EDPB adopts Art. 65 dispute resolution binding decisions regarding Facebook, Instagram and WhatsApp

Dec 6, 2022

Source: European Data Protection Board

Brussels, 6 December – The EDPB adopted three dispute resolution decisions on the basis of Art. 65 GDPR concerning Meta Platforms Ireland Limited (Meta IE). The binding decisions address important legal issues arising from the draft decisions of the Irish SA as lead supervisory authority (LSA) regarding Meta IE platforms Facebook, Instagram and WhatsApp. The EDPB binding decisions play a key role in ensuring the correct and consistent application of the GDPR by the national Supervisory Authorities.

The Irish SA issued the draft decisions following complaint-based inquiries into the processing activities of the three platforms. The Facebook and Instagram draft decisions concern, in particular, the lawfulness and transparency of processing for behavioural advertising. The WhatsApp draft decision concerns notably the lawfulness of processing for the purpose of the improvement of services. Several SAs issued objections on the draft decisions prepared by the Irish SA concerning, among others, the legal basis for processing (Art. 6 GDPR), data protection principles (Art. 5 GDPR), and the use of corrective measures including fines.

As no consensus was reached on these objections, the EDPB was called upon to settle the dispute between the SAs within two months.

In its binding decisions, the EDPB settles, among others, the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising, in the cases of Facebook and Instagram, and for service improvement, in the case of WhatsApp.  

The LSA shall adopt its three final decisions, addressed to the controller, on the basis of the EDPB binding decisions, taking into account the EDPB’s legal assessment, at the latest one month after the EDPB has notified its decisions. The EDPB will publish its decisions on its website after the LSA has notified its national decisions to the controller.


Note to editors:
For further information on the Art. 65 procedure, please consult the FAQ

Recent news

Data Protection Day 2023

On the occasion of Data Protection Day, we invite you to take a look back at GDPR enforcement over the last few years and explore how the EDPB helps all EEA DPAs act as one to safeguard your rights, today and tomorrow. Join us to see how European data protection...

read more

EDPB publishes Binding Decision concerning WhatsApp

Following the EDPB’s binding dispute resolution decision of December 5th, WhatsApp IE was issued a 5.5 million euro fine by the Irish Data Protection Authority (DPA). In its Binding Decision, the EDPB instructed the IE DPA to amend its draft decision with respect to...

read more
Generated by Feedzy