DATA PROTECTION
EDPB publishes binding decisions regarding Facebook and Instagram.
The European Data Protection Board ('EDPB') announced, on 12 January 2023, the publication of its binding decisions, adopted on the basis of Article 65(1)(a) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') on the disputes submitted by the Data Protection Commission ('DPC') on Meta Platforms Ireland Limited and its Instagram and Facebook services, respectively.
In particular, the EDPB explained that the binding decisions in question, which were adopted by the EDPB in December 2022, are the result of complaint-based inquiries into Facebook and Instagram's activities, specifically concerning the lawfulness and transparency of processing for behavioural advertising, and that the legal assessments expressed therein are incorporated in the DPC's decisions of 31 December 2022.
In regards to the disputes, the EDPB highlighted, among other things, that the DPC had not assessed Meta's processing of sensitive data and therefore, the EDPB did not have sufficient factual evidence to enable it to make findings on any possible infringement of Meta's obligations under Article 9 of the GDPR. As such, the EDPB instructed the DPC to carry out a new investigation.
Separately, the EDPB did not publish its third binding decision adopted in December 2022, on the dispute arising on an inquiry relating to WhatsApp Ireland Limited, noting that the final decision of the DPC still has to be adopted.
In particular, the EDPB explained that the binding decisions in question, which were adopted by the EDPB in December 2022, are the result of complaint-based inquiries into Facebook and Instagram's activities, specifically concerning the lawfulness and transparency of processing for behavioural advertising, and that the legal assessments expressed therein are incorporated in the DPC's decisions of 31 December 2022.
In regards to the disputes, the EDPB highlighted, among other things, that the DPC had not assessed Meta's processing of sensitive data and therefore, the EDPB did not have sufficient factual evidence to enable it to make findings on any possible infringement of Meta's obligations under Article 9 of the GDPR. As such, the EDPB instructed the DPC to carry out a new investigation.
Separately, the EDPB did not publish its third binding decision adopted in December 2022, on the dispute arising on an inquiry relating to WhatsApp Ireland Limited, noting that the final decision of the DPC still has to be adopted.
