Illegal use of personal data by Meta

By Thomas Vink, 24th August 2023

The General Data Protection Regulation (GDPR) is supposed to give users a free choice as to whether or not they agree to the collection of their personal data. However, when the GDPR came into effect in May 2018 many users have been presented with the opposite situation: various “consent boxes” popped up online or in applications, often combined with a threat that the service can no longer be used if users do not consent.

On 25 May 2018, the first day of application of the GDPR, noyb filed complaints against WhatsApp, Instagram and Facebook (now Meta) regarding this “forced consent” with different data protections authorities (“DPAs”)

4.5 years later, these complaints led to a decision by the European Data Protection Board (EDPB) in December 2022 and January 2023 and Meta was fined EUR 395 million by the Ireland Data Protection Commissioner (DPC) for illegal use of data on Instagram, WhatsApp, and Facebook.

Illegal use of personal data by Meta

Organisation Name

noyb – Europäisches Zentrum für digitale Rechte

Country/Jurisdiction

Austria, Belgium, Ireland, Court of Justice of the European Union

Amount Granted

EUR 53,975

Current Status

Ongoing

Grant type

Litigation Track Support

Description

The General Data Protection Regulation (GDPR) is supposed to give users a free choice as to whether or not they agree to the collection of their personal data. However, when the GDPR came into effect in May 2018 many users have been presented with the opposite situation: various “consent boxes” popped up online or in applications, often combined with a threat that the service can no longer be used if users do not consent.

On 25 May 2018, the first day of application of the GDPR, noyb filed complaints against WhatsApp, Instagram and Facebook (now Meta) regarding this “forced consent” with different data protections authorities (“DPAs”)

4.5 years later, these complaints led to a decision by the European Data Protection Board (EDPB) in December 2022 and January 2023 and Meta was fined EUR 395 million by the Ireland Data Protection Commissioner (DPC) for illegal use of data on Instagram, WhatsApp, and Facebook.

Following these decisions, there are a range of follow up appeals, including an appeal by Meta against the DPC decision, an appeal by the DPC against parts of the EDPB decision, and a number of outstanding issues brought up in the original complaints by noyb that were not dealt with by the data protection authorities in Belgium, Germany and Austria, who now consider the complaints closed.

noyb has filed a judicial review in Ireland relating to Meta’s appeal of the DPC decision and appeals against the data protection authorities in Belgium and Austria. Additionally, noyb will file an appeal to the Court of Justice of the European Union against the EDPB for refusing to give noyb access to the case file. For strategic reasons, noyb decided not to appeal against the German data protection authority. The DFF grant support noyb’s litigation in Ireland, Belgium and the Court of Justice of the European Union.

Among other things noyb wants to obtain:

  • the certainty that the remainder of the case will be handled by at least one of these courts;
  • clarification in several points regarding the procedure following a complaint in so-called “cross-border” cases;
  • a clear decision on the right to be heard as a complainant, access to documents and access to evidence across borders;
  • a decision from the Court of Justice of the European Union giving guidelines to the data protection authorities to coordinate their action to reach a final decision on all aspects of the complaint;
  • a final decision to be enforced against Meta.
"there are a range of follow up appeals, including an appeal by Meta against the DPC decision, an appeal by the DPC against parts of the EDPB decision, and a number of outstanding issues brought up in the original complaints by noyb that were not dealt with by the data protection authorities in Belgium, Germany and Austria, who now consider the complaints closed"

Strategic Goal

Confirmation that illegal targeted advertising and profiling by Meta based on an inappropriate use of data is in violation of data protection law, and this large-scale collection and abuse of data by Big Tech platforms ends.

Organisation Name

Women’s Link Worldwide