EDPB adopts Art. 65 dispute resolution binding decisions regarding Facebook, Instagram and WhatsApp
On December 6th, 2022, the European Data Protection Board (EDPB) adopted three dispute resolution decisions on the basis of Art. 65 GDPR concerning Meta Platforms Ireland Limited (Meta IE) platforms Facebook, Instagram and WhatsApp.
Following the EDPB’s binding dispute resolution decisions, the Irish Data Protection Authority has adopted its first decisions the December 31st, 2022: Facebook was fined €210 million and Instagram €180 million. The final decision against WhatsApp, which was the subject of the third EDPB binding decision, still has to be adopted by the Irish Data Protection Authority.
The binding decisions address important legal issues arising from the draft decisions of the Irish SA as lead supervisory authority (LSA) regarding Meta IE platforms Facebook, Instagram and WhatsApp. The EDPB binding decisions play a key role in ensuring the correct and consistent application of the GDPR by the national Supervisory Authorities.
The Irish SA issued the draft decisions following complaint-based inquiries into the processing activities of the three platforms. The Facebook and Instagram draft decisions concern in particular the lawfulness and transparency of processing for behavioural advertising. The WhatsApp draft decision concerns notably lawfulness of processing for the purpose of the improvement of services. Several SAs issued objections on the draft decisions prepared by the Irish authority concerning, among others, the legal basis for processing (Art. 6 GDPR), data protection principles (Art. 5 GDPR), and the use of corrective measures including fines.
As the Irish SA considered that these objections were not relevant and/or reasoned, the EDPB was called upon to settle the dispute between the SAs within two months.
In its binding decisions, the EDPB settles, among others, the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising, in the cases of Facebook and Instagram, and for service improvement, in the case of WhatsApp.
The LSA shall adopt its three final decisions, addressed to the controller, on the basis of the EDPB binding decisions, taking into account the EDPB's legal assessment, at the latest one month after the EDPB has notified its decisions. The EDPB will publish its decisions on its website after the LSA has notified its national decisions to the controller.
- EDPB’s FAQ on the article 65 of the GDPR (PDF, 398 ko) - EDPB
- The European Data Protection Board (EDPB)
- [FR] Le CEPD adopte trois décisions importantes concernant Facebook, Instagram et WhatsApp
- Facebook and Instagram decisions: “Important impact on use of personal data for behavioural advertising” - EDPB
- Binding Decision 4/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its Instagram service (Art. 65 GDPR) - EDPB