European Union: Issued EDPB Binding Decision 4/2022 on Meta Ireland’s Instagram behavioural advertising processing compliance with GDPR

On 5 December 2022, the European Data Protection Board issued the Binding Decision 4/2022 on the dispute submitted by the Irish Data Protection Commission (DPC) involving the lawfulness and transparency of personal data processing for behavioural advertising purposes of Meta Platforms Ireland Limited's Instagram service. The EDPB addressed the legal basis Instagram uses for processing personal data for personalised advertising. In the decision, the EDPB stated that personal data processing for personalized advertising is not essential for the performance of the contract between Meta and its users. Consequently, the EDPB instructed the DPC to include the violation of Article 6 of the General Data Protection Regulation (GDPR) in its binding decision. Finally, the EDPB instructed the DPC to order Meta Ireland to change Instagram's Data Policy and Terms of Use to comply with GDPR and assess Instagram's processing of sensitive personal data for advertising purposes compliance with GDPR.