus harming “the rights and freedoms of millions of data subjects in the EEA” 534 . As a result, the EDPB
shares the NL SA’s concern that the corrective measure chosen in the circumstances of this case should
aim to bring the processing into compliance with the GDPR thus minimising the potential harm to data
subjects created by the violations of the GDPR.

526
NL SA Objection, paragraph 57. In this respect, the EDPB recalls that, as stated in Sections 4.4.2 and 5.4.2
above, while the EDPB finds that the IE SA should have found an infringement of Art. 6(1)(b) GDPR in its Draft
Decision, it does not have sufficient factual evidence allowing it to find a possible infringement by Meta IE of its
obligations under Art. 9(2) GDPR.
527 NL SA Objection, paragraph 58.
528 FI SA Objection, paragraph 25.

529 HU SA Objection, p. 3.
530 AT SA Objection, p. 8-9.
531 Meta IE Article 65 Submissions, paragraphs 8.27-8.28.
532 NL SA Objection, paragraph 54.
533 NL SA Objection, paragraph 58.
534 NL SA Objection, paragraph 57.

74
Adopted

285. In addition, the EDPB recalls that contrary to Meta IE’s contention, it is not necessary to establish an
‘urgent necessity’ 535 for imposing a temporary ban, in that nothing in the GDPR limits the application
of Article 58(2)(f) GDPR to exceptional circumstances 536 .

286. At the same time, the EDPB notes that in assessing the appropriate measure to be applied, Recital 129
GDPR provides that consideration should be given to ensuring that the measure chosen does not
create ‘’superfluous costs’’ and ‘’excessive inconveniences’’ for the persons concerned in light of the
objective pursued. When choosing the appropriate corrective measure, there is a need to assess
whether the chosen measure is necessary to enforce the GDPR and achieve protection of the data
subjects with regard to the processing of their personal data, which is the objective being pursued537 .
Compliance with the principle of proportionality requires ensuring that the chosen measure does not
create disproportionate disadvantages in relation to the aim pursued.

287. The EDPB takes note of the elements raised by the objections, particularly the NL SA, to justify the
need for imposing a temporary ban, consisting in essence in the need to halt the processing activities
that are being undertaken in violation of the GDPR until compliance is ensured in order to avoid further
prejudicing data subject rights. However, the EDPB considers that the objective of ensuring
compliance and bringing the harm to the data subjects to an end can, in this particular case, be
adequately met also by amending the order to bring processing into compliance envisaged in the Draft
Decision to reflect Meta IE’s infringement of Article 6(1) GDPR identified in Section 4.4.2 of this Binding
Decision. In addition to the fines that will be imposed, this measure would require Meta IE to put in
place the necessary technical and operational measures to achieve compliance within a set timeframe.

288. In respect of the imposition of an order to bring processing into compliance, Meta IE submits that any
such order should ‘’afford a reasonable opportunity’’ to Meta IE to comply 538 . When determining the
transition period for bringing Meta IE’s processing into compliance with GDPR, the EDPB requests that
the IE SA gives due regard to the harm caused to the data subjects by the continuation of Meta IE’s
infringement of Article 6(1) GDPR during this period. More specifically, the order should require Meta
IE to restore compliance within a short period of time. In this respect, the EDPB notes that, in response
to Meta IE’s submission, the IE SA considered the three-month deadline for compliance for the
infringements of Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR necessary and proportionate
in light of the potential for harms to the data subjects rights that such a measure entails, considering
that the interim period for compliance ‘’will involve a serious ongoing deprivation of their rights’’ 539 .
The LSA also points out the significant financial, technological, and human resources, as well as the

535
Meta IE Article 65 Submissions, paragraph 8.28.
536
See a contrario Art. 4 Implementing Decision 2010/87, in its version prior to the entry into force of
Implementing Decision 2016/2297; C-311/18 Schrems II, paragraph 114.
537 C-311/18, Schrems II, paragraph 112: ‘’Although the supervisory authority must determine which action is

appropriate and necessary and take into consideration all the circumstances [...] in that determination, the
supervisory authority is nevertheless required to execute its responsibility for ensuring that the GDPR is fully
enforced with all due diligence’’.
538 Meta IE Article 65 Submissions, point 8.31.

539 Draft Decision, paragraph 202. In this regard, Meta IE argues that this was not a reasonable period of time

within which to make the necessary changes, as the changes would be resource-intensive and would require
“sufficient lead in time for preparing, drafting, designing and engineering the relevant changes, conducting and
taking account of user testing of the proposed changes, internal cross-functional engagement as well as of course
engagement with the Commission, and localisation and translation of the information for countries in the
European Region’’. Draft Decision, paragraph 201.

75
Adopted

clear instructions provided to Meta IE to comply with GDPR 540 . The EDPB considers that this line of
reasoning applies all the more to the corrective measures imposed in relation to Meta IE’s
infringement of Article 6(1) GDPR.

289. Finally, the EDPB recalls that non-compliance with an order issued by a supervisory authority can be
relevant both in terms of it being subject to administrative fines up to 20 million euros or, in the case
of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year in
line with Article 83(6) GDPR, and in terms of it being an aggravating factor for the imposition of
administrative fines 541 . In addition, the investigative powers of supervisory authorities allow them to
order the provision of all the information necessary for the performance of their tasks including the
verification of compliance with one of their orders 542 .

290. The EDPB therefore instructs the IE SA to include in its final decision an order for Meta IE to bring its
processing of personal data for the purpose of behavioural advertising in the context of the Instagram
services into compliance with Article 6(1) GDPR within three months.

291. In addition, the EDPB notes that the current wording of the order “to bring the Data Policy and Terms
of Use into compliance with Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR as regards
information provided on data processed pursuant to Article 6(1)(b) GDPR”’ should be modified in order
to reflect the EDPB’s findings in Section 4.4.2 that Meta IE is not allowed to rely on Article 6(1)(b) GDPR
for the processing of personal data for the purpose of behavioural advertising. Therefore, the EDPB
instructs the LSA to adjust its order to Meta IE to bring its Instagram Data Policy and Terms of Use into
compliance with Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR within three months, to refer
not only to information provided on data processed pursuant to Article 6(1)(b) GDPR, but also on data
processed for the purpose of behavioural advertising in the context of Instagram services (to reflect
the finding of the EDPB in Section 4.4.2 that for this processing the controller cannot rely on Article
6(1)(b) GDPR).

540
Draft Decision, paragraph 202.
541
Art. 83(2)(i) GDPR.
542 Art. 58(1) GDPR.

76
Adopted

9 ON THE DETERMINATION OF THE ADMINISTRATIVE FINE
292. The EDPB recalls that the consistency mechanism may also be used to promote a consistent
application of administrative fines 543 .

9.1 On the determination of the administrative fine for the transparency
infringements

9.1.1 Analysis by the LSA in the Draft Decision

The application of the criteria under Article 83(2) GDPR
293. In its Draft Decision, the IE SA explains how it considered the criteria in Article 83(2) GDPR in deciding
whether to impose an administrative fine and to determine its amount in the circumstances of this
case 544 . The most pertinent criteria for the present dispute are summarised below.

The nature, gravity and duration of the infringement, taking into account the nature scope or purpose
of the processing concerned as well as the number of data subjects affected and the level of damage
suffered by them (Article 83(2)(a) GDPR)
294. The IE SA explains that it assesses the infringements of Article 5(1)(a), Article 12(1) and Article 13(1)(c)
GDPR identified in the Draft Decision simultaneously in the context of the Article 83(2) GDPR
criteria 545 . Further, the IE SA explains that ‘’the processing concerned’’ refers to “all of the processing
operations that [Meta IE] carries out in the context of the Instagram service on the personal data under
its controllership for which it relies on Article 6(1)(b) GDPR”, in line with the scope of the inquiry
(permissibility in principle of processing personal data for behavioural advertising) 546 .

295. In terms of the nature of the infringements, the IE SA explains that they concern a cornerstone of
data subject rights, namely the right to information. The IE SA argues that ”the provision of the
information concerned goes to the very heart of the fundamental right of the individual to protection
of personal data which stems from the free will and autonomy of the individual to share their personal
data in a voluntary situation such as this. If the required information has not been provided, the data
subject has been deprived of the ability to make a fully informed decision as to whether they wish to
use a service that involves the processing of their personal data and engages their associated rights.
Furthermore, the extent to which a data controller has complied with its transparency obligations has
a direct impact on the effectiveness of the other data subject rights. If data subjects have not been
provided with the prescribed information, they may be deprived of the knowledge they need in order
to consider exercising one of the other data subject rights” 547 . Further, the IE SA points out that the

543
See Recital 150 GDPR; EDPB Guidelines on RRO, paragraph 34 and EDPB Guidelines on Article 65(1)(a) GDPR,
paragraph 91.
544 Draft Decision, paragraphs 206-207.

545 “While I emphasise that each is an individual and discrete “infringement” of the GDPR, I am proposing to

assess all three infringements simultaneously as all concern transparency and, by reason of their common nature
and purpose, are likely to generate the same, or similar, outcomes in the context of some of the Article 83(2)
GDPR assessment criteria”. Draft Decision, paragraph 209.
546 Draft Decision, paragraph 210.
547 Draft Decision, paragraphs 212.

77
Adopted

breach of the transparency principle by Meta IE has the potential to undermine other fundamental
data protection principles sur as the principles of fairness and accountability 548 . Finally, the IE SA notes
that the European legislator included infringements on the right to information and Article 5 GDPR in
Article 83(5) GDPR, which carries the highest maximum fine 549 .

296. In terms of the gravity of the infringements, the IE SA explains that Meta IE is found to also have
infringed Article 12(1) and Article 5(1)(a) GDPR because the company has not provided the required
information in the required manner under Article 13(1)(c) GDPR. The IE SA adds that this “represents
a significant level of non-compliance, taking into account the importance of the right to information,
the consequent impact on the data subjects concerned and the number of data subjects potentially
affected” 550 .

297. With regards to the nature, scope or purpose of the processing concerned, the IE SA considers that
the “processing carried out by [Meta IE] in the context of the Instagram service pursuant to Article
6(1)(b) GDPR is extensive. [Meta IE] processes a variety of data in order to provide Instagram users
with a ‘personalised’ experience, including by way of serving personalised advertisements. The
processing is central to and essential to the business model offered, and, for this reason, the provision
of compliant information in relation to that processing becomes even more important. This, indeed,
may include location and IP address data” 551 .

298. With reference to the number of data subjects affected, the IE SA points out that, as Meta IE
confirmed, ’’as of the date of the commencement of the Inquiry, i.e. 31 August 2018, [Meta IE] had
approximately monthly active accounts and, as of December 2021, it had approximately
monthly active users in the European Economic Area” 552 . While noting the figures provided by
Meta IE incorrectly excluded the number of UK active accounts to which the GDPR was applicable at
the date of the Complaint, the LSA considered that, when measuring these figures by reference to the
total population of the EEA (including the UK), a ‘’significant portion of the population of the EEA seems
to have been impacted by the infringements’’ 553 .

299. In terms of damages suffered by affected data subjects, the IE SA finds that “failure to provide all of
the prescribed information undermines the effectiveness of the data subject rights and, consequently,
infringes the rights and freedoms of the data subjects concerned. A core element of transparency is
empowering data subjects to make informed decisions about engaging with activities that cause their
personal data to be processed, and making informed decisions about whether to exercise particular
rights, and whether they can do so. This right is undermined by a lack of transparency on the part of a
data controller” 554 .

300. On Article 83(2)(a) GDPR, the IE SA concludes that “[the] infringements are serious in nature. The lack
of transparency goes to the heart of data subject rights and risks undermining their effectiveness by
not providing transparent information in that regard. While the infringements considered here relate

548
Draft Decision, paragraph 213
549 Draft Decision, paragraph 214.
550 Draft Decision, paragraph 216.
551 Draft Decision, paragraph 221.
552 Draft Decision, paragraph 223.
553 Draft Decision, paragraphs 223-225 and 253.
554 Draft Decision, paragraph 228.

78
Adopted

to one lawful basis, it nonetheless concerns vast swathes of personal data impacting millions of data
subjects. When such factors are considered, it is clear that the infringements are serious in their
gravity” 555 . The IE SA further notes the impact of the infringement on a ‘’significant portion of the
population of the EEA’’, as well as on ‘’data subject’s ability to be fully informed about their data
protection rights, or indeed about whether in their view they should exercise those rights’’ 556 .

301. The IE SA does not attach significant weight to the duration of the infringements 557 , considering that
the complaint - and therefor the Inquiry - was made against a specific set of documents (Instagram’s
Data Policy and Terms of Use) and that more recent versions of the relevant documents are outside
the scope of the Inquiry 558 .

The intentional or negligent character of the infringements (Article 83(2)(b) GDPR)

302. The IE SA notes the complainants view that the infringement arose from ‘’[Meta IE] made a deliberate
and calculated decision to present the information in a particular manner such as to mislead data
subject’’ 559 but states that there is no evidence that Meta IE ‘’made a deliberate decision to present
the information to data subject in a particular way’’ 560 . The IE SA further notes that the EDPB
Guidelines on Administrative Fines ‘’recognise that an intentional breach generally only occurs where
there is a deliberate act to infringe the GDPR’’, and that, in this regard, ‘’a finding of intentionality is
predicated on knowledge and wilfulness as to characteristics of an offence’’. The IE SA finds there was
no evidence of an intentional and knowing breach of a provision of the GDPR. The IE SA however finds
that the infringement was negligent, taking into account ‘’the failure of an organisation of this size to
provide sufficiently transparent materials in relation to the core of its business mode” 561 .

The action taken by the controller or processor to mitigate the damage suffered by data subjects
(Article 83(2)(c) GDPR)

303. The IE SA notes Meta IE’s position that “has discharged its transparency obligations in respect of the
Instagram service and, accordingly, complies fully with the GDPR in this respect.” Notwithstanding
their disagreement with this position, the IE SA “accept[s] that it represents a genuinely held belief on
[Meta IE’s] part’’. On that basis, the IE SA notes that ‘’there has not been an effort to mitigate the
damage to data subjects, as it was [Meta IE’s] position that data subjects were incurring no such
damage” 562 . The IE SA is not swayed by Meta IE’s argument that their efforts to comply with the GDPR

555
Draft Decision, paragraph 253.
556
Draft Decision, paragraph 253.
557 Draft Decision, paragraph 253.
558 Draft Decision, paragraphs 218 and 253. The IE SA notes, however, that “In imposing corrective powers [...]

the GDPR requires that the broader impact of infringements be considered” (Draft Decision, paragraph 218).
559 Draft Decision, paragraph 231.
560 Draft Decision, paragraph 232. In its analysis, the IE SA takes into consideration the EDPB Guidelines on

Administrative Fines on the notions of ‘intentional’ and ‘negligent’. Draft Decision, paragraphs 230-232.
561 In this regard, the IE SA notes that ‘’Meta Ireland should have been aware of its transparency requirements,

especially in light of the transparency guidelines and should have provided clarity about the precise extent of the
processing operations carried out pursuant to Article 6(1)(b) GDPR. Meta Ireland further should have ensured
that it adhered strictly to its transparency obligations when choosing the lawful bases on which they rely and
should have used these obligations as a guide as to the information to be conveyed to data subjects’’ (Draft
Decision, paragraph 253).
562 Draft Decision, paragraph 234.

79
Adopted

should be taken into consideration, as - in general - compliance with the GDPR is a duty imposed on
each controller. In the present case, the IE SA finds this factor is neither mitigating nor aggravating
insofar as “beyond simply complying with the GDPR, there are no obvious mitigating steps that could
have been taken” 563 . Notwithstanding this, the IE SA identifies a mitigating factor in Meta IE’s
willingness to engage in steps to bring its processing into compliance on a voluntary basis pending the
conclusion of the inquiry 564 .

The degree of responsibility of the controller taking into account technical and organisational
measures implemented pursuant to Articles 25 and 32 (Article 83(2)(d) GDPR)

304. The IE SA does mention this factor as an aggravating factor in the Draft Decision. The IE SA takes the
view that, considering that guidance on transparency was available to Meta IE at the date of the
complaint, it ’’should have been aware of the appropriate standards – albeit at a general level – and,
having made a deliberate decision to present the information in a manner which fell significant below
the standard required, has a high degree of responsibility for the lack of compliance with the GDPR’’ 565 .

Any relevant previous infringements by the controller or processor (Article 83(2)(e) GDPR)

305. The IE SA does not mention this factor as an aggravating or mitigating factor in the Draft Decision 566 ,
taking into consideration that ‘’the Commission has not made any findings of infringements by Meta
Ireland in the context of the Instagram service which could be considered relevant for [this]
assessment’’ 567 .

The categories of personal data affected by the infringements (Article 83(2)(g) GDPR)

306. The IE SA notes that “[the] lack of transparency concerned broad categories of personal data relating
to users who sign up to the Instagram service” 568 . Although acknowledging that the assessment made
by the IE SA in this Inquiry “was rather generalised in nature” the LSA points out that the lack of
transparency by Meta IE contributed to the “lack of clarity as to the precise categories of personal
data relevant for this Inquiry” 569 .

307. Nonetheless, the IE SA concludes that, in the absence of evidence that these personal data are of a
particularly sensitive nature, this factor should be regarded as neither aggravating nor mitigating 570 .

563
Draft Decision, paragraph 235.
564
Draft Decision, paragraph 236.
565 Draft Decision, paragraph 240.

566 Draft Decision, paragraph 253.
567 Draft Decision, paragraphs 241 and 243. The IE SA notes their disagreement with Meta IE Article 65

Submissions that the absence of previous decision should be considered as a mitigating factor.
568 Draft Decision, paragraph 247.
569 Draft Decision, paragraph 247.
570 Draft Decision, paragraph 247.

80
Adopted

The manner in which the infringements became known to the supervisory authority (Article 83(2)(h)
GDPR)

308. The IE SA notes that “[the] subject matter became known to the Commission due to an Inquiry
conducted on foot of the Complaint. The subject matter did not give rise to any requirement of
notification, and I have already acknowledged several times that the controller’s genuinely held belief
is that no infringement is/was occurring” 571 . The IE SA does not mention this factor as an aggravating
or mitigating factor in the Draft Decision 572 .

Any other aggravating or mitigating factor (Article 83(2)(k) GDPR)

309. The IE SA considers whether the “lack of transparency has the potential to have resulted in financial
benefits for [Meta IE]” based on the view that a “more transparent approach to processing operations
carried out on foot of that contract would represent a risk to [Meta IE]’s business model”, which would
be the case “if existing or prospective users were dissuaded from using the Instagram service by clearer
explanations of the processing operations carried out, and their purposes”. The IE SA concludes that
this factor is neither aggravating nor mitigating, arguing that “any general consideration of this [factor]
ultimately involves an element of speculation on both [Meta IE]’s and the Commission’s part” 573 .

The application of the criteria under Article 83(1) GDPR
310. Based on these circumstances, the IE SA considers that administrative fines pursuant to Article 58(2)(i)
GDPR and Article 83 GDPR, totaling an amount not less than €18 million and an amount not more than
€23 million should be issued on Meta IE for the infringement of Article 5(1)(a), Article 12(1) and Article
13(1)(c) GDPR in the context of Instagram service 574 .

311. The LSA considers that the proposed administrative fines are effective, proportionate and dissuasive
taking into account all of the circumstances of the Inquiry 575 . Regarding the effectiveness, the IE SA
argues that the “infringements are serious, both in terms of the extremely large number of data
subjects potentially affected, the categories of personal data involved, and the consequences that flow
from the failure to comply with the transparency requirements for users” 576 . Concerning the
dissuasiveness, the LSA states that the fine must “dissuade both the controller/processor concerned
as well as other controllers/processors carrying out similar processing operations from repeating the

571
Draft Decision, paragraph 248.
572
Draft Decision, paragraph 253.
573 Draft Decision, paragraphs 251-252.
574 Draft Decision, sections 9 and 10.

More specifically, the IE SA proposes the following administrative fines (Draft Decision, paragraph 254):
- a fine of between €11.5 million and €14 million for the failure to provide sufficient information in relation to
the processing operations carried out on foot of Article 6(1)(b) GDPR, thereby infringing Articles 5(1)(a) and
13(1)(c) GDPR;
- a fine of between €6.5 million and €9 million for the failure to provide the information that was provided on
the processing operations carried out in foot of Article 6(1)(b) GDPR, in a concise, transparent, intelligible and
easily accessible form, using clear and plain language, thereby infringing Articles 5(1)(a) and 12(1) GDPR.
The proposed administrative fines are to be applied cumulatively, as they do not surpass the maximum provided
for in Art. 83(5) GDPR. See Draft Decision, paragraphs 264, 295 and 296.
575 Draft Decision, paragraph 258.
576 Draft Decision, paragraph 255.

81
Adopted

conduct concerned” 577 . As regards the proportionality, the IE SA considers that the fines proposed “do
not exceed what is necessary to enforce compliance with the GDPR, taking into account the size of
Instagram user base, the impact of the infringements on the effectiveness of the data subject rights
enshrined in Chapter III of the GDPR and the importance of those rights in the context of the GDPR as
a whole” 578 .

312. The IE SA refers to the need to take into account the undertaking’s turnover in the calculation of the
maximum possible fine amounts 579 . The notion of “undertaking” is determined to refer to Meta
Platforms, Inc. 580 . The IE SA takes into consideration the revenue reported by Meta Platforms, Inc. for
the year ending 31 December 2020 ($85.965 billion) 581 .

9.1.2 Summary of the objections raised by the CSAs

313. The DE, FR, IT, NL, and NO SAs 582 object to the envisaged action taken by the LSA with regard to the
administrative fine proposed in the Draft Decision concerning the infringements of the transparency
obligations by asking the IE SA to impose a (significantly) 583 higher administrative fine with reference
to the established infringements.

314. The dispute arising from these objections concerns whether the proposed fine is effective,
proportionate and dissuasive pursuant to Article 83(1) GDPR 584 . With reference to these three
criteria, the above mentioned CSAs, specifically, argue as follows.

315. According to the DE SAs, the fine proposed by the LSA in the Draft Decision is not proportionate with
regard to the financial position of the undertaking. More specifically, the DE SAs argue that the
envisaged fine of at most 23 million euros is not proportionate compared to the worldwide annual
turnover on Meta Platforms, Inc 585 . The DE SAs point out that the proposed fine ‘’represents only about
0.03% of the turnover of Meta Platforms, Inc. and about 0.72% of the maximum fine“ 586 . With respect
to dissuasiveness, the DE SAs consider that the fine proposed by the LSA “weakens the position of
supervisory authorities and endangers compliance with the GDPR’’ as this would leave controllers
under the impression that “enforcement of the GDPR will not be felt economically’’ 587 .

316. The FR SA argues that the amount of the envisaged fine “seems low and hardly compatible with the
objective set by Article 83(1) GDPR of ensuring to impose dissuasive fines” taking into account “the

577
Draft Decision, paragraph 256.
578
Draft Decision, paragraph 257.
579 Draft Decision, paragraph 274.
580 Draft Decision, paragraphs 275 - 295. Formerly Facebook, Inc.
581 Draft Decision, paragraph 295.
582 DE SAs Objection, pp. 10-12; FR SA Objection, paragraphs 36-48; IT SA Objection, pp. 7-10 ; NL SA Objection,

paragraphs 39-53; NO SA Objection, pp. 9-13.
583 All these CSAs specified that the fine should be increased ‘’significantly’’ or ‘’substantially’’ except the NL and

the IT SAs (which stated the fine should be increased). See DE SAs Objection, p. 12; FR SA Objection, paragraph
45; IT SA Objection, pp. 8-9; NO SA Objection, p. 13; NL SA Objection, paragraph 51.
584 DE SAs Objection, p. 11 ; FR SA Objection, paragraph 47; IT SA Objection pp. 7-8 ; NL SA Objection, paragraph

50; NO SA Objection, pp. 11-12.
585 DE SAs Objection, p. 11.
586 DE SAs Objection, p. 11.
587 DE SAs Objection, p. 11.

82
Adopted

number of data subjects concerned, the particularly intrusive nature of the processing operations in
question, the breaches observed, the position of Meta Platforms Ireland Limited as a quasi-monopolist
and its financial situation” 588 . In this respect, the FR SA notes that the fine proposed by the IE SA is no
proportionate since “the cumulative amount of the two breaches of the provisions of Articles 5-1-a)
and 13-1-c) of the GDPR, on the one hand, and the provisions of Articles 5-1-a) and 12-1 of the GDPR,
on the other hand, represents only about 0.03% of the turnover of Meta Platforms Inc. and less than
1% of the maximum fine” 589 .

317. The IT SA argues that ‘’by having regard to the controller, in particular the nature and size of Meta
Platforms Inc. [...] the range at issue would appear to be overly low and neither proportionate nor
dissuasive’’ 590 .

318. The NL SA doubts, also referring to the EDPB Guidelines on Administrative Fines, that the fines
proposed by the IE SA meet the objective to be effective, “particularly considering the strong financial
position of the controller and the finding that the identified lack of transparency likely has had financial
benefits for the controller” 591 . As regard to dissuasiveness, the NL SA argues, also referring to
established CJEU case-law, that Meta IE “generates a turnover of over 86 billion dollars (approximately
79 billion euros) per annum, therefore it would be able to generate a daily revenue of approximately
235 million dollars. Instead of dissuading future behaviour, the penalty would be simply regenerated
in a few hours” (specific deterrence) 592 . With reference to proportionality, the NL SA questions the
lack of reasoning in the Draft Decision as to why the amounts proposed are commensurate to the
seriousness of the infringements 593 .

319. The NO SA argues that the envisaged amount of the fine is not effective nor dissuasive neither to Meta
IE nor to other controllers, considering the financial benefits accrued because of the violation and
worldwide annual turnover of Meta Platform, Inc. for 2020 594 In particular, the NO SA points out that
Meta IE “would likely have no issue paying the proposed fine, and the amount of the fine it is not likely
to affect [it] in such a way that it would see a need to substantially change its practices” 595 . The NO
SA illustrates this by the fact that in 2020, Meta IE set aside one billion euro of provisions to address,
inter alia, the risk of fines for infringement to the data protection rules 596 .

320. In addition, these objections raise arguments with regards to the weight afforded to some of the
criteria listed in Article 83(2) GDPR.

321. The IT SA objects to the LSA's decision not to consider WhatsApp's previous infringements in the case
IN-18-12-2 as an aggravating circumstance under Article 83(2)(e) GDPR, insofar as it is part of the same
group of companies of Meta IE. According to the IT SA “even though the WhatsApp case did raise
additional, more specific issues, one can hardly question that the relevant decision sets a key precedent

588
FR SA Objection, paragraph 38.
589
FR Objection, paragraph 40.
590 IT SA Objection, p. 8.

591 NL SA Objection, paragraph 48.
592 NL SA Objection, paragraph 49.
593 NL SA Objection, paragraph 50.
594 NO SA Objection, p. 12.
595 NO SA Objection, p. 12.
596 NO SA Objection, p. 11.

83
Adopted

in assessing controller’s repetitive conduct’’ as ‘’not only did the controller in question clearly stick to
the same business model in offering its different social networking services, it also did not change its
assessment as to how to manage users’ data with particular regard to its information and
transparency obligations’’ 597 .

322. According to the DE, FR, NL and NO SAs, the fine proposed by the LSA in the Draft Decision is not
proportionate with regard to the seriousness of the infringement 598 .

323. The NL SA argues that the fine is not commensurate with the seriousness of the infringements
established (Article 83(2)(a) GDPR) and is inconsistent with the IE SA's qualifications as such 599 . The FR
SA also argues that the fine is in contradiction with the seriousness of the violations identified and the
nature of the processing (Article 83(2)(a) GDPR) 600 .

324. The DE, FR, and IT SAs state that the fine proposed is not consistent with the amount retained by the
IE SA in its decision dated 20 August 2021 against the company WhatsApp Ireland Limited (case IN-18-
12-2), in which the IE SA imposed an administrative fine of 225 million euros, including a fine of 30
million euros for the infringement of Article 12 and 13 GDPR and a fine of 90 million on account of the
infringement of Article 5(1)(a) GDPR 601 . Moreover, the FR and IT SAs state that the amount proposed
appears low also in comparison with the one retained by the LU SA in its decision of 15 July 2021
against the company Amazon Europe Core, where an administrative fine of 746 million euros has been
imposed for the infringements of Articles 6, 12 and 13 GDPR, and which was also based on a complaint
that the processing operations carried out by the companies of the Amazon group relating to
behavioural advertising did not have a valid legal basis 602 . In addition, the FR SA notes that the amount
of the fine proposed by the IE SA “seems to be underestimated in comparison with the amount retained
in the deliberation of the CNIL’s restricted committee No. SAN-2019- 001 of 21 January 2019 imposing
a penalty of 50 million euros on the company Google LLC” 603 . The FR SA considers this case as
comparable because it is also based on a referral “filed by the association ‘NOYB’ with the CNIL,
relating to a similar issue and formulated against Google, and that the restricted committee has
identified a breach of Article 6 of the GDPR and a breach of the provisions of Articles 12 and 13 of the
GDPR” 604 . However, the FR SA notes that “the amount retained against Google LLC is close to that
proposed by the Irish data protection authority, even though the processing operations in question
concern all European users, [...] which was not the case in the above-mentioned CNIL’s decision, for
which only French users were taken into account” 605 .

597
IT SA Objection, p. 9.
598
DE SAs Objection p.11 ; FR SA Objection, paragraph 47; NL SA Objection, paragraphs 39 and 43-44 ; NO SA
Objection, p. 12.
599 NL SA Objection, paragraphs 39 and 43-44.
600 FR SA Objection, paragraph 50.
601 FR SA Objection, paragraph 42 ; IT SA Objection, p. 8.

602 FR SA Objection, paragraph 43. Similar reasoning is included in the IT SA Objection, which states that ‘’even

by proportion to the respective turnover [...] there is little doubt that the fining proposal by the LSA is not in line
with the proportinality requirement’’ (IT SA Objection, p. 8).
603 FR SA Objection, paragraph 41.
604 FR SA Objection, paragraph 41.
605 FR SA Objection, paragraph 41.

84
Adopted

325. The NO SA argues that “the suggested fine is not proportionate to the seriousness of the violations and
the aggravating factors identified”, the “number of data subjects affected in the EEA amounts to
hundreds of millions” and agrees with the LSA that the controller’s “level of responsibility is high” 606 .

326. On the risks posed by the Draft Decision, the DE, FR, IT, NL, and NO SAs consider that, if adopted, the
Draft Decision would lead to a significant risk for the protection of the fundamental rights and
freedoms of the data subjects 607 . The DE, FR, IT, NL, and NO SAs explain that it would not ensure an
effective enforcement of the GDPR, as the proposed fine is unable to create a deterrent effect (either
specifically towards the controller, or in general towards other controllers) 608 . The NO SA considers
this would mean, “that the complainant and the affected data subjects would in practice be denied
the level of data protection set out in the GDPR” 609 . The FR SA argues the Draft Decision as it stands
would “lead to a levelling down of the level of administrative fines imposed by European data
protection authorities, thereby reducing the authorities' coercive power and, consequently, their ability
to ensure effective compliance with the protection of the personal data of European residents”610 . The
DE SAs add that “the Draft Decision does not ensure a consistent application of administrative fines”611 .

9.1.3 Position of the LSA on the objections
327. The LSA considers none of the objections relating to the quantum of the proposed administrative fine
as relevant and reasoned 612 .

328. In relation to objections calling for an increase of the amount of the fine set out in the Draft Decision,
the LSA states that notwithstanding the variance between the views of the CSAs on the calculation of
the fine that the IE SA has “fully taken into account the criteria at Article 83(2) GDPR, and that the
proposed administrative fines meet the requirements of Article 83(1) GDPR, taking into account all the
circumstances of this matter and as set out Part 9 of the Draft Decision” 613 . The IE SA also argues that
the IE SA considers “the proposal as to the fine to be meaningful in terms of both the financial
significance of it on any view, as well as the significant publicity that a fine in this region will
attract’’ 614 .

329. With reference to the objections relating to the mode of calculating the proposed administrative fine
(assessment of the Article 83(2) GDPR criteria), the LSA does not accept that these objections are
relevant 615 . The LSA recalls that it has already examined in its Draft Decision whether the
infringements were intentional and whether Meta IE obtained a financial benefit as a result of the
infringements, questions to which it answered in the negative 616 . Furthermore, the LSA takes the view

606
NO SA Objection, p. 12.
607
DE SAs Objection, p. 12; FR SA Objection, paragraph 47; IT SA Objection, pp. 8-10; NL SA Objection
paragraph 52; NO SA Objection, p. 12.
608 DE SAs Objection, p. 12; FR SA Objection paragraph 47; IT SA Objection, pp. 8-10 ; NL SA Objection

paragraph 49 and 52; NO SA Objection, p. 12.
609 NO SA Objection, p. 12.
610 FR SA Objection, paragraph. 48.
611 DE SAs Objection, p. 11.

612 Composite Response, paragraph 120.
613 Composite Response, paragraph 118.
614 Composite Response, paragraph 119.
615 Composite Response, paragraph 126.
616 Composite Response, paragraph 124. On this matter, the IE SA refers to respectively paragraphs 230-233

and 251-252 of the Draft Decision.

85
Adopted

that “it would be contrary to a literal interpretation of Article 83(2)(e) GDPR to take the decision made
by the IE SA in respect of WhatsApp Ireland Limited (i.e. IN-18-2-1) in the calculation of the fine for this
Draft Decision in circumstances where the infringements do not concern the same controller or
processor’’ 617 .

9.1.4 Assessment of the EDPB

9.1.4.1 Assessment of whether the objections were relevant and reasoned

330. The objections raised by the DE, FR, IT, NL, and NO SAs concern ‘’whether the action envisaged in the
Draft Decision complies with the GDPR’’ 618 .

331. The EDPB takes note of Meta IE’s view that not a single objection put forward by the CSAs meets the
threshold of Article 4(24) GDPR 619 .

332. With specific regard to these objections on the determination of the administrative fine for the
transparency infringements, Meta IE acknowledges that the objections as to whether envisaged
corrective measures comply with the GDPR fall within the scope of the dispute resolution
mechanism 620 , however in their view, objections that solely object to the amount of a fine are outside
the scope of this mechanism 621 . Meta IE argues that ‘’the DPC, as the LSA, has the sole competence
and discretion to impose an administrative fine’’ 622 . Moreover, Meta IE claims that the EDPB is not
competent to determine whether the administrative fine is effective, proportionate, and dissuasive623 .
The EDPB does not share this reading of the GDPR, as explained above (see Section 8.4.2, paragraphs
277-279 of this Binding Decision) and considers that CSAs may object to the fine amount proposed by
an LSA in its draft decision 624 .

617 Composite Response, paragraph 126.
618 EDPB Guidelines on RRO, paragraph 32.
619 Meta IE Article 65 Submissions, Annex 1, p. 65.
620 Meta IE Article 65 Submissions, paragraph 8.5
621 Meta IE Article 65 Submissions, paragraph 9.2
622 Meta IE Article 65 Submissions, paragraph 9.2.
623 Meta IE Article 65 Submissions, paragraph 9.2. Meta IE argues that “The GDPR does not confer any power on

the EDPB to consider objections solely challenging the amount of a fine, and the EDPB may not give instructions
as to whether a fine ought to be imposed, or as to its amount’’.
624 In this regard, Recital 150 GDPR can be recalled, as it states that the consistency mechanism may also be used

to promote a consistent application of administrative fines. Consequently, an objection can challenge the
elements relied upon to calculate the amount of the fine, and if the assessment of the EDPB within this context
identifies shortcomings in the reasoning leading to the imposition of the fine at stake, the LSA will be instructed
to re-assess the fine and remedy the identified shortcomings (EDPB Guidelines on Art. 65(1)(a), para 91; EDPB
RRO Guidelines, paragraph 34). The EDPB found several objections on this subject matter admissible in the past,
see inter alia Binding Decision 1/2020, paragraphs 175-178 and 180-181, Binding Decision 1/2021, paragraphs
310-314, Binding Decision 1/2022 paragraphs 53-55, Binding Decision 2/2022, paragraphs 186-190.
Consequently, within its mission of ensuring a consistent application of the GDPR, the EDPB is fully competent
to resolve the dispute arisen among supervisory authorities and remedy the shortcomings in the Draft Decision
concerning the calculation of the amount of the fine, which will in any event be quantified and imposed by the
LSA in its national decision adopted on the basis of the EDPB’s binding decision.

86
Adopted

333. The EDPB takes note of further arguments put forward by Meta IE, aiming to demonstrate the lack of
relevance of the objections raised by the DE, FR, IT, NL, and NO SAs 625 . Meta IE disagrees with the
content of these objections, which concerns its merits and not its admissibility.

334. The EDPB finds that the DE, FR, IT, NL, and NO SAs disagree with specific parts of the IE SA’s Draft
Decision, namely the assessment made by the LSA in Chapter 9 ‘’Administrative fine’’ and Chapter 10
‘’Other relevant factors’’ in setting the administrative fine applicable to the violations of transparency
identified 626 . If followed, these objections would lead to a different conclusion in terms of corrective
measures imposed. In consequence, the EDPB considers the objections raised by the DE, FR, IT, NL,
and NO SAs to be relevant.

335. Meta IE further considers that the DE, FR, IT, NL and NO SAs’ objections have not created “reasonable
doubt’’ as to the validity of the LSA’s calculation of the fine and do not explain why the fine envisaged
in the Draft Decision is incompatible with Article 83 GDPR 627 . In this respect, Meta IE claims that the
objections of the DE, FR, IT, NL and NO SAs are not sufficiently reasoned as they focus on hypothetical
“preventive effects” of the fine on other controllers in future proceedings 628 . In addition, Meta IE puts
forward that the comparison made by the DE, FR, and IT SAs in their objections with other fines
imposed in other cases is not relevant to the extent that fines should result in a case-by-case
assessment 629 . Meta IE also objects to the FR SA’s objection that the fine should be tied to the
turnover, considering that Meta IE’s turnover is only relevant for determining the maximum fine
amount under Articles 83(4)-(6) GDPR and not the fine amount 630 . Finally, in response to the NO SA’s
objection, Meta IE argues that controller’s financial provisions for potential regulatory-related
expenses cannot be considered as a relevant factor under Article 83(2) GDPR 631 . It follows from the
above arguments that Meta IE disagrees with the reasoning provided in these objections, which thus
concerns the merits and not the admissibility of the objection.

336. The EDPB finds that the DE, FR, IT, NL, and NO SAs argue why they propose amending the Draft
Decision and how this leads to a different conclusion in terms of administrative fine imposed, i.e. why
they propose to impose a higher fine for the transparency breaches 632 .

625 Meta IE argues that these objections are “a direct criticism of the amount of the DPC’s proposed fine (i.e. an
area within the DPC’s sole discretion as LSA) rather than the lawfulness of the DPC’s reliance on the relevant
factors to calculate the fine (which would be the Draft Decision’s relevant legal and factual content to which
the [CSAs] could object)’’. Meta IE Article 65 Submissions, Annex 1, paragraphs 2.17 - 2.19, 5.13, 7.12, 8.23, and
9.19.
626 DE SAs Objection, p. 10; FR SA Objection, paragraph 36 ; IT SA Objection, pp. 7-9 ; NL SA Objection,

paragraph 40 and 53; NO SAs’ Objection, pp. 9-10.
627 Meta IE Article 65 Submissions, Annex 1, paragraphs 2.21, 5.15, 5.17-18, 7.14, 8. 25, and 9.22. In this regard

Meta IE submits that ‘’a fine proposed by the LSA is effective, proportionate, and dissuasive as long as the criteria
laid down in Article 83(2) GDPR are duly taken into account (which is clearly the case here). Indeed, the calculation
of fines is subjective, and there is significant variance amongst objecting CSAs as to what the appropriate fine
should be’.
628 Meta IE Article 65 Submissions, Annex 1, paragraphs 2.22, 5.19, 7.16, 8.26, and 9.23.
629 Meta IE Article 65 Submissions, Annex 1, paragraphs 2.23, 5.18, and 7.17.
630 Meta IE Article 65 Submissions, Annex 1, paragraph 5.21.
631 Meta IE Article 65 Submissions, Annex 1, paragraph 9.26.
632 DE SAs Objection, p. 11-12; FR SA Objection, paragraphs 38, 40, 42, 43, 47; IT SA Objection, pp. 7-9 ; NL SA

Objection, paragraphs 44-45 and 47-50; NO SA Objection, pp. 11-12.

87
Adopted

337. In terms of risks, Meta IE claims the Draft Decision does not pose any risk, let alone a significant risk
to fundamental rights and argues the objections of the DE, FR, IT, NL, and NO SAs fail to demonstrate
the contrary, as required 633 .

338. In particular, Meta IE considers that the DE, FR SA and IT SAs’ objections appear to focus on increasing
the “punitive impact” of the fine on Meta IE, instead of demonstrating any significant risks to the
fundamental rights of data subjects 634 . Meta IE further claims that the NL and NO SAs’ objections does
not set out how the proposed fine would pose a direct and significant risk to fundamental rights and
freedoms 635 . In addition, Meta IE argues the DE, FR, IT, NL and NO SAs’ objections rest on
unsubstantiated possible effect the Draft Decision could have on future behaviour of other controllers,
without demonstrating how this Decision would lead to significant risks in the case at hand 636 .
Therefore, Meta IE claims that, in doing so, the assessment made by the DE, FR, IT and NL SAs is
incorrect as they do not consider the reputational costs generated by such a fine 637 .

339. First, the EDPB notes that any risk assessment addresses future outcomes which are to some degree
uncertain, and finds there is no basis in the GDPR to limit the notion of risks to the boundaries of the
particular case at hand. Article 4(24) GDPR refers to the risks posed to the "fundamental rights and
freedoms of data subjects" and “where applicable, the free flow of personal data within the Union”.
Both of these aspects are phrased in a general way. The wording of this provision does not in any way
limit the demonstration of the risks to showing the risks posed to the data subjects affected by the
concrete processing carried out by the specific controller, in light of the objective of guaranteeing a
‘’high level of protection in the EU for the rights and interests of the individuals’’ 638 . Therefore, the risks
posed by a draft decision to be demonstrated by a relevant and reasoned objection might also concern
data subjects whose personal data might be processed in the future, including by other controllers.

340. The EDPB also notes that the DE, FR, IT, NL, and NO SAs 639 considered both of the aspects that are
entailed by dissuasiveness of the fine, i.e. specific deterrence and general deterrence 640 .

633 Meta IE Article 65 Submissions, Annex 1, paragraphs 2.24-2.27, 5.22-5.25, 7.18-7.21, 8.28-8.32, and 9.25-
9.27.
634 Meta IE Article 65 Submissions, Annex 1, paragraphs 2.24, 5.22, and 7.18.
635 Meta IE Article 65 Submissions, Annex 1, paragraphs 8. 28, and 9.25.
636 Meta IE Article 65 Submissions, Annex 1, paragraphs 2.25, 5.23, 7.19, 8.30, and 9.26.
637 Meta IE Article 65 Submissions, Annex 1, paragraphs 2.26, 5.24, 7. 20, 8.31. Meta IE adds that, in any case, it

‘’does not consider that fines such as the one proposed in the Draft Decision could encourage other companies
not to comply with the GDPR’’.
638 Judgement of the Court of Justice of 6 November 2003, Lindqvist, Case C-101/01, ECLI:EU:C:2003 596,

(hereinafter ‘C-101/01 Lindqvist'), paragraph 95; Judgement of the Court of Justice of 16 December 2008, Heinz
Huber v Bundesrepublik Deutschland, C‑524/06, ECLI:EU:C:2008:724, (hereinafter ‘C‑524/06 Huber’), paragraph
50; Judgement of the Court of Justice of 24 November 2011, Asociación Nacional de Establecimientos
Financieros de Crédito, C-468/10 and C-469/10, ECLI:EU:C:2011:777, paragraph 28.
639 DE SAs Objection, p. 12 (referring to the ‘’undertaking in question’’), FR SA Objection, paragraph 47 (referring

to ‘’the controller’’); IT SA Objection pp.8-9 (referring to ‘’the controller’’); NL SA Objection, paragraph 52
(referring to the risk in relation to ‘’the illegal processing at hand’’); NO SA Objection, p.12 (referring to
‘’incentives for Meta IE’’).
640 The CJEU has consistently held that a dissuasive fine is one that has a genuine deterrent effect, encompassing

both specific deterrence (discouraging the addressee of the fine from committing the same infringement again)
and general deterrence (discouraging others from committing the same infringement in the future). See, inter

88
Adopted

341. The EDPB finds that the DE, FR, IT, NL, and NO SAs articulate an adverse effect on the rights and
freedoms of data subjects if the Draft Decision is left unchanged, by referring to a failure to guarantee
a high level of protection in the EU for the rights and interests of the individuals 641 .

342. Therefore, the EDPB considers the DE, FR, IT, NL, and NO SAs objections to be reasoned.

9.1.4.1 9.1.4.2. Assessment on the merits
343. In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning all the
matters which are the subject of the relevant and reasoned objections, in particular whether the
envisaged action in relation to the controller complies with the GDPR.

344. The EDPB recalls that the consistency mechanism may also be used to promote a consistent
application of administrative fines 642 . A fine should be effective, proportionate and dissuasive, as
required by Article 83(1) GDPR, taking account of the facts of the case 643 . In addition, when deciding
on the amount of the fine, the LSA shall take into consideration the criteria listed in Article 83(2) GDPR.

345. The EDPB responds to Meta IE’s argument that the LSA has sole discretion to determine the
appropriate corrective measures in the event of a finding of infringement above (see Section 8.4.2,
paragraphs 277 -279 as well as footnote 624).

346. The finding in the Draft Decision of a transparency infringement for the processing concerned still
stands. The EDPB recalls that, on substance, no objections were raised on this finding. Meta IE
infringed its general transparency obligations by being unclear on the link between the purposes of
processing, the lawful bases of processing and the processing operations involved 644 , irrespective of
the validity of the legal basis relied on for the ‘processing concerned’. It remains the case that, for the
transparency infringements, ‘‘the processing concerned’’ should be understood as meaning all of the
processing operations that Meta IE carries out on the personal data under its controllership for which
Meta IE indicated it relied on Article 6(1)(b) GDPR 645 , including for the purposes of behavioural
advertising. This is without prejudice to the fact that Meta IE inappropriately relied on Article 6(1)(b)
GDPR as a legal basis to process personal data for the purpose of behavioural advertising as part of
the delivery of its Instagram service under the Terms of Use. Whether or not Meta IE appropriately
chose its legal basis for processing, the transparency infringement as assessed in the Draft Decision
still stands. Therefore, the IE SA must not modify this description retro-actively in light of the
assessment of the validity of the legal basis, including for the purpose of carrying out any reassessment
of the administrative fines originally proposed by the Draft Decision, as might be required by this
Binding Decision.

alia, Judgement of the Court of Justice of 13 June 2013, Versalis Spa v European Commission, C-511/11 P,
ECLI:EU:C:2013:386, (hereinafter ‘C-511/11, Versalis’), paragraph 94.
641 DE SAs Objection, p. 12, FR SA Objection, paragraphs 47-48; IT SA Objection, pp.8-9; NL SA Objection,

paragraph 52; NO SA Objection, p. 12. See also EDPB Guidelines on RRO, paragraph 37.
642 Recital 150 GDPR. EDPB Guidelines on RRO, paragraph 34; EDPB Guidelines on Administrative fines p. 7

(“When the relevant and reasoned objection raises the issue of the compliance of the corrective measure with
the GDPR, the decision of EDPB will also discuss how the principles of effectiveness, proportionality and
deterrence are observed in the administrative fine proposed in the draft decision of the competent supervisory
authority”).
643 EDPB Guidelines on Administrative fines, p. 7; EDPB Guidelines on calculation of fines, paragraphs 132-134.
644 Draft Decision, paragraph 189.
645 Draft Decision, paragraph 210.

89
Adopted

347. In light of the objections found relevant and reasoned, the EDPB addresses whether the Draft Decision
proposes a fine for the transparency infringements that is in accordance with the criteria established
by Article 83(2) GDPR and the criteria provided for by Article 83(1) GDPR. In doing this, the EDPB will
first assess the disputes arisen in respect of the analysis of specific criteria under Article 83(2) GDPR
performed by the LSA, and then examine whether the proposed fine meets the requirements of
effectiveness, dissuasiveness and proportionality set in Article 83(1) GDPR, including by affording
adequate weight to the relevant factors and to the circumstances of the case.

On any relevant previous infringements by the controller or processor (Article 83(2)(e) GDPR)

348. Article 83(2)(e) GDPR requires supervisory authorities to give due regard to any previous relevant
infringement of the GDPR by the controller or processor as one of the circumstances that justifies an
increase in the basic amount of the fine. As similar reference can be found in Recital 148 GDPR.

349. For the purposes of Article 83(2)(e) GDPR, both previous infringements of the same subject matter
and infringements of a different subject matter but committed in a manner similar to that under
investigation, should be considered as relevant. Furthermore, the EDPB recalls that the scope of
assessment of infringements may include not only previous decisions by the investigating supervisory
authority, but also infringements found by other authorities, provided that they are relevant to the
case under investigation 646 .

350. The EDPB first notes that, contrary to Meta IE’s views 647 , substantial similarities exist in the
infringements found by the LSA in its draft decision and in its decision IN-18-12-2 in relation to
WhatsApp Ireland Limited and in which breach of GDPR obligations were established. As rightly
pointed out by the IT SA, the LSA indeed considered in both decisions that the controller had not
provided transparent information on the legal basis and purposes of the processing operations or sets
of processing operations carried out, thereby infringing Article 5(1)(a), Article 12(1) and Article 13(1)(c)
GDPR 648 .

351. The IT SA contends that, to the extent that Meta IE and WhatsApp Ireland Limited are part of the same
corporate group, the previous decision concerning WhatsApp Ireland Limited “sets a key precedent in
assessing a controller’s repetitive conduct”, as “not only did the controller in question clearly stick to
the same business model in offering its different social networking services, it also did not change its
assessment as to how to manage users’ data with particular regard to its information and
transparency obligations” 649 . The IE SA disagrees with this objection, considering that Article 83(2)(e)

646
EDPB Guidelines on Administrative Fines, paragraph 93.
647
Meta IE Article 65 Submissions, paragraph 10.3. According to Meta IE’s the DPC Final Decision IN-18-12-2
against WhatsApp Ireland Limited concerns ‘’wholly separate proceeding involving wholly separate allegations
and claims’’.
648 DPC Final Decision IN-18-12-2 concerning WhatsApp Ireland Limited, 20 August 2021, paragraphs 496, 591

and 595, available at: https://edpb.europa.eu/system/files/2021-09/dpc final decision redacted for issue
to edpb 01-09-21 en.pdf ; Draft Decision, p. 71.
649 IT SA Objection, p. 9.

90
Adopted

GDPR cannot apply in the circumstances of this case insofar as its decision against WhatsApp Ireland
Limited was addressed to a different controller 650 .

352. In this respect, the EDPB notes that Meta IE and WhatsApp Ireland Limited are both subsidiaries of
Meta Platforms, Inc. 651 . Nonetheless, the EDPB recalls that the GDPR draws a distinction between on
the one hand the “controller” or “processor” 652 , which are responsible for complying with the rules of
the GDPR, and on the other hand the “undertaking” 653 to which the controller or processor is part of,
and that may be found jointly and severally liable for the payment of the fine 654 . In this context, Article
83(2)(e) GDPR explicitly refers to the need to consider previous relevant infringements committed ‘’by
the controller or processor’’ (emphasis added).

353. Therefore, the EDPB considers that the Final Decision does not need to refer to the infringements by
WhatsApp Ireland Limited, as established in Decision IN-18-12-2, as an aggravating factor under Article
83(2)(e) GDPR for the calculation of the fine.

The effectiveness, proportionality and dissuasiveness of the administrative fine (Article 83(1) GDPR)
354. With regard to effectiveness of the fines, the EDPB recalls that the objective pursued by the corrective
measure chosen can be to re-establish compliance with the rules, or to punish unlawful behaviour, or
both 655 . In addition, the EDPB notes that the CJEU has consistently held that a dissuasive penalty is
one that has a genuine deterrent effect. In that respect, a distinction can be made between general
deterrence (discouraging others from committing the same infringement in the future) and specific
deterrence (discouraging the addressee of the fine from committing the same infringement again)656 .
Therefore, in order to ensure deterrence, the fine must be set at a level that discourages both the
controller or processor concerned as well as other controllers or processors carrying out similar
processing operations from repeating the same or a similar unlawful conduct. Proportionality of the
fine needs also to be ensured as the measure must not go beyond what is necessary to attain that
objective 657 . In this respect, the EDPB disagrees with Meta IE’s views that there is no basis to conclude
that the amount of the fine must have a general preventive effect 658 .

650 Composite Response, paragraph 125. According to the IE SA, this stems directly from the wording of Article
83(2)(e) GDPR, which ‘’expressly states that only relevant previous infringements by the same controller or
processor must be taken into consideration’’.
651 DPC Final Decision IN-18-12-1 concerning WhatsApp Ireland Limited, 20 August 2021, paragraph 872; Draft

Decision, paragraphs 5 and 288.
652 See Art. 4(7)-(8) GDPR.
653 According to Recital 150, ‘’where administrative fines are imposed on an undertaking, an undertaking should

be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes’’. According
to settled case-law of the CJEU, the term ‘undertaking’ “encompasses every entity engaged in an economic
activity, regardless of the legal status of the entity and the way in which it is financed’’ (see, in this regard, EDPB
Binding Decision 1/2021, paragraph 292).
654 EDPB Binding Decision 1/2021, paragraph 290.
655 EDPB Guidelines on Administrative Fines, p. 6.
656 See, inter alia, C-511/11, Versalis, paragraph94.
657 See Judgement of the General Court of 14 October 2021, MT v Landespolizeidirektion Steiermark, C-231/20,

, ECLI:EU:C:2021:845, paragraph45 (“the severity of the penalties imposed must […] be commensurate with the
seriousness of the infringements for which they are imposed, in particular by ensuring a genuinely deterrent
effect, while not going beyond what is necessary to attain that objective”).
658 Meta IE Article 65 Submissions, Annex 1, paragraphs, 2.22, 5.16, 7.16, 8.30 and 9.23.

91
Adopted

355. The EDPB reiterates that it is incumbent upon the supervisory authorities to verify whether the
amount of the envisaged fines meets the requirements of effectiveness, proportionality and
dissuasiveness, or whether further adjustments to the amount are necessary, considering the entirety
of the fine imposed and all the circumstances of the case, including e.g. the accumulation of multiple
infringements, increases and decreases for aggravating and mitigating circumstances and
financial/socio-economic circumstances 659 . Further, the EDPB recalls that the setting of a fine is not
an arithmetically precise exercise 660 , and supervisory authorities have a certain margin of discretion
in this respect 661 .

356. The DE, FR, IT, NL, and NO SAs , object to the level of the fine envisaged in the Draft Decision as they
consider the proposed fine not effective, proportionate and dissuasive (Article 83(1) GDPR) 662 .

357. These CSAs argue that the elements of Article 83(2) GDPR are not weighed correctly by the LSA when
calculating the administrative fines in the present case, in light of the requirements of Article 83(1)
GDPR 663 . Specifically, the DE, FR, IT, NL and NO SAs argue that the fine envisaged in the Draft Decision
is not proportionate with IE SA’s findings in relation to the nature and seriousness of the infringements
and the number of data subjects concerned 664 .

358. In addition, these CSAs argue that the fine is not effective, proportionate and dissuasive taking into
account the financial position of Meta Platform, Inc. 665 .

359. The EDPB takes note of Meta IE’s disagreement with the fine proposed by the IE SA 666 and their view
that the LSA already considers all factors it considered to be relevant to Article 83(2) GDPR and that
‘’none of the CSAs have created any reasonable doubt as to the validity of the DPC’s calculation’’ 667 .

360. The EDPB notes that in the Draft Decision the IE SA indicates being satisfied the proposed fines are
effective, proportionate and dissuasive, taking into account all the circumstances of the IE SA’s
inquiry 668 . The IE SA assessed the different criteria of Article 83(2) GDPR in relation to the transparency

659 EDPB Guidelines on calculation of fines, paragraph 132, and EDPB Guidelines on Administrative Fines, p. 6,
specifying that ”administrative fines should adequately respond to the nature, gravity and consequences of the
breach, and supervisory authorities must assess all the facts of the case in a manner that is consistent and
objectively justified”.
660 See Judgement of the General Court of 22 September 2021, Altice Europe NV v Commission, T 425/18,

ECLI:EU:T:2021:607, paragraph362; Judgement of the General Court of 5 October 2011, Romana Tabacchi v
Commission, Case T‑11/06, ECLI:EU:T:2011:560, paragraph266.
661 See, inter alia, judgement of the General Court of 16 June 2011, Caffaro Srl v Commission, T-192/06,

ECLI:EU:T:2011:278, paragraph38. See also EDPB Guidelines on calculation of fines, p. 2.
662DE SAs Objection, pp. 10-12; FR SA Objection, paragraphs 36-48; IT SA Objection pp. 7-10 ; NL SA Objection,

paragraphs 39-53; NO SA Objection, pp. 9-13;
663 DE SAs Objection, p. 11 ; FR SA Objection, paragraph 47; IT SA Objection pp. 7-8 ; NL SA Objection, paragraph

50; NO SA Objection, pp. 11-12
664 DE SAs Objection, p. 11; FR SA Objection, paragraph 38 ; IT SA Objection, p. 8 ; NL SA Objection, paragraph 42

and 48; NO SA Objection, p. 12.
665 DE SAs Objection, p. 11 ; FR SA Objection, paragraph 38-40; IT SA Objection, pp. 8 ; NL SA Objection, paragraph

48-49; NO SA Objection, pp. 11-12.
666 Meta IE Article 65 Submissions, paragraph 9.1.
667 Meta IE Article 65 Submissions, paragraph 9.3.
668 Draft Decision, paragraphs 255 - 258.

92
Adopted

infringements found 669 . The IE SA considered the infringements as serious in nature 670 , and in terms
of gravity of the infringements found a significant level of non-compliance 671 . Furthermore, the EDPB
underlines that, as established by the IE SA, the infringements affect a significant number of data
subjects 672 and are extensive 673 . The EDPB also observes that the IE SA considered the negligent
character of the infringement 674 , as well as the high level of responsibility of Meta IE for the lack of
compliance with the GDPR 675 as aggravating factors under Article 83(2) GDPR. Further, the IE SA
qualified the level of damage suffered by data subjects as significant 676 . In addition, the IE SA identified
only one mitigating factor, without indicating, however, whether this should lead to a slight or
substantial reduction of the fine range 677 .

361. Meta IE argues that reputation costs should also be taken into consideration, citing the IE SA’s remark
on “the significant publicity that a fine in this region will attract” 678 . On principle, the EDPB agrees
that reputation costs could be taken into consideration to some extent, if credible arguments are put
forward about the grave detriment that would ensue. Meta IE does not present such arguments679 .
The EDPB is of the view that in this case other incentives would offset any reputational costs. As far as
advertisers are concerned, Meta IE puts forward that “The personalised nature of the Instagram
Service is also the reason why it has been instrumental in the success of small and medium sized
businesses (“SMBs”) worldwide, including across the EU. Personalisation on social media and other
digital technologies, including the Instagram Service, enables SMBs to compete for customers through
“customizing [sic] products and services, [...] building a unique brand image, tailoring marketing to a
specific audience and developing a strong one-to-one connection with a community of customers’’ 680 .
As far as users of the Instagram service are concerned, there are network effects at play which leads
to incentives to join - or not leave - the platform, so as not to be excluded from participating in
discussions, corresponding with and receiving information from others 681 .

362. According to the DE, FR, and IT SAs, the proposed fine is not consistent with the fine of 225 million
euros decided upon by the IE SA in its decision dated 20 August 2021 against WhatsApp Ireland Limited

669 Draft Decision, paragraphs 209 - 252.
670 Draft Decision, paragraphs 212 - 215 and 253.
671 Draft Decision, paragraphs 216 - 217 and 253.
672 Draft Decision, paragraphs 223 - 225 and 253.
673 Draft Decision, paragraph 221.
674 Draft Decision, paragraphs 230-233 and 253.
675 Draft Decision, paragraph 240. The IE SA considers that ‘’Meta Ireland should have been aware of the

appropriate standards – albeit at a general level – and, having made a deliberate decision to present the
information in a manner which fell significant below the standard required, has a high degree of responsibility
for the lack of compliance with the GDPR’’.
676 The IE SA finds it sufficiently shown that “rights have been damaged in a significant manner, given the lack of

an opportunity to exercise data subject rights while being fully informed”, Draft Decision, paragraph 229
677 Draft Decision, paragraphs 234 - 236.
678 Composite Response, paragraph 119. See Meta IE Article 65 Submissions, Annex 1, paragraphs 2.26, 5.24,

7.20, 8.31.
679 Meta IE states that “even if Meta Ireland or other companies could ever consider that multi-million fines are

negligible from a financial point of view (a statement that is unsubstantiated and disputed), such companies
would obviously be concerned by the reputational cost of such fines.” Meta IE Article 65 Submissions, Annex 1,
paragraphs 2.26, 5.24, 7.20, and 8.31.
680 Meta IE Article 65 Submissions, paragraph 6.23.
681 NO SA Objection, p. 5. In the same vein, the FR SA describes Meta IE’s position as quasi-monopolist (FR SA

Objection, paragraph 38).

93
Adopted

for the same transparency infringements (breaches of Articles 12 and 13 GDPR) 682 . In particular, the
DE SAs point out that ‘’the facts and the seriousness of the infringements in the two cases are no
sufficiently different to justify a difference of 85% in the fine imposed’’ 683 . The FR and IT SAs also
compare with the fine of 746 million euros decided by the LU SA in its decision of 15 July 2021 against
the company Amazon Europe Core for carrying out behavioural advertising without a valid legal basis
and for transparency infringements (Articles 6, 12 and 13 GDPR) 684 . While the EDPB agrees with both
the IE SA and Meta IE that imposing fines requires a case-by-case assessment under Article 83 GDPR685 ,
the EDPB notes that the cases cited by the DE, FR and IT SAs do show marked similarities with the
current case, as they both refer to large internet platforms run by data controllers with multi-national
operations and significant resources available to them, including large, in-house, compliance teams.
Moreover, there are similarities with regards to the nature and gravity of the infringements
involved 686 . Thus, these cases can give an indication on the matter.

363. The DE, FR, IT and NO SAs calculate that the envisaged upper limit of the fine range is about 0.03 %687
of the global annual turnover of Meta Platforms, Inc., which the DE SAs note is about 0.72% of the
maximum ceiling provided for in Article 83(5) GDPR 688 . For illustrative purposes also, is the amount
of time it would take Meta Platforms, Inc. on average to generate 23 million euros in turnover in 2020,
which was about 2 hours and 33 minutes 689 .

364. The EDPB agrees with the objections raised that - if the proposed fine was to be imposed for the
transparency infringements - there would be no sufficient special preventive effect towards the
controller, nor a credible general preventive effect 690 . The proposed fine amount, even where a final
amount at the upper limit of the range would be chosen, is not effective, proportionate and dissuasive,
in the sense that this amount can simply be absorbed by the undertaking as an acceptable cost of
doing business 691 . As behavioural advertising is at the core of Meta IE’s business model 692 , the risk of
this occurring is all the greater 693 . By bearing the cost of the administrative fine, the undertaking can
avoid bearing the cost of adjusting their business model to one that is compliant as well as any future
losses that would follow from the adjustment.

682 DE SA Objection, p. 11-12 ; FR SA Objection, paragraph 42 ; IT SA Objection, p.8. The IE SA’s decision in this
case (case IN-18-12-2) is under appeal before the Irish courts.
683 DE SA Objection, p. 12.
684 FR SA Objection, paragraph 43 ; IT SA Objection p.8.
685 Draft Decision, paragraph 219-220 ; Meta IE Article 65 Submissions, pargraphs 2.23, 5.18, 7.17.
686 In this regard, the DE SA points out that in both decisions the IE SA stated that the provisions infringed ‘’go

to the heart of the general principle of transparency and the fundamental right of the individual to protection of
his/her personal data which stems from the free will and autonomy of the individual to share his/her personal
data”. DE SA Objection, p. 11.
687 DE SA Objection, p. 11; FR SA Objection, paragraph 40 ; IT SA Objection, p. 8 ; NO SA Objection, p. 12.
688 DE SA Objection, p. 11.
689 Based on the total annual turnover of 2020 being EUR 79 billion calculated by the NL SA in its objection (NL

SA Objection, paragraph 49) on the basis of the turnover of Meta Platforms, Inc. referred to in the Draft
Decision (86 billion dollars). Thus, a fine of EUR 23 million would have taken 2h33 to generate.
690 DE SA Objection, p. 12; IT SA Objection, pp. 8-9 ; NO SA Objection, p. 12 ; FR SA Objection, paragraph 47.
691 NO SA Objection, p. 11.
692 Draft Decision, paragraphs 102, 221, 227 and 251.
693 NO SA Objection, pp. 11-12.

94
Adopted

365. Though the IE SA touches upon the notions of effectiveness, proportionality and dissuasiveness in
relation to the proposed fine 694 , there is no justification based on elements specific to the case to
explain the modest fine range chosen. Moreover, the EDPB notes that while the IE SA takes into
consideration the turnover of the undertaking to ensure that the fine it proposed does not exceed the
maximum amount of the fine provided for in Article 83(5) GDPR 695 , the IE SA does not articulate how
and to what extent the turnover of this undertaking is considered to ascertain that the administrative
fine meets the requirement of effectiveness, proportionality and dissuasiveness 696 . In this regard the
EDPB recalls that, contrary to Meta IE’s views 697 , the turnover of the undertaking concerned is not
exclusively relevant for the determination of the maximum fine amount in accordance with Article
83(4)-(6) GDPR, but should also be considered for the calculation of the fine itself, where appropriate,
to ensure the fine is effective, proportionate and dissuasive in accordance with Article 83(1) GDPR 698 .
The EDPB therefore instructs the IE SA to modify its Draft Decision to elaborate on the manner in
which the turnover of the undertaking concerned has been taken into account for the calculation of
the fine.

366. In light of the above, the EDPB considers that the proposed fine does not adequately reflect the
seriousness and severity of the infringements nor has a dissuasive effect on Meta IE. Therefore, the
fine does not fulfil the requirement of being effective, proportionate and dissuasive in accordance
with Article 83(1) and (2) GDPR. In light of this, the EDPB directs the IE SA to set out a significantly
higher fine amount for the transparency infringements identified, in comparison with the upper limit
for the administrative fine envisaged in the Draft Decision. In doing so, the IE SA must remain in line
with the criteria of effectiveness, proportionality, and dissuasiveness enshrined in Article 83(1) GDPR
in its overall reassessment of the amount of the administrative fine.

9.2 On the determination of an administrative fine for further infringements

9.2.1 Analysis by the LSA in the Draft Decision
367. The IE SA in the Draft Decision concludes that Meta IE has not sought to rely on consent in order to
process personal data to deliver its service as outlined in the Instagram Terms of Use and is not legally
obliged to rely on consent in order to do so (Finding 1) 699 . Alongside, the IE SA concludes that Meta IE
can rely on Article 6(1)(b) GDPR as a legal basis to carry out the personal data processing activities
involved in the provision of its service to users, including behavioural advertising insofar as that forms
a core part of the service (Finding 2) 700 . In these terms, the IE SA did not propose to establish an
infringement of Article 6(1) GDPR.

694
Draft Decision, paragraphs 255 - 258.
695
Draft Decision, paragraph 295.
696 EDPB Guidelines on calculation of fines, paragraph 120.
697Meta IE Article 65 Submissions, paragraphs 9.8-9.10. In addition, Meta IE’s argument that “[turnover] is not a

relevant consideration when determining the amount of the fine under Article 83(2) GDPR” is not within the
scope of the dispute as no CSAs raised an objection on the consideration of turnover under this provision (Meta
IE Article 65 Submissions, paragraphs 9.5-9.8).
698 EDPB Binding Decision 1/2021, paragraphs 405-412.
699 Draft Decision, p. 23.
700 Draft Decision, paragraphs 111-115 and p. 40.

95
Adopted

368. In addition, no infringement of Article 9(1) GDPR has been found as the IE SA has not identified and
separately assessed any processing of special categories of personal data by Meta IE in the context of
Instagram Terms of Use.

369. The IE SA in its Draft Decision concludes that Meta IE has infringed Article 5(1)(a), Article 13(1)(c) and
Article 12(1) GDPR due to the lack of transparency in relation to the processing for which Article 6(1)(b)
GDPR has been relied on (Finding 3) 701 .

9.2.2 Summary of the objections raised by the CSAs
370. The AT, DE, FR, IT, NO, and SE SAs 702 object to the LSA’s failure to take action with respect to one or
more specific infringements they deem should have been found and ask the IE SA to impose a higher
administrative fine as a result of these additional infringements.

Objections requesting the imposition of a fine for the additional infringement of Article 6(1) GDPR or
Article 6(1)(b) GDPR

371. The DE and FR SAs ask for the administrative fine to be increased 703 as a consequence of the proposed
finding of an infringement of Article 6(1) GDPR 704 . The AT, NO and SE SAs argue that the fine should
be increased following the finding of an infringement of Article 6(1)(b) GDPR 705 .

372. The DE SAs state that the fact that Article 6(1) GDPR was infringed is not properly reflected in the
calculation of the fine in the Draft Decision 706 . The DE SAs argue that in the current case the processing
of personal data was performed without a legal basis as consent of the data subjects would be
required, which was not given, and that the “Draft Decision is insofar not in compliance with Article 83
GDPR as it does not consider the additional infringement of Articles 5(1)(a), Art. 6(1), 9(1) when
calculating the amount of the administrative fine” 707 . The DE SAs state that it is a highly serious
infringement under Article 83(2)(a) GDPR considering that personal data of at least
individuals were affected 708 . The DE SAs also highlight that the fine imposed needs to aim to prevent
further infringements of the GDPR; first, it should have “special preventive” effects, meaning that the
amount imposed needs to be such that “it is not to be expected that the specific controller will commit
similar infringements again” by having “such a noticeable impact on the profits of the undertaking that
future infringements of data protection law would not be ‘discounted’ into the processing performed

701
Draft Decision, p. 71.
702
AT SA Objection, pp. 11-12 ; DE SAs Objection, p. 10 and 12; FR SA Objection, pp. 9-10.; NO SA Objection, pp.
9-13; SE SA Objection, pp. 4-5.
703 FR SA Objection, paragraph 44; DE SAs Objection, p. 10.
704 DE SAs Objection, pp. 1-6 and pp. 9-10; FR SA Objection, paragraphs 5-14, 33 and 52;
705 AT SA Objection, pp. 11-12 ; NO SA Objection, pp. 10-11 ; SE SA Objection, pp. 4-5.

In addition, also the DE (DE SAs objection, p. 10), FI and NO (NO SA objection, p. 9) SAs (FI SA Objection,
paragraph 26) argue that an administrative fine should be imposed for the infringement of Article 6(1)(b) GDPR;
however, this aspect of the objection raised by the DE, FI and NO SAs was deemed to be not relevant and
reasoned by the EDPB in paragraph 85 above.
706 DE SAs Objection, p. 10.
707 DE SAs Objection, p. 10.
708 DE SAs Objection, p. 10.

96
Adopted

by the undertaking lightly”; secondly, it should have ‘’general preventive” effects by leading other
controllers to “make a significant effort to avoid similar violations” 709 .

373. The FR SA considers that some violations are wrongly not included in the Draft Decision 710 and argues
that “since it considers that breach of Articles 6 has been committed, which is added to the other
breaches found by the Irish data protection authority, the amount proposed by the latter should be
accordingly increased” 711 . The FR SA recalls that the same approach of cumulating the amounts of the
fine has been adopted by the EDPB in points 324 to 327 of its Binding Decision 1/2021 712 .

374. On risks posed by the Draft Decision, the DE SAs explain that the shortcoming of the Draft Decision
would cause significant risks for the fundamental rights and freedoms of the data subjects, “because
an effective enforcement of the GDPR, which is the precondition for the protection of the fundamental
rights and freedoms of the data subjects, cannot be ensured’’ 713 . The DE SAs also point out that
administrative fines shall in each individual case be effective, proportionate and dissuasive and both
special and general preventive since these two “concepts aim to protect the fundamental rights and
freedom of the data subjects by preventing further infringements of the GDPR” 714 . Moreover, the DE
SAs raise that “the non-compliance with one of the central provisions of the GDPR would not have any
negative financial impact on the undertaking and therefore, from an economical point of a view could
be a reasonable option for controllers’’ 715 . The FR SA considers that adopting the IE SA's Draft Decision
as it stands “presents a risk to the fundamental rights and freedoms of the data subjects, in accordance
with Article 4(24) of the GDPR” 716 and “would lead to a levelling down of the level of administrative
fines imposed by European data protection authorities, thereby reducing the authorities' coercive
power and, consequently, their ability to ensure effective compliance with the protection of the
personal data of European residents” 717 .

***

375. The AT, NO and SE SAs, which considered that the IE SA should have found an infringement of Article
6(1)(b) GDPR 718 , ask for the administrative fine to be increased as a consequence of that infringement.

376. The AT SA argues that “the additional infringement [of Article 6(1)(b) GDPR] is not properly reflected
in the envisaged amount of the administrative fine” and that the IE SA’s Draft Decision is not in
compliance with Article 83 GDPR insofar as it does not consider the additional infringement of Article
6(1)(b) GDPR when calculating the amount of the administrative fine 719 .

709
DE SAs Objection, p. 10.
710
FR SA Objection, paragraph 44.
711 FR SA Objection, paragraph 44.
712 FR SA Objection, paragraph 44.
713 DE SAs Objection, p. 12.

714 DE SAs Objection, p. 10.
715 DE SAs Objection, p. 12.
716 FR SA Objection, paragraph 47.
717 FR SA Objection, paragraph 48.
718 AT SA Objection, pp. 1-7; NO SA Objection, pp.10-11; SE SA Objection, pp. 2-3.
719 AT SA Objection, p. 11.

97
Adopted

377. The NO SA states that an administrative fine should be imposed for Meta IE’s processing of personal
data in the context of online behavioural advertising without a valid legal basis 720 . The NO SA analyses
several of the criteria listed in Article 83(2) GDPR in order to prove the need of the imposition of an
administrative fine 721 . Specifically, the NO SA argues that an administrative fine of a substantial
amount is needed, in light of the nature and gravity of the infringement (given that “the principle of
lawfulness [...] is a fundamental pillar of the GDPR” and “processing personal data without a legal
basis is a clear violation of the data subjects’ fundamental right to data protection because no one
should have to tolerate processing of their personal data save for when it is legitimised by the
legislators” 722 ), as well as the scope of the processing (“wide”, as ‘’all data subject activity may
potentially be used for OBA purposes”), the number of data subjects affected in the EEA (“hundreds of
millions”) and the intangible damage suffered by them (Article 83(2)(a) GDPR), the high level of
responsibility of Meta IE (Article 83(2)(d) GDPR), the categories of personal data involved (“of a very
personal and private nature”, able to “reveal intimate details of the data subjects’ lifestyle, mindset,
preferences, psychological wellbeing et cetera”) (Article 83(2)(g) GDPR) and an additional aggravating
factor (high likelihood of contribution to development of ‘’targeting algorithms which may be harmful
on an individual and societal level’’, Article 83(2)(k) GDPR) 723 .

378. The SE SA argues that “the Draft Decision is not in compliance with Article 83 insofar as the additional
infringement of Article 6(1)(b) is not considered in calculating the administrative fine” and that “an
administrative fine pursuant to Article 83 GDPR cannot be regarded as ‘effective, proportionate and
dissuasive’ when the provision that the processing is based on, namely Article 6(1)(b) GDPR, was
infringed and when this infringement is not properly reflected in the envisaged amount of the
administrative fine” 724 . The SE SA takes the view that that the intentional character of the infringement
(Article 83(2)(b) GDPR) and the financial benefits gained from the infringement (Article 83(2)(k) GDPR)
must be found as aggravating factors 725 . As to intentionality, the SE SA argues that the switch from
consent to Article 6(1)(b) GDPR in 2018 suggests this act was done with the intention of circumventing
the new rights afforded to users by the GDPR when the processing relies upon consent, and that in
any way the infringement needs to be considered as intentional at least as of the moment of adoption
of the EDPB Guidelines on Article 6(1)(b) GDPR which “clearly gives doubt to the legality of the
processing” 726 . As to the financial benefits gained, the SE SA argues “Meta Ireland has made significant
financial gain from being able to provide personal advertisement as part of a whole take it or leave it
offer for its social media platform service” and that due to the unclear information provided to data
subjects it can be reasonably assumed that more data subjects have been misled into being subject to
the processing 727 . Lastly, the SE SA considers it would be appropriate to take into account Meta IE’s
turnover for the calculation of the fine in order to make it effective and dissuasive 728 .

720
NO SA Objection, p. 10.
721
NO SA Objection, p. 10-11.
722 The NO SA also highlights that “[behavioural advertising] entails profiling, which inherently constitutes risks

for the data subjects’ integrity”.
723 NO SA Objection, p. 10-11.
724 SE SA Objection, p. 4.
725 SE SA Objection, p. 4.
726 SE SA Objection, p. 4.
727 SE SA Objection, p. 4.
728 SE SA Objection, p. 4-5.

98
Adopted

379. On risks posed by the Draft Decision, the AT SA argues that “should the Draft Decision be approved in
its current version, the risks for the fundamental rights and freedoms of data subjects lie in the fact
that the action envisaged in relation to the controller is likely to fall short of the proportionality and –
above all – dissuasiveness requirements set forth in Article 83 GDPR” and that “ignoring infringements
of the GDPR when calculating fines would lead to lesser compliance with the GDPR and ultimately to
lesser protection of data subjects in relation to the processing of personal data” 729 . The NO SA explains
that not imposing a fine for the lack of legal basis creates the risk that the violated provisions are not
respected by Meta IE or other controllers and the LSA would not be able to effectively safeguard the
data subjects’ rights, and that “in absence of corrective measures that create the appropriate
incentives for [Meta IE] and other controllers to change their behaviour, the same or similar violations
are likely to reoccur to the detriment of the complainant and other data subjects” 730 . The SE SA argues
the infringement of Article 6(1)(b) GDPR “is not properly reflected in the envisaged amount of the
administrative fine, it shows controllers (Meta Ireland included) that enforcement of the GDPR and its
provisions is not effective. This threatens compliance with the GDPR on a general level, seeing as how
non-compliance could be a viable option for controllers when the costs for compliance are greater.
Given the proposed changed findings regarding legal basis, there are significant risks to the
fundamental rights of data subjects if these does not also merits a substantive increase in fines to
dissuade Meta Ireland and other controllers” 731 .

Objections requesting the imposition of a fine for the additional infringement of Article 9 GDPR
380. The DE and FR SAs argue that, as the IE SA should have identified and separately assessed any
processing of special categories of personal data under Article 9 GDPR in the context of the Instagram
Terms of Use and that Meta IE processes the entire amount of data it holds, including special
categories of data in breach of Articles 6 and 9 GDPR 732 , the amount of the fine should be increased
accordingly 733 .

381. The DE SAs state that “the infringement of Article 5(1)(a), Article 6(1) and Article 9(1) GDPR [...] also
entails an administrative measure and a fine according to Art. 83(2)(5) GDPR” 734 , and argue that these
infringements are “serious” 735 . The FR SA considers that a breach of Article 9 GDPR is wrongly not
included in the Draft Decision 736 and that the amount of the fine proposed by the LSA should be
increased in light of the addition of such infringements to those already established 737 . The FR SA
recalls that the same approach of cumulating the amounts of the fine has been adopted by the EDPB
in points 324 to 327 of the Binding Decision 1/2021 738 .

382. On risks posed by the Draft Decision, the DE SAs explain that the shortcoming of the Draft Decision
would cause significant risks for the fundamental rights and freedoms of the data subjects, “because
an effective enforcement of the GDPR, which is the precondition for the protection of the fundamental

729
AT SA Objection, p. 12.
730
NO SA Objection, p. 12.
731 SE SA Objection, p. 5.
732 See Section 5.2., paragraphs 150-155.

733 DE SAs Objection, pp. 7-8; FR SA Objection, paragraph 30.
734 DE SAs Objection, p. 10.
735 DE SAs Objection, p. 10.
736 FR SA Objection, paragraph 44.
737 FR SA Objection, paragraph 44.
738 FR SA Objection, paragraph 44.

99
Adopted

rights and freedoms of the data subjects, cannot be ensured’’ 739 . The DE SAs also point out that
administrative fines shall in each individual case be effective, proportionate and dissuasive and both
special and general preventive since these two “concepts aim to protect the fundamental rights and
freedom of the data subjects by preventing further infringements of the GDPR” 740 . Moreover, the DE
SA raises that “the non-compliance with one of the central provisions of the GDPR would not have any
negative financial impact on the undertaking and therefore, from an economical point of a view could
be a reasonable option for controllers’’ 741 . The FR SA considers that adopting the IE SA's Draft Decision
as it stands “presents a risk to the fundamental rights and freedoms of the data subjects, in accordance
with Article 4(24) of the GDPR” 742 and “would lead to a levelling down of the level of administrative
fines imposed by European data protection authorities, thereby reducing the authorities' coercive
power and, consequently, their ability to ensure effective compliance with the protection of the
personal data of European residents” 743 .

Objections requesting the imposition of a fine for the additional infringement of Article 5(1)(a) and
5(1)(b)-(c) GDPR

383. The IT SA argues that the fine should be increased following the finding of an infringement of Article
5(1)(a) GDPR 744 , and of Article 5(1)(b) and Article 5(1)(c) GDPR 745 . As stated in Section 6.2 of this
Binding Decision, the IT SA agrees to a large extent with the Draft Decision’s Finding 3 on the
infringement of Article 12(1), Article 13(1)(c), and Article 5(1)(a) GDPR in terms of transparency 746 but
it argues that Meta IE has also failed to comply with the more general principle of fairness under Article
5(1)(a) GDPR, which, in the view of the IT SA, entails separate requirements from those relating
specifically to transparency 747 . Moreover, as analysed in Section 7.2, the IT SA states that there is an
additional infringement of points (b) and (c) of Article 5(1) GDPR on account of Meta IE’s failure to
comply with the purpose limitation and data minimisation principles 748 . The IT SA asks for a fine to be
issued for those two additional infringements. With regard to Article 5(1)(a) GDPR, the IT SA argues
that the finding of such infringement “should result into the imposition of the relevant administrative
fine as per Article 83(5)(a) GDPR” as far as “the infringement of the fairness principle in addition to the
transparency one [...] should result into increasing the amount of the said fine substantially by having
regard to the requirement that each fine should be proportionate and dissuasive. Indeed, the gravity
of the infringement would be factually compounded” 749 . With reference to Article 5(1)(b) and Article
5(1)(c) GDPR, the IT SA considers that “the infringement of purpose limitation and data minimisation
principles (...) should result into increasing the amount of the said fine substantially by having regard
to the requirement that each fine should be proportionate and dissuasive. Indeed, the gravity of the
infringement would be factually compounded” 750 .

739
DE SAs Objection, p. 12.
740
DE SAs Objection, p. 10.
741 DE SAs Objection, p. 12.
742 FR SA Objection, paragraph 47.
743 FR SA Objection, paragraph 48.
744 IT SA Objection, Section 2, p.7

745 IT SA Objection, Section 2, p.4
746 IT SA Objection,Section 2, pp. 4-5.
747 IT SA Objection, Section 2, pp. 4-7
748 IT SA Objection, Section 1, pp. 2-4.
749 IT SA Objection, pp. 6-7
750 IT SA Objection, p.4.

100
Adopted

384. On the significance of risks posed by the Draft Decision, the IT SA argues that “the failure to find an
infringement of Article 5(1)(a) GDPR as for the fairness principle may become a dangerous precedent
with a view to future decisions concerning other digital platform operators – more generally, other
controllers that rely on the same business model – and markedly weaken the safeguards to be provided
by way of the effective, comprehensive implementation of the data protection framework including
the fairness of processing principle” 751 . With reference to Article 5(1)(b) and Article 5(1)(c) GDPR, the
IT SA adds that, should the Draft Decision be approved in its current version, the infringement of two
key principles of the whole data protection framework as introduced by the GDPR will not be
punished, “which would seriously jeopardise the safeguards the data subjects (Instagram users) are
entitled to” 752 .

9.2.3 Position of the LSA on the objections
385. The LSA considers none of the objections requesting the imposition of a fine for the proposed
additional infringements as meeting the threshold set by Article 4(24) GDPR 753 . Given that these
objections were premised upon the requirement for the Draft Decision to include findings of
infringement of Article 6(1)(b), Article 9, Article 5(1)(a), 5(1)(b) and 5(1)(c) GDPR, on which the IE SA
expressed its disagreement – the IE SA does not consider the objections requesting exercise of a
corrective power in response to these findings of infringement as being relevant and reasoned.

9.2.4 Analysis of the EDPB
9.2.4.1 Assessment of whether the objections were relevant and reasoned
386. The objections raised by the AT, DE, FR, IT, NO, and SE SAs concern “whether the action envisaged in
the Draft Decision complies with the GDPR” 754 .

387. The EDPB takes note of Meta IE’s view that not a single objection put forward by the CSAs meets the
threshold of Article 4(24) GDPR 755 . Meta IE rejects the objections in this section based on its view
that the LSA has sole discretion to determine corrective measures 756 . The EDPB responds to these
arguments above (see Section 8.4.2) and is of the view that CSAs may ask for specific corrective
measures to be taken by the LSA, whether this concerns infringements already identified in the Draft
Decision or as a result of the one identified by the CSA in its objection 757 . Meta IE refutes the
allegations of additional infringements put forward in the objections, and by consequence, any
demands for increasing the administrative fine in relation them 758 . The EDPB recalls that the
assessment of admissibility of objections and the assessment of the merits are two distinct steps 759 .

388. The EDPB finds that the objections concerning the increase of the administrative fine in connection
with the additional infringement of Article 6(1)/6(1)(b) GDPR and/or Article 9 GDPR raised by the AT,

751
IT SA Objection, p. 7.
752
IT SA Objection, p. 4
753 Composite Response, paragraph 110..
754 EDPB Guidelines on RRO, paragraph 32.
755 Meta IE Article 65 Submissions, Annex 1, p. 65.

756 Meta IE Article 65 Submissions, Annex 1, paragraphs 1.31, 2.21, 5.18, 7.15, 9.22, and 10.16.
757 EDPB RRO Guidelines, paragraph 34. See also Recital 150 GDPR. The EDPB found several objections on this

subject matter admissible in the past, see Binding Decision 2/2022, paragraphs 186-190.
758 See Meta IE Article 65 Submissions, paragraphs 8.10-8.15, and more specifically Annex 1, paragraphs 1.33,

2.18, 5.20, 7.13, 9.18 and 9.20, and 10.16.
759 EDPB Guidelines on Article 65(1)(a), paragraph 63.

101
Adopted

DE, FR, NO, and SE SAs stand in direct connection with the substance of the Draft Decision, as they
concern the imposition of a corrective measure for an additional infringement, which would be found
as a consequence of reversing the conclusions in the Draft Decision also in scope of this dispute760 .
Clearly, the decision on the merits of the demands to take corrective measures for a proposed
additional infringement is affected by the EDPB’s decision on whether to reverse the findings in the
Draft Decision and whether to instruct the LSA to establish additional infringements.

389. The EDPB takes note of further arguments put forward by Meta IE aiming to demonstrate the lack of
relevance of these objections, specifically with regard to the objections raised by the AT SA761 .
However, the EDPB notes that Meta IE disagrees with the content of these objections, which concerns
its merits and not its admissibility.

390. If followed, these objections would lead to a different conclusion in terms of corrective measures
imposed 762 . In consequence, the EDPB considers the objections raised by the AT, DE, FR, NO and SE
SAs in connection to imposing an administrative fine for the alleged breach of Article 6(1)/6(1)(b)
GDPR and/or Article 9 GDPR to be relevant.

391. Meta IE argues that the AT, NO, and SE SAs objections in relation to the need to increase the fine
amount because of the alleged infringement of Article 6(1)(b) GDPR lacks adequate reasoning as they
fail to demonstrate why Meta IE could not rely on Article 6(1)(b) GDPR 763 . According to Meta IE, the
SE SA’s objection is also based on the unfounded claim that Meta IE intentionally sought to circumvent
data subject rights by switching from consent to contractual necessity as the legal basis in May 2018764 .
Furthermore, Meta IE takes the view that the objections from the AT, DE, FR and NO SAs are not
sufficiently reasoned as they refer to the use of administrative fine as ''general preventive measures''
on controllers, thus speculating on potential future behaviour or intentions of unidentified
controllers 765 . The EDPB understands that Meta IE disagrees with the reasoning provided in the
objections, which thus concerns their merits and not their admissibility.

392. In addition, Meta IE argues that the FR SA’s objection is not reasoned because it does not substantiate
“how a fine for the additional purported infringements would be calculated, whether this fine would
need to be added to the proposed fine and how this would affect the overall fine” 766 . Meta IE further
takes issue with the AT SA’s objection and argues it has not put forward a sufficiently reasoned basis
for its objection to challenge the LSA’s calculation of the criteria laid down in Article 83(2) GDPR 767 . In
this respect, the EDPB recalls that CSAs are not required to engage in a full assessment of all the

760
AT SA Objection, p. 11; DE SAs Objection, p. 2; FR SA Objection, paragraphs 44 and 50; NO SA Objection, p.
11; SE SA Objection, p. 4.
761 Meta IE Article 65 Submissions, Annex 1, paragraph 1.32. According to Meta IE, by referring to the fact that

‘’Meta Ireland is... the provider of one of the biggest social media network in the world’’, the AT SA ‘’fails to
explain how this relates to any specific factual and legal content of the Draft Decision’’.
762 AT SA Objection, p. 11; DE SAs Objection, p.2; FR SA Objection, paragraph 44 and 50; NO SA Objection, p.

11; SE SA Objection, p. 4.
763 Meta IE Article 65 Submissions, Annex 1, 1.33, 9.20, and 10.17.

764 Meta IE Article 65 Submissions, Annex 1, 10.17.
765 Meta IE Article 65 Submissions, Annex 1, paragraphs 1.35, 2.22, 5.16 and 9.23. Meta IE adds that ‘’in any

event, where a fine as large as that currently proposed in the Draft Decision is imposed, there is no doubt that
other controllers will take note of this in such circumstances’’.
766 Meta IE Article 65 Submissions, Annex 1, paragraph 5.20.
767 Meta IE Article 65 Submissions, Annex 1, paragraph 1.34.

102
Adopted

aspects of Article 83 GDPR in order for an objection on the appropriate administrative fine to be
considered reasoned. It is sufficient to lay out which aspect of the Draft Decision that, in their view, is
deficient/erroneous and why. Second, the EDPB recalls that the criteria listed in Article 83(2) GDPR
are not exhaustive, thus it is entirely possible to argue an administrative fine is not “effective,
proportionate and dissuasive” in the meaning of Article 83(1) GDPR without referring to a specific
criterion listed in Article 83(2) GDPR.

393. The EDPB finds that the AT, DE, FR, NO and SE SAs adequately argue why they propose amending the
Draft Decision 768 and how this leads to a different conclusion in terms of administrative fine
imposed 769 .

394. In terms of risks, Meta IE claims the Draft Decision does not pose any risk, let alone a significant risk
to fundamental rights, and argues the objections of the AT, DE ,FR, NO and SE SAs 770 fail to
demonstrate the contrary, as required.

395. More specifically, Meta IE considers that the DE and FR SAs’ objections focus on increasing the
‘’punitive impact’’ of the fine on Meta IE rather than demonstrating any significant risks to the
fundamental rights of data subjects 771 . In this regard, Meta IE argues the AT, DE, NO, and SE SAs’
objections rest on unsubstantiated possible effect of the Draft Decision on the future behaviour of
other controllers, instead of doing a case by case assessment under Article 83 GDPR 772 . In particular,
Meta IE claims that, in doing so, the assessment made by these supervisory authorities is incorrect to
the extent it only takes into account financial costs and does not consider reputational costs 773 .

396. The EDPB recalls that any risk assessment addresses future outcomes which are to some degree
uncertain 774 . Contrary to Meta IE’s views, the objections reflect specifically on Meta IE’s future
approach in the event the Draft Decision is adopted as it stands and go beyond providing “speculative
argument based on the putative lack of a general preventive impact on other controllers” 775 . The EDPB
also notes that the DE, FR, NL, NO and SE SAs 776 considered both of the aspects that are entailed by
dissuasiveness of the fine, i.e. specific deterrence and general deterrence 777 .

768 AT SA Objection, pp. 11; DE SAs Objection, p. 10 ; FR SA Objection, paragraph 50 ; NO SA Objection pp. 9-11;
SE SA Objection p. 4.
769 AT SA Objection, pp. 11-12; DE SAs Objection, p. 12 ; FR SA Objection, paragraphs 44-45 ; NO SA Objection

p. 13 ; SE SA Objection, p. 4
770 Meta IE Article 65 Submissions, Annex 1, paragraphs 1.36-1.40, 2.24-2.27, 5.22-5.25, 9.25-9.27, and 10.18-

10.20.
771 Meta IE Article 65 Submissions, Annex 1, paragraphs 2.24 and 5.22.
772 Meta IE Article 65 Submissions, Annex 1, paragraphs 1.38, 2.25 5.23, 9.26, and 10.18.
773 Meta IE Article 65 Submissions, Annex 1, paragraphs 1.38, 2.26, 5.24, and 10.19. Meta IE adds that, in any

case, it ‘’does not consider that fines such as the one proposed in the Draft Decision could encourage other
companies not to comply with the GDPR’’.
774 See Section 9.1.4.1 of this Binding Decision.
775 Meta IE Article 65 Submissions, Annex 1, paragraph 10.18 (SE SA).

776 DE SAs Objection, p. 12 (referring to the ‘’undertaking in question’’), FR SA Objection, paragraph 47 (referring

to ‘’the controller’’); IT SA Objection pp.8-9 (referring to ‘’the controller’’); NL SA Objection, paragraph 52
(referring to the risks in relation to ‘’the illegal processing at hand’’); NO SA Objection, p.12 (referring to
‘’incentives for Meta IE’’).
777 The CJEU has consistently held that a dissuasive fine is one that has a genuine deterrent effect,

encompassing both specific deterrence (discouraging the addressee of the fine from committing the same

103
Adopted

397. The EDPB finds that the AT, DE, FR, NO, and SE SAs articulate an adverse effect on the rights and
freedoms of data subjects if the Draft Decision is left unchanged, by referring to a failure to guarantee
a high level of protection in the EU for the rights and interests of the individuals 778 .

398. Therefore, the EDPB considers the AT, DE, FR, NO, and SE SAs objections concerning the imposition of
a fine for the alleged additional infringements of Article 6/6(1)(b) and/or Article 9 GDPR to be
reasoned.

***

399. With respect to the objection raised by the IT SA concerning the imposition of an administrative fine
for the infringement of the fairness principle enshrined in Article 5(1)(a) GDPR, the EDPB finds,
contrary to Meta IE’s views 779 , that it stands in connection with the substance of the Draft Decision,
as it concerns the imposition of a corrective measure for an additional infringement, which would be
found as a consequence of incorporating the finding put forward by the objection. Clearly, the decision
on the merits of the demand to take corrective measures for a proposed additional infringement is
affected by the EDPB’s decision on whether to instruct the LSA to include an additional infringement.

400. If followed, the IT SA’s objection would lead to a different conclusion in terms of corrective
measures imposed 780 . Taking note of Meta IE’s position 781 , the EDPB finds the objections raised by
the IT SA to be relevant.

401. Meta IE argues the IT SA’s objection does not put forward reasonable doubt as to the validity of the
LSA’s calculation of the fine and claims there is no basis in the GDPR for suggesting that an
administrative fine must have a ‘’general deterrent effect’’ 782 .The EDPB finds that the IT SA adequately
argues why they propose amending the Draft Decision and how this leads to a different conclusion in
terms of administrative fine imposed 783 .

infringement again) and general deterrence (discouraging others from committing the same infringement in
the future). See, inter alia, C-511/11, Versalis, paragraph 94.
778 AT SA Objection, p. 11-12; DE SAs Objection, p. 12; FR SA Objection, paragraphs 47-48; NO SA Objection, p.

12; SE SA Objection, p. 5. See also EDPB Guidelines on RRO, paragraph 37.
779 Meta IE Article 65 Submissions, paragraph 7.13. According to Meta IE, the IT SA objections is not relevant

given that the LSA has not found any infringement of the fairness, purpose limitation and data minimisation
principles (Article 5(1)(a)-(c) GDPR).
780 IT SA Objection, p. 7.
781 Meta IE Article 65 Submissions, paragraph 7.13. According to Meta IE, given the IE SA has not found any

infringement of the fairness principle, there is no basis for the imposition of a fine on this ground. EDPB already
responded to this line of reasoning above in Section 8.4.2.
782 Meta IE Article 65 Submissions, paragraphs 7.15-16.
783 The IT SA argues that the finding of such infringement “should result into increasing the amount of the said

fine substantially by having regard to the requirement that each fine should be proportionate and dissuasive’’
insofar as ‘’the gravity of the infringement would be factually compounded.” (IT SA Objection, pp. 6-7).

104
Adopted

402. Meta IE argues the objection of the IT SA fails to demonstrate the risk posed by the Draft Decision, as
required 784 and, in doing so, Meta IE dismisses the concerns articulated by the IT SA on the precedent
the Draft Decision sets for other controllers 785 .

403. The EDPB finds that the IT SA articulates an adverse effect on the rights and freedoms of data subjects
if the Draft Decision is left unchanged, by referring to a failure to guarantee a high level of protection
in the EU for the rights and interests of the individuals 786 .

404. Therefore, the EDPB considers the IT SA’s objection concerning the imposition of a fine for the
additional infringement of the principle of fairness enshrined in Article 5(1)(a) GDPR to be reasoned.

***

405. The EDPB recalls its analysis of whether the objection raised by the IT SA in respect of the proposed
additional infringements of Article 5(1)(b) and Article 5(1)(c) GDPR meets the threshold set by Article
4(24) GDPR (see Section 7.4.1 above). In light of the conclusion that such objection is not relevant and
reasoned, the EDPB does not need to further examine this linked objection.

9.2.4.2 Assessment on the merits
406. In accordance with Article 65(1)(a) GDPR, the EDPB shall take a Binding Decision concerning all the
matters which are the subject of the relevant and reasoned objections, in particular whether the
envisaged action in relation to the controller or processor complies with the GDPR. More specifically,
the EDPB needs to assess whether an administrative fine should be imposed for the additional
infringements of Article 6(1) GDPR and the principle of fairness under Article 5(1)(a) GDPR. However,
in light of its findings in Section 5.4.2 above, the EDPB does not need to examine the merits of the
objections of the DE and FR SAs requesting the imposition of a fine for the alleged additional breach
of Article 9 GDPR.

407. The EDPB recalls that the consistency mechanism may also be used to promote a consistent
application of administrative fines 787 and that the objective pursued by the corrective measure
chosen can be to re-establish compliance with the rules or to punish unlawful behaviour (or both)788 .
The EDPB responds above to Meta IE’s position that the LSA has sole discretion to determine which
corrective measures are appropriate (see Section 8.4.2).

9.2.4.2.1 Assessment of whether an administrative fine should be imposed for the infringement of
Article 6(1) GDPR

784
Meta IE Article 65 Submissions, paragraph 7.18.
785
Meta IE Article 65 Submissions, paragraph 7.19. On this, the EDPB has set out its position above in Section
9.1.4.1 above.
786 IT SA Objection, p. 7.

787 Recital 150 GDPR. EDPB Guidelines on RRO, paragraph 34; EDPB Guidelines on Administrative fines p. 7

(“When the relevant and reasoned objection raises the issue of the compliance of the corrective measure with
the GDPR, the decision of EDPB will also discuss how the principles of effectiveness, proportionality and
deterrence are observed in the administrative fine proposed in the draft decision of the competent supervisory
authority”). See also above paragraph 344.
788 EDPB Guidelines on Administrative Fines, p. 6. See also paragraph 354 of this Binding Decision.

105
Adopted

408. The EDPB recalls its conclusion in this Binding Decision on the infringement of Article 6(1) GDPR 789
and that the objections raised by the AT, DE, FR, NO and SE SAs found to be relevant and reasoned
requested the IE SA to exercise its power to impose an administrative fine 790 .

409. The EDPB takes note of Meta IE’s views that, even if an infringement is found, the appropriate course
would be to refer the matter back to the LSA to determine whether to impose any appropriate
corrective measures 791 , and that the LSA has sole competence and discretion regarding the amount of
the fine 792 . The EDPB responds to Meta IE’s argument that the LSA has sole discretion to determine
the appropriate corrective measures in the event of a finding of infringement above in Section 8.4.2.

410. The EDPB concurs that the decision to impose an administrative fine needs to be taken on a case-by-
case basis in light of the circumstances and is not an automatic one 793 . In the case at hand, however,
the EDPB agrees with the reasoning put forward by the AT, DE, FR, NO and SE SAs in their objections.
The EDPB reiterates that lawfulness of processing is one of the fundamental pillars of the data
protection law and considers that processing of personal data without an appropriate legal basis is a
clear and serious violation of the data subjects’ fundamental right to data protection 794 .

411. Several of the factors listed in Article 83(2) GDPR speak strongly in favour of the imposition of an
administrative fine for the infringement of Article 6(1) GDPR.

The nature, gravity and duration of the infringement (Article 83(2)(a) GDPR)

412. As mentioned above and outlined below 795 , the nature and gravity of the infringement clearly tip the
balance in favour of imposing an administrative fine.

413. With respect to the scope of processing, the EDPB notes the IE SA’s assessment that the personal data
processing carried out by Meta IE on the basis of Article 6(1)(b) GDPR is extensive, adding that “Meta
Ireland processes a variety of data in order to provide Instagram users with a ‘personalised’ experience,
including by way of serving personalised advertisements. The processing is central to and essential to
the business model offered [...]’’ 796 .

789 Section 4.4.2 of this Binding Decision.
790
Paragraph 390 and 398 of this Binding Decision.
791 Meta IE Article 65 Submissions, paragraph 8. 13
792 Meta IE Article 65 Submissions, paragraph 9.2, 10.4,
793 EDPB Guidelines on Administrative fines, p. 6 (“Like all corrective measures in general, administrative fines

should adequately respond to the nature, gravity and consequences of the breach, and supervisory authorities
must assess all the facts of the case in a manner that is consistent and objectively justified. The assessment of
what is effective, proportional and dissuasive in each case will have to also reflect the objective pursued by the
corrective measure chosen, that is either to re-establish compliance with the rules, or to punish unlawful
behaviour (or both)”), p. 7 (“The Regulation requires assessment of each case individually”; “Fines are an
important tool that supervisory authorities should use in appropriate circumstances. The supervisory authorities
are encouraged to use a considered and balanced approach in their use of corrective measures, in order to
achieve both an effective and dissuasive as well as a proportionate reaction to the breach. The point is to not
qualify the fines as last resort, nor to shy away from issuing fines, but on the other hand not to use them in such
a way which would devalue their effectiveness as a tool.”).
794 Article 8(2), EU Charter of Fundamental Rights. See NO SA objection, p. 10.
795 In particular, see Section 4.4.2 of this Binding Decision as well as paragraphs 408, 413-415.
796 Draft Decision, paragraphs 221.

106
Adopted

414. In this respect, the EDPB also recalls that the infringement at issue relates to the processing of personal
data of a significant number of people 797 and that the impact on them has to be considered.

415. Though the damage is very difficult to express in terms of a monetary value, it remains the case that
data subjects have been faced with data processing that should not have occurred (by relying
inappropriately on Article 6(1)(b) GDPR as a legal basis as established in Section 4.4.2). The data
processing in question - behavioural advertising - entails decisions about information that data
subjects are exposed to or excluded from receiving. The EDPB recalls that non-material damage is
explicitly regarded as relevant in Recital 75 and that such damage may result from situations “where
data subjects might be deprived of their rights and freedoms or prevented from exercising control over
their personal data”. Given the nature and gravity of the infringement of Article 6(1)(b) GDPR, a risk
of damage caused to data subjects is, in such circumstances, consubstantial with the finding of the
infringement itself.

The intentional or negligent character of the infringement (Article 83(2)(b) GDPR)
416. The SE SA argues the infringement of Article 6(1)(b) GDPR should be considered intentional on Meta
IE’s part, which is an aggravating factor 798 .

417. The EDPB takes note of Meta IE’s position that it did not act intentionally with the aim to infringe the
GDPR, nor was negligent - but “has relied on what it has consistently considered in good faith to be a
valid legal basis for the purpose of processing of personal data for behavioural advertising and which
now requires escalation to the EDPB for resolution” 799 . Before addressing each of the elements of this
claim, the EDPB first notes that establishing either intent or negligence is not a requirement for
imposing a fine, but deserves “due regard”. Second, contrary to what Meta IE implies, the mere
circumstance that a dispute between the LSA and the CSAs has escalated to the EDPB does not serve
as evidence that a controller acted in good faith with respect to the disputed issues. First, the dispute
arises only (long) after the controller has decided on its course of action, and therefore cannot inform
it. Second, a dispute may simply bring to light that an LSA has decided to challenge a position
commonly held by (a majority of) the CSAs.

418. The EDPB Guidelines on calculation of fines confirm that there are two cumulative elements on the
basis of which an infringement can be considered intentional: the knowledge of the breach and the
willfulness in relation to such act 800 . By contrast, an infringement is “unintentional” when there was a
breach of the duty of care, without having intentionally caused the infringement.

419. The characterisation of an infringement as intentional or negligent shall be done on the basis of
objective elements of conduct gathered from the facts of the case 801 . It is worth noting the broader

797
Draft Decision, paragraph 253, the Instagram service is provided to a significant portion of the population of
the EEA. This aspect was also highlighted by the objections raised by the NO SA (NO SA Objection, pp. 10-11)
and DE SAs (DE SAs Objection, pp. 9 and 11).
798 SE SA Objection, pp. 4-5.

799 Meta IE Article 65 Submissions, paragraph 8.28.
800 The EDPB Guidelines on calculation of fines, paragraphs 56, referring to the EDPB Guidelines on

Administrative Fines: “in general, ‘intent’ includes both knowledge and wilfulness in relation to the characteristics
of an offence, whereas ‘unintentional’ means that there was no intention to cause the infringement although the
controller/processor breached the duty of care which is required in the law”.
801 EDPB Guidelines on calculation of fines, paragraph 57 and EDPB Guidelines on Administrative Fines p. 12.

107
Adopted

approach adopted with respect to the concept of negligence, since it also encompasses situations in
which the controller or processor has failed to adopt the required policies, which presumes a certain
degree of knowledge about a potential infringement 802 . This provides an indication that non-
compliance in situations in which the controller or processor should have been aware of the potential
breach (in the example provided, due to the lack of the necessary policies) may amount to negligence.

420. The SE SA argues that Meta IE “has continued to rely on Article 6(1)(b) for the processing, despite the
aforementioned [EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR] – which clearly gives doubt to the
legality of the processing – which were first adopted on 9 April 2019 and made final on 8 October 2019.
The infringement must in all cases be considered intentional from that later date” 803 .

421. The EDPB recalls that even prior to the adoption EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR,
there were clear indicators that spoke against relying on contract as legal basis. First, in WP29 Opinion
02/2010 on online behavioural advertising, only consent - as required by Article 5(3) of the ePrivacy
Directive - is put forward as possible legal basis for this activity. As Article 6 GDPR resembles Article 7
of the Data Protection Directive to a large extent, WP29 Opinion 02/2010 remained a relevant source
on this matter for controllers preparing for the GDPR to enter into application. Second, WP29 Opinion
06/2014 on the notion of legitimate interests explicitly states that “the fact that some data processing
is covered by a contract does not automatically mean that the processing is necessary for its
performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s
tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is
because the data controller has not been contracted to carry out profiling, but rather to deliver
particular goods and services, for example. Even if these processing activities are specifically
mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the
performance of the contract” 804 .

422. It stems from the above that Meta IE had (or should have had) knowledge about the infringement of
Article 6(1)(b) GDPR. However, this mere element is not sufficient to consider an infringement
intentional, as stated above, since the “aim” or “wilfulness” of the action should be demonstrated.

423. The EDPB recalls that that having knowledge of a specific matter does not necessarily imply having the
“will” to reach a specific outcome. This is in fact the approach adopted in the EDPB Guidelines on
calculation of fines and WP29 Guidelines on Administrative Fines, where the knowledge and the
“wilfulness” are considered two distinctive elements of the intentionality 805 . While it may prove
difficult to demonstrate a subjective element such as the “will” to act in a certain manner, there need
to be some objective elements that indicate the existence of such intentionality 806 .

424. The EDPB recalls that the CJEU has established a high threshold in order to consider an act intentional.
In fact, even in criminal proceedings the CJEU has acknowledged the existence of “serious negligence”,

802
The EDPB Guidelines on calculation of fines, paragraph 56 (Example 4) quote the EDPB Guidelines on
Administrative Fines, which mention, among the circumstances indicative of negligence, “failure to adopt
policies (rather than simply failure to apply them)”.
803 SE SA Objection, p. 4.
804 WP29 Opinion 06/2014 on the notion of legitimate interests, p. 16-17.
805 EDPB Guidelines on calculation of fines, paragraph 56, and EDPB Guidelines on Administrative Fines, p. 11.
806 See EDPB Guidelines on calculation of fines, paragraphs 56 and 57, and WP29 Guidelines on Administrative

Fines, p. 12.

108
Adopted

rather than “intentionality” when “the person responsible commits a patent breach of the duty of care
which he should have and could have complied with in view of his attributes, knowledge, abilities and
individual situation” 807 . In this regard, while the EDPB confirms that a company for whom the
processing of personal data is at the core of its business activities is expected to have sufficient
measures in place for the safeguard of personal data 808 , this does not, however, per se change the
nature of the infringement from negligent to intentional.

425. In this regard, the SE SA puts forward that Meta IE based its processing of personalised advertisement
on consent until the GDPR came into force on 25 May 2018, and at this time switched to relying on
Article 6(1)(b) GDPR for the processing in question instead. The timing and the logistics for this switch
suggests this act was done with the intention of circumventing the new rights of users under Article
6(1)(a) GDPR. The SE SA adds that “[the] proposed finding of infringement concerning information
deficits about the processing, namely on what legal basis it is based, further supports this conclusion,
since it goes to show that Meta Ireland was aware of the questionable legality of that basis and tried
to conceal the infringement to avoid scrutiny by supervisory authorities and data subjects” 809 .

426. The EDPB considers the timing of the changes made by Meta IE to its Instagram Terms of Use as an
objective element, however this alone does not indicate intention. Around this time period, many
controllers updated their data protection policies. The objection suggests that the conclusion on
intentionality is corroborated by the shortcomings to the transparency obligations. In the EDPB’s view,
the combination of the timing of the change of legal basis with the lack of transparency is not sufficient
to indicate intention either.

427. Therefore, on the basis of the available information, the EDPB is not able to identify a will of Meta IE
to act in breach of the law as it cannot be concluded that Meta IE intentionally acted to circumvent its
legal obligations.

428. Therefore, the EDPB considers that the arguments put forward by the SE SA do not meet the threshold
to demonstrate the intentionality of the behaviour of Meta IE. Accordingly, the EDPB is of the view
that the Draft Decision does not need to include this element.

429. At the same time, the EDPB notes that, even establishing that the infringement was committed
negligently, a company for whom the processing of personal data is at the core of its business activities
should have in place sufficient procedures for ensuring compliance with the GDPR 810 .

430. The EDPB does not accept Meta IE’s claim of “good faith”, but is of the view that Meta IE was certainly
seriously negligent in not taking adequate action, within a reasonable time period, following the
adoption of the EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR on 9 April 2019. Even before that
date, the EDPB considers there was at the very least negligence on Meta IE’s part considering the
contents of WP29 Opinion 02/2010 on online behavioural advertising and WP29 Opinion 06/2014 on
the notion of legitimate interests (see paragraph 421 of this Binding Decision), which means Meta IE
had (or should have had) knowledge about the infringement of Article 6(1)(b) GDPR, given the fact

807
Judgement of the Court of Justice of 3 June 2008, The Queen, on the application of International Association
of Independent Tanker Owners (Intertanko) and Others v. Secretary of State for Transport, C-308/06,
ECLI:EU:C:2008:312, paragraph77.
808 EDPB Binding Decision 1/2020, adopted on 9 November 2020, paragraph 195.
809 SE SA Objection, p. 4.
810 See EDPB Binding Decision 1/2020, paragraph 195.

109
Adopted

that processing of personal data is at the core of its business practices, and the resources available to
Meta IE to adapt its practices so as to comply with data protection legislation.

The degree of responsibility of the controller taking into account technical and organisational
measures implemented pursuant to Articles 25 and 32(Article 83(2)(d) GDPR)
431. The EDPB considers the degree of responsibility of Meta IE’s part to be of a high level, on the same
grounds as set in the Draft Decision with regards to the transparency infringements 811 .

The financial benefit obtained from the infringement (Article 83(2)(k) GDPR)

432. The SE SA argues Meta IE gained financial benefits from their decision to rely on contract as legal basis
for behavioural advertising, rather than obtaining consent from the users of Instagram 812 . While not
providing an estimate of its size, the SE SA considers the existence of financial benefit sufficiently
proven on the basis of “the self-evident fact that Meta Ireland has made significant financial gain from
being able to provide personal advertisement as part of a whole take it or leave it offer for its social
media platform service, as opposed to establishing a separate legal basis for it. By also being unclear
in the information to data subjects, it is a reasonable assumption that more data subjects have been
misled into being subject to the processing, thus increasing the financial benefits gained by Meta
Ireland pursuant to personal advertisement” 813 .

433. As explicitly stated in Article 83(2)(k) GDPR, financial benefits gained directly or indirectly from the
infringement can be considered an aggravating element for the calculation of the fine. The aim of
Article 83(2)(k) GDPR is to ensure that the sanction applied is effective, proportionate and dissuasive
in each individual case 814 .

434. In particular, in view of ensuring fines that are effective, proportionate and deterrent, and in light of
common accepted practice in the field of EU competition law 815 , which inspired the fining framework
under the GDPR, the EDPB is of the view that, when calculating the administrative fine, supervisory
authorities could take account of the financial benefits obtained from the infringement, in order to
impose a fine that aim at “counterbalancing the gains from the infringement” 816 .

435. When applying this provision, the supervisory authorities must “assess all the facts of the case in a
manner that is consistent and objectively justified” 817 . Therefore, financial benefits from the
infringement could be an aggravating circumstance if the case provides information about profit
obtained as a result of the infringement of the GDPR 818 .

811 Draft Decision, paragraph 240. In this respect, the EDPB notes that the high degree of responsibility of Meta
IE for the non-compliance with the GDPR was considered as an aggravating factor by LSA for the calculation of
the fine.
812 SE SA Objection, p. 4.
813 SE SA Objection p. 4.
814 EDPB Guidelines on calculation of fines, paragraph 107.
815 See the CJEU rulings cited in EDPB Binding Decision 2/2022, paragraph 219.
816 EDPB Guidelines on calculation of fines, examples 7c and 7d.
817 EDPB Guidelines on Administrative Fines, p. 6 (emphasis added), quoted in Binding Decision 1/2021,

paragraph 403.
818 EDPB Guidelines on calculation of fines, paragraph 110.

110
Adopted

436. In the present case, the EDPB considers that it does not have sufficiently precise information to
evaluate the specific weight of the financial benefit obtained from the infringement.

437. Nonetheless, the EDPB acknowledges the need to prevent that the fines have little to no effect if they
are disproportionally low compared to the benefits obtained with the infringement. The EDPB
considers that the IE SA should ascertain if an estimation of the financial benefit from the infringement
is possible in this case. Insofar as this results in the need to increase the amount of the fine proposed,
the EDPB requests the IE SA to increase the amount of the fine proposed.

Competitive advantage - other factor (Article 83(2)(k) GDPR)
438. The NO SA identifies an aggravating factor in that “that the unlawful processing of personal data in all
likelihood has contributed to the development of algorithms which may be harmful on an individual or
societal level, and which may have considerable commercial value to [Meta IE]. The algorithms may
have contributed to giving [Meta IE] a competitive advantage vis-à-vis its competitors” 819 .

439. On principle, the EDPB agrees that a competitive advantage could be an aggravating factor if the case
provides objective information that this was obtained as a result of the infringement of the GDPR 820 .
In the present case, the EDPB considers that it does not have sufficiently precise information to
evaluate the existence of a competitive advantage resulting from the infringement. The EDPB
considers that the IE SA should ascertain if an estimation of the competitive advantage derived from
the infringement is possible in this case. Insofar as this results in the need to increase the amount of
the fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.

***

440. Taking into account the nature and gravity of the infringement as well as other aspects in accordance
with Article 83(2) GDPR, the EDPB considers that the IE SA must exercise its power to impose an
additional administrative fine. Also, covering this additional infringement with a fine would be in line
with the IE SA’s (proposed) decision to impose administrative fines in this case for the transparency
infringements relating to processing carried out in reliance on Article 6(1)(b) GDPR 821 . The EDPB
underlines that, in order to be effective, proportionate and dissuasive, a fine should reflect the
circumstances of the case. Such circumstances not only refer to the specific elements of the
infringement, but also those of the controller or processor who committed the infringement, namely
its financial position.

9.2.4.2.2 Assessment of whether an administrative fine should be imposed for the infringement of the
fairness principle under Article 5(1)(a) GDPR
441. The EDPB recalls its conclusion in this Binding Decision on the infringement by Meta IE of the fairness
principle under Article 5(1)(a) GDPR 822 and that the objection raised by the IT SA, which was found to

819
NO SA Objection, p. 11.
820
EDPB Guidelines on calculation of fines, paragraph 109. See also paragraphs 433 of this Binding Decision.
821 Draft Decision, paragraphs 253-258.
822 Section 4.4.2 of this Binding Decision.

111
Adopted

be relevant and reasoned, requested the IE SA to exercise its power to impose an administrative
fine 823 .

442. The EDPB takes note of Meta IE’s views that it would not be appropriate for the EDPB to instruct the
LSA to take corrective measures in relation to the additional infringement of the fairness principle
under Article 5(1)(a) GDPR considering that this issue does not fall within the scope of the Inquiry. The
EDPB responds to these arguments above in Section 6.4.2 824 .

443. The EDPB recalls that the decision to impose an administrative fine needs to be taken on a case-by-
case basis in light of the circumstances and is not an automatic one 825 . In the same vein, the EDPB’s
assessment of Meta IE’s compliance with the principle of fairness is carried out by taking into account
the specificities of the case, of the particular social networking service at hand and of the processing
of personal data carried out, namely for the purpose of online behavioural advertising 826 .

444. As previously established, the principle of fairness under Article 5(1)(a) GDPR, although intrinsically
linked to the principles of lawfulness and transparency under the same provision, has an independent
meaning 827 . It underpins the whole data protection framework and plays a key role for securing a
balance of power in the controller-data subject relationship 828 .

445. Considering the EDPB’s findings in Section 6.4.2 that Meta IE has not complied with key requirements
of the principle of fairness as defined by the EDPB, namely allowing for autonomy of the data subjects
as to the processing of their personal data, fulfilling data subjects’ reasonable expectation, ensuring
power balance, avoiding deception and ensuring ethical and truthful processing, as well as the overall
effect of the infringement by Meta IE of the transparency obligations and of Article 6(1) GDPR, the
EDPB reiterates its view that Meta IE has infringed the principle of fairness under Article 5(1)(a) GDPR
and agrees with the IT SA that this infringement should be adequately taken into account by the IE SA
in the calculation of the amount of the administrative fine to be imposed following the conclusion of
this inquiry.

446. Therefore, the EDPB instructs the IE SA to take into account the infringement by Meta IE of the fairness
principle enshrined in Article 5(1)(a) GDPR as established above when re-assessing the administrative
fines for the transparency infringements and the determination of the fine for the lack of legal basis.
If, however, the IE SA considers an additional fine for the breach of the principle of fairness is an
appropriate corrective measure, the EDPB requests the IE SA to include this in its final decision. In any
case, the IE SA must take into account the criteria provided for by Article 83(2) GDPR and ensuring it
is effective, proportionate and dissuasive in line with Article 83(1) GDPR.

823
Paragraphs 399-404 of this Binding Decision.
824 Meta IE Article 65 Submissions, paragraph 8.15.
825 See above paragraph 410.
826 See above section 6.4.2
827 See above section 6.4.2, paragraph 224.
828 See above section 6.4.2

112
Adopted

10 BINDING DECISION
447. In light of the above, and in accordance with the task of the EDPB under Article 70(1)(t) GDPR to issue
binding decisions pursuant to Article 65 GDPR, the EDPB issues the following Binding Decision in
accordance with Article 65(1)(a) GDPR.

448. The EDPB addresses this Binding Decision to the LSA in this case (the IE SA) and to all the CSAs, in
accordance with Article 65(2) GDPR.

On the objections concerning whether the LSA should have found an infringement for lack of
appropriate legal basis
449. The EDPB decides that the objections of the AT, DE, ES, FI, FR, HU , NL, NO, and SE SAs regarding Meta
IE’s reliance on Article 6(1)(b) GDPR in the context of its offering of the Instagram Terms of Use meet
the requirements of Article 4(24) GDPR.

450. On the parts of the DE SAs’ objection requesting the finding of an infringement of Article 5(1)(a) GDPR,
and the parts of the DE and NO SAs objections requesting specific corrective measures under Article
58 GDPR for the infringement of Article 6(1) or 6(1)(b) GDPR, namely the imposition of an
administrative fine, a ban of the processing of personal data for the purpose of behavioural
advertising, an order to delete personal data processed under Article 6(1)(b) GDPR, and an order to
identify a valid legal basis for future behavioural advertising or to abstain from such processing
activities, the EDPB decides that these parts of their objections do not meet the threshold of Article
4(24) GDPR. Similarly, the part of the FI SA objection concerning the imposition of a specific corrective
measures, namely an administrative fine is not reasoned and does not meet the threshold of Article
4(24) GDPR.

451. The EDPB instructs the IE SA to alter its Finding 2 of its Draft Decision, which concludes that Meta IE
may rely on Article 6(1)(b) GDPR in the context of its offering of Instagram Terms of Use, and to include
an infringement of Article 6(1) GDPR, based on the shortcomings that the EDPB has identified in this
Binding Decision.

On the objections concerning whether the LSA’s Draft Decision includes sufficient analysis and evidence
to conclude that Meta IE is not obliged to rely on consent to process the Complainant’s personal data
452. The EDPB decides that the objections of the AT, DE, FI, FR, and NL SAs regarding the LSA’s Finding 1
that Meta IE is not legally obliged to rely on consent to process personal data to deliver the Instagram
Terms of Use meet the requirements of Article 4(24) GDPR.

453. On the part of the NL SA objection asking the IE SA to include in its Draft Decision the elements
concerning the need to rely on consent for the placing of tracking technology on end users devices
under ePrivacy legislation, the EDPB decides that this part falls outside the scope of the EDPB’s
mandate. The objection raised by the ES SA regarding the potential infringement of Article 9 GDPR is
not sufficiently reasoned and, therefore, the EDPB decides that the objection of the ES SA does not
meet the threshold provided for by Article 4(24) GDPR.

454. The EDPB instructs the IE SA to remove from its Draft Decision its conclusion on Finding 1. The EDPB
decides that the IE SA shall carry out a new investigation into Meta IE’s processing operations in its

113
Adopted

Instagram service to determine if it processes special categories of personal data (Article 9 GDPR), and
complies with the relevant obligations under the GDPR to the extent that the investigation
complements the findings made in the IE SA’s Final Decision adopted on the basis of this Binding
Decision; and, based on the results of this investigation, issue a new draft decision in accordance with
Article 60(3) GDPR.

On the objection concerning the potential additional infringement of the principle of fairness
455. The EDPB decides that the objection of the IT SA regarding the infringement by Meta IE of the principle
of fairness under Article 5(1)(a) GDPR, meets the requirements of Article 4(24) GDPR.

456. The EDPB instructs the IE SA to find in its final decision an additional infringement of the principle of
fairness under Article 5(1)(a) GDPR by Meta IE.

On the objection concerning the potential additional infringement of the principles of purpose
limitation and data minimisation
457. On the objection by the IT SA concerning the possible additional infringements of the principles of
purpose limitation and data minimisation under Article 5(1)(b) and (c) GDPR, the EDPB decides this
objection does not meet the requirements of Article 4(24) GDPR.

On the objections concerning corrective measures other than administrative fines
458. The EDPB decides that the objections of the AT and NL SAs requesting additional and/or alternative
specific corrective measures to be imposed meet the requirements of Article 4(24) GDPR.

459. The EDPB instructs the IE SA to include in its final decision an order for Meta IE to bring its processing
of personal data for the purposes of behavioural advertising in the context of the Instagram service
into compliance with Article 6(1) GDPR within three months.

460. The EDPB also instructs the LSA to adjust its order to Meta IE to bring Instagram Data Policy and Terms
of Use into compliance with Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR within three
months, to refer not only to information provided on data processed pursuant to Article 6(1)(b) GDPR,
but also to data processed for the purposes of behavioural advertising in the context of Instagram
service (to reflect the finding of the EDPB that for this processing the controller cannot rely on Article
6(1)(b) GDPR).

On the objections concerning the determination of the administrative fine for the transparency
infringements

461. The EDPB decides that the objections of the DE, FR, IT, NL, and NO SAs regarding the determination of
the administrative fine for the transparency infringements, meet the requirements of Article 4(24)
GDPR.

462. The EDPB considers that the Final Decision does not need to refer to the infringements by WhatsApp
Ireland Limited, as established in Decision IN-18-12-2, as an aggravating factor under Article 83(2)(e)
GDPR for the calculation of the fine.

463. The EDPB instructs the IE SA to modify its Draft Decision to elaborate on the manner in which the
turnover of the undertaking concerned has been taken into account for the calculation of the fine, as

114
Adopted

appropriate, to ensure the fine is effective, proportionate and dissuasive in accordance with Article
83(1) GDPR.

464. The EDPB considers that the proposed fine does not adequately reflect the seriousness and severity
of the infringements nor has a dissuasive effect on Meta IE. Therefore, the fine does not fulfil the
requirement of being effective, proportionate and dissuasive in accordance with Article 83(1) and (2)
GDPR. In light of this, the EDPB directs the IE SA to set out a significantly higher fine amount for the
transparency infringements identified, in comparison with the upper limit for the administrative fine
envisaged in the Draft Decision. In doing so, the IE SA must remain in line with the criteria of
effectiveness, proportionality, and dissuasiveness enshrined in Article 83(1) GDPR in its overall
reassessment of the amount of the administrative fine.

On the objections concerning the imposition of an administrative fine for the lack of legal basis
465. The EDPB decides that the objections of the AT, DE, FR, NO, and SE SAs regarding the imposition of an
administrative fine for the infringement of Article 6(1) or Article 6(1)(b) GDPR meet the requirements
of Article 4(24) GDPR.

466. In relation to intentionality under Article 83(2)(b) GDPR, the EDPB considers that the arguments put
forward by the SE SA in their objection do not contain sufficient objective elements to demonstrate
the intentionality of the behaviour of Meta IE.

467. Regarding the possible financial benefit obtained from the infringement as well as the competitive
advantage (Article 83(2)(k) GDPR), the EDPB instructs the IE SA to ascertain if an estimation of the
financial benefit from the infringement is possible in this case. Insofar as further estimation of the
financial benefit from the infringement is possible in this case and results in the need to increase the
amount of the fine proposed, the EDPB requests the IE SA to increase the amount of the fine proposed.

468. The EDPB instructs the IE SA to cover the additional infringement of Article 6(1) GDPR with an
administrative fine which is effective, proportionate and dissuasive in accordance with Article 83(1)
GDPR. In determining the fine amount, the IE SA must give due regard to all the applicable factors
listed in Article 83(2) GDPR, in particular the nature and gravity of the infringement, the number of
data subjects affected and the seriously negligent character of the infringement.

On the objection concerning the imposition of an administrative fine for the infringement of the
fairness principle under Article 5(1)(a) GDPR
469. The EDPB decides that the objection of the IT SA regarding the imposition of an administrative fine for
the infringement of Article 5(1)(a) GDPR meets the requirements of Article 4(24) GDPR.

470. The EDPB instructs the IE SA to factor the additional infringement of the principle of fairness enshrined
in Article 5(1)(a) GDPR into its adoption of appropriate corrective measures. In this respect, the IE SA
is instructed to take due account of this infringement when re-assessing the administrative fines for
the transparency infringements and the determination of the fine for the lack of legal basis. If,
however, the IE SA considers an additional fine for the breach of the principle of fairness is an
appropriate corrective measure, the EDPB requests the IE SA to include this in its final decision. In any
case, the IE SA must take into account the criteria provided for by Article 83(2) GDPR and ensuring it
is effective, proportionate and dissuasive in line with Article 83(1) GDPR.

115
Adopted

On the objection concerning the imposition of an administrative fine for the infringement of Article
5(1)(b) and (c) GDPR
471. The EDPB decides that it does not need to examine the objection of the IT SA regarding the imposition
of an administrative fine for the infringement of Article 5(1)(b) and Article 5(1)(c) GDPR.

11 FINAL REMARKS
472. This Binding Decision is addressed to the IE SA and the CSAs. The IE SA shall adopt its final decision on
the basis of this Binding Decision pursuant to Article 65(6) GDPR.

473. Regarding the objections deemed not to meet the requirements stipulated by Article 4(24) GDPR, the
EDPB does not take any position on the merit of any substantial issues raised therein. The EDPB
reiterates that its current decision is without any prejudice to any assessments the EDPB may be called
upon to make in other cases, including with the same parties, taking into account the contents of the
relevant draft decision and the objections raised by the CSAs.

474. According to Article 65(6) GDPR, the IE SA shall adopt its final decision on the basis of the Binding
Decision without undue delay and at the latest by one month after the Board has notified its Binding
Decision.

475. The IE SA shall inform the Board of the date when its final decision is notified to the controller or the
processor 829 . This Binding Decision will be made public pursuant to Article 65(5) GDPR without delay
after the IE SA has notified its final decision to the controller 830 .

476. The IE SA will communicate its final decision to the Board 831 . Pursuant to Article 70(1)(y) GDPR, the IE
SA’s final decision communicated to the EDPB will be included in the register of decisions which have
been subject to the consistency mechanism.

For the European Data Protection Board
The Chair

(Andrea Jelinek)

829
Art. 65(6) GDPR.
830
Art. 65(5) and (6) GDPR.
831 Art. 60(7) GDPR.

116
Adopted