Record fine for Instagram following EDPB's intervention
Following the European Data Protection Board (EDPB) binding dispute resolution decision of 28 July 2022, the Irish Data Protection Authority (DPC) has adopted its decision on Instagram (Meta Platforms Ireland Limited - Meta IE) and issued a record fine under the GDPR.
The final decision of the DPC follows a self-initiated inquiry on Instagram's publication of the email addresses and/or phone numbers of children with professional Instagram accounts on their profiles and the public default setting of children's personal Instagram accounts.
Contrary to the analysis made by the Irish authority in its draft decision, the EDPS concluded that Meta IE processed the children's personal data unlawfully, i.e. without a legal basis, and instructed the Irish authority to amend its draft decision in order to establish a breach of Article 6(1) of the GDPR.
This is the first binding decision of the EDPB on one of the fundamental pillars of EU data protection law: the lawfulness of processing under Article 6 of the GDPR.
The EDPS binding decision was adopted on the basis of Article 65 of the GDPR, after the DPC, as lead supervisor, had triggered the dispute resolution procedure regarding the objections raised by several supervisory authorities concerned.