Further Problems For Meta In Europe

The Norwegian Data Protection Authority ('NDPA') has taken action to ban Meta from processing personal data for the purposes of behavioural advertising, after the latter purported to change the legal basis for that processing.

After complaints in Ireland from the privacy organisation noyb ('none of your business'), the Irish data protection authority ('DPC') found that Meta could not rely on the contractual basis (Art. 6(1)(b) GDPR) for the processing of personal data for behavioural advertising, and ordered Meta to make its processing compliant with the GDPR.

Meta then purported to rely on legitimate interest (Art. 6(1)(f) GDPR) as the legal basis for its processing. However, in Germany, the Court of Justice found that attempting to rely on Art. 6(1)(f) was also not compliant with the requirements of the GDPR.