It is now all over the national and international headlines the news of the sanction imposed by the Irish privacy authority, on Meta for carrying out the personalization of advertisements on Facebook and Instagram, in execution of a contract, without obtaining the specific consent of the customer.
The Irish authority called the Data Protection Commission (DPC), in fact, as a result of two investigations conducted on the parent company and the other companies, found that several GDPR regulations (primarily Article 6) had been violated, imposing two separate fines for irregularities found, respectively, on Facebook (€210 million) and Instagram (€180 million).
The focal point of the decision concerns the DPC’s radical stance on the non-usability of the legal basis of the contract as a basis for the personalization of advertisements and behaviour-based advertising (the European Data Protection Board – EDPB had already expressed this view).
The investigation started from two 2018 complaints (one from Austria and one from Belgium). In fact, before the GDPR came into force, Meta relied on users’ consent, but after the introduction of the regulation it had shifted the focus to the “contractual” basis: users also had to agree to profiling for advertising purposes in order to access the service, according to its own terms and conditions.
Given the particularity of the case…
