EDPB adopts letters to Access Now and BEUC on TikTok and an Art. 65 dispute resolution binding decision regarding Instagram

Jul 29, 2022

Source: European Data Protection Board

Brussels, 29 July – The EDPB adopted two letters in response to Access Now and BEUC concerning TikTok. In these letters, the EDPB highlights the swift action taken by the Irish, Italian and Spanish Supervisory Authorities (SAs) following TikTok’s announcement that it would no longer seek users’ consent to send personalised advertisements, but that the legal basis for this would be the legitimate interest of TikTok and its partners. As a result of these actions, TikTok announced that it would pause the change in the legal basis used for personalised ads.

EDPB Deputy Chair Ventsislav Karadjov said: “TikTok’s suspension of the envisaged change of legal basis is a testament to the SAs’ determination and their commitment to safeguarding the interests of TikTok users and data subjects in general. I am confident that SAs have the necessary tools to protect the rights of data subjects and that the cooperation within the EDPB ensures that this is done efficiently and consistently across the European Economic Area.”

In addition, the EDPB adopted a dispute resolution decision on the basis of Art. 65 GDPR. The binding decision seeks to address the lack of consensus on certain aspects of a draft decision issued by the Irish SA as lead supervisory authority (LSA) regarding Instagram (Meta Platforms Ireland Limited (Meta IE)) and the subsequent objections expressed by some of the concerned supervisory authorities (CSAs).

The LSA issued the draft decision following an own-volition inquiry into the processing activities of Meta IE. The LSA’s draft decision concerns Meta IE’s compliance with Art. 5(1)(a) and (c), 6(1), 12(1), 13, 24, 25 and 35 GDPR in respect of certain processing of children’s personal data in the context of Instagram. In particular, it concerns the public disclosure of email addresses and phone numbers of children using the Instagram business account feature and a public-by-default setting for personal accounts of children on Instagram during a period falling within the temporary scope of the LSA’s inquiry. On 3 December 2021, the LSA shared its draft decision with the CSAs in accordance with Art. 60(3) GDPR. Several CSAs issued objections pursuant to Art. 60(4) GDPR concerning, among others, the legal basis for processing and the determination of the fine.

The SAs were unable to reach consensus on some of the objections, which were then referred to the EDPB by the LSA for determination pursuant to Art. 65(1)(a) GDPR, thereby initiating the dispute resolution procedure.

The EDPB has now adopted its binding decision. The LSA shall adopt its final decision, addressed to the controller, on the basis of the EDPB decision, without undue delay and at the latest one month after the EDPB has notified its decision. The EDPB will publish its decision on its website without undue delay after the LSA has notified their national decision to the controller. 

Note to editors:

For further information on the Art. 65 procedure, please consult the FAQ


EDPB_Press Release_2022_10

Recent news

EDPB Launches Data Protection Guide for small business

The EDPB has launched a Data Protection Guide to help small business owners on their way to become more data protection compliant. The Guide aims to raise awareness about the GDPR and to provide practical information to SMEs about GDPR compliance in an accessible and...

read more

Europe Day 2023

Every year in early May we celebrate peace and unity in Europe through Europe Day, to commemorate the signing of the 'Schuman Declaration'. This year, on Saturday 6 May, the EU institutions invite you to a wide range of online and on-site activities across the EU...

read more
A look back at the Privacy Symposium 2023

A look back at the Privacy Symposium 2023

For the second time in a row, the EFDPO was one of the Key Partners of the Privacy Symposium in Venice – an international conference for data protection professionals and enthusiasts from around the world. Privacy Symposium aims to bring together data protection...

read more
Generated by Feedzy