EDPB Publishes Urgent Binding Decision Banning Meta’s Behavioral Advertising Within the EEA

On December 7, 2023, the European Data Protection Board (EDPB) announced that it had published an urgent binding decision (Urgent Binding Decision 1/2023), imposing a ban on Meta regarding the processing of personal data for the purposes of behavioral advertising. 

After the EDPB's immediate binding decision, which was adopted on October 27th, 2023, the Irish data protection authority issued its conclusive ruling on November 10, 2023. The decision imposes a ban on Meta Ireland Limited for processing personal data for behavioral advertising purposes, citing the legal bases of contract and legitimate interest. The EDPB's binding decision was prompted by a request from the Norwegian Data Protection Authority to enforce final measures applicable throughout the entire European Economic Area (EEA).

Anu Talus, Chair of the EDPB, said:

After careful consideration, the EDPB deemed it necessary to instruct the IE DPA to impose an EEA-wide processing ban on Meta IE. The EDPB Binding Decisions in December 2022 clarified that a contract is an unsuitable legal basis for Meta's behavioral advertising data processing. Additionally, Meta was found by the IE DPA to be non-compliant with the orders issued last year. This triggered the use of the Art. 66 urgency procedure—a departure from the standard cooperation procedure allowable only in exceptional circumstances.

On July 14, 2023, the Norwegian DPA issued an order, under Art. 66 (1) of the GDPR, imposing a temporary ban on Meta IE and Facebook Norway AS ("Facebook Norway") for processing the personal data of Norwegian data subjects for behavioral advertising under the legal bases of contract or legitimate interest. This ban was time-limited and geographically confined to Norway for three months. On September 26, 2023, the Norwegian DPA requested an urgent binding decision from the EDPB to institute final measures applicable to users in all EEA states.

Upon analyzing the case, the EDPB concluded that ongoing GDPR infringements posed urgent risks to the rights and freedoms of data subjects. The evidence presented indicated an ongoing infringement of Art. 6 (1) of the GDPR due to the improper use of the legal bases of contract and legitimate interest by Meta IE for behavioral advertising data processing. Additionally, the EDPB found an ongoing infringement of Meta's obligation to comply with decisions by DPAs, especially the Irish DPA's final decisions from December 2022.

Considering the urgency, the EDPB determined that regular cooperation mechanisms couldn't be applied as usual, and the need for final measures was evident to prevent serious and irreparable harm to data subjects.

Furthermore, the EDPB noted that the Irish DPA failed to respond to a mutual assistance request from the Norwegian DPA within the GDPR's specified timeframe, triggering the presumption of urgency under Art. 61 (8) of the GDPR.

Consequently, the EDPB instructed the Irish DPA to impose a ban on processing addressed to Meta IE for the collection of personal data on Meta's products for behavioral advertising purposes, based on contract and legitimate interest. The Irish DPA adopted its final decision on November 10, 2023. 

According to Art. 66 of the GDPR, in exceptional circumstances, a DPA has the authority to adopt provisional measures with legal effect within its territory for a maximum of three months if it deems urgent action necessary to protect the rights and freedoms of data subjects. Despite the fact that these measures deviate from the GDPR's consistency mechanism, in Art. 63 of the GDPR, or the One-Stop-Shop mechanism in Art.60 of the GDPR, this tool ensures that authorities can always safeguard individuals' rights and freedoms in their respective Member State, regardless of the situation.

The DPA issuing such provisional measures must promptly communicate them, along with the reasons for adoption, to the other concerned DPAs, the European Data Protection Board, and the European Commission. If the DPA believes urgent final measures are necessary, it can request an urgent opinion or an urgent binding decision from the EDPB, citing the reasons for the urgent need to deviate from standard cooperation and consistency procedures.

To better understand the timeline for this decision, here is the EDPB’s infographic on the matter: