After two fines already steep in the fall (405 million euros in September, then 265 million in November), the American giant Meta was again heavily sanctioned on Wednesday January 4. Accused of raping “its obligations in terms of transparency”, he was fined 210 million euros for Facebook and 180 million for Instagram. A third ruling on another powerful Meta subsidiary, WhatsApp, is expected in mid-January.
These penalties were issued by the Irish Data Protection Commission (DPC). This Irish equivalent of the French Cnil (National Commission for Computing and Liberties) is Meta’s regulator on behalf of the European Union, since the company’s regional headquarters are in Dublin.
GDPR circumvented
In a statement, the DPC said the US company was relying on an incorrect legal basis “for its processing of personal data for advertising purposes” targeted. In other words, Meta is accused of illegally forcing users of its social networks to accept targeted advertising. The group thus circumvents the obligation of consent provided for since 2018, in all countries of the European Union, by the General Regulation on Data Protection (GDPR).
“Instead of having a ‘yes/no’ option for personalized ads, they just moved the consent clause into the terms and conditions” of the contract, explains in a press release the Austrian lawyer Max Schrems, founder of Noyb, the association for the defense of privacy at the origin of the three complaints against Meta. “This is not only unfair but clearly illegal. We don’t know of another company that has tried to ignore GDPR in such an arrogant way. »
Soon a consent option?
The company now has three months to “bring its data processing operations into compliance”, indicates the DPC. For Noyb, this means that Meta must have implemented, within this period, a version of Facebook and Instagram that does not use the personal data of Internet users for advertisements.. “Users should be able to withdraw consent at any time, and Meta cannot limit service if users choose to do so,” says the association in its press release.
The American giant, which calls itself ” disappointed ” and intends to appeal, according to AFP, believes for its part that the DPC does not require it to set up a consent option. He says he is evaluating a variety of solutions to change the legal basis for data processing.
Asked by AFP, analyst Dan Ives, of the American investment company Wedbush Securities, believes that these new sanctions could inflict on Meta “a big blow in the stomach with 5 to 7% of its advertising revenue threatened”.
A European dispute
While the decision taken on Wednesday by the Irish Cnil is unquestionably severe with regard to Meta, this has not always been the case, and this regulator is even accused by Noyb of having “take the side” of the American group for several years. In October 2021, the DPC had thus issued a draft decision which validated the legal basis used by Facebook and proposed a fine of 26 to 36 million euros, much lower than that which was decided on Wednesday.
This amount had been deemed largely insufficient by other equivalent European authorities, including the CNIL. They had asked the European Data Protection Board (EDPB) to judge the dispute, and the latter had ruled in their favor on the question of the legal basis. The case had thus revealed deep fractures between the various European data protection authorities.