EDPB adopts Art. 65 dispute resolution binding decisions regarding Facebook, Instagram and WhatsApp

13 January 2023

On December 6^th, 2022, the European Data Protection Board (EDPB) adopted three dispute resolution decisions on the basis of Art. 65 GDPR concerning Meta Platforms Ireland Limited (Meta IE) platforms Facebook, Instagram and WhatsApp.

Following the EDPB’s binding dispute resolution decisions, the Irish Data Protection Authority has adopted its first decisions the December 31^st, 2022: Facebook was fined €210 million and Instagram €180 million. The final decision against WhatsApp, which was the subject of the third EDPB binding decision, still has to be adopted by the Irish Data Protection Authority.

The EDPB published its binding dispute resolution decisions regarding Facebook and Instagram on January 12, 2023.

The binding decisions address important legal issues arising from the draft decisions of the Irish SA as lead supervisory authority (LSA) regarding Meta IE platforms Facebook, Instagram and WhatsApp. The EDPB binding decisions play a key role in ensuring the correct and consistent application of the GDPR by the national Supervisory Authorities.

The Irish SA issued the draft decisions following complaint-based inquiries into the processing activities of the three platforms. The Facebook and Instagram draft decisions concern in particular the lawfulness and transparency of processing for behavioural advertising. The WhatsApp draft decision concerns notably lawfulness of processing for the purpose of the improvement of services. Several SAs issued objections on the draft decisions prepared by the Irish authority concerning, among others, the legal basis for processing (Art. 6 GDPR), data protection principles (Art. 5 GDPR), and the use of corrective measures including fines.

As the Irish SA considered that these objections were not relevant and/or reasoned, the EDPB was called upon to settle the dispute between the SAs within two months.

In its binding decisions, the EDPB settles, among others, the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising, in the cases of Facebook and Instagram, and for service improvement, in the case of WhatsApp.

The LSA shall adopt its three final decisions, addressed to the controller, on the basis of the EDPB binding decisions, taking into account the EDPB's legal assessment, at the latest one month after the EDPB has notified its decisions. The EDPB will publish its decisions on its website after the LSA has notified its national decisions to the controller.