Data Protection Commission hiked €59m fine for Facebook owner Meta to €390m

Meta has indicated it will appeal the ruling. Picture: Leah Farrell / RollingNews.ie

Ireland’s Data Protection Commission has hiked an initial €59m fine for social media giant Meta over how it processes personal data, to €390m.

The DPC had imposed the smaller fine after it found Meta had breached the landmark EU data law — the General Data Protection Regulation (GDPR) — in how it processed the data of its users for targeted advertising.

However, the European Data Protection Board (EDPB) rejected the DPC’s original decision and said Meta did not have a lawful basis to process users’ personal data for the purposes of behavioural advertising just because they had clicked “I accept” on new terms of service with Facebook and Instagram.

Complainants, who originally lodged their complaints in 2018, had argued Meta was effectively “forcing” users to consent to have their personal data processed for behavioural advertising and other personalised services, in breach of GDPR, as users had to accept an updated terms of service to still be able to use the platforms.

The company has been given a period of three months to bring its data processing operations into compliance with the law.

Meta has indicated it will appeal the ruling and a spokesperson said “these decisions do not prevent targeted or personalised advertising on our platform”.

“Given that regulators themselves disagreed with each other on this issue up until the final stage of these processes in December, it is hard to understand how we can be criticised for the approach we have taken to date, and therefore we also plan to challenge the size of the fines imposed,” it said.

Separately, the DPC has taken issue with an order from the European watchdog to conduct a fresh investigation that would span all of Facebook and Instagram’s data processing operations.

“The EDPB does not have a general supervision role akin to national courts in respect of national independent authorities and it is not open to the EDPB to instruct and direct an authority to engage in open-ended and speculative investigation,” it said.

The DPC added it would take a case in the Court of Justice of the EU seeking to annul this direction.