European Union: Issued EDPB Binding Decision 3/2022 on Meta Ireland’s Facebook behavioural advertising processing

On 5 December 2022, the European Data Protection Board issued a decision (Binding Decision 3/2022) on the dispute involving the lawfulness and transparency of data processing for behavioural advertising on Meta Platforms Ireland Limited's Facebook service. The EDPB addressed the legal basis used by Facebook for processing data for personalised advertising. In the decision, the EDPB stated that personalised advertising is not essential for the performance of its services and that Facebook cannot rely on a "contract" with its users to process personal data for advertising purposes. Consequently, the EDPB instructed the DPC to include the violation of Article 6 of the General Data Protection Regulation (GDPR) in its binding decision. Finally, the EDPB instructed the DPC to order Meta Ireland to make Facebook's Data Policy and Terms of Use in compliance with GDPR and investigate Facebook's processing of sensitive personal data for advertising purposes data compliance with GDPR.