EDPB - Urgent Binding Decision 01/2023: Difference between revisions

Latest revision as of 16:39, 12 December 2023

EDPB - Urgent Binding Decision 01/2023

Authority:	EDPB
Jurisdiction:	European Union
Relevant Law:	Article 6(1)(f) GDPR Article 6(1)(b) GDPR Article 58(2)(f) GDPR Article 60 GDPR Article 61 GDPR Article 66 GDPR Article 66(2) GDPR Article 41 CFREU
Type:	Other
Outcome:	n/a
Started:	26.09.2023
Decided:	27.10.2023
Published:	07.12.2023
Fine:	n/a
Parties:	Meta Platfroms Ireland Ltd
National Case Number/Name:	Urgent Binding Decision 01/2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	English
Original Source:	EDPB (in EN)
Initial Contributor:	co

The EDPB issued an urgent binding decision pursuant to Article 66(2) GDPR ordering a ban on Meta Platforms Ireland’s processing of personal data collected on Meta’s products for behavioural advertising purposes on the basis of Article 6(1)(b) GDPR and Article 6(1)(f) GDPR .

English Summary

Facts

On 31 December 2022, the Irish DPC as Lead Supervisory Authority in a cross-border case, issued two final decisions concerning, respectively Meta’s Facebook and Instagram services as controllers. These were adopted on the basis of two binding decisions by the EDPB, Binding Decisions 3/2022 and 4/2022 adopted by the EDPB on 5 December 2022 pursuant to Article 65(1)(a) GDPR.

On 5 April 2023, the DPC communicated to the concerned supervisory authorities (CSAs) via the IMI system Meta’s compliance reports showing their efforts to comply with the decisions by the DPC. In these reports, Meta stated that it changed its legal basis for behavioural advertising from Article 6(1)(b) GDPR to Article 6(1)(f) GDPR, backed by a legitimate Interest assessments. These documents were submitted to the CSAs so that they could assess whether the measures adopted by Meta could be considered effective in guaranteeing compliance with the orders in the DPC decision.

The Norwegian DPA (Datatilsynet) communicated to the DPC that it had doubts regarding the legitimacy of Meta’s choice of Article 6(1)(f) GDPR as a legal basis. Thereafter, the DPC shared two other letters from Meta to the CSAs substantiating its compliance efforts and the CSAs submitted their opinion to the DPC which were then sent back to Meta for feedback. On 5 May 2023, the Norwegian DPA transmitted a mutual assistance request to the DPC under Article 61(1) GDPR, asking the DPC to order a temporary ban on Meta’s processing for purposes of behavioural advertising based on Article 6(1)(f) GDPR and requesting the DPC to specify how it will ensure that Meta complies with Article 6(1) GDPR. On 30 May 2023, the Dutch DPA also asked the Irish DPC to provide its conclusions on the compliance efforts undertaken by Meta in a mutual assistance request under Article 61 GDPR. The DPC stated that it would be able to respond to the mutual assistance requests and draw its conclusion on the compliance reports only at the end of June 2023. The DPC also replied to the Norwegian DPA request for mutual assistance stating that it could not comply with it. The Norwegian DPA asked the DPC to at least inform it as to whether it would potentially follow the Norwegian DPA’s mutual assistance request, but indicated that it would still wait for the DPC's position at the end of June.

On 13 June 2023, however, the DPC stated that it would share its provisional assessment only after the delivery of CJEU judgment in case C-252/21 Meta Platforms and Others v Bundeskartellamt in July. Following the publication of judgment, the Irish DPC issued a provisional position paper with its preliminary conclusion on 11 July 2023, stating that Meta failed to comply with the orders of its decisions. The DPC’s provisional position paper was then submitted to the CSAs for feedback.

Preoccupied by the inactivity of the DPC, the Norwegian DPA imposed a temporary ban on Meta and Facebook Norway on the processing of personal data of Norwegian data subjects for purposes of behavioural advertising based on Article 6(1)(b) GDPR and Article 6(1)(f) GDPR on 14 July 2023. After a further set of exchanges between Meta and the Norwegian DPA, and Meta’s statement that it would shift to Article 6(1)(a) GDPR as a legal basis, the Norwegian DPA imposed a coercive fine on Meta and Facebook Norway for non-compliance with its order.

On 18 August 2023, the DPC communicated to the CSAs its final position on Meta’s compliance with its decisions and concluded that Meta failed to demonstrate compliance but that it was reasonable to give Meta a chance to rely on consent as a legal basis.

On 21 September 2023, the Norwegian DPA submitted to the DPC its view on the state of the proceedings and argued that it still considered the adoption of urgent measures necessary, asking the DPC to reconsider its position.

Given the negative response of the DPC, on 26 September 2023, the Norwegian DPA made a request to the EDPB to issue an urgent binding decision under Article 66(2) GDPR, asking that final measures be adopted.

Holding

First of all, the EDPB Secretariat assessed the request and asked the Norwegian DPA to submit further documentation paying particular attention to scrutinize the right to good administration under Article 41 CFREU. On 17 October, the EDPB assessed the completeness of the file and established its competence to deal with the request to issue an urgent binding decision.

1. Competence of the EDPB

For the EDPB to be competent to issue an urgent binding decision, two conditions must be given, namely: that a DPA has taken provisional measures under Article 66(1) GDPR and the same DPA made a request to issue a binding decision under Article 66(2) GDPR. In this case, the Norwegian DPA followed these two steps, hence the EDPB considered itself competent to deal with the request.

2. The right to good administration

In the second place, the EDPB made sure to act in accordance with the right to good administration under Article 41 of the Chartere of Fundamental Rights of the European Union (CFREU) and Article 11(1) of the EDPB Rules of Procedure. It also considered Meta’s position and ascertained that all the documents it received were also known to Meta, so that the procedure would respect Meta’s right to be heard. The EDPB concluded that Meta did not have an opportunity to make its views known on the procedure and asked Meta to provide written submissions.

3. On the need to request final measures

Further, the EDPB considered whether the adoption of urgent final measures was necessary, which is the case when one or several infringements exist and when an urgency situation justifies derogation from the ordinary procedure.

3.1.Infringments of the GDPR

First, as regards the existence of GDPR infringement(s) by Meta, the EDPB considered both the position of the Norwegian DPA and of the DPC in relation to the reliance of Meta on Article 6(1)(b) GDPR for behavioural advertising. The EDPB concluded that Meta was still processing location data and advertisement interaction data for purposes of behavioural advertising relying on Article 6(1)(b) GDPR, although it was previously declared unlawful by the DPC. Hence the EDPB held that Meta was still acting in violation of Article 6(1) GDPR.

Secondly, the EDPB assessed whether Meta was still processing personal data for purposes of behavioural advertising on the basis of Article 6(1)(f) GDPR. The EDPB considered that in line with the DPC’s decision, Meta was supposed to bring its processing into compliance with Article 6(1) GDPR, specifying that it may include but is “not limited to the identification of an appropriate alternative legal basis”.

The EDPB assessed the existence of the three cumulative conditions needed to satisfy the requirements of Article 6(1)(f) GDPR and concluded that Meta unlawfully relied on Article 6(1)(f) GDPR as a legal basis, since “the interests and fundamental rights of data subjects override the legitimate interests put forward by Meta IE for the processing of personal data collected on Meta’s products for the purposes of behavioural advertising”

In light of these findings, the EDPB concluded that there was an ongoing infringement of Article 6(1) GDPR by Meta.

Thirdly, the EDPB considered Meta’s infringement of the duty to comply with decisions by supervisory authorities, against Article 60(10) GDPR, which constitutes an independent violation of the GDPR. On he basis of the positions of the Irish and Norwgian DPAs, the EDPB held that “Meta IE did not achieve compliance with the IE SA Decisions within the deadline for compliance and is therefore currently in breach of its duty to comply with decisions by supervisory authorities.”

3.2. Urgency

The EDPB reiterated in its decision that the issuing of an urgent binding decision is an exceptional circumstance and it can only be granted if the regular consistency mechanism cannot be applied due to such urgency, as per Article 66(2) GDPR.

First, the EDPB assessed the existence of urgency on the basis of the position of the Norwegian DPA, the elements in the file and the circumstances of the infringement, that is the nature, gravity, duration and number of data subjects affected by the infringement. In this regard, the EDPB held, as it also previously stated in its binding decisions that the nature and gravity of the infringements were significant. Also the duration of the infringement was considered. In particular, “the fact that the processing activities are still performed without reliance on an appropriate legal basis represents an element in favour of concluding that there is an urgent need for final measures to be adopted”.

Hence the EDPB concluded that “failing to put an end to the processing activities at stake and to enforce the IE SA Decisions exposes data subjects to a risk of serious and irreparable harm”.

Secondly, the EDPB addressed the necessity to derogate from the standard cooperation and consistency mechanism, and it concluded that the fact that the DPC did not adopt any final measures to put an end to Meta’s GDPR infringements despite the risk of serious and irreparable harm for data subjects “shows that the regular cooperation and consistency mechanism is not providing satisfactory results”.

Thirdly, the EDPB examined whether the legal presumption of urgency provided in Article 61(8) GDPR was given in the case in question. Under Article 61(8) GDPR, if a DPA does not provide the information requested in a mutual assistance request within one month, urgency will be presumed. In this case, the Norwegian DPA had made such a request but received an unmotivated negative answer from the Irish DPC. The EDPB reiterated the importance of the cooperation mechanism and the fact that mutual assistance is at the core of such cooperation. Further, the authorities receiving a mutual assistance request have a series of procedural and substantive obligations under Article 61 GDPR to respond to such request. The EDPB also stressed that the mutual assistance request is a one-to-one procedure between the requesting and requested authorities. From a procedural point of view, the EDPB considered that the Irish DPC fulfilled its duty to respond to the request within the established time limit. As regards the substance of the reply by the DPC, however, the EDPB held that even though the DPC later explained that its answer that it could not comply with the request was a mistake, the DPC “does not state it tried to amend its answer – for instance to provide the reasons for any refusal to comply with the request - or sought assistance to do so within the one-month deadline.”

Under Article 61(4) GDPR, the DPC might have refused to comply with the request but it also needed to give reasons explaining that compliance would infringe the GDPR or Member state law. Hence, the EDPB concluded that the DPC failed to provide a substantive reasoned response to the Norwegian DPA’s mutual assistance request within one month, thus the urgency could be presumed in accordance with Article 61(8) GDPR.

4. On the appropriate final measures

In its last point, the EDPB considered all the elements brought forward by the DPAs and the nature, gravity and duration of the infringements by Meta in order to assess the appropriateness of a ban on processing as a final measure. In particular, the seriousness of the infringement and the fact that the deadline for compliance had expired three months before, “provide arguments in favour of considering that the imposition of a ban would be appropriate, necessary and proportionate today”.

As a consequence, the EDPB ordered a ban on processing of personal data collected on Meta’s products for behavioural advertising purposes on the basis of Article 6(1)(b) GDPR and Article 6(1)(f) GDPR, pursuant to Article 58(2)(f) GDPR, to be effective one week after notification to Meta. The EDPB added that the geographical scope of the measures should extend to the entire EEA.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

Urgent Binding Decision 01/2023 requested by the

Norwegian SA for the ordering of final measures regarding
Meta Platforms Ireland Ltd (Art. 66(2) GDPR)

Adopted on 27 October 2023

Adopted 1Table of contents

1 Summary of facts............................................................................................................................. 4

1.1 Summary of the relevant events............................................................................................. 4

1.2 Submission of the request to the EDPB and related events ................................................. 14

2 Competence of the EDPB to adopt an urgent binding decision under Article 66(2) GDPR.......... 15
2.1 The SA has taken provisional measures under Article 66(1) GDPR....................................... 15

2.2 Existence of a request pursuant to Article 66(2) GDPR coming from a SA in the EEA.......... 16

2.3 Conclusion............................................................................................................................. 16

3 The right to good administration.................................................................................................. 16
4 On the need to request final measures......................................................................................... 17

4.1 On the existence of infringements........................................................................................ 17

4.1.1 On the infringement of Article 6(1) GDPR..................................................................... 18

4.1.2 On the infringement of the duty to comply with decisions by supervisory authorities42

4.2 On the existence of urgency to adopt final measures by way of derogation from the
cooperation and consistency mechanisms ....................................................................................... 45

4.2.1 On the existence of urgency and the need to derogate from the cooperation and
consistency mechanisms............................................................................................................... 46

4.2.2 On the application of a legal presumption of urgency justifying the need to derogate
from the cooperation and consistency mechanisms.................................................................... 56

4.2.3 Conclusion as to the existence of urgency.................................................................... 65

5 On the appropriate final measures............................................................................................... 65
5.1 Content of the final measures............................................................................................... 65

5.1.1 Summary of the position of the NO SA ......................................................................... 65

5.1.2 Summary of the position of Meta IE and Facebook Norway ........................................ 66

5.1.3 Analysis of the EDPB...................................................................................................... 69
5.1.4 Conclusion..................................................................................................................... 76

5.2 Adoption of the final measures and notification to the controller....................................... 76

6 Urgent Binding Decision................................................................................................................ 77

7 Final remarks................................................................................................................................. 78

Adopted 2The European Data Protection Board

Having regard to Article 66 of Regulation 2016/679/EU of the European Parliament and of the Council

of 27 April 2016 on the protection of natural persons with regard to the processing of personal data
and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation) (hereinafter ‘GDPR’) ,

HavingregardtotheEEAAgreementandinparticulartoAnnexXIandProtocol37thereof,asamended
by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 , 2

Having regard to Articles 11, 13, 23 and 39 of the EDPB Rules of Procedure 3, hereinafter the ‘EDPB
RoP’.

Whereas:

(1) The main role of the European Data Protection Board (hereinafter the ‘EDPB’ or the ‘Board’) is to
ensurethe consistentapplicationoftheGDPRthroughoutthe EEA.Tothiseffect,itcanadopt opinions

and binding decisions under different circumstances described under Articles 63 to 66 GDPR, within
the consistency mechanism. The GDPR also established a cooperation mechanism, as it follows from
Article 60 GDPR that the lead supervisory authority (hereinafter ‘LSA’) shall cooperate with the other

supervisory authorities concerned (hereinafter ‘CSAs’) in an endeavour to reach consensus.

(2) Pursuant to Article 66(1) GDPR, in exceptional circumstances, where a supervisory authority (‘SA’)
considers that there is an urgent need to act in order to protect the rights and freedoms of data

subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64
and65GDPRortheprocedurereferredtoinArticle 60GDPR,immediatelyadoptprovisionalmeasures
intended to produce legal effects on its own territory with a specified period of validity which shall not

exceed three months.

(3)InaccordancewithArticle66(2)GDPR,whereasupervisoryauthorityhastakenameasurepursuant
to Article 66(1) GDPR and considers that final measures need urgently be adopted, it may request an

urgent opinion or an urgent binding decision from the Board, giving reasons for requesting such
opinion or decision.

(4) In accordance with Article 13(2) EDPB RoP, the supervisory authority requesting an urgent binding

decision shall submit any relevant document. When necessary, the documents submitted by the
competent supervisory authority shall be translated into English by the EDPB Secretariat. Once the
Chair and the competent supervisory authority have decided that the file is complete, it is

communicated via the EDPB Secretariat to the members of the Board without undue delay.

(5)Pursuant to Article 66(4)GDPR and Article 13(1) EDPB RoP, the urgent binding decision of the EDPB
shall be adopted by simple majority of the members of the EDPB within two weeks following the

decision by the Chair and the competent supervisory authority that the file is complete.

1
2OJ L 119, 4.5.2016, p. 1.
References to ‘Member States’ made throughout this decision should be understood as references to ‘EEA
Member States’. References to ‘EU’ should be understood, where relevant, as references to ‘EEA’.
3EDPB Rules of Procedure, adopted on 25 May 2018, as last modified and adopted on 6 April 2022.

Adopted 3 1 SUMMARY OF FACTS

1. This document contains an urgent binding decision adopted by the EDPB pursuant to Article 66(2)
GDPR, following a request made by the Norwegian supervisory authority - ‘Datatilsynet’ (hereinafter,
the ‘NO SA’) within the framework of the urgency procedure under Article 66 GDPR.

1.1 Summary of the relevant events

2. On 31 December 2022, the Irish supervisory authority (‘Data Protection Commission’, hereinafter the

‘IE SA’) issued a final decision concerning the inquiry IN-18-5-5 (hereinafter, the ‘IE SA FB Decision’,
related to the Facebook Service)and a final decision concerning the inquiry IN-18-5-7 (hereinafter, the

‘IE SA IG Decision’, related to the Instagram Service) in which it found that Meta Platforms Ireland Ltd
(hereinafter, ‘Meta IE’) did not rely on a valid legal basis for processing personal data for behavioural
4
advertising purposes . These two decisions (hereinafter, collectively, the ‘IE SA Decisions’) were
adopted on the basis of EDPB Binding Decisions 3/2022 and 4/2022, adopted by the EDPB pursuant to
5
Article 65(1) (a) GDPR on 5 December 2022 (hereinafter, the ‘EDPB Binding Decisions’) .

3. Each of the IE SA Decisions concluded that Meta IE was not entitled to rely on Article 6(1)(b) GDPR to
carry out processing of personal data for the purpose of behavioural advertising in the context of the

Facebook Terms of Service / Instagram Terms of Use and included an order, addressed to Meta IE, to
bring its processing of personal data for behavioural advertising purposes into compliance with Article
7
6(1) GDPR within three months .

4. On 5 April 2023, the IE SA shared with the CSAs , using the Internal Market Information system
9
(hereinafter, ‘IMI’) , Meta IE’s compliance reports regarding the Facebook Service (IN-18-5-5) and the
Instagram Service (IN-18-5-7) (hereinafter collectively, the ‘Meta IE Compliance Reports’ or the
10
‘Compliance Reports’) and supporting material that Meta IE submitted to the IE SA on 3 April 2023

4 Decision of the Irish Data Protection Commission of 31 December 2022, DPC Inquiry Reference: IN-18-5-5,
concerning a complaint directed against Meta Platforms Ireland Limited (formerly Facebook Ireland Limited) in

respect of the Facebook Service (the ‘IE SA FB Decision’); Decision of the Irish Data Protection Commission of 31
December 2022, DPC Inquiry Reference: IN-18-5-7, concerning a complaint directed against Meta Platforms
Ireland Limited (formerly Facebook Ireland Limited) in respect of the Instagram Service (the ‘IE SA IG Decision’).
5 EDPB Binding Decision 3/2022, adopted on 05 December 2022 (hereinafter ‘EDPB Binding Decision 3/2022’);
EDPB Binding Decision 4/2022 adopted on 05 December 2022 (hereinafter ‘EDPB Binding Decision 4/2022’). In

each of these binding decisions the EDPB instructed the IE SA to alter its Finding 2 of its Draft Decision, which
concluded that Meta IE may rely on Art. 6(1)(b) GDPR in the context of its offering of the Facebook Terms of
Service or the Instagram Terms of Use and to include an infringement of Art. 6(1) GDPR based on the
shortcomings that the EDPB has identified in the EDPB Binding Decisions. The reasoning of the EDPB is available

in paragraphs 94-133 and 484 of EDPB Binding Decision 3/2022 and in paragraphs 97-137 and 451 of EDPB
Binding Decision 4/2022.
6IE SA FB Decision, Finding 2, p. 49; IE SA IG Decision, Finding 2, p. 49.
7 IE SA FB Decision, paragraphs 8.8, 10.44; IE SA IG Decision, paragraphs 212, 417. The deadline for compliance

8ith the orders in the IE SA Decisions fell on 5 April 2023.
In the cases leading to the adoption of the IE SA Decisions, all EEA SAs were CSAs pursuant to the GDPR (IE SA
FB Decision, Schedule 1, paragraph 1.10; IE SA IG Decision, Appendix 1 - Schedule 1, paragraph 6).
9More specifically, the IE SA shared on 5 April 2023 the Meta IE Compliance Reports via two IMI workflows, one

for the IE SA FB Decision and one for the IE SA IG Decision respectively (hereinafter, collectively, the ‘IE SA IMI
Informal Consultations’ or the ‘IMI Informal Consultations’).
10Meta IE’s Compliance Report regarding the Facebook Service (IN-18-5-5) of 3 April 2023 (hereinafter, ‘Meta
IE Compliance Report on IE SA FB Decision’), paragraphs 2.1 and 2.3 and Meta IE’s Compliance Report

Adopted 4 with the aim of showing compliance with the IE SA Decisions. In its Compliance Reports, Meta IE
indicated that it changed its legal basis for the majority 11of its processing of personal data for

behavioural advertising purposes from Article 6(1)(b) GDPR to Article 6(1)(f) GDPR as of 5 April 2023,
which was the deadline for compliance with the IE SA Decisions . Specifically for reliance on Article
13
6(1)(f) GDPR, Meta IE provided legitimateinterests assessmentsas supporting materials (hereinafter
collectively, the ‘Meta IE Legitimate Interests Assessments’). Without providing its own analysis on

the Compliance Reports, the IE SA invited all the CSAs to assess the extent to which the measures
implemented by Meta IE achieved compliance with the orders in the IE SA Decisions and welcomed
feedback from the CSAs by 5 May 2023. The deadline was later on extended to 15 May 2023 . 14

5. Onthesameday,theNOSAemailedtheIESAinrespectofMetaIE’schangeoflegalbasistolegitimate
interest, expressing strong doubts as to whether this legal basis could be validly relied on and asking

for the IE SA’s preliminary view on this.

6. On 6 April 2023, upon request of the IE SA, the EDPB Secretariat circulated a message from the IE SA
to the members of the Enforcement expert subgroup within the EDPB. Such message aimed to attract
15
allCSAs’attentiontotheIESAIMIInformalConsultationscirculatedbytheIESAviaIMI .Onthesame
day, the IE SA replied to the NO SA’s email of 5 April 2023, pointing to the message from the IE SA to
the CSAs circulated by the EDPB Secretariat.

7. On 13 April 2023, the IE SA shared with the CSAs via IMI two further letters from Meta IE (one on the
IE SA FB Decision and one on the IE SA IG Decision) dated 12 April 2023, providing further information

on its compliance efforts in relation to the IE SA Decisions.

8. On 14 April 2023, the NO SA responded negatively to a meeting request from Meta IE dated 28 March
2023, pointing out that the case is handled by the IE SA as the LSA.

9. Some CSAs asked for clarifications on the procedure being followed, for example on the reasons why

the IE SA did not at that point share its assessment of Meta IE’s compliance with the orders in the IE
SA Decisions. The IE SA clarified, first, that the assessment of compliance with the orders in the IE SA

Decisions would be carried out on a joint basis, more specifically by way of an assessment carried out
by the CSAs at the same time as the LSA, and that this sequencing of the process was aimed to ensure

a timely and consistent approach, in line with the deadline for compliance determined by the EDPB,

regarding the Instagram Service (IN-18-5-7) of 3 April 2023 (hereinafter, ‘Meta IE Compliance Report on IE SA

11 Decision’), paragraphs 2.1 and 2.3.
According to the Compliance Reports, Meta IE continued to process limited categories of non-behavioural
information toshow advertising onFacebook or Instagrambased onArt. 6(1)(b) GDPR. See Meta IE Compliance
Report on IE SA FB Decision, paragraphs 3.1.3 and 5.8.2, and Meta IE Compliance Report on IE SA IG Decision,
paragraphs 3.1.3 and 5.8.2.
12
Meta IE Compliance Report on IE SA FB Decision, paragraph 2.1; Meta IE Compliance Report on IE SA IG
Decision, paragraph 2.1.
13Meta IE’s Legitimate Interests Assessments Behavioural Advertising Processing of 3 April 2023, Annex 4 to
Meta IE Compliance Report on IE SA FBDecision and Annex 4 toMeta IE ComplianceReport on IE SA IG Decision.
14Following requests from two of the CSAs, the deadline to share feedback was extended until 15 May 2023. In

15ct, the IE SA waited for a few more days, giving the opportunity to further CSAs to share their views.
In the same message, the IE SA also specified: ‘As you will also recall, IE SA confirmed, during the Article 65
[GDPR] discussions, that any assessment of compliance with the orders made [in the IE SA Decisions] would be
carried out on a joint basis, the same as in previous cases, whereby the IE SA together with all CSAs would jointly
assess the extent to which any action taken has achieved compliance with the terms of the order’.

Adopted 5 formulated on the basis that urgent action was required to be taken by Meta IE to address the
16 17
infringement . The IE SA also clarified that it would not issue a new draft decision .

10. Several CSAs provided their feedback on the way in which Meta IE complied with the IE SA Decisions.

• The Österreichische Datenschutzbehörde (Austrian supervisory authority - hereinafter, the ‘AT

SA’) shared its views that processing operations in connection with behavioural advertising
could not be based on Article 6(1) (f) GDPR . 18

• The Integritetsskyddsmyndigheten (Swedish supervisory authority - hereinafter, the ‘SE SA’)
stressed the importance of adhering to any applicable EDPB guidelines 19.

• The Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (hereinafter, the ‘DE

Hamburg SA’) shared its views stating that ‘at this stage, consent would be the only possible
legal basis to comply with’ the orders in the IE SA Decisions, and expressing concerns regarding

the indications that sensitive data are processed without consent and regarding the processing
activities for which Meta IE continued to rely upon Article 6(1)(b) GDPR . 20

• The Autoriteit Persoonsgegevens (Dutch supervisory authority - hereinafter the ‘NL SA’) shared
its views that ‘the interests listed by [Meta IE] in the/its Legitimate Interest Assessment cannot
be considered as “legitimate interests” in the sense of Article 6(1) (f) GDPR’, the processing of

personal data is not ‘necessary’ for the purpose of the declared interests, and the ‘fundamental
rights and freedoms of the data subject override the interest of [Meta IE] and the third parties
21
involved’ .

• The NO SA transmitted on 5 May 2023 a formal mutual assistance request under Article 61 (1)
22
GDPR (hereinafter, the ‘NO SA Mutual Assistance Request’) to the LSA using the dedicated

16
These clarifications were made by the IE SA on 26 April 2023 as a reply to a question of the FR SA of 25 April
2023 made in the IE SA IMI Informal Consultations.
17The SE SA asked for clarification on the procedure being followed on 4 May 2023 via the IMI Informal
Consultations. The IE SA replied on 5 May 2023.
18
TheseviewsweresharedasareplytotheIESAIMIinformalconsultationconcerningonlytheIESAFBDecision
(Comment of the AT SA of 18 April 2023), see footnote 9. The AT SA also indicated that a balancing test was also
difficult because the term ‘Behavioural Advertising Processing’ was not defined in the Privacy Policy and what
this actually entailed was not entirely clear. The AT SA also made reference to the reasoning in its relevant and
reasonedobjectiontotheIESA’sdraftdecision intheprocedureleading totheadoptionoftheIESA FBDecision.
19
Comment of the SE SA of 4 May 2023 as a reply to the IE SA IMI Informal Consultations, see footnote 9.
20Commentofthe DE Hamburg SAof4May2023as areply to the IE SA IMI InformalConsultations,see footnote
9. In its comments, the DE Hamburg SA stated that there ‘are strong indications that sensitive data stemming
from different sources are processed without consent against the Art. 9 (1) GDPR’ and that ‘consent [is] the only

possible legal basis for that kind of processing’ and made further remarks on this issue. The DE Hamburg SA also
stated that the ‘processing described or indicated in the updated Terms of Use and [Meta IE] Privacy Notice
cannot be based on Art. 6 (1) (b) GDPR’.
21CommentoftheNLSAof4May2023,paragraph3-attachedasareplytotheIESAIMIInformalConsultations,

see footnote 9. The NL SA, in its comments, also ‘urgently asks the [IE SA] to swiftly undertake adequate actions
in order to cease the continuous illegality of the invasive processing of personal data of millions of users’
(paragraph 4). In addition to providing detailed views on the applicability of Art. 6(1)(f) GDPR (paragraphs 8-63),
theNLSAalsostresseditsconcernsabouttheprocessingofspecialcategoriesofdataandaboutthecompatibility

of the processing of the amount of data at stake with the principles of data minimisation and purpose limitation
(paragraphs 6-7).
22Comment of the NO SA of 5 May 2023 as a reply to the IE SA IMI Informal Consultations (see footnote 9),
attaching a copy of the NO SA Mutual Assistance Request introduced on 5 May 2023.

Adopted 6 IMI flow 23. The NO SA requested the IE SA to (1) issue a temporary ban on Meta IE’s processing
ofpersonaldataforbehaviouraladvertisingpurposesbasedonArticle6(1)(f)GDPRand(2)share

a timeline with the NO SA and the CSAs specifying how the IE SA will ensure in an expedient
manner that Meta IE complies with Article 6(1) GDPR.

• The Agencia Española de Protección de Datos (Spanish supervisory authority - hereinafter the
‘ES SA’) shared its views stating that ‘the submitted Legitimate Interest Assessment does not
demonstrate that the processing carried out by [Meta IE] with the purpose of behavioural

advertisement be based on Article 6(1)(f) GDPR since it does not meet the requirements of this
Article’ .

• The Tietosuojavaltuutetun toimisto (Finnish supervisory authority - hereinafter the ‘FI SA’)
shared its views on 15 May 2023 that ‘based on the information available, it does not seem that
[Meta IE] would have brought all its processing activities into compliance with the GDPR and
25
would meet the requirements of the GDPR’ .

• In addition, the Garante per la protezione dei dati personali (Italian supervisory authority -

hereinafter, the ‘IT SA’) shared its views on 23 May 2023 saying that ‘[Meta IE’s] proposal is not
such as to adequately implement the order to bring the processing into compliance insofar as it
misclassifies part of the user-related information and thereby applies the legal basis of

23The formal NO SA Mutual Assistance Request contained two requests labelled as follows: ‘Pursuant to Art.
61(1) GDPR,thefollowingrequestsaremade:i.Wekindly requestthattheIESAissuesatemporarybanon[Meta

IE]’s processing of personal data for behavioural advertising purposes on Facebook and Instagram based on Art.
6(1)(f) GDPR, in accordance with Art. 58(2)(f) GDPR. The ban should last until the lead and concerned supervisory
authorities are satisfied that [Meta IE] has provided adequate and sufficient commitments to ensure compliance
withArt.6(1)GDPRandArt.21GDPR,inlinewithArt.31GDPR.Thiswillgiveustheopportunitytofurtherengage
with [Meta IE] and make sure that it commits to fully respect its obligations under the GDPR, while preventing

any further risks for data subjects stemming from [Meta IE]’s non-compliant behavioural advertising practices.
Please note that in our view, behavioural advertising includes any activities where advertising is targeted on the
basis of a data subject’s behaviour or movements, including advertising based on perceived location’. ii. ‘We
kindly requestthat the IE SA shares a timeline specifying how it will ensure in an expedient manner that [Meta IE]
complies with Art. 6(1) GDPR. We should be grateful if the IE SA, by 5 June 2023, would share the timeline and

confirm that a temporary ban will be issued. If the IE SA is not in a position to comply with our request regarding
[Meta IE], we may need to consider our options in relation to the adoption of provisional measures in Norway
pursuant to Art. 66 GDPR. We hope that this will not be necessary and look forward to cooperating further with
the IE SA within the framework of the cooperation mechanisms set out in Chapter VII GDPR’.
24These views were shared as a reply in the IESA IMI informal consultation concerning only the IE SA IG Decision

(Comment of the ES SA of 12 May 2023). More specifically, the ES SA argued that the interests listed by Meta IE
are ‘purely economic or commercial interests’ of Meta IE or third parties, and that in respect of the condition of
necessity of the processing ‘the direct link between the processing and the legitimate interest should be
established and prove that there are no less intrusive alternatives for the data subjects that could serve the
interest equally effectively’ (p. 4). The ES SA also noted some shortcomings in the balancing test carried out by

25ta IE (Comment of the ES SA of 12 May 2023, p. 5).
Comment of the FI SA of15 May 2023 as a reply to the IE SA IMI Informal Consultations (see footnote9). More
specifically, the FI SA expressed doubts about legitimate interest being the most suitable legal basis in the case
at hand and argued that the Legitimate Interests Assessment carried out by Meta IE ‘seems to be rather one-
sided and superficial and fails to convince why the interests of [Meta IE] or third parties should override the

interests and fundamental rights of the data subjects’ (Comment of the FI SA of 15 May 2023, p. 2) and ‘fails to
take duly into consideration the volume of the processing and the high number of users of the said services’
(CommentoftheFISAof15May2023,p.2-3).TheFISAalsonotedthatcertaincategoriesofpersonaldataseem
to still be unlawfully collected for behavioural advertising purposes under Art. 6(1)(b) GDPR (Comment of the FI
SA of 15 May 2023, p. 2).

Adopted 7 contractual performance under Article 6(1)(b) GDPR to the serving of ads which, actually, are
behavioural in nature’ 26; the IT SA also highlighted some concerns concerning the switch to
27
legitimate interest for the other processing activities for behavioural advertising purposes .

11. The IE SA shared with Meta IE the feedback received from the CSAs and invited Meta IE to provide
28
submissions on these views by 2 June 2023 .

12. On 30 May 2023, the NL SA sent the IE SA a request for mutual assistance under Article 61 GDPR
(hereinafter, the ‘NL SA Mutual Assistance Request’) asking the IE SA to provide its conclusion as to

whether Meta IE could rely on Article 6 (1) (f) GDPR, its conclusion as to whether Meta IE complies
with the IE SA Decisions and as to a timeframe, which appropriate and expedient action will be taken
to ensure that Meta IE acts in compliance with Article 6 GDPR . 29

13. On 31 May 2023, the IE SA provided an update to all CSAs via the IE SA IMI Informal Consultations
(hereinafter, the ‘IE SA Update to CSAs of 31 May 2023’, informing them about the NL SA Mutual

Assistance Request and highlighting that it will be in a position to complete its own assessment of the
Meta IE Compliance Reports and share its assessment with the NO SA and NL SA (who lodged Article
61 GDPR requests) and all other CSAs by the end of June 2023. In particular, the IE SA indicated that

theyhad‘receivedalloftheassessmentsfromCSAs’and‘forwardedthemto[MetaIE]forittoconsider
the views expressed and to detail any changes that it proposes to implement on foot of the CSA

assessments’. Furthermore, the IE SA stated that it will ‘complete its own assessment of [Meta IE]’s
compliance reports’ after receiving Meta IE’s response. The IE SA also stated ‘it will be in a position to

complete its own assessment of [Meta IE]’s compliance reports and to share its assessment with the
Norwegian and Dutch supervisory authorities (both of which have lodged Article 61 requests for
mutual assistance) and with all other CSAs by the end of June 2023’.

14. Also, on 31 May 2023, Meta IE sent a letter to the IE SA providing its views and comments on the
process that was being followed by the IE SA and asking for an extension of its deadline to provide a
reply. In this context, it also provided some comments to the IE SA on the CSAs' feedback and some

preliminary comments on the requests for urgent enforcement action from some CSAs.

26
Comment of the IT SA of 23 May 2023 as a reply to the IE SA IMI Informal Consultations (see footnote 9). As
indicated in footnote 11, Meta IE indicated in its Compliance Reports the fact that it continued to process some
data under Art. 6(1)(b) GDPR. The IT SA argued in this respect that ‘[Meta IE]’s distinction between non-
behavioural and behavioural advertising can be said to be artificial and based merely on language’ (Comment of
the IT SA of 23 May 2023, p. 1)
27
Comment of the IT SA of23May2023 as areply to the IESA IMI Informal Consultations(see footnote 9). More
specifically, according to the IT SA, ‘it is as if the controller was shifting the burden of proof regarding legitimate
interest as the legal basis of processing on the data subjects – who conversely should be called into play as key
actors in the two subsequent steps of the legitimate interest test, i.e. when assessing the necessity of the
processing and performing the required balancing exercise’ (Comment of the IT SA of 23 May 2023, p. 2). The IT

SAalsounderlinedthat‘theprocessingoperationsunderpinningtheuseofOnlineBehaviouralAdvertisingshould
more appropriately be grounded in consent as a legal basis within the meaning of Art. 6(1) (a) GDPR’ (p.3).
28On12May2023and16May2023,theIESAsenttwoletterstoMetaIE,providing MetaIE with thefirstreplies
received from CSAs informing Meta IE that some CSAs requested an extension of time to provide a response. On
25 May 2023, the IE SA transmitted to Meta IE the latest comments from CSAs with respect to the way in which

Meta IE complied with the IE SA Decisions. The IE SA invited Meta IE to provide submissions by 2 June COB. On
26 May 2023, the IE SA shared an update with all CSAs, informing them that their responses were forwarded to
Meta IE, whose response was awaited by 2 June 2023.
29The IE SA provided a reply on 31 May 2023. On the same day, the IE SA provided an update to CSAs in the IMI
Informal Consultations, described in the following paragraph.

Adopted 815. On 2 June 2023, the IE SA provided a reply to the NO SA Mutual Assistance Request. In the notification
formused,theIESAstatedthatitcould notcomplywiththerequest(bycheckingapre-codetextbox),

andinvitedtheNOSAtolookatthe‘detailedresponseuploadedbythe[IESA]’intheIESAIMIInformal
Consultations (see above, paragraph 13).

16. On 9 June 2023, the NO SA further replied to the IE SA, via the IE SA IMI flow relating to the NO SA

Mutual Assistance Request, asking whether the IE SA could ‘share their preliminary thoughts or non-
bindingly indicate whether [it] may potentially be inclined to follow [the NO SA Mutual Assistance
Request]’.InthesamemessagetheNOSAindicatedthatitwouldinanycaseawaittheIESA’sresponse

towards the end of June.

17. On 13 June 2023, the IE SA informed all CSAs via the IE SA IMI Informal Consultations that it would
await the judgment of the Court of Justice of the European Union in Case C-252/21 (Meta Platforms

Inc. v Bundeskartellamt) (hereinafter, the ‘CJEU Bundeskartellamt Judgment’) before sharing its
assessment of the Meta IE Compliance Reports . The IE SA, noting the NO SA Mutual Assistance
Request and the NL SA Mutual Assistance Request, indicated their intention to finalise their

assessment as soon as possible after the CJEU Bundeskartellamt Judgment expected on 4 July 2023.

18. On 14 June 2023, the IE SA sent a letter to Meta IE replying to its letter of 31 May 2023. The IE SA
explained its intention to wait for the CJEU Bundeskartellamt Judgment before circulating its

provisional assessment of the steps taken by Meta IE in purported compliance with the orders in the
IE SA Decisions, as well as the expected next steps leading to the issuance of the final outcome of the

assessment of compliance. In the same letter, the IE SA informed Meta IE that it no longer required it
to make submissions in reply to the CSAs’ initial observations.

19. On 21 June 2023, Meta IE shared with the IE SA its views on the concerns raised by some of the CSAs

and regarding potential urgent proceedings. On 23 June 2023, the IE SA shared via the IMI Informal
Consultations the communication received from Meta IE on 21 June 2023. The IE SA stated that Meta
IE specified that this communication is without prejudice to Meta IE’s position that it brought its

processing into compliance with the orders in the IE SA Decisions.

20. On 30 June 2023, Meta IE shared by letter additional information with the IE SA regarding the IE SA’s
proposed compliance assessment. In this letter, Meta IEoutlined its views on the next steps envisaged

by the IE SA and provided information and arguments on what it considered to be misunderstandings
underpinning the views provided by the CSAs on the Meta IE Compliance Reports . 31

21. On 4 July 2023, the Court of Justice of the European Union delivered the CJEU Bundeskartellamt
32
Judgment . On 6 July 2023, the IE SA indicated to all the CSAs via the IE SA IMI Informal Consultations

30
31The CJEUhad just announcedthat it would deliver the judgment beforethe IE SAgave this update to theCSAs.
Letter from Meta IE to the IE SA of 30 June 2023. Meta IE’s comments on the next steps envisaged by the IE SA
are available in paragraphs 1-3 of this letter. Meta IE also provided clarifications, information and arguments on
what it considered to be misunderstandings underpinning the views provided by the CSAs on the Meta IE
Compliance Reports in paragraph 7. By way of example, Meta IE stated that it ‘does not engage in a “balancing”
exercise on receipt of a valid objection’, that the IE SA Decisions only apply to processing for behavioural

advertising purposes (and not to processing of non-behavioural information for advertising purposes), and that
the assessment of ‘Behavioural Advertising Processing’ only concerns data relating to activity on Facebook and
Instagram (on-platform data). Meta IE also clarified that it relies on Art. 6(1)(a) GDPR to process information
provided to Meta IE by third party advertising partners (‘off-platform data‘) for the purposes of showing
personalised advertisements.
32JudgmentoftheCourtofJusticeoftheEuropeanUnionof4July2023,MetaPlatformsInc.vBundeskartellamt,

C-252/21, EU:C:2023:537.

Adopted 9 thatitwasconsideringsuchjudgmentinthecontextoffinalisingitsprovisionalassessmentofthesteps
taken by Meta IE in purported compliance with the IE SA Decisions 3.

22. On 11 July 2023, the IE SA issued a provisional position paper (‘IE SA Provisional Position Paper’) in
which it preliminarily concluded that Meta IE had not complied with the orders in the IE SA Decisions,
34
and shared it with the CSAs alongside a letter dated 30 June 2023 received from Meta IE . The IE SA
invited the CSAs to share their views on the IE SA Provisional Position Paper by 21 July 2023 . 35

23. Between 20 July 2023 and 21 July 2023, two CSAs shared their views on the IE SA Provisional Position
36
Paper via the IE SA IMI Informal Consultations . The IE SA shared these CSAs’ views with Meta IE on
21 July 2023.

24. On14 July2023,the NO SA imposed a temporaryban onMeta IE andFacebook NorwayAS (‘Facebook

Norway’) regarding the processing of personal data of data subjects in Norway for behavioural
advertising for which Meta IE relies on Article 6(1)(b) GDPR or Article 6(1)(f) GDPR (the ‘NO SA Order’

or the ‘Provisional Measures’). On the same day, the NO SA informed by email the IE SA of the
Provisional Measures being taken on the basis of Article 66(1) GDPR. On 7 August 2023, the NO SA
rejected Meta IE’s and Facebook Norway’s request for deferred implementation of the NO SA Order.

25. On 20 July 2023, the IE SA shared an update to the CSAs via the IE SA IMI Informal Consultations,
informing the CSAs of its views on the NO SA Order. It also stated that it did not mean to refuse to
comply with the NO SA Mutual Assistance Request as this was a result of ‘incorrectly (and

inadvertently)’checking a boxand that, inits view,itscommunicationto the NO SAof2 June2023was
referring to two documents shared with all CSAs on 31 May 2023 , which ‘directed to the subject

matter of the NO SA [Mutual Assistance Request]’ and were ‘clearly engaging with the substance of
the NO SA [Mutual Assistance Request] [...]’.

26. On 24 July 2023, the NO SA answered to questions from a politician in the Irish national parliament on

the NO SA Mutual Assistance Request. In its reply, the NO SA describes the reply provided by the IE SA
to the NO SA Mutual Assistance Request and explains the reasons behind the issuance of the

ProvisionalMeasures,expressingitsconcernsthat‘whileitisvery clearthat[MetaIE]doesnotcomply
with the GDPR,failing to takespecific andresolute enforcementactionwould leadtoa cat-and-mouse

game whereby [Meta IE] is able to evade compliance indefinitely’ and that ‘simply stating that [Meta
IE] does not comply with the GDPR [...] without imposing any specific order spelling out what [Meta
IE] must potentially do to comply with the law and by which date, will allow [Meta IE] to further delay

compliance’.

33In the same communication, the IE SA also indicated they expected to be in a position to circulate their
provisional assessment the following week, and that they would then give the CSAs a period of ten days to
respond. While the NO SA and the IE SA indicated that this update occurred on 5 July 2023, according to the IMI

34ports relating to the IE SA IMI Informal Consultations, this update seems to have been sent on 6 July 2023.
This letter was already mentioned above in paragraph 20.
This update was shared by the IE SA via the IE SA IMI Informal Consultations. Together with the IE SA Provisional
Position Paper and the Letter from Meta IE to the IE SA of 30 June 2023, the IE SA also shared again the Meta IE
Compliance Reports (already shared on 5 April 2023 with the CSAs).
35
In the same communication, the IE SA also indicated that it would then provide the CSAs’ views on the IE SA
Provisional Position Paper to Meta IE inviting it to make its submissions by 4 August 2023.
36The NL SA shared its views via a document attached on 20 July 2023 and the DE Hamburg SA via a document
attached on 21 July 2023.
37See paragraph 13 above.

Adopted 1027. On 27 July 2023, Meta IE sent a letter to the IE SA stating that it intends to ground its processing for
behavioural advertising purposes 38on consent (Article 6(1)(a) GDPR) (by way of “Meta IE’s Consent

Proposal”Meta IE’s Consent Proposal)

39
. The IE SA
shared this letter with the CSAs via the IE SA IMI Informal Consultations.

28. On the same day, Meta IE sent a letter to the NO SA, making reference to the letter sent to the IE SA

andrequesting the NO SA to lift the ProvisionalMeasuresin lightof Meta IE’s commitments tothe LSA
to ensure compliance by way of relying upon consent.

29. On 1 August 2023, the IE SA replied to Meta IE taking note of Meta IE’s intention to implement the

necessary measures to enable it to rely on Article 6(1)(a) GDPR
4.

30. Meanwhile, on 1 August 2023, Meta IE and Facebook Norway lodged a complaint with the NO SA

requesting that it lifts the NO SA Order. On 3 August 2023, the NO SA rejected this complaint and on
the following day the NO SA sent a letter to Meta IE and Facebook Norway requesting confirmation as
to whether the NO SA Order would be complied with.

31. On 4 August 2023, Meta IE provided its response to the IE SA Provisional Position Paper. On the same
date, Meta IE and Facebook Norway replied to the NO SA that they have, in their view, complied with
the NO SA Order, and requested the Oslo District Court to grant a preliminary injunction against the

NO SA Order.

32. On 7 August 2023, the NO SA decided to impose a coercive fine on Meta IE and Facebook Norway for
the non-compliance with the NO SA Order. On 14 August 2023, Meta IE requested the deferred

implementation of the coercive fine imposed on Meta IE and Facebook Norway, at least until the Oslo
District Court has ruled on Meta IE’s and Facebook Norway’s applications for a preliminary injunction.

On 25 August 2023, the NO SA rejected Meta IE’s and Facebook Norway’s request for deferred
implementation of the coercive fine.

33. On 8 August 2023, Meta IE and Facebook Norway sent a letter to the Ministry of Local Government

and Regional Development of Norway, asking it to consider Meta IE’s and Facebook Norway’s
complaints against the NO SA Order submitted to the NO SA on 1 August 2023 . The Ministry of Local

38

39

40 This letter was shared by the IE SA with the CSAs via the IE SA IMI Informal Consultations. The IE SA also
highlighted that all the correspondence from Meta IE should be treated as confidential.
41 Meta IE sustained that the Ministry should have declared the complaint valid and the decision should have
been repealed, indicating that ‘the audit did not give [Meta IE] necessary notice of its proposed actions and did

not give [Meta IE] the necessary opportunity to be heard’. In addition, Facebook Norway was of the opinion that
the NO SA wrongfully indicated Facebook Norway as an addressee of the decision.

Adopted 11 Government and Regional Development of Norway responded on 10 August 2023, refusing to
accommodate the request and indicating that it did not have the authority to handle complaints

against the NO SA Order.

34. On 10 August 2023, Meta IE sent a letter to the IE SA

highlighted its concerns arising from the Article 66 GDPR
proceedings arising from the Provisional Measures and running in parallel to the process led by the IE

SA.

35. The IE SA responded on 11 August 2023. In its letter, the IE SA

highlighted that it considered it is not for it to second-guess the decision of the NO SA to
trigger the application of the urgency procedure and that the Article 66 GDPR procedure would take

its own course.

36. The proceedings concerning the request for preliminary injunction lodged with the Oslo District Court
further developed and the parties submitted written pleadings . 42

37.

43
.

38. On 18 August 2023, the IE SA shared with all CSAs its final position paper (‘IE SA Final Position Paper’),
in which the IE SA concluded that Meta IE failed to demonstrate compliance with the orders in the IE
44
SA Decisions . The IE SA also indicated its view that in light of the Meta IE’s Consent Proposal, it is fair

42On 10 August 2023 and 11 August 2023, respectively, Meta IE and Facebook Norway and the NO SA submitted
their written pleadings to the Oslo District Court. Meta IE requested provisional injunctions to avoid damage
following an alleged invalid administrative decision and Facebook Norway claimed that the NO SA’s justification

was inadequate. The NO SA responded to the request for a preliminary injunction claiming, inter alia, that there
was no case processing error that may have affected the content of the decision, the conditions for urgent
measures for adopting its decision were met, the decision did not violate Article 84 GDPR (proportionality) and
that an injunction by the Oslo District Court would have been in a manifest disparity with the damages or
inconveniences Norway would have been inflicted. Meta IE then submitted further written pleadings to the Oslo

District Court on 14 August 2023. On 15 August 2023, Meta IE and Facebook Norway complained against the NO
SAabouttheNOSA’srejectionoftheircomplaint.MetaIEandFacebookNorwayreiteratethattheappealbefore
the Ministry should be admissible and that they have the right to appeal the decision of the Ministry (contrary
to the Ministry’s declaration) according to administrative law. On 16 August 2023, the NO SA submitted further
written pleadings to the Oslo District Court, while Meta IE and Facebook Norway submitted their additional

43itten pleadings on 18 August 2023.

44Together with the IE SA Final Position Paper, the IE SA shared with the CSAs the same supporting materials as

shared together with the IE SA Provisional Position Paper. See above paragraph 22.
Also, on 17 August 2023, the IE SA provided an update to all CSAs via the IE SA IMI Informal Consultations,
informing them mainly of the fact that the copies of the relevant communications to which the IE SA was party
were transmitted to the NO SA and Meta IE to ensure that both the NO SA and Meta IE were in a position to put
the full suite of communications before the Oslo District Court.

Adopted 12 and reasonable to give Meta IE an opportunity to demonstrate that it can rely on consent as its lawful
45
basis rather than engaging in enforcement measures .

39. On 25 August 2023, Meta IE and Facebook Norway submitted, each, to the NO SA their comments on
the NO SA’s intended request for an urgent binding decision from the EDPB pursuant to Article 66 (2)

GDPR, which was specified in the NO SA Order.

40. On 28 August 2023, Meta IE and Facebook Norway complained against the NO SA regarding the

coercive fine it had imposed. Meta IE and Facebook Norway asked the NO SA to revoke the
enforcement decision or, at least, to lower the amount.

41. On 6 September 2023, the Oslo District Court decided not to grant the petitions from Meta IE and

Facebook Norway for a preliminary injunction against the NO SA Order.

42.

46.
.

43.

47.

44. On 21 September 2023, the NO SA sent a letter to the IE SA outlining their views on the current state

of play. More specifically, the NO SA stated that it considered there is still an urgent need for a ban of
the unlawful processing of personal data carried out by Meta IE despite the Meta IE’s Consent
48
Proposal , and that such a ban would
representanincentiveforMetaIEtoswiftlybringprocessingintocompliance .Thus,theNOSAasked

the IE SA to reconsider their position, outlined in the IE SA Final Position Paper that enforcement

45
IE SA Final Position Paper, paragraph 9.2.
46

47

48
Letter of the NO SA to the IE SA of 21 September 2023, p. 2.

49Letter of the NO SA to the IE SA of 21 September 2023, p. 3.

Adopted 13 measuresarenotnecessaryatthispointintime 50.TheletteralsomentionedthattheNOSArequested

submissions from Meta IE about its intention to ask the EDPB for an urgent binding decision, but may
consider not making such request should the IE SA decide to adopt enforcement measures . 51

45. On 26 September 2023, Meta IE and Facebook Norway made submissions in relation to the request of

the NO SA for an urgent binding decision of the EDPB and the NO SA lodged its request to the EDPB on
IMI. Further details on this are available below .2

46. On 27 September 2023, the IE SA replied to the letter of the NO SA of 21 September 2023, outlining
its views on the NO SA’s position and course of action. More specifically, the IE SA recalled that the

EDPB explicitly declined to instruct the IE SA to impose a temporary ban in the EDPB Binding Decisions
and explained that each of the IE SA Decisions ‘made provision for enforcement measures, namely,
the orders for compliance, under which [Meta IE]’s proposals for the adoption of one or more

alternative legal bases for the [processing operations at stake] would be assessed, and ruled on, on
their respective merits’ . The IE SA also expressed the view that ‘it is inaccurate to suggest that the [IE

SA] could impose an immediate ban on processing, whilst continuing to progress its assessment of
[Meta IE]’s proposed consent-based model, in conjunction with its CSA colleagues’ . 54

47. On 11 October 2023, the NO SA replied to the letter of the IE SA of 27 September 2023. In this letter,
the NO SA expressed its concern that despite the LSA and CSAs ‘agreeing that [Meta IE] cannot base

processing of personal data for behavioural advertising on Article 6(1)(b) GDPR or Article 6(1)(f) GDPR,
[Meta IE] continues to violate Article 6(1) GDPRand the [IE SA Decisions], and such violation continues
to be tolerated’ . The NO SA reiterated its view that ‘corrective measures can and should be imposed
56
on [Meta IE] as soon as possible to stop [Meta IE]’s current illegal processing activities’ .

48. The IE SA further replied on 13 October 2023. In its letter, the IE SA argued that the request of the NO

SA to the EDPB amounts, in substance, to a demand for enforcement action against the IE SA for its
(alleged) failure to implement the IE SA Decisions and to an attempt to use the Article 66 GDPR

procedure as a means to procure an order from the EDPB to compel the IE SA to impose an EEA-wide
ban on Meta IE’s processing of personal data for behavioural advertising purposes 57. The IE SA also

expressed its view that it did put in place an enforcement procedure following the IE SA Decisions,
consistent with the EDPB Binding Decisions 58.

49. On16October2023,Meta IEandFacebookNorwayinitiatedlegalproceedingsbeforetheOsloDistrict

Court to demand the invalidation of the NO SA Order.

1.2 Submission of the request to the EDPB and related events

50Letter of the NO SA to the IE SA of 21 September 2023, p. 3.
51Letter of the NO SA to the IE SA of 21 September 2023, p. 3.
52See paragraph 67 below.
53
Letter of the IE SA to the NO SA of 27 September 2023, p. 3.
54Letter of the IE SA to the NO SA of 27 September 2023, p. 4.
55Letter of the NO SA to the IE SA of 11 October 2023, p. 1.
56Letter of the NO SA to the IE SA of 11 October 2023, p. 1.
57
Letter of the IE SA to the NO SA of 13 October 2023, p. 2-3, in which the IE SA also states that: ‘while, subject
to ongoing litigation in Norway, [Meta IE]’s Norwegian subsidiary is accruing liabilities on a daily basis by
reference to the fine recently applied by NO SA, [Meta IE]’s processing operations as they relate to behavioural
advertising remain unchanged at this point’.
58
Letter of the IE SA to the NO SA of 13 October 2023, p. 3-6.

Adopted 1450. As mentioned above, on 26 September 2023, the NO SA used IMI to request the EDPB to adopt an

urgentbindingdecisionpursuanttoArticle66(2)GDPR,withtheeffectoforderingtheimplementation
of final measures (hereinafter, the ‘NO SA Request to the EDPB’ or ‘Request to the EDPB’).

51. Following the submission of the NO SA Request to the EDPB, the EDPB Secretariat assessed the
completeness of the file on behalf of the Chair of the EDPB.

52. In the context of the assessment of the completeness of the file, the EDPB Secretariat contacted the

NO SA on 4 October 2023 and 11 October 2023 requesting further documents and clarifications. In
both cases, the NO SA responded on the same day by providing clarifications and uploading additional
documents on IMI.

53. The EDPB Secretariat also contacted the IE SA on 5 October 2023, requesting additional documents

andclarifications.FollowingarequestsentbytheIESAtoextendthedeadlineinitiallyseton6October,
the EDPB Secretariat extended the deadline to 9 October 2023. On 9 October, the IE SA replied by
attaching some of the additional documents and providing some clarifications. On the basis of the

reply, the EDPB Secretariat requested on the same day some further information and provided
clarifications onthequestionsithadpreviouslyasked.On10October2023,theIESArespondedto the
EDPB Secretariat’s email of 9 October 2023, highlighting the need for appropriate time to carry out
verifications. On 11 October 2023, the EDPB Secretariat responded to the IE SA’s email identifying

certainitemsasmattersofpriority.On12October2023,theIESArespondedtotheEDPBSecretariat’s
request providing several documents and clarifications.

54. A matter of particular importance that was scrutinised by the EDPB Secretariat was the right to good
administration, as required by Article 41 of the Charter of Fundamental Rights of the European Union

(hereinafter,the‘Charter’).FurtherdetailsonthistopicareprovidedinSection3ofthisurgentbinding
decision.

55. On 12 October 2023, the decision on the completeness of the file was then taken by the Chair of the
EDPB and on 13 October 2023 by the NO SA in line with Article 13(2) of the EDPB RoP. The file was

circulated by the EDPB Secretariat to all the members of the EDPB on 13 October 2023.

56. On 17 October 2023, following a request of the IE SA to include an additional letter sent by the IE SA
totheNOSAon13October2023,theEDPBdecided toincludeitinthefile,onthebasisofArticle11(2)
EDPB RoP.

2 COMPETENCE OF THE EDPB TO ADOPT AN URGENT BINDING

DECISION UNDER ARTICLE 66(2) GDPR

57. The EDPB is competent to issue an urgent binding decision under Article 66(2) GDPR to the extent that
thefollowingconditionsaremet:anSAhastakenprovisionalmeasurespursuanttoArticle66(1)GDPR,
59
and there is a request from this SA pursuant to Article 66(2) GDPR.

2.1 The SA has taken provisional measures under Article 66(1) GDPR

58. On 14 July 2023, the NO SA adopted provisional measures pursuant to Article 66(1) GDPR, prohibiting

Meta IE from processing the personal data of data subjects residing in Norway for targeting

59See Art. 66(2) GDPR and EDPB Urgent Binding Decision 01/2021 on the request under Article 66(2) GDPR from
the Hamburg (German) Supervisory Authority for ordering the adoption of final measures regarding Facebook
Ireland Limited (hereinafter ‘EDPB Urgent Binding Decision 01/2021’), adopted on 12 July 2021, section 2.

Adopted 15 advertisements on the basis of observed behaviour for which Meta IE relies on Article 6(1)(b) GDPR or
Article 6(1)(f) GDPR.

59. The EDPB therefore considers that this condition is satisfied.

2.2 Existence of a request pursuant to Article 66(2) GDPR coming from a SA in the
EEA

60. On 26 September 2023, the NO SA requested the EDPB to adopt an urgent binding decision pursuant

to Article 66(2) GDPR, by introducing a formal request in the IMI system (Article 17 of the EDPB RoP).

61. The EDPB therefore considers that this condition is satisfied.

2.3 Conclusion
62. The EDPB concludes it is competent to adopt an urgent binding decision under Article 66(2) GDPR.

3 THE RIGHT TO GOOD ADMINISTRATION

63. The EDPB is subject to Article 41 of the Charter (right to good administration). This is also reflected in
Article 11(1) EDPB RoP.

64. Similarly to what is provided under Article 65(2) GDPR, an urgent binding decision of the EDPB is
addressed to the lead supervisory authority and all the supervisory authorities concerned, and is
60
binding on them . It is not aimed to address directly any third party.

65. Nevertheless, the EDPB assessed whether all the documents it received to be used in order to take its
decision were known by Meta IE and Facebook Norway, and whether Meta IE and Facebook Norway

were offered the opportunity to exercise their right to be heard on all the elements of fact and law to
be used by the EDPB to take its decision.

66. In this respect, the NO SA informed the EDPB Secretariat that it made available all the documents it
submitted to the EDPB to Meta IE and Facebook Norway. The other documents (submitted by the IE

SA), if not already known to the companies, were made available to them by the EDPB Secretariat by
way of letters of 13 October 2023 and 18 October 2023 . 62

67. On 17 September 2023, the NO SA sent a letter to Meta IE and Facebook Norway asking for their

submissions on its draft request for an Article 66(2) GDPR urgent binding decision from the EDPB.
Following extensions of the deadline initially set, these submissions were provided on 26 September
2023 (hereinafter, ‘Meta IE’s Submissions of 26 September 2023’ and ‘Facebook Norway’s

Submissions of 26 September 2023’). These submissions also attached Meta IE’s and Facebook
Norway’sprevioussubmissionsof25August2023 concerning the intentionof theNO SA to request an
urgent binding decision of the EDPB (‘Meta IE’s Submissions of 25 August 2023’ and ‘Facebook

Norway’s Submissions of 25 August 2023’). In addition to these submissions, the file submitted to the
EDPB also included multiple documents produced by Meta IE and/or Facebook Norway in the context

oftheassessmentofcompliancewiththeIESADecisionsand/orinthecontextofthelegalproceedings

60Art. 65(2) GDPR. According to Art. 66(4) GDPR, this provision is derogated in respect of the deadline for

61option; therefore, the last sentence of Art. 65(2) GDPR fully applies.
Letter of the EDPB Chair to Meta IE and Facebook Norway of 13 October 2023.
62Letter of the EDPB Chair to Meta IE and Facebook Norway of 18 October 2023.

Adopted 16 63
concerning the NO SA Order , where Meta IE’s and Facebook Norway’s positions in respect of the
elements being considered by the EDPB were clarified.

68. On the basis ofthe assessment performed by the EDPBSecretariat,Meta IE andFacebook Norwayhad

not yet had an opportunity to make their views known on some elements of fact and law included in
some documents of the file to be used by the EDPB to take its decision. The Chair of the EDPB invited
bywayofherletterof13October2023 MetaIEandFacebookNorwaytoprovidewrittensubmissions

to the EDPB on these elements. These submissions, together with annexes, were provided by Meta IE
and Facebook Norway on 16 October 2023 (‘Meta IE’s Submissions of 16 October 2023” and
65
“Facebook Norway’s Submissions of 16 October 2023’) and were subsequently added to the file.

69. On 18 October 2023, the Chair of the EDPB sent a new letter to Meta IE and Facebook Norway
informing them of the document added to the file on 17 October 2023 and providing them with an
opportunity to make written submissions on it. Meta IE and Facebook Norway made written

submissionson19October2023(‘Meta IEandFacebookNorway’sSubmissionsof19October2023’),
which were added to the file.

70. The EDPB notes that Meta IE and Facebook Norway received the opportunity to make their views

regarding all the legal and factual elements used by the EDPB to take this decision. Therefore, in case
Meta IE and Facebook Norway would be found to be entitled to a right to be heard in this procedure,
it would be in any case fully respected.

4 ON THE NEED TO REQUEST FINAL MEASURES

71. TheEDPBconsidersthatinorderforanurgentbindingdecisionadoptedpursuanttoArticle66(2)GDPR
toorderfinalmeasurestwocumulativeconditionsneedtobefulfilled:theexistenceofone(orseveral)
infringement(s) and the existence of an urgency situation justifying a derogation from the regular

cooperation procedure.

72. Consequently, the sections below assess first the existence of infringements (Section 4.1), then the
existence of an urgency situation (Section 4.2).

4.1 On the existence of infringements

63By way of example, these documents included the Letter from Meta IE to the IE SA of 31 May 2023, the letter
from Meta IE to the IE SA of 21 June 2023, the Letter from Meta IE to the IE SA of 30 June 2023, Meta IE’s
Response to the IE SA Provisional Position Paper of 4 August 2023, Letter from Meta IE to the IE SA of 27 July

6423, Letter from Meta IE to the NO SA of 27 July 2023.
Letter of the Chair of the EDPB to Meta IE and Facebook Norway of 13 October 2023, replying to their letter of
28 September 2023 where they requested that Meta IE and Facebook Norway be granted access to any
documents in the administrative file, and tobe afforded an opportunitytomake submissions afterreviewing the
file in advance of the EDPB reaching a final decision.
65On 18 October 2023, Meta IE and Facebook Norway provided new versions of two of their annexes. In these

letters of 16 October 2023, Meta IE and Facebook Norway also informed the EDPB that they filed a complaint
before the Oslo District Court challenging and seeking to invalidate the NO SA Order on the merits.

Adopted 17 4.1.1 On the infringement of Article 6(1) GDPR

4.1.1.1 Summary of the overall position of the NO SA

73. TheNOSArequestedtheEDPBtoadoptanurgentbindingdecisionorderingfinalmeasurestobetaken

across the EEA to ensure that ‘personal data shall not be processed for behavioural advertising based
on Article 6(1)(b) [GDPR] or Article 6(1)(f) GDPR in the context of the Services’ . In the NO SA Request

to the EDPB, the NO SA defines ‘behavioural advertising’ as ‘targeting ads on the basis of observed
behaviour’ . In the view of the NO SA, this includes ‘targeting ads on the basis of inferences drawn

from observed behaviour as well as on the basis of data subjects’ movements, estimated location and
how data subjects interact with ads and user-generated content’ . This definition is in line with their
69
understanding of the scope of the IE SA Decisions .

74. In the NO SA Request to the EDPB, the NO SA states that ‘[Meta IE] has failed to ensure compliance
70
with(...)[theIESADecisions]’ .According to the NOSA,thereisconsensusamong theCSAsthat Meta
IE’s processing of personal data for behavioural advertising purposes is currently infringing the GDPR,

and in particular Article 6(1)(b) GDPR, Article 6(1)(f) GDPR, and the duty to comply with the decisions
of the SAs .1

75. The NO SA’s analysis is based on the following elements:

• Despite the IE SA Decisions, Meta IE still relies on Article 6(1)(b) GDPR to process (1) location
information, including GPS location, data subjects’ activity on Meta products and the places

data subjects like to go and the businesses and people data subjects are near; and (2)

information about ads that Meta IE shows and how data subjects engage with those ads; for
the purpose of behavioural advertising . 72

• Meta IE relies on Article 6(1)(f) GDPR to process some personal data for the purpose of

behavioural advertising, while Article 6(1)(f) GDPR is not an appropriate legal basis for this
processing .73

• The IE SA also considers thatMeta IE failed to demonstrate that it has a lawful basis to process
platform behavioural data for behavioural advertising , and did not provide any

documentation confirming that it stopped processing personal data for the purpose of
75
behavioural advertising on the basis of Article 6(1)(b) GDPR and Article 6(1)(f) GDPR .

66NO SA Request to the EDPB, p. 12.
67NO SA Request to the EDPB, p. 12.
68NO SA Request to the EDPB, p. 3-4, referring to the NO SA Order.
69
NO SA Order, p. 3.
70NO SA Request to the EDPB, p. 6.
71NO SA Request to the EDPB, p. 5-7.
72NO SA Request to the EDPB, p. 4 which refers to the NO SA Order. See also NO SA Order, section 7.2.1.1.
73
NO SA Request to the EDPB, p. 4. The NO SA Request to the EDPB only mentions that Meta IE changed its legal
basis for ‘some of its processing’ of personal data. Meta IE clarifies in its Letter to the IE SA of 30 June 2023 that
these changes relate to the personal data collected on its products (paragraph 7c). A description of this data is
provided in section 2.3 of the Meta IE Compliance Reports.
74
NO SA Request to the EDPB, p. 5.
75NO SA’s Decision to Impose a Coercive Fine on Meta IE and Facebook Norway of 7 August 2023, p. 4.

Adopted 1876. The NO SA states that Meta IE has already been given enough time to bring its processing into
compliance with Article 6(1) GDPR, and takes the view that ‘[Meta IE] is making use of dilatory
76
strategies’ .

77. The NO SA considers that there is sufficient information to allow the EDPB to conclude that
infringements are taking place . 77

4.1.1.2 Inappropriate reliance on Article 6(1)(b) GDPR

4.1.1.2.1 Summary of the position of the NO SA

78. The NO SA takes the view that Meta IE’s infringement of Article 6(1)(b) GDPR in the context of its

behavioural advertising processing activities was confirmed by the EDPB Binding Decisions and the IE
SADecisionswhichconcluded,inlinewiththeviewsexpressedinpreviousEDPBguidelines,thatArticle

6(1)(b) GDPR is an unsuitable legal basis for behavioural advertising processing activities, both
generally and in the case at issue . 78

79. The NO SA finds that Meta IE has incorrectly understood what constitutes ‘processing of personal data

for the purposes of behavioural advertising’ in the IE SA Decisions . It states that Meta IE’s processing
80 81
of data subjects’ location data and engagement with ads is part of Meta IE’s processing of personal
data for the purpose of behavioural advertising concerned by the IE SA Decisions 82, and that, pursuant
83
to those decisions, such processing which is based on Article 6(1)(b)GDPR, is unlawful .

4.1.1.2.2 Summary of the position of the controller

80. MetaIEstatesthat,priortotheIE SADecisions,itreliedonArticle 6(1)(b)GDPR inagoodfaithmanner

and its ‘bona fide belief that it was lawful for it to do so’ , considering that different national courts
found that Meta IE may validly rely on Article 6(1)(b) GDPR to process personal data for the purposes

of behavioural advertising . 85

76
NO SA Request to the EDPB, p. 6.
77NO SA Request to the EDPB, p. 7.
78NO SA Request to the EDPB, footnotes 4 and 10, referring to EDPB Guidelines 8/2020 on the targeting of social
media users, paragraphs 49 and 71.
79
NO SA Order, section 7.2.1.1, p. 14 (referring to the IE SA FB Decision paragraph 10.44(b) and the IE SA IG
Decision paragraph 417(b), respectively).
80According to the NO SA, ‘[Meta IE]’s use of location data to inform which ads are displayed to data subjects

clearly constitutesBehaviouralAdvertising.Itisuncleartouswhatthislocationisestimatedonthebasisof,ifnot
the data subject’s behaviour’. NO SA Order, section. 7.2.1.1, p. 15.
81According to the NO SA, ‘For information about data subjects’ engagement with ads, we understand that data
subjects may click on “Hide Ad” and that one effect of this would be that the particular ad is not shown to that

data subject again. We agree with [Meta IE]’s assertion set out in its letter of 30 June 2023 that this in itself does
not constitute processing for Behavioural Advertising. However, to the extent that this or any other engagement
with an ad is used to inform which other ads a data subject should see, we find that the processing of personal

82ta does take place for Behavioural Advertising’, NO SA Order, section. 7.2.1.1, p. 15.
NO SA Order, section. 7.2.1.1, p. 15. The NO SA also states this in the NO SA Mutual Assistance Request, p. 5.
83NO SA Order, p. 15.
84Meta IE’s Submissions of 25 August 2023, paragraph 65.
85
Meta IE’s Submissions of 25 August 2023, paragraph 65; Written Pleading of 18 August 2023 from Meta IE to
Oslo District Court, p. 6.

Adopted 19 86
81. Meta IE acknowledges that the IE SA Decisions concluded differently to these cases , and argues that
it took since then substantial steps to bring its processing activities into ‘what it believes was
87
compliance with those decisions’ . Meta IE states that it changed its legal basis from Article 6(1)(b)
GDPR to Article 6(1)(f) GDPR for the processing of personal data collected on Meta’s products for the
88
purposes of behavioural advertising to comply with the IE SA Decisions . It states further that it relies
on Article 6(1)(a) GDPR to process personal data obtained from third party advertising partners 8.

82. In relation to the definition of what behavioural advertising encompasses, Meta IE states that its

processing of personal data for the purpose of behavioural advertising comprises the use of
‘information collected on Meta’s products about a user’s behaviour over time in order to assess and

understand users’ interests and preferences’. According to Meta IE, this includes signals such as ‘a
user’s activity across Meta’s products, engagement with content such as other users’ posts or which

pages they visit, the individuals and groups they communicate with, and/or what the user searches
90
for’ . Meta IE states that it processes this personal data to assess and understand users’ interests and
preferences, and to provide them with behavioural advertisements . 91

83. However, Meta IE takes the view that its processing of a) demographic data (including location data),

b) In-use app, browser and device data c) advertisement shown and d) advertisement interaction
data does not constitute behavioural advertising, and therefore falls beyond the scope of the IE SA

Decisions 93.Inthisrespect,MetaIEarguesthatitsprocessingofsuchdataonthebasisofArticle6(1)(b)
GDPR is valid .4

84.

95
.

4.1.1.2.3 Analysis of the EDPB

85. The EDPBBindingDecisionsinstructed, inter alia, the IESA to findaninfringementofArticle 6(1)GDPR
on the ground that Meta IE inappropriately relied upon Article 6(1)(b) GDPR to process personal data

for the purposes of behavioural advertising, and therefore lacked a legal basis to process this data for
this purpose . In relation to this, the EDPB also instructed the IE SA to include in each of its final

86Written Pleading of 18 August 2023 from Meta IE to Oslo District Court, p. 6.
87Meta IE’s Submissions of 25 August 2023, paragraph 65; Written Pleading of 18 August 2023 from Meta IE to
Oslo District Court, p. 6.
88
Meta IE Compliance Report on IE SA FB Decision, paragraphs 2.1 and 2.3 and Meta IE Compliance Report on IE
SA IG Decision, paragraphs 2.1 and 2.3.
89 Such data includes information from third party websites, apps and certain offline interactions (such as

purchases). See Meta IE Letter to the IE SA of 30 June 2023, paragraph 7c and footnote 150 below.
90Meta IE Compliance Report on IE SA FB Decision, paragraph 2.2; Meta IE Compliance Report on IE SA IG
Decision, paragraph 2.2
91Meta IE Compliance Report on IE SA FB Decision, paragraph 2.2; Meta IE Compliance Report on IE SA IG

Decision, paragraph 2.2.
92As described in section 5.8.2 of the Meta IE Compliance Reports.
93Meta IE’s Request for preliminary injunction of 4 August 2023, p. 27.
94
95Meta IE’s Request for preliminary injunction of 4 August 2023, p. 27.

96
EDPB Binding Decision 3/2022, paragraphs 133 and 484; EDPB Binding Decision 4/2022, paragraphs 137 and
451.

Adopted 20 decisions an order for Meta IE to bring it processing of personal data for the purpose of behavioural

advertising in the context of the Facebook and Instagram services into compliance with Article 6(1)
GDPR within three months 97.

86. On the basis of the EDPB Binding Decisions, the IE SA Decisions ordered Meta IE to bring its processing
into compliance with Article 6(1) GDPR , the IE SA ordered Meta IE to take the necessary actions to

bring into compliance with Article 6(1) GDPR and to address the finding that Meta IE is not entitled to
processpersonaldataforthepurposeofbehaviouraladvertisingonthebasisofArticle6(1)(b)GDPR . 99
The EDPB notes that the IE SA made clear that such action may include, but is not limited to, the

identification of an appropriate alternative legal basis in Article 6(1) GDPR 100.

87. In the Compliance Reports, Meta IE indicated that it changed the legal basis it relies on for the

processingof personaldata collectedon itsproductsforbehavioural advertising purposesfromArticle
6(1)(b)GDPR to Article6(1)(f)GDPRasof 5April2023, which wasthedeadlineforcompliance withthe
101
IE SA Decisions . Meta IE also states that it still relies on Article 6(1)(b) GDPR to process what it
considers to be ‘limited categories of non-behavioural information’ to show advertising on Facebook
102
and Instagram .

88. In the IE SA Final Position Paper assessing Meta IE’s compliance with the IE SA Decisions and taking
into consideration the comments received by the CSAs on such compliance, the IE SA addressed two

key questions relevant for the purpose of this section of this urgent binding decision: the definition of
behavioural advertising and whether the processing of Meta IE for advertising purposes relying upon
103
Article 6(1)(b) GDPR falls within such definition .

89. As to the definition of behavioural advertising, the IE SA referred to the definition provided by the
104
Article 29 Working Party in its Opinion 2/2010 being referred to by Meta IE in the Compliance
Reports 10:

‘Behavioural advertising is advertising that is based on the observation of the behaviour of

individuals over time. Behavioural advertising seeks to study the characteristics of this
behaviour through their actions (repeated site visits, interactions, keywords, online content) in

order to develop a specific profile and thus provide data subjects with advertisements tailored
to match their inferred interests’ 106.

97
EDPB Binding Decision 3/2022, paragraphs 288 and 493; EDPB Binding Decision 4/2022, paragraphs 290 and
459.
98See IE SA FB Decision, paragraph 10.44b; IE SA IG Decision, paragraph 212. See also IE SA Final Position Paper,
paragraph 2.1.
99
IE SA FB Decision, paragraph 10.44b and IE SA IG Decision, paragraph 212.
100IE SA FB Decision, paragraph 10.44b and IE SA IG Decision, paragraph 212.
101Meta IE Compliance Report on IE SA FB Decision, paragraph 2.1; Meta IE Compliance Report on IE SA IG
Decision, paragraph 2.1.
102
Meta IE Compliance Report on IE SA FB Decision, paragraph 3.1.3; Meta IE Compliance Report on IE SA IG
Decision, paragraph 3.1.3.
103IE SA Final Position Paper, paragraphs 7.3 - 7.22.
104IE SA Final Position Paper, paragraph 7.5, referring to Article 29 Working Party Opinion 2/2010 adopted on 22

June 2010, p. 5.
105Meta IE Compliance Report on IE SA FB Decision, p. 4; Meta IE Compliance Report on IE SA IG Decision, p.4.
106Article 29 Working Party Opinion 2/2010 adopted on 22 June 2010, p. 5.

Adopted 2190. TodefinewhethertheprocessingofMetaIEforadvertisingpurposesrelyinguponArticle6(1)(b)GDPR
falls within such definition, the IE SA also referred to the description of Meta IE’s processing for
107
behavioural advertising purposes provided by the EDPB in the EDPB Binding Decisions :

‘[Meta IE] collects data on its individual users and their activities on and off its Facebook social
networkservicevianumerousmeanssuchastheserviceitself,otherservicesoftheMetagroup
including Instagram, WhatsApp and Oculus, third party websites and apps via integrated

programming interfaces such as Facebook Business Tools or via cookies, social plug-ins, pixels
and comparable technologies placed on the internet user’s computer or mobile device.
According to the descriptions provided, [Meta IE] links these data with the user’s Facebook

accounttoenableadvertiserstotailortheiradvertisingtoFacebook’sindividualusersbasedon
their consumer behaviour, interests, purchasing power and personal situation. This may also
include the user’s physical location to display content relevant to the user’s location’10.

91. The IE SA noted that Meta IE relies on Article 6(1)(b) GDPR for a more limited set of personal data for
109
advertising purposes in the Facebook and Instagram services . The EDPB notes that Meta IE argues
that it is relying on Article 6(1)(b) GDPR for the processing of ‘limited non-behavioural information’ to
show advertisements, as described in its Compliance Reports 110:

‘a) Demographic data. This consists of age users provide, gender users provide, and estimated
general location. The use of demographic data is required to ensure advertising is appropriate
in accordance with the Terms of Use/Service. For example, (...) (c) relying on location is
necessary to ensure advertisements that [Meta IE] show users are in an appropriate language

and relate to an appropriately located company or service (e.g., [Meta IE] does not show users
advertisements for products which are not available in their country);

b) In-use app, browser and device data. (...) This includes the type of device being used, the
language chosen on the device at that time and the version of the Facebook/Instagram app
being used. These data points are necessary to deliver advertisements appropriately. For
example,toproperlyformattheadvertisementtomeettheviewingrequirementsofthedevice,

to avoid users being shown advertisements for apps which are not supported by the operating
systemontheirdevice,andensurethattheadvertisementisinthechosenlanguageoftheuser;

c) Advertisements shown. This consists of information on whether the advertisement is
rendered and delivered to a user. This information is a basic metric which [Meta IE] needs in
order, for example, to ensure the number of advertisements that [Meta IE] shows to users is at
an appropriate level and to ensure that the same advertisements are not being directed to the

user repeatedly. The information does not indicate whether the user has actually noticed the
advertisement;

d) Advertisement interaction data. This consists of two forms of information provided by users
if they choose to interact with advertisements: (a) to provide negative feedback on their
advertising experience, for example by selecting to “hide” or report an advertisement; and (b)

107IE SA Final Position Paper, paragraph 7.4, referring to EDPB Binding Decision 3/2022, paragraphs 95-96 and
EDPB Binding Decision 4/2022, paragraphs 98-99.
10EDPB Binding Decision 3/2022, paragraphs 95-96 and EDPB Binding Decision 4/2022, paragraphs 98-99.
10IE SA Final Position Paper, paragraphs 2.2, 4.5 and 7.6.
110
As referred to in the IE SA Final Position Paper, paragraph 7.6.

Adopted 22 to provide positive feedback on their advertising experience, for example by clicking
advertisements they find relevant’. 111

92. The EDPB notes the IE SA’s following findings:

• In relation to location data, the IE SA took the view that Meta IE did not provide sufficient

information to allow the IE SA to understand why location data would fall outside the
112
definition of behavioural data . According to the IE SA, Meta IE did not explain whether it is
processing the user’s physical location or the location that they proactively provide to Meta IE

to target ads to them.
• In relation to device data, the IE SA indicated that device information could also be used to

identify different market segments, which in turn could be processed for behavioural
advertising purposes 113.

• In relation to advertisements shown, the IE SA indicated that more clarity from Meta IE would
be required as to whether Meta IE only analyses records of ads shown (which, according to

the IE SA, are not amounting to behavioural data) or also behavioural ads presented by other
tools through a shared interface screen, which would also add to the behavioural processing

by Meta IE 114.

• In relation to advertisement interaction data, the IE SA underlined that ‘interaction data’ was
listed in the definition of behavioural advertising in the Article 29 Working Party Opinion,
115
which was incorporated by Meta IE into its Compliance Reports . The IE SA therefore
underlined the lack of clarity on how Meta IE would then distinguish ‘advertisement

interaction data’, listed in point d) above from ‘interaction data’ included in the Article 29
Working Party Opinion 2/2010. The IE SA raised concerns as to the fact that Meta IE stated

that it relies on Article 6(1)(b) GDPR in circumstances where the user provides positive
advertising feedback 116. According to the IE SA, this falls within the definition of behavioural

111
Meta IE Compliance Report on IE SA FB Decision, paragraph 5.8.2; Meta IE Compliance Report on IE SA IG
Decision, paragraph 5.8.2.
112In particular,the IE SAstatedthat‘[Meta IE]hasexplainedthe usesof this data, but notwhy theseusesdo not
amount to behavioural processing. For example, it is unclear if location data is used by [Meta IE] to tailor ads to
users on the basis of visits to certain types of shops, their travel to business hubs or holiday destinations, or the

times of year at which they travel. If [Meta IE] use location data in these ways, then this would be processing
personal data for the purposes of behavioural advertising, both by reference to the EDPB’s description of such
advertising, as set out at paragraph 7.4 above, and by reference to the Article 29 Working Party Opinion relied
on by [Meta IE]’, IE SA Final Position Paper, paragraph 7.11.
113The IE SA stated that ‘it is unclear whether [Meta IE] identifies device information as a different market

segment. While the processing of device information to serve ads may not amount to behavioural advertising, it
ispossiblethat[MetaIE]identifiescertaindevicesasadifferentmarketsegment.Thetypeofdevicecouldindicate
spending power or history, which could be processed for behavioural purposes’, IE SA Final Position Paper,
paragraph 7.12.
114
115IE SA Final Position Paper, paragraph 7.13.
Article 29 Working Party Opinion 2/2010 adopted on 22 June 2010, p. 5 referred to in Meta IE Compliance
Report on IE SA FB Decision, p. 4 and Meta IE Compliance Report on IE SA IG Decision, p. 4.
116The IE SA’s concerns relate in particular to Meta IE’s statement that when ‘the user provides positive
advertising feedback (e.g., actively choosing to click on a specific ad they find relevant and want to see), [Meta

IE] similarly needs to use that information to ensure it is providing the user with an appropriate and relevant
personalised advertising experience pursuant to the Terms of Service’, see IE SA Final Position Paper, paragraph
7.14, referring to Meta IE Compliance Report on IE SA FB Decision, paragraph 5.8.2 and Meta IE Compliance
Report on IE SA IG Decision, paragraph 5.8.2.

Adopted 23 advertising provided by the Article 29 Working Party Opinion 2/2010 as it involves Meta IE
’117
‘inferringconclusionsaboutuserpreferencesfromusers’interactionwithanadvertisement .
Following further information provided by Meta IE on 30 June 2023 to the IE SA on negative

advertisingfeedback 11,theIESAindicatedthat,totheextentthatMetaIE‘processespersonal

data solely to prevent a specific hidden ad being shown to a user, then the [IE SA] agrees that
this does not amount to behavioural advertising. However, to the extent that [Meta IE] infers

a user’s advertising preferences from the fact that they have hidden an ad, then this does fall
withinthedefinitionofbehaviouraladvertising’ 119.TheIESAaddedthat‘[MetaIE]submissions

are too vague to determine whether it processes personal data just to hide the specific ad, or

whether it draws inferences from the choice to hide an ad. The reference in the justification of
this processing to a user’s “personal advertising experience” indicates that the decision to hide
120
onead could beused toinferpreferencesabout theadsthat a user receives moregenerally’ .
TheEDPBnotesthatthisappreciationisinlinewiththeobservationsmadebytheDEHamburg
121
SA .The IE SA thereforeprovidedthat‘it appearsfrom theinformationprovidedby[MetaIE]
that it uses data about hidden ads to engage in behavioural advertising’. The IE SA also

provided similar conclusions for the positive feedback, raising that ‘Using information about

click-throughs to determine what types of ads a user wants to see in the future falls plainly
within the definition of behavioural advertising provided by [Meta IE] to the [IE SA]’ 12.

93. In light of the above, the EDPB notes that the IE SA found that Meta IE still conducts some processing
for the purposes of behavioural advertising in reliance on Article 6(1)(b) GDPR 123.

94. In addition, the IE SA also indicated the lack of sufficient information to explain why categories (a) to
(d) were not behavioural data 124. The EDPB also notes that on this basis, the IE SA found that Meta IE
had not demonstrated compliance with the IE SA Decisions as regards reliance on Article 6(1)(b) GDPR

for behavioural advertising 12.

95. The EDPB notes that this view was also expressed by certain CSAs replying to the IE SA IMI Informal

Consultations. More specifically, the FI SA stated that ‘the following personal data seems to be still
unlawfully collected for behavioural advertising purposes under Article 6(1)(b) [GDPR]: “Information

117
IE SA Final Position Paper, paragraph 7.15.
118Meta IE said that ‘with respect to negative advertising feedback, if a user selects the option that is available
to “Hide Ad – never see this ad again,” then [Meta IE] needs to use that information to ensure that choice
regarding the user’s personal advertising experience (i.e., what advertisements they do not want to see) is

respected’, IE SA Final Position Paper, paragraph 7.16.
119IE SA Final Position Paper, paragraph 7.16, referring to the comments of the DE Hamburg SA on the IE SA
Provisional Position Paper.
120IE SA Final Position Paper, paragraph 7.16.
121
‘Allowing[MetaIE]tofurtherjustifywhetheritprocessespersonaldataonlytohideaparticularad,orwhether
it draws inferences from the decision to hide an ad, is nothing more than leaving a choice not to describe the
actual purpose of the processing, to formally fall short of the definition of behavioural advertising. In doing so,
hiding certain ads without anything deriving from that decision would contradict [Meta IE]´s business model. To

the extent that this or other engagement with an ad is used to learn what other ads a data subject should see,
Hamburg SA notes that the processing of personal data serves purposes of behavioural advertising’, Views of DE
Hamburg SA of 4 May 2023; as referred to in the IE SA Final Position Paper, paragraph 7.17.
122IE SA Final Position Paper, paragraph 7.19.
123
IE SA Final Position Paper, paragraph 6.2 and paragraph 8.1.
124IE SA Final Position Paper, paragraph 7.22.
125IE SA Final Position Paper, paragraphs 7.1, 7.22 and 8.1.

Adopted 24 about ads we show you and how you engage with those ads” and “Location information”’. 126The IT SA

also stated that ‘[Meta IE]’s proposal is not such as to adequately implement the order to bring the
processing into compliance insofar as it misclassifies part of the user-related information and thereby

applies the legal basis of contractual performance under Article 6(1)(b) GDPR to the serving of ads
which, actually, are behavioural in nature’ 12.

96. The EDPB observes that if any of the data listed in paragraph 91 of this urgent binding decision may be

considered as falling within the scope of the definition of behavioural advertising, there are grounds
forfinding thatMetaIEisinfringingArticle6(1)GDPR.Thisis becauseMetaIE wouldstill beprocessing

personal data for the purpose of behavioural advertising on the basis of Article 6(1)(b)GDPR, although
it was considered unlawful by the IE SA Decisions 12.

97. Inthisrespect,theEDPBsharestheIESA’sviewthatMetaIEstillconductssomeprocessingofpersonal

data for the purposes of behavioural advertising in reliance on Article 6(1)(b) GDPR 12, at least for the
following categories of data:

• Location data - the EDPB finds, in line with the view of the IE SA, that Meta IE failed to
demonstrate that its processing of location data does not constitute processing for the
130
purpose of behavioural advertising . It is unclear to the EDPB, as it is to the NO SA and the IE
SA, on which basis the location is estimated, if not the data subject’s behaviour. The EDPB

consequently finds, in line with the view of the NO SA, that Meta IE’s processing of location
131
data to inform which ads are displayed to data subjects constitutes behavioural advertising .
• Advertisement interaction data - the EDPB finds, in line with the view of the IE SA, that Meta

IE failed to demonstrate that its processing of advertisement interaction data does not
constitute processing for the purpose of behavioural advertising. The EDPB shares the view of

the IE SA that ‘[Meta IE] is recording the behaviour of the users when they are presented with
adsandusethattotailorfuturepresentationofads’ 132.TheEDPBconsequentlyfindsthatMeta

IE’s processing of advertisement interaction data constitutes behavioural advertising for the
following reasons:

o As rightly pointed out by the IE SA, the EDPB recalls that interaction is listed among

the data types in the definition of behavioural advertising in the Article 29 Working
Party Opinion 2/2010 13.

o The EDPB observes that irrespective of whether the data subject provides negative or
positivefeedbackon theadstheysee, MetaIEstatesthattheinteractionswill beused
134
toprovidean‘appropriateandrelevantadvertisingexperience’ whichindicatesthat
Meta IE is inferring conclusions about user preferences from such interaction.

126Views of the FI SA of 15 May 2023, p. 2.
127Views of IT SA on IE SA FB Decision of 23 May 2023, p. 2, and views of IT SA in IE SA IG Decision of 23 May
2023, p. 2.
128
In this respect, the IE SA Decisions implemented the findings described in the EDPB Binding Decision 3/2022,
paragraphs 94-133 and the EDPB Binding Decision 4/2022, paragraphs 97-137.
129See paragraphs 92-93 above.
130IE SA Final Position Paper, paragraph 7.11.
131
132IE SA Final Position Paper, paragraph 7.11.
IE SA Final Position Paper, paragraph 7.14.
133IE SA Final Position Paper, paragraph 7.14.
134Meta IE Compliance Report on IE SA FB Decision, p. 16.

Adopted 25 o With respect to negative feedback (i.e., where the data subject clicks to hide/report

an ad), the EDPB observes that Meta IE states that it needs to use this information ‘to
ensure that choice regarding the user’s personal advertising experience (i.e., what
135
advertisements they do not want to see) is respected’ . The EDPB also observes that
MetaIEstatesthat theoptions‘HideAd’and‘Report Ad’areusedto‘directlyinfluence

the ads [users] see’ 13. The EDPB shares the view of the IE SA that ‘the reference in the

justification of this processing to a user’s “personal advertising experience” indicates
that the decision to hide one ad could be used to infer preferences about the ads that
137
a user receives more generally’ and therefore that ‘it appears from the information
provided by [Meta IE] that it uses data about hidden ads to engage in behavioural
138
advertising’ .
o With respect to positive feedback, the EDPB observes that Meta IE states that when

‘the user provides positive advertising feedback (e.g., actively choosing to click on a
specific ad they find relevant and want to see), [Meta IE] similarly needs to use that

information to ensure it is providing the user with an appropriate and relevant
139
personalised advertising experience pursuant to the Terms of Service’ .
Consequently, the EDPB also shares the view of the IE SA that this practice falls within

the definition of behavioural advertising provided by the WP29 Opinion as it involves
Meta IE ‘inferring conclusions about user preferences from users’ interaction with an
’140
advertisement .

98. In conclusion, the EDPB finds that Meta IE is inappropriately relying on Article 6(1)(b) GDPR to process

location data and advertisement interaction data collected on its products for the purpose of
behavioural advertising.

99. In addition, the EDPB shares the view of the IE SA that Meta IE did not provide sufficient information
to explain whyother categoriesofdata processed by Meta IEdo notamount to behaviouraldata,such
141
as device data and advertisements shown . In this respect, the EDPB finds, in line with the view of
the IE SA, that in relation to device data, if Meta IE would use device data to identify different market
segments, this would constitute a processing for behavioural advertising for which it would rely

inappropriately on Article 6(1)(b), infringing Article 6(1) GDPR 142.

135Letter from Meta IE to the IE SA of 30 June 2023, p. 5.
136Meta IE’s submissions of 16 October 2023 to the Oslo District Court. For Instagram specifically, also see the

screenshots included in p. 35 of the Annex 3 to the Compliance Report on IE SA IG Decision.
137IE SA Final Position Paper, paragraph 7.16.
138IE SA Final Position Paper, paragraph 7.18.
139Meta IE Compliance Report on IE SA FB Decision, paragraph 5.8.2 and Meta IE Compliance Report on IE SA IG

140ision, paragraph 5.8.2.
IE SA Final Position Paper, paragraph 7.15.
141See paragraph 89 above.
142The IE SA stated that ‘it is unclear whether [Meta IE] identifies device information as a different market

segment. While the processing of device information to serve ads may not amount to behavioural advertising, it
ispossiblethat[MetaIE]identifiescertaindevicesasadifferentmarketsegment.Thetypeofdevicecouldindicate
spending power or history, which could be processed for behavioural purposes’, IE SA Final Position Paper,
paragraph 7.12.

Adopted 26 4.1.1.3 Inappropriate reliance on Article 6(1)(f) GDPR

4.1.1.3.1 Summary of the position of the NO SA

100. The NO SA considers that Article 6(1)(f) GDPR does not constitute an appropriate legal basis under
143
Article 6(1) GDPR for Meta IE’s behavioural advertising processing .

101. The NO SA refers to the IE SA Final Position Paper, in which the IE SA concluded that Meta IE continues
to fail to rely onavalidlegalbasis toprocesspersonaldata for behaviouraladvertising purposesunder

Article 6(1) GDPR, despite Meta IE’s switch to Article 6(1)(f) GDPR as a legal basis for its behavioural
advertising processing on 5 April 2023 14. The NO SA outlines that this conclusion was supported by
145
several CSAs explicitly, without any objection being raised by the other CSAs .

102. Further, the NO SA states that paragraph 117 of the CJEU Bundeskartellamt Judgment validates the

conclusion that Article 6(1)(f) GDPR does not constitute an appropriate legal basis for Meta IE’s
behavioural advertising processing 146. In this respect, the NO SA acknowledges Meta IE’s view that the

judgment is irrelevant and relates to a different aspect of Meta IE’s processing for behavioural
advertising 147. However, the NO SA argues that the ruling does apply to Meta IE’s behavioural
148
advertising practices in general and, therefore, that it cannot be disregarded .

4.1.1.3.2 Summary of the position of the controller

103. In its Compliance Reports, Meta IE states that it has changed its legal basis from Article 6(1)(b) GDPR

to Article 6(1)(f) GDPR for ‘Behavioural Advertising Processing’ - solely for personal data collected on
Meta’s products 149- to comply with the IE SA Decisions 150.

104. Asmentionedinparagraph81above,MetaIEdefinesthescopeofthisprocessingoperationprocessed
on the basis of Article 6(1)(f) GDPR as follows:

‘Behavioural Advertising Processing comprises the use by [Meta IE] of information collected on

[Meta’s] products about a user’s behaviour over time in order to assess and understand users’

143NO SA Request to the EDPB, p. 4.
144NO SA Request to the EDPB, p. 5. As specified in paragraph 104 below, Meta IE defines the scope of this
processing operation processed on the basis of Art. 6(1)(f) GDPR as relating to personal data collected on Meta’s

products.
145NO SA Request to the EDPB, p. 5.
146NO SA Request to the EDPB, p. 5.
147NO SA Request to the EDPB, p. 6. As specified in paragraphs 109 and 142 below, in paragraph 1.5 (A) of Meta

IE’s Response to the IE SA’s Provisional Position Paper of 4 August 2023, Meta IE considers that the
Bundeskartellamt Judgment ‘does not rule out Article 6(1)(f) [GDPR] “as a matter of principle” as a valid legal
basis for [Meta IE]’s Behavioral Advertising Processing. The judgment assessed Article 6(1)(f) [GDPR] (and the
element of “necessity”) in the context of different processing than is at-issue here (i.e., data collected off-[Meta],

and to a limited extent cross-product data processing, as opposed to data collected on-[Meta] products). (...)
Further,theCJEUdidnot(andcouldnotasamatteroflaw)issueablanketfindingthatusers’interestswillalways
outweigh [Meta IE]’s and third parties’ legitimate interests in the context of personalised advertising (...).’
148NO SA Request to the EDPB, p. 6.
149
Meta IE indicates to rely on Art. 6(1)(a) GDPR to process personal data about users’ activity off-Meta’s
products (such as on third-party websites, apps and certain offline interactions (e.g., purchases)), obtained by
MetaIEfromthirdpartyadvertisingpartnersforthepurposesofshowingpersonalisedadvertisingtotheseusers
onFacebookorInstagram(seeMetaIEComplianceReportonIESAFBDecision,p.12,paragraph3.1.2,andMeta

IE Compliance Report on IE SA IG Decision, p. 13, paragraph 3.1.2).
150Meta IE Compliance Report on IE SA FB Decision, p. 4, and Meta IE Compliance Report on IE SA IG Decision, p.
4.

Adopted 27 interests and preferences. This includes signals such as a user’s activity across [Meta’s]

products, engagement with content such as other users’ posts or which pages they visit, the
individuals and groups they communicate with, and/or what the user searches for. [Meta IE]

uses all of these signals to assess and understand users’ interests and preferences and to
provide them with behavioural advertisements.’ (emphasis added in bold) 151

105. With respect to the above, the EDPB notes that the personal data processed for behavioural

advertising purposes on the basis of Article 6(1)(f) GDPR is collected ‘on’ and ‘across’ Meta’s products
and that these terms are used interchangeably by Meta IE.

106. Meta IE also refers to its updated privacy policies for Facebook and Instagram, which provide the list
of categories of personal data processed for this purpose 152.

107. In Meta IE’s view, it was entitled to consider that it could switch to Article 6(1)(f) GDPR for its
behaviouraladvertisingprocessingtocomplywiththeIESADecisions 153.AccordingtoMetaIE,neither

the EDPB Binding Decisions nor the IE SA Decisions ordered Meta IE to rely on a specific legal basis
under Article 6(1) GDPR, such as Article 6(1)(a) GDPR 154. Meta IE argues that it is only once the IE SA

adopted the IE SA Final Position Paper on 18 August 2023 that an authority concluded that Meta IE’s
reliance on Article 6(1)(f) GDPR was insufficient to comply with the IE SA Decisions 155. Meta IE argues

that prior to this date ‘[s]ome SA submissions are inconsistent with one another and cannot be
reconciled (for example (...) certain SAs appear to consider that consent is the only viable basis possible
156
whereas others accept Article 6(1)(f) GDPR is viable)’ .

157
108. Meta IE carried out Legitimate Interests Assessments annexed to its Compliance Reports , in which
it concludes that Article 6(1)(f) GDPR constitutes an appropriate legal basis for behavioural
158
advertising . Meta IE reiterates this conclusion on 4 August 2023, after having made a commitment
to switch to Article 6(1)(a) GDPR through the Meta IE’s Consent Proposal 15. In addition, Meta IE
highlighted that it ‘expended significant resources’ and implemented ‘very substantial steps’ to switch

from Article 6(1)(b) GDPR to Article 6(1)(f) GDPR to comply with the deadline of 5 April 2023 16.

109. With respect to the CJEU Bundeskartellamt Judgment, Meta IE takes the view that this case ‘does not

rule out Article 6(1)(f) [GDPR] as a matter of principle as a valid legal basis’ for Meta IE’s behavioural

151
Meta IE Compliance Report on IE SA FB Decision, p. 4, and Meta IE Compliance Report on IE SA IG Decision, p.
4.
152Meta IE Compliance Report on IE SA FB Decision, p. 4-5, and Meta IE Compliance Report on IE SA IG Decision,
p. 4-5.
153
Meta IE’s Submissions of 26 September 2023, p. 10, and Meta IE’s Submissions of 25 August 2023, p. 22. See
also Meta IE’s letter to the IE SA of 27 July 2023, p. 1-2.
154Meta IE’s Submissions of 26 September 2023, p. 10, and Meta IE’s Submissions of 25 August 2023, p. 4 and
16.
155
Meta IE’s Submissions of 26 September 2023, p. 11 and Meta IE’s Submissions of 16 October 2023, p.5.
156Letter from Meta IE to the IE SA regarding process and urgency of 31 May 2023, p. 3.
157Meta IE’s Legitimate Interests Assessments Behavioural Advertising Processing of 3 April 2023, Annex 4 to
Meta IE Compliance Report on IE SA FBDecision and Annex 4 toMeta IE ComplianceReport on IE SA IG Decision.
158
Annex 4 to the Meta IE Compliance Report on IE SA FB Decision and to Meta IE Compliance Report on IE SA
IG Decision, p. 4, and Meta IE Compliance Report on IE SA FB Decision, p. 11, Meta IE Compliance Report on IE
SA IG Decision, p. 12.
159Meta IE’s Request for preliminary injunction, 4 August 2023, p. 27.
160
Meta IE’s Submissions of 26 September 2023, p. 10 and Meta IE’s Submissions of 16 October 2023, p.5. See
also Meta IE’s Submissions of 25 August 2023, p. 33.

Adopted 28 advertising processing activities, given that the CJEU ‘did not (and could not as a matter of law) issue

a blanket finding that users’ interests will always outweigh [Meta IE]’s and third parties’ legitimate
interests in the context of personalised advertising’ 161. It argues that the CJEU Bundeskartellamt

Judgment relates to a different processing than the processing covered by the EDPB Binding Decisions
and the IE SA Decisions. More specifically, Meta IE points out that this judgment relates to personal

data collected off-Meta, as opposed to data collected on-Meta products. Notably, Meta IE states that
the scope of the case, ‘excludes processing for behavioural advertising purposes when using personal

data collected across different [Meta IE]’s products’, while acknowledging that the case focuses ‘to a
lesser extent’ on ‘the processing of personal data collected across various [Meta IE]’s products’ 16.

110. Lastly, despite considering that it can lawfully rely on Article 6(1)(f) GDPR, Meta IE announced that,

taking into account the ‘different views’ of the IE SA both in the IE SA Provisional Position Paper and
regarding the interpretation of the CJEU Bundeskartellamt Judgment, it was willing to switch to
163
consent for the processing at stake .

164
.

165
.

166.

167.

4.1.1.3.3 Analysis of the EDPB

111. In the IE SA Decisions, Meta IE was directed to take the necessary action to address the finding that

Meta IE is not entitled to carry out the processing operations at stake on the basis of Article 6(1)(b)
GDPR,wasordered tobringits processingof personaldatafor the purposesofbehaviouraladvertising

into compliance with Article 6(1) GDPR and it was specified that such action is ‘not limited to the

161
Meta IE’s Response to IE SA’s Provisional Position Paper, 4 August 2023, section 1.5 (A) and also section 2 for
a more detailed analysis.
162 Meta IE’s Request for preliminary injunction, 4 August 2023, p. 27.
163 Meta IE’s letter to the IE SA of 27 July 2023, p. 1-2.

164 Meta IE’s letter to the IE SA of 27 July 2023, p. 2.
165 Meta IE’s letter to the IE SA of 27 July 2023, p. 2.
166
IE SA’s letter to Meta IE of 11 August 2023, p. 2.
167 IE SA’s letter to Meta IE of 11 August 2023, p. 2.

Adopted 29 identification of an appropriate alternative legal basis’, but may include the implementation of ‘any

necessary measures required to satisfy the conditionality associated with that/those alternative legal
basis/bases’ 16.

112. TheEDPBnotesthat,accordingtoMetaIEComplianceReportsandtheIESAFinalPositionPaper,Meta
169
IE relies on Article 6(1)(f) GDPR to process personal data collected on Meta’s products for the
purposes of behavioural advertising since 5 April 2023 170.

113. Pursuant to Article 6(1)(f) GDPR, Recital 47 GDPR and the CJEU’s settled case-law 171, three cumulative

conditions must be met to be able to rely on Article 6(1)(f) GDPR, ‘namely, first, the pursuit of a
legitimate interest by the data controller or by a third party; second, the need to process personal data

for the purposes of the legitimate interests pursued; and third, [according to a balancing test] that the
interests or fundamental freedoms and rights of the person concerned by the data protection do not
172
take precedence over the legitimate interest of the controller or of a third party’ .

114. More specifically, the first condition relates to the existence of legitimate interests pursued by the
controller or a third party.

115. Meta IE has identified different interests that it considers legitimate and on which it relies for the
processing at stake. These interests are pursued either by Meta IE or third parties, namely businesses
that use Facebook/Instagram and other users of Meta’s products 173. More specifically, Meta IE

identified the four following legitimate interests:

• (1)Meta IE’s‘interest and theinterestsofother userstoprovidea positiveuserexperiencethat

users will want to engage with, and which is tailored to users - providing quality targeted and
personalised ads is a core element of the wider user experience across Meta Products’,

• (2) Meta IE’s ‘interest and the interests of other users to enable [Meta IE] to generate revenue
and continue to innovate, improve and develop the Meta Products and new technologies’,

• (3) Meta IE’s and third parties’ (e.g. advertisers) interests ‘to provide businesses, both big and

small, the opportunity to connect with the users who are most likely to be interested in their
products and services’, and

• (4) Meta IE’s ‘interests and the interests of third parties (e.g. advertisers) and other users, for
businesses, both big and small, to be able to promote their products and services to users’ 17.

168
IE SA FB Decision, paragraph 8; and IE SA IG Decision, paragraph 212.
169IE SA Final Position Paper, paragraph 7.23, p. 11-12, referring to Meta IE’s Letter to the IE SA of 30 June 2023,
and Meta IE Compliance Report on IE SA FB Decision, p. 4, and Meta IE Compliance Report on IE SA IG Decision,
p. 4.
170
IE SA Final Position Paper, paragraph 7.25, p. 12, and Meta IE Compliance Report on IE SA FB Decision, p. 4,
and Meta IE Compliance Report on IE SA IG Decision, p. 4.
171As recently recalled in the CJEU Bundeskartellamt Judgment, paragraph 106, which refers to previous case-
law. The IE SA Final Position Paper also recalls and applies this test in paragraphs 7.27 and seq., p. 12-21.
172See paragraph 106 of the CJEU Bundeskartellamt Judgment.
173
Meta IE Compliance Report on IE SA FB Decision, p. 6, and Meta IE Compliance Report on IE SA IG Decision, p.
6.
174Meta IE Compliance Report on IE SA FB Decision, p. 6, and Meta IE Compliance Report on IE SA IG Decision, p.
6.

Adopted 30116. These four categories of interests are further broken down in several sub-interests in Meta IE
Legitimate Interests Assessments 17. For example, the first and the second legitimate interests also

include the following sub-interest: ‘[For other Facebook and Instagram users:] The enjoyment of
Facebook and Instagram services free of charge’. 176

117. As recalled by the IE SA, the given legitimate interests must be ‘sufficiently clearly articulated and [be]

real and present, corresponding to current activities or to benefits that are expected in the near
future’ 177.

118. The EDPB notes that the IE SA concluded that the interests listed by Meta IE in its Compliance Reports
can meet these criteria 178.

119. The second condition relates to the necessity of the processing for the pursuit of those interests (or
‘necessity test’).

120. In its Compliance Reports, Meta IE considers that: (1) the processing at stake is necessary to pursue
and achieve the legitimate interests identified by Meta IE 179, (2) this processing is reasonable and
180
proportionate to achieve the legitimate interests pursued and (3) no viable alternatives exist that
would allow the legitimate interests to be achieved 181.

121. In that regard, the IE SA considers that Meta IE failed to demonstrate in its Compliance Reports that

its behavioural advertising processing was necessary to the different legitimate interests it
identified 182. More specifically, the IE SA points out that Meta IE’s explanations regarding the impact

of the processing at stake are ‘too vague’ and therefore they do not allow the IE SA to determine that
there is a less intrusive alternative that Meta IE could pursue 183. In addition, the IE SA considers that

Meta IE Legitimate Interests Assessments do not apply the necessity test for each of the legitimate
interest on which it relies 184.

122. More specifically, regarding the first interest set out by Meta IE, the IE SA refers to the EDPB Binding
Decision 3/2022 and concludes that behavioural advertising is not in the interest of all Meta IE’s users,
185
but only of some users . Therefore, according to the IE SA, Meta IE has not explained the need to

175
MetaIELegitimateInterestsAssessmentsBehaviouralAdvertisingProcessingof3April2023,Annex4toMeta
IE Compliance Report on IE SA FB Decision and Annex 4 to Meta IE Compliance Report on IE SA IG Decision, p. 9-
13.
176MetaIELegitimateInterestsAssessmentsBehaviouralAdvertisingProcessingof3April2023,Annex4toMeta

IE Compliance Report on IE SA FB Decision and Annex 4 to Meta IE Compliance Report on IE SA IG Decision, p. 9.
This sub-interest is further detailed on p. 12 of Meta’s Legitimate Interests Assessments.
177IE SA Final Position Paper, paragraph 7.33, referring to the EDPB Binding Decision 02/2022, paragraph 110.
178
IE SA Final Position Paper, paragraph 7.33, p. 13-14.
179Meta IE Compliance Report on IE SA FB Decision, p. 6 and Meta IE Compliance Report on IE SA IG Decision,
p.6, both referring to sections 2.b, 2.c., and 3.a of Meta IE Legitimate Interests Assessments.
180Meta IE Compliance Report on IE SA FB Decision, p. 6 and Meta IE Compliance Report on IE SA IG Decision, p.

7, both referring to section 3.b of Meta IE Legitimate Interests Assessments.
181Meta IE Compliance Report on IE SA FB Decision, p. 6 and Meta IE Compliance Report on IE SA IG Decision, p.
7, both referring to sections 3.c, 3.d, and 3.e of Meta IE Legitimate Interests Assessments.
182
183IE SA Final Position Paper, paragraph 7.50, p. 18.
IE SA Final Position Paper, paragraph 6.3, p. 5.
184IE SA Final Position Paper, paragraph 7.41, referring to Meta IE Legitimate Interests Assessments Behavioural
Advertising Processing of 3 April 2023, Annex 4 to Meta IE Compliance Report on IE SA FB Decision and Annex 4

to Meta IE Compliance Report on IE SA IG Decision.
185IE SA Final Position Paper, paragraphs 7.43-7.44, p. 16.

Adopted 31 process the personal data of all of its users ‘for the purposes of realising the interests of those users
186
who want to receive behavioural advertising’ .

123. Further, regarding the second, third and fourth interests put forward by Meta IE in its Compliance
187
Reports , the IE SA concludes that Meta IE’s arguments are not sufficiently substantiated because of
the vagueness and the lack of specificity of the analysis 188. In particular, Meta IE has not explained

which specific categories of personal data Meta IE needs to process or which processing operations
need to take place to achieve the above interests 189.

124. When conducting the ‘necessity test’ in the Meta IE Legitimate Interests Assessments, Meta IE claims

that ‘Without the Processing, which as explained above is essential in order to monetise Facebook and
Instagram, [Meta IE] would not be able to provide the services to users free of charge in the same

manner as it does currently. This in turn would jeopardise the attainment of the legitimate interests
identified above’ 190. According to Meta IE, if it did not carry out the processing of personal data

collected on its products for the purpose of behavioural advertising and if it only carried out the
‘limited’ processing it engages in when data subjects object, it ‘would significantly impact the user

experienceonFacebook andInstagram (in part, duetolessinnovation happeningon theplatformsdue
to reduced revenue) and it would also impact [Meta IE]’s ability to provide Facebook and Instagram

free of charge (regardless of the financial means of the user) to users as this is largely due to the
revenues that [Meta IE] makes from enabling advertisers to effectively advertise to Instagram and
191
Facebook users’ .

125. However, the IE SA points out that Meta IE’s privacy policy states that Meta IE is pursuing a legitimate
interest ‘to generate revenue’, which is different than providing services for free 19. According to the

IE SA, given that other types of advertising may also generate revenue, it cannot be concluded that
behavioural advertising is necessary to generate ‘any revenue at all’ 193.

126. The IE SA also highlights that ‘there is no explanation as to why it is necessary to process all the data
categories that [Meta IE] uses for behavioural advertising in order to provide the services for free’ 19.

Against this background, the IE SA concludes that Meta IE’s claim that it is necessary to carry out
behavioural advertising to provide Meta IE’s services is not sufficiently granular 195. In particular, it is

unclear whether, through this argument, Meta IE is saying that (1) Meta IE is unable to provide
FacebookandInstagramforfreeunlessitprocessesthepersonaldataofallofitsusersforthepurpose

186
IE SA Final Position Paper, paragraph 7.44, p. 16.
187Meta IE Compliance Report on IE SA FB Decision, p. 6, and Meta IE Compliance Report on IE SA IG Decision, p.
6.
188IE SA Final Position Paper, paragraphs 7.45 and 7.50, p. 16 and 18.
189
IE SA Final Position Paper, paragraph 7.45, p. 16.
190MetaIELegitimateInterestsAssessments BehaviouralAdvertisingProcessingof3April2023,Annex4toMeta
IE Compliance Report on IE SA FB Decision and Annex 4 to Meta IE Compliance Report on IE SA IG Decision, p.
21, section 3a.
191
MetaIELegitimateInterestsAssessments BehaviouralAdvertisingProcessingof3April2023,Annex4toMeta
IE Compliance Report on IE SA FB Decision and Annex 4 to Meta IE Compliance Report on IE SA IG Decision, p.
24, section 3d.
192IE SA Final Position Paper, paragraph 7.46, p. 17.
193
IE SA Final Position Paper, paragraph 7.46, p. 17.
194IE SA Final Position Paper, paragraph 7.47, p. 17.
195IE SA Final Position Paper, paragraph 7.47, p. 17.

Adopted 32 of behavioural advertising, or (2) Meta IE is still able to provide Facebook and Instagram for free by
196
processing the personal data of some of its users who do not object to behavioural advertising .

127. The IE SA’s conclusion for the second condition was shared by a number of CSAs in their comments
and reactions on the Compliance Reports:

• On 4 May 2023, the NL SA outlined that ‘[t]he massive processing of users’ (special) personal
data for the purpose of behavioural advertising is not ‘necessary’ for the purposes of the
197
declared interests’ .

• On 23 May 2023, the IT SA notes in relation to Meta IE Legitimate Interests Assessments that

‘it is as if the controller were shifting the burden of proof regarding legitimate interest as the
legal basis of processing on the data subjects – who conversely should be called into play as

key actors in the two subsequent steps of the legitimate interest test, i.e. when assessing the
necessity of the processing and performing the required balancing exercise’ 19.

• In the NO SA Order, the NO SA argues that Meta IE fails to show that it fulfils the ‘necessity

test’ based on (1) the absence of assessment of the necessity of each interest put forward by
Meta IE, (2) the absence of a substantiated assessment regarding alternative advertising

models that could be viable, (3) the incorrect finding in Meta IE Legitimate Interests
Assessments that its behavioural advertising processing is unlikely to have an adverse impact

ondata subjects,and (4)theinappropriatereference to the fact thatother businessesarealso
carrying out behavioural advertising, which does not have an impact on the lawfulness of such
processing 19.

128. According to the settled case-law of the CJEU, when applying the necessity test, ‘it should be borne in
mind that derogations and limitations in relation to the protection of personal data must apply only in
200
so far as is strictly necessary’ .

129. In its Bundeskartellamt Judgment, the CJEU also recalled that this second condition requires ‘to
ascertain that the legitimate data processing interests pursued cannot reasonably be achieved just as

effectively by other means less restrictive of the fundamental rights and freedoms of data subjects, in
particular the rights to respect for private life and to the protection of personal data guaranteed by
201
Articles 7 and 8 of the Charter’ . This condition must also be examined in conjunction with the
principle of data minimisation under Article 5(1)(c) GDPR 202.

196IE SA Final Position Paper, paragraph 7.47, p. 17.
197Views of the NL SA of 4 May 2023 on Meta IE’s choice of a new legal basis for the processing of personal data

198Meta IE in the framework of Behavioural Advertising on its platforms Facebook and Instagram, paragraph 3.
Views of IT SA on the IE SA FB Decision of 23 May 2023, p. 2, and views of IT SA on the IE SA IG Decision of 23
May 2023, p. 2.
199NO SA Order, p. 17-18.
200Judgment of 4 May 2017, Rīgas satiksme, C-13/16, ECLI:EU:C:2017:43, paragraph 30 and cited case-law;

Judgment of 11 December 2014, Ryneš, C-212/13, ECLI:EU:C:2014:2428, paragraph 28; Judgment of 11
December 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, ECLI:EU:C:2019:1064, paragraph 46.
201CJEU Bundeskartellamt Judgment, paragraph 108.
202CJEU Bundeskartellamt Judgment, paragraph 109.

Adopted 33130. In the EDPB Binding Decisions, the EDPB considered that there are realistic, less intrusive alternatives
203
to behavioural advertising, making the processing at stake not ‘necessary’ .

131. Inlight ofthe above,the EDPBconsidersthat therearegrounds forconcluding, asthe IE SA did 204,that

Meta IE failed to fulfil the second condition of the ‘necessity test’ to be able to rely on Article 6(1)(f)
GDPR for the processing of personal data collected on Meta’s products for purposes of behavioural
205
advertising, in particular whether there are no other means that are less intrusive alternatives and
regarding compliance with the principle of data minimisation under Article 5(1)(c) GDPR 20.

132. The third condition relates to the ‘balancing test’.

133. In its Compliance Reports referring to the Meta IE Legitimate Interests Assessments, Meta IE has
concluded that, in light of the ‘extensive measures and safeguards’ it implemented, the potential risks
207
to data subjects identified are ‘appropriately mitigated’ .

134. More specifically, Meta IE refers inter alia to the following safeguards: the measures implemented to

ensure transparency towards data subjects (e.g. through privacy policies and ‘Help center’ articles),
the publication of advertising policies for users, the existence of restrictions on targeting criteria, the

existence of control tools (in relation to advertising in general or to specific ads that are displayed to
users) 208,thepossibilitytoobjecttotheprocessing 209andthepossibilitytoexercisedatasubjects’data
210
protectionrights .Metaalsoarguesthatthelanguage introducedtoexplainthechangeoflegalbasis
and the impact on users, including their ability to object to the behavioural advertising processing at

stake, ‘have been implemented to ensure that users have a reasonable expectation of Behavioural
Advertising Processing and are aware of their right to object to this processing 211’. In Meta IE’s

Legitimate Interests Assessments, Meta further claims that ‘Users reasonably expect the processing of
Platform Behavioural Information for behavioural advertising, taking into account the robust

203EDPB Binding Decision 3/2022, paragraph 121 and the EDPB Binding Decision 4/2022, paragraph 124. As

eluded to in the EDPB Binding Decisions, the AT SA, PL SA (only for EDPB Binding Decision 3/2022) and SE SAs
mention as examples contextual advertising based on geography, language and content, which do not involve
intrusivemeasuressuch asprofiling andtracking ofusers.Thisanalysiswasmadeinthecontextofthelegalbasis
of Art. 6(1)(b) GDPR.
204
205IE SA Final Position Paper, paragraph 7.50, p. 18 and paragraph 6.3., p. 5.
IE SA Final Position Paper, paragraphs 7.46-7.48, p. 17.
206IE SA Final Position Paper, paragraph 7.45, p. 16, and an analysis of the principle of data minimisation is
included in paragraph 7.59, p. 19, with respect to the balancing test.
207
Meta IE Compliance Report on IE SA FB Decision, p. 10 and Meta IE Compliance Report on IE SA IG Decision,
p. 11, both referring to sections 4 and in particular sections 4.2.b and 4.2.c of Meta IE Legitimate Interests
Assessments.
208Meta IE Legitimate Interests Assessments, of 3 April 2023, Annex 4 to Meta IE Compliance Report on IE SA FB

Decision and Annex 4 to Meta IE Compliance Report on IE SA IG Decision, section 4.2.c. on the implemented
safeguards.SomesafeguardsarereiteratedinMetaIEComplianceReportonIESA FBDecision,p.7-10andMeta
IE Compliance Report on IE SA IG Decision, p. 7-12.
209Meta IE Legitimate Interests Assessments, of 3 April 2023, Annex 4 to Meta IE Compliance Report on IE SA

FB Decision and Annex 4 to Meta IE Compliance Report on IE SA IG Decision, section 4.2.e. on the opt-out tools.
210Meta IE Legitimate Interests Assessments, of 3 April 2023, Annex 4 to Meta IE Compliance Report on IE SA
FB Decision and Annex 4 to Meta IE Compliance Report on IE SA IG Decision, section 4.2.f. on data protection
rights.
211
Meta IE Compliance Report on IE SA FB Decision, p. 7 and Meta IE Compliance Report on IE SA IG Decision,
p. 7.

Adopted 34 transparency [Meta] has implemented (...), which contributes to managing user expectations around
212
the Processing and personalised advertising more broadly’ .

135. In that regard, the EDPB notes that the IE SA concluded that, due to the failure to facilitate the right to
213
object under Article 21 GDPR , the lack of any consideration of the right to private life (as enshrined
in Article 7 of the Charter) 214 or data minimisation 21, and the insufficient consideration of the impact
216
of the processing on the purpose limitation principle , Meta IE has not demonstrated that its
legitimate interests in processing for behavioural advertising outweigh the fundamental rights and
217
freedoms of data subjects . In particular regarding the right to object, the IE SA pointed out inter alia
that ‘there is no ability in these [objection] tools to turn off processing of data collected directly by

[Meta IE] for advertising purposes, including content, audio, metadata about content, apps and
features used, transactions, hashtag and the time, frequency and duration of activities on [Meta IE]

products’ as these categories of data would still be used for the purpose of behavioural advertising
according to Meta IE’s privacy policy 21.

136. The IE SA also refers to a previous CJEUjudgment of 24 September 2019, where the CJEU held that the
data subjects’ fundamental rights under Articles 7 and 8 of the Charter ‘override, as a rule (...) the
219
economic interest’ of a private operator .

137. The conclusion of the IE SA regarding the third condition was shared by a number of CSAs in their
comments and reactions on the Meta IE Compliance Reports:

• On 4 May 2023, the NL SA concluded that ‘[t]he fundamental rights and freedoms of the data
subject override the interest of [Meta IE] and the third parties involved’ 22. The NL SA raised

the following considerations:

o ‘some of the data processed by [Meta IE] for the purpose of behavioural advertising
are special, sensitive kinds of personal data, which increase the weight attached to
221
the interests of data subjects in the balancing act ’
o ‘Not only the type but also the sheer amount of data that is processed by a company

with the size of [Meta IE] should be taken into account in the balancing act. For the
purposes of behavioural advertisement, [Meta IE] processes a broad spectrum of

(special) personal data from millions of users. These data are analysed and possibly
222
stored, adjusted, and reused on a daily basis. ’

212Meta IE Legitimate Interests Assessments, of 3 April 2023, Annex 4 to Meta IE Compliance Report on IE SA
FB Decision and Annex 4 to Meta IE Compliance Report on IE SA IG Decision, p. 7.
213
IE SA Final Position Paper, paragraphs 7.60.-7.66., p. 19-21.
214IE SA Final Position Paper, paragraphs 7.57, p. 19.
215IE SA Final Position Paper, paragraph 7.59, p. 19.
216IE SA Final Position Paper, paragraph 7.58, p. 19.
217
IE SA Final Position Paper, paragraph 7.67, p. 21, and paragraph 6.3., p. 5.
218IE SA Final Position Paper, paragraph 7.65., p. 20-21, referring in footnote 29 to p. 54-55 of Meta IE’s privacy
policy.
219IESAFinalPositionPaper,paragraph7.57.,p.19,referringtoJudgmentoftheCourtofJusticeoftheEuropean

Union of 24 September 2019, GC and Others, C-136/17; ECLI:EU:C:2019:773, paragraph 53. In this case, the
private operator was a search engine. Also see case-law cited.
220Views of the NL SA of 4 May 2023 on Meta IE’s choice of a new legal basis for the processing of personal data
by Meta IE in the framework of Behavioural Advertising on its platforms Facebook and Instagram, paragraph 3.
221
Views of the NL SA of 14 May 2023, paragraph 43.
222Views of the NL SA of 14 May 2023, paragraph 44.

Adopted 35 o ‘With regard to user expectations, the NL SA points out that, in line with the principle
of accountability, the assessment of user expectations should take place before the

processing is initiated under Art. 6(1)(f) GDPR. Controllers cannot simply "retroactively
adjust" the expectations of existing users and bring processing in line with Art. 6(1)(f)

GDPR, simply by providing them with some information – especially not when the
essence of this information is hard to grasp. 22’

o ‘Furthermore,asalsoconcludedbytheEDPBinitsdecision3/2022,20theNLSAagrees
withtheEDPBthatusersdonotsignupto[MetaIE]’sservicestobeservedpersonalized

content but for the sake of connecting with friends and family. Even in its changed
Terms of Service, [Meta IE] presents its services as “services that enable people to

connect with each other, build communities…”. The connection to
people/friends/family is therefore still theservicewith which [Meta IE] seeks to attract

newusers.Eventhough“buildingbusinesses”isinsertedasathird“goa”oftheservices
of [Meta IE], this does not create the reasonable expectation that users’ personal data
224
will be processed for the purpose of behavioural advertising’ .
o ‘NL SA therefore concludes that users do not expect or should reasonably expect that

their data are processed for the sake of behavioural advertising as done by [Meta
IE].25’

o ‘Consideringthegravityoftherisksidentified,NLSAfindsthat[MetaIE]indeedtreads
very lightly on these risks and their mitigation.26’

o ‘The NL SA therefore finds that the right to object as provided for in the GDPR, a core
right when processing is undertaking on the basis of Art. 6(1)(f) GDPR, is therefore not
227
properly respected by [Meta IE]’ .

• On 12 May 2023, the ES SA identified the following shortcoming in Meta IE’s assessment of
the balancing test:

o ‘Regarding the impact on data subjects, it is not established that it does not concern
sensitive data.
o As regards the way in which data is processed, data is processed massively,

comprehensively and in combination with all types of data obtained from other
sources, without taking into account the principle of data minimization.

o As regards the data subject’s reasonable expectations, the data typology reflected in
the privacy policy is not easily understandableto the average user, who does not know

exactlywhatdataisbeingprocessedandwhattheextentofsuchprocessingis.Inorder
for the user to know what type of data is being processed and how they are being

processed, the user must also look up several documents.
o As regards the position of the controller and the data subject, there is no balance of

power, Meta [IE] is a large company which imposes its conditions on its users without
they have the possibility of choosing or not certain processing operations and which of

223Views of the NL SA of 14 May 2023, paragraph 45.
224Views of the NL SA of 14 May 2023, paragraph 46.
225
226Views of the NL SA of 14 May 2023, paragraph 49.
Views of the NL SA of 14 May 2023, paragraph 51.
227Views of the NL SA of 14 May 2023, paragraph 63.

Adopted 36 their data are processed. There is also no analysis of how the [processing] affects

vulnerable sectors, and how to mitigate possible negative effects.
o Finally, with regard to the additional safeguards included to prevent undue impact on

data subjects, as already stated, the principle of data minimization is not taken into

account, there is no indication of what actions [Meta IE] takes to prevent the
processing of sensitive data indirectly and, as explained below, the GDPR is not
228
complied with regard to the right to object.’ [emphasis added in bold]

• On 15 May 2023, the FI SA stated that ‘[Meta IE]´s legal interests assessment (...) seems to be

rather one-sided and superficial and fails to convince why the interests of [Meta IE] or third
parties should override the interests and fundamental rights of the data subjects’ 229.

• On 23 May 2023, the IT SA notes in relation to Meta IE Legitimate Interests Assessments that
‘it is as if the controller were shifting the burden of proof regarding legitimate interest as the

legal basis of processing on the data subjects – who conversely should be called into play as
key actors in the two subsequent steps of the legitimate interest test, i.e. when assessing the
230
necessity of the processing and performing the required balancing exercise’ .

• In the NO SA Order, the NO SA rejects Meta IE’s assumption that the data subjects

undisputedly want and expect behavioural advertising based on monitoring and profiling of
their behaviour 231. Therefore, according to the NO SA, Meta IE’s assessment of the elements
of Article 6(1)(f) GDPR has been skewed 23. In addition, the NO SA refers to the paragraph 117

of the CJEU Bundeskartellamt Judgment, which held that ‘data subjects cannot reasonably
expect that the operator of the social network will process that user’s personal data, without

his or her consent, for the purposes of personalised advertising’ 233. Further, the NO SA
considers that informing data subjects about behavioural advertising processing does not

mean that it falls within their reasonable expectations and in any case, data subjects are not
realistically able to read the privacy policies of every service used, including Meta IE’s privacy
234
policies . The NO SA also argues that Meta IE fails to show that Meta IE’s interests outweigh
the rights and freedoms of data subjects 23.

236
138. The IE SA made an overall conclusion on the three-step test that Meta IE has not demonstrated
compliance with Article 6(1)(f) GDPR for the processing at stake 237. The IE SA highlighted, both in the

IE SA Provisional Position Paper and IE SA Final Position Paper that this conclusion stems from the
following reasons: (1) ‘[Meta IE] has not made out that the processing is necessary for legitimate

interests. Its explanations of the impact of the processing on its business are too vague to allow the [IE

228Views of the ES SA of 12 May 2023, p. 5.
229ViewsoftheFISAof15May2023,preliminary remarksonMeta´snewlegalbasisinrelationtotheprocessing

of personal data for the purposes of behavioural advertising in Facebook and Instagram services, p. 2.
230ViewsofITSAonthelegalbasisorderandtransparency orderrelatingtotheIE SAFBDecision,p.2,and views
of IT SA on the legal basis order and transparency order relating to the IE SA IG Decision of 23 May 2023, p. 2.
231NO SA Order, p. 15-16.
232
NO SA Order, p. 15-16.
233NO SA Order, p. 17.
234NO SA Order, p. 16.
235NO SA Order, p. 17-23.
236
IE SA Final Position Paper, paragraphs 7.27-7.28, p. 12-13, referring to the CJEU Bundeskartellamt Judgment,
paragraph 126.
237IE SA Final Position Paper, paragraph 7.30, p. 13.

Adopted 37 SA] to determine that there is no less intrusive alternative that can be pursued’, (2) ‘[Meta IE] has not

demonstrated that the balancing favours its processing. In particular, the opt-out mechanism provided
does not comply with the GDPR’ 238. The conclusions of the IE SA regarding the results of the three-step
testwassharedbyanumberofCSAs,whichalsoraisedtheinappropriaterelianceby Meta IEtoArticle

6(1)(f) GDPR:

• On 18 April 2023, the AT SA stated that processing operations in connection with ‘behavioural
239
advertising processing’ cannot be based on Article 6(1)(f) GDPR .
• On 12 May 2023, the ES SA indicated that Meta IE Legitimate Interests Assessments ‘did not

demonstrate that the processing carried out by Meta IE with the purpose of behavioural
advertisement can be based on [A]rticle 6(1)(f) [GDPR] since it does not meet the requirements

of this article’0.

• In the NL SA Mutual Assistance Request sent on 30 May 2023, the NL SA expressed concerns
as to Meta IE’s reliance on Article 6(1)(f) GDPR, taking into account ‘thefact that thecontroller

could not have been unaware of already established guidance from the EDPB, nor of the
position of several CSAs on the matter, but chose to explore the path of Article 6(1)(f) [GDPR]
241
regardless’ . The NL SA states that ‘Meta [IE] cannot invoke Article 6(1)(f) [GDPR] as a valid
legalbasistoprocessthepersonaldataofitsusersforthepurposesofbehaviouraladvertising’,

and that this conclusion is ‘in line with several EDPB and WP29 Guidance documents, which
underpin that the appropriateness of using Article 6(1)(f) [GDPR] as a legal basis for the
242
processing concerned is highly questionable’ .

139. In previous judgments, the CJEU clarified that when carrying out the ‘balancing test’, the data

controller ‘must take account of the significance of the data subject’s rights arising from Articles 7 and
8 of the Charter’ 24.

140. In its Bundeskartellamt Judgment, the CJEU held the following obiter dictum:

‘as can be seen from recital 47 of the GDPR, the interests and fundamental rights of the data
subject may in particular override the interest of the data controller where personal data are
244
processed in circumstances where data subjects do not reasonably expect such processing .’

‘(...) such processing must also be necessary in order to achieve that interest and the interests
or fundamental freedoms and rights of the data subject must not override that interest. In the

contextofthatbalancing oftheopposingrightsatissue,namely,thoseofthecontroller,onthe
one hand, and those of the data subject, on the other, account must be taken, as has been

noted (...) above, in particular of the reasonable expectations of the data subject as well as the
scale of the processing at issue and its impact on that person. 24’

238IE SA Final Position Paper, paragraph 6.3, p. 5 ; IE SA Provisional Position Paper, paragraph 5.3, p. 4 (in

239ghtly different terms).
IMI report on Compliance in the Facebook case.
240Views of the ES SA, 12 May 2023, p. 6.
241NL SA Mutual Assistance Request, p. 2.
242NL SA Mutual Assistance Request, p. 1, where a reference is made to the EDPB Guidelines 8/2020 on the

targeting of social media users.
244CJEU Bundeskartellamt Judgment, paragraph 112.
244CJEU Bundeskartellamt Judgment, paragraph 112.
245CJEU Bundeskartellamt Judgment, paragraph 116.

Adopted 38 ‘In this regard, it is important to note that, despite the fact that the services of an online social

network such as Facebook are free of charge, the user of that network cannot reasonably
expectthattheoperatorofthesocialnetworkwillprocessthatuser’spersonaldata,without

his or her consent, for the purposes of personalised advertising. In those circumstances, it
must be held that the interests and fundamental rights of such a user override the interest of

thatoperatorinsuchpersonalisedadvertisingbywhichitfinancesitsactivity,withtheresult
that the processing by that operator for such purposes cannot fall within the scope of point
246
(f) of the first subparagraph of Article 6(1) of the GDPR.’ [emphasis added]

141. In the IE SA Provisional Position Paper issued before the CJEU Bundeskartellamt Judgment, the IE SA
provisionallyfoundthatMetaIEhadnotdemonstratedcompliancewithArticle6(1)(f)GDPR 247asMeta

IE had not demonstrated that it could rely on Article 6(1)(f) GDPR 248. The IE SA then confirmed that
Meta IE has not demonstrated compliance with Article 6(1)(f) GDPR following the analysis of the CJEU

Bundeskartellamt Judgment as it states in its Final Position Paper that ‘Prior to the date of [the
Bundeskartellamt]judgment,the[IESA]hadanalysed[MetaIE]’srelianceonArticle6(1)(f)[GDPR]and

had come to the provisional conclusion that [Meta IE] had not demonstrated compliance with that
provision’ and that‘theCJEUindicated that there aresignificant barriers to [Meta IE] seeking to rely on
249
Article 6(1)(f) [GDPR] for the behavioural advertising processing at issue in that judgment’ .

142. The EDPB notes Meta IE’s arguments regarding the alleged irrelevance of the CJEU Bundeskartellamt
250
Judgment . Meta considers that this judgment ‘does not rule out Article 6(1)(f) [GDPR] “as a matter
of principle” as a valid legal basis for [Meta IE]’s Behavioral Advertising Processing. The judgment

assessed Article 6(1)(f) [GDPR] (and the element of “necessity”) in the context of different processing
than is at-issue here (i.e., data collected off-[Meta] 25, and to a limited extent cross-product data

processing, as opposed to data collected on-[Meta] products). (...) Further, the CJEU did not (and could
not as a matter of law) issue a blanket finding that users’ interests will always outweigh [Meta IE]’s
and third parties’ legitimate interests in the context of personalised advertising (...) 252.’

143. As regards the scope of the CJEU Bundeskartellamt Judgment, the EDPB notes the references made to
data collection from other services of the group to which an operator belongs 25.

246
CJEU Bundeskartellamt Judgment, paragraph 117.
247IE SA Provisional Position Paper, paragraph 6.26, p. 11.
248IE SA Provisional Position Paper, paragraph 5.3, p. 4.
249IE SA Final Position Paper, paragraph 7.26, p. 12.
250
MetaIE’sResponsetoIESA’sProvisionalPositionPaperof4August2023,section1.5(A).SeealsoENGVersion
of Meta IE Merits Complaint submitted to the Oslo District Court of 16 October 2023 (corrected), p. 38 and Meta
IE’s Submissions of 26 September 2023, p. 10-11.
251Data collected ‘off’-Meta products refers data collected outside of Meta’s products, such as on third-party

websites, apps and certain offline interactions (e.g., purchases).
252Meta IE’s Response to IE SA’s Provisional Position Paper of 4 August 2023, section 1.5 (A) and section 2 for a
more detailed analysis of the CJEU Bundeskartellamt Judgment.
253In that regard, paragraph 86 of the CJEU Bundeskartellamt Judgment states: ‘By Questions 3 and 4, which it is

appropriate to examine together, the referring court asks, in essence, whether and under what conditions points
(b)and(f)ofthefirstsubparagraphofArticle6(1)oftheGDPRmustbeinterpretedasmeaningthattheprocessing
of personal data by the operator of an online social network, which entails the collection of data of the users of
such a network from other services of the group to which that operator belongs or from visits by those users to

third-party websites or apps, the linking of those data with the social network account of those users and the use
of such data, may be considered to be necessary for theperformance of a contract to which the data subjects are
party, within the meaning of point (b), or for the purposes of the legitimate interests pursued by the controller or

Adopted 39144. The EDPB acknowledges that the behavioural advertising processing that Meta carries out in reliance
254
ofArticle6(1)(f)GDPRandthatisexaminedforthepurposeofthissection4.1.1.3 relatestopersonal
data collected on Meta’s products while, according to Meta IE, the CJEU Bundeskartellamt Judgment

mostly relates to personal data obtained from third party advertising partners outside of Meta’s
products. However, the EDPB considers that this Judgment, addressed to Meta IE, Meta Platforms Inc.
255
and Facebook Deutschland GmbH , outlines the way the balancing exercise may be carried out for
the purpose of behavioural advertising, which is also relevant for personal data collected on Meta’s
products.

145. The EDPB recalls its previous guidelines where it highlighted that ‘it would be difficult for controllers to
justify using legitimate interests as a lawful basis for intrusive profiling and tracking practices for

marketing or advertising purposes, for example those that involve tracking individuals across multiple
websites, locations, devices, services or data-brokering. 256’

146. The EDPB considers that this guidance is relevant for the processing at stake carried out by Meta IE,

which,asprovidedintheEDPBBindingDecisions,isintrusivegivenitsscaleandtheextensiveamounts
of data that is processed by Meta IE 257. In those decisions, the EDPB outlined ‘the complexity, massive

scale and intrusiveness of the behavioural advertising practice that Meta IE conducts through the
Facebook [or Instagram] service’ 25. In other words, ‘[b]ehavioural advertising, as briefly described in

[paragraph 95 of the EDPB Binding Decision 3/2022 and paragraph 98 of the Binding Decision
4/2022 259] is a set of processing operations of personal data of great technical complexity, which has a

by a third party, within the meaning of point (f). That court asks, in particular, whether, to that end, certain
interests which it explicitly lists constitute ‘legitimate interests’ within the meaning of the latter provision.’
254
Meta IE indicates to rely on Art. 6(1)(a) GDPR to process personal data obtained by Meta IE from third party
advertising partners. Such data is about users’ activity off-Meta’s products. See footnotes 89 and 149 above in
that regard.
255The request for a preliminary ruling in the CJEU Bundeskartellamt Judgment has been made in proceedings

betweenMetaPlatformsInc.,formerlyFacebookInc.,MetaPlatformsIrelandLtd,formerlyFacebookIrelandLtd,
andFacebookDeutschlandGmbH,ontheonehand,andtheBundeskartellamt.MetaIEoperatestheonlinesocial
network Facebook in the EU. See CJEU Bundeskartellamt Judgment, paragraphs 2 and 26.
256Article 29 Working Party Guidelines on Automated individual decision-making and Profiling for the purposes

of Regulation 2016/679, adopted on 3 October 2017, as last Revised and Adopted on 6 February 2018, endorsed
by the EDPB on 25 May 2018, p. 15. This was referred to by the NO SA in the NO SA Order, p. 9. This same
statement wasreiterated by the EDPB in theEDPB Guidelines on the targeting of social media users, Version 2.0,
adopted on 13 April 2021, paragraph 56.
257EDPB Binding Decision 3/2022, paragraph 444 and EDPB Binding Decision 4/2022, paragraph 413.
258
EDPB Binding Decision 3/2022, paragraph 96 and the EDPB Binding Decision 4/2022, paragraph 99.
259Paragraph 95 of EDPB Binding Decision 3/2022 states: ‘These requests for preliminary rulings mention that
[Meta IE] collects data on its individual users and their activities on and off its Facebook social network service
via numerous means such as the service itself, other services of the Meta group including Instagram, WhatsApp

and Oculus, third party websites and apps via integrated programming interfaces such as Facebook Business
Tools or via cookies, social plug-ins, pixels and comparable technologies placed on the internet user’s computer
or mobile device. According to the descriptions provided, [Meta IE] links these data with the user’s Facebook
account to enable advertisers to tailor their advertising to Facebook’s individual users based on their consumer

behaviour, interests, purchasing power and personal situation. This may also include the user’s physical location
to display content relevant to the user’s location. Meta IE offers its services to its users free of charge and
generates revenue through this personalised advertising that targets them, in addition to static advertising that
is displayed to every user in the same way.’

Paragraph 98 of EDPB Binding Decision 4/2022 states: ‘These requests for preliminary rulings mention that Meta
IE collects data on its individual users and their activities on and off its Facebook service via numerous means
suchastheserviceitself,otherservicesoftheMetagroupincludingInstagram,WhatsAppandOculus,thirdparty
websites and apps via integrated programming interfaces such as Facebook Business Tools or via cookies, social

Adopted 40 particularlymassiveandintrusivenature” 260.TheIESAreiteratedthisconclusionintheIESADecisions:

‘ItisthereforeclearthattheBoardconsiders(...)thenatureandscopeoftheprocessingtobeextensive,
complex, intrusive and on a massive scale’ 261.

147. In light of the above and taking into account the legal analysis provided by the IE SA (see for example

in paragraphs 135 and 138 above, as supported by the assessment performed by the of the CSAs), the
EDPB considers that the interests and fundamental rights of data subjects override the legitimate

interests put forward by Meta IE for the processing of personal data collected on Meta’s products for
the purposes of behavioural advertising, with the result that Meta IE did not fulfil the third condition

of Article 6(1)(f) GDPR.

148. In light of the above analysis of the EDPB from paragraph 111 to 147, the EDPB considers that Meta IE
inappropriately relies on Article 6(1)(f) GDPRto process personal data collected on its products for the

purpose of behavioural advertising.

4.1.1.3.4 Conclusion as to the infringement of Article 6(1) GDPR

149. The compliance approach adopted by Meta IE has been assessed in the IE SA Final Position Paper as
follows:

• Meta IE seeks to still rely on Article 6(1)(b) GDPR to process some specific categories of

personal data 262, for advertising purposes 263;

• Meta IE seeks to rely on Article 6(1)(f) GDPR to process other personal data for the purposes
of behavioural advertising 264- solely for personal data collected on Meta’s products 265;

• Meta IE relies on Article 6(1)(a) GDPR to process personal data provided to Meta IE by third
party advertising partners 266.

150. Meta IE is willing to rely on Article 6(1)(a)
GDPR as its legal basis
267
through the Meta IE’s Consent Proposal .

151. The EDPB highlights the need to assess the compliance of the processing activities within the scope of

the IE SA Decisions with Article 6(1) GDPR at this point in time.

plug-ins, pixels and comparable technologies placed on the internet user’s computer or mobile device164.
According to the descriptions provided, Meta IE links these data with the user’s Facebook account to enable
advertiserstotailortheiradvertisingtoFacebook’sindividualusersbasedontheirconsumerbehaviour,interests,

purchasing power and personal situation. This may also include the user’s physical location to display content
relevanttotheuser’slocation.MetaIEoffersitsservicestoitsusersfreeofchargeandgeneratesrevenuethrough
this personalised advertising that targets them, in addition to static advertising that is displayed to every user in
the same way.’
260
261EDPB Binding Decision 3/2022, paragraph 123 and the EDPB Binding Decision 4/2022, paragraph 126.
IE SA FB Decision, paragraph 9.23 and IE SA IG Decision, paragraph 243.
262See paragraph 91 above.
263IE Final Position Paper, paragraphs 6.2 and 7.1-7.22.
264
265IE Final Position Paper, paragraphs 6.3 and 7.23-7.67.
IE Final Position Paper, paragraph 7.23, referring to Meta IE’s Letter to the IE SA of 30 June 2023.
266IE SA Final Position Paper, paragraph 7.23, referring to Meta IE’s Letter to the IE SA of 30 June 2023.
267Letter from Meta IE to IE SA regarding consent of 27 July 2023, p. 2.

Adopted 41 268. For the sake of clarity, the EDPB specifies that Meta IE’s Consent Proposal

was not assessed in its merits for the purposes of this urgent binding decision. In this regard, the EDPB
may only take note of the existence of an ongoing evaluation of the Meta IE’s Consent Proposal by the

IE SA and the CSAs.

152. According to the EDPB, there is an ongoing infringement of Article 6(1) GDPR arising from

inappropriate reliance on Article 6(1)(b) GDPR for processing of personal data, including location data
and advertisement interaction data collected, on Meta’s products for behavioural advertising
269
purposes .

153. Inaddition,theEDPBconcludes thatthereisanongoinginfringementofArticle6(1)GDPRarisingfrom

inappropriate reliance on Article 6(1)(f) GDPR for processing personal data collected on Meta’s
products for behavioural advertising purposes 27.

4.1.2 On the infringement of the duty to comply with decisions by supervisory authorities

4.1.2.1 Summary of the overall position of the NO SA

154. According to the NO SA, since the deadline for complying with the IE SA Decisions was 5 April 2023 but
the infringement of Article 6(1) GDPR still persists more than six months later, Meta IE failed to ensure
271
compliance with the IE SA Decisions, and hence infringed its duty to comply with the SAs’ decisions .
The NO states further that there is consensus on the European level between the IE SA and the CSAs
272
that the processing continues to be unlawful , and that ‘as acknowledged by the IE SA itself, Meta IE
has failed to ensure compliance with [the IE SA Decisions]’ 273. The NO SA stated that this non-
274
compliance constitutes in itself an independent violation of the GDPR for which Article 83(5)(e)
GDPRenvisagesafinewhichmaybeimposedinadditiontothefinesimposedbytheIESADecisions 275.

4.1.2.2 Summary of the position of the controller

155. MetaIEstatedthat,priortotheIESADecisions,itreliedonArticle6(1)(b)GDPRinagoodfaithmanner
276
and its ‘bona fide belief that it was lawful for it to do so’ .

156. Following to the IE SA Decisions, Meta IE argued that it took substantial steps to bring its processing
277
activities into ‘what it believes was compliance with [the IE SA] decisions’ , including by changing its
legal basis from Article 6(1)(b) GDPR to Article 6(1)(f) GDPR for the processing of personal data
278
collected on its products for the purposes of behavioural advertising .

268

269See the analysis carried out above in Section 4.1.1.2.3 and paragraphs 98-99.
270See the analysis carried out above in Section 4.1.1.3.3 and paragraph 148.
271NO SA Request to the EDPB, p. 6.
272
NO SA Request to the EDPB, p.12.
273NO SA Request to the EDPB, p. 6.
274NO SA Request to the EDPB, p. 6 and Letter from the NO SA to the IE SA dated 11 October 2023, p. 2.
275NO SA Request to the EDPB, p. 6.
276
Letter from Meta IE to NO SA of 4 August 2023, in relation to right to be heard, paragraph 65.
277Letter from Meta IE to NO SA of 4 August 2023, in relation to the right to be heard, dated paragraph 65.
278 Meta IE’s Compliance Report regarding the Facebook Service (IN-18-5-5) of 3 April 2023 (hereinafter,
‘Compliance Report on IE SA FB Decision’), paragraph 2.1 and Meta IE’s Compliance Report regarding the

Instagram Service (IN-18-5-7) of 3 April 2023 (hereinafter, ‘Compliance Report on IE SA IG Decision’), paragraph
2.1 (together, the ‘Compliance Reports’).

Adopted 42157. Meta IE takes the view that neither the EDPB Binding Decisions nor the IE SA Decisions ordered Meta

IE to rely on a specific legal basis for the processing of personal data collected on its products for
behavioural advertising purpose under Article 6(1) GDPR, such as Article 6(1)(a) GDPR 27. As a result,

Meta IE still currently seeks to rely on Article 6(1)(b) GDPR to process some specific categories of
personaldatathatitdoesnotconsidertobebehaviouraldata 28,andonArticle6(1)(f)GDPRtoprocess
281
other personal data for the purposes of behavioural advertising - solely for personal data collected
on its products 282.

158. After considering the IE SA Provisional Position Paper (including the IE SA’s interpretation of the CJEU
Bundeskartellamt Judgment), Meta IE stated that it was willing to implement the necessary measures

to rely on Article 6(1)(a) GDPR as its legal basis for processing for the purpose of behavioural
advertising through the Meta IE’s Consent Proposal 28.

159. After considering the IE SA’s Final Position Paper, Meta IE stated that it considered itself as compliant
with the IE SA Decisions
284
.

285
.

4.1.2.3 Analysis of the EDPB

160. TheEDPBrecallsthatArticle60(10)GDPRprovidesforthedutyforthecontrollerto‘takethenecessary

measures to ensure compliance with the decision [taken in the context of the cooperation mechanism]
as regards processing activities in the context of all its establishments in the Union’ 28.

161. The EDPB also recalls that non-compliance with an order of an SA pursuant to Article 58(2) GDPR
constitutes an infringement that may be sanctioned by way of an administrative fine pursuant to
287
Article 83(5)(e) GDPR and Article 83(6) GDPR .

279Meta IE’s Submissions of 26 September 2023, p. 10, and Meta IE’s Submissions of 25 August 2023, p. 4 and

280
See paragraph 91 above and the IE SA Final Position Paper, paragraphs 6.2 and 7.1-7.22.
281IE SA Final Position Paper, paragraphs 6.3 and 7.23-7.67.
282See paragraph 104 above and the IE SA Final Position Paper, paragraph 7.23, referring to Meta IE’s Letter to

the IE SA of 30 June 2023.
283Letter from Meta IE to IE SA regarding consent of 27 July 2023, p. 2.
284Meta IE’ Submissions of 25 August 2023, paragraph 61.
285Meta IE’s Submissions of 25 August 2023, paragraph 64.
286
Article 60 GDPR.
287According to Art. 83(5)(e) GDPR, ‘non-compliance with an order or a temporary or definitive limitation on
processingorthesuspensionofdataflowsbythesupervisory authoritypursuanttoArticle 58(2)[GDPR]orfailure
to provide access in violation of Article 58(1) [GDPR]’ is an infringement that ‘shall, in accordance with

paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 %
of the total worldwide annual turnover of the preceding financial year, whichever is higher’. Art. 83(6) GDPR
provides: ‘Non-compliance with an order by the supervisory authority as referred to in Article 58(2) [GDPR] shall,
in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the

case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year,
whichever is higher’.

Adopted 43162. The EDPB confirms, in line with the view of the NO SA 288, that non-compliance with decisions of
289
supervisory authorities is in itself an independent violation of the GDPR .

163. As already noted above, the IE SA Decisions required Meta IE to, inter alia, take the necessary action

to address the finding that Meta IE is not entitled to process personal data for behavioural advertising
on the basis of Article 6(1)(b) GDPR and to bring its processing of personal data for behavioural
290
advertising purposes into compliance with Article 6(1) GDPR. Also, the IE SA made clear that the
actions Meta IE should take to comply with the IE SA Decisions may include, but were not limited to,
291
the identification of an appropriate alternative legal basis in Article 6(1) GDPR and may include the
implementation of any necessary measures required to satisfy the conditionality associated with
292
that/those alternative legal basis/bases . The deadline for compliance with the IE SA Decisions was
5 April 2023.

The EDPB notes that in the IE SA Final Position Paper, the IE SA found that Meta IE failed to
demonstrate compliance with the IE SA Decisions, and states that Meta IE ‘failed to demonstrate that

it no longer relies on Article 6(1)(b) GDPR to process personal data for behavioural advertising’ and
‘failed to demonstrate that it has a lawful basis to process Platform behavioural Data for behavioural
293
advertising’ .

164. The EDPB notes that the NL SA also stated that ‘As Meta [IE] has publicly stated that it already makes
useofArticle6(1)(f)[GDPR]asalegalbasis,thisconclusionmeansthat-atthemoment-personaldata

of millions of European data subjects are being processed without there being a valid legal basis. This
moreovermeansthat Meta[IE]doesnotcomplywiththe[IESA]’s orderinthe[IESADecisions]tobring
294
these processing operations in line with Article 6 GDPR’.

165. The EDPB notes the view of the IE SA that neither the GDPR nor Irish national law prescribes the

mannerinwhichtheassessmentofthestepstakenby thecontrollerinpurportedcompliance withthe
orders of an SA should be carried out 295. In this respect, the EDPB notes that Meta IE does not contest

that the IE SA’s findings made subsequently to the IE SA Decisions are made ‘to implement the existing
[IE SA] decisions pursuant to Article 60(10) GDPR’. 296

166. In respect of Meta IE’s argument that it fully complied with the IE SA Decisions by taking, first,

substantial steps to bring its processing activities into compliance by 5 April 2023 297and, secondly,
steps in the direction of theMeta IE’s Consent Proposal 29, the EDPB highlights that these elements do

288
Letter from the NO SA to the IE SA of 17 September 2023 in relation to the right to be heard, p. 7.
289‘Non-compliance with a corrective power previously ordered may be considered either as an aggravating
factor, or as a different infringement in itself, pursuant to Art. 83(5)(e) and Art. 83(6) GDPR. Therefore, due note

should be taken that the same non-compliant behaviour cannot lead to a situation where it is punished twice’,
EDPB Guidelines 04/2022 on the calculation of administrative fines under the GDPR, version 2.1, paragraph 103.
290See IE SA FB Decision, paragraph 10.44b; IE SA IG Decision, paragraph 212.
291IE SA FB Decision, paragraph 10.44b and IE SA IG Decision, paragraph 10.
292
IE SA FB Decision, paragraph 8; and IE SA IG Decision, paragraph 212.
293IE SA Final Position Paper, section 8, p. 25. In relation to Meta IE’s reliance on Article 6(1)(b) GDPR, also see
paragraphs 96-99 above. In relation to Meta IE’s reliance on Art. 6(1)(f) GDPR, also see paragraphs 121, 135, 138
above.
294
NL SA Mutual Assistance Request, p. 2.
295Letter of the IE SA to Meta IE of 14 June 2023, p. 1-2.
296Meta IE’s Submissions of 26 September 2023, p. 12 and 13.
297Meta IE’s Submissions of 26 September 2023, p. 10 and Meta IE’s Submissions of 16 October 2023, p. 5. See

also Meta IE’s Submissions of 25 August 2023, p. 33.
298Letter from Meta IE to IE SA regarding consent of 27 July 2023, p. 2.

Adopted 44 notinthemselvescontradicttheconclusionthatatthispointintimecompliancewithArticle6(1)GDPR

for the processing activities within the scope of the IE SA Decisions has not yet been achieved while
the deadline to implement the IE SA Decisions was 5 April 2023.

4.1.2.4 Conclusion as to the infringement of the duty to comply with decisions by supervisory
authorities

167. InlightofitsfindingsthatMetaIEstillreliesinappropriatelyonArticle6(1)(b)GDPRtoprocesspersonal
data, including location data and advertisement interaction data, collected on its products for the

purpose of behavioural advertising 300and on Article 6(1)(f) GDPR to process personal data collected
onitsproductsforthepurposeofbehaviouraladvertising 301theEDPBfinds,inlinewiththeconclusions
302 303 304
drawn by the IE SA and with the views expressed in particular by the NO SA in the
courseof the proceedings, that Meta IE did not achievecompliancewith the IE SADecisions within the

deadline for compliance and is therefore currently in breach of its duty to comply with decisions by
supervisory authorities.

4.2 On the existence of urgency to adopt final measures by way of derogation

from the cooperation and consistency mechanisms

168. The second element to assess pursuant to Article 66(2) GDPR is the existence of an urgency situation

justifying a derogation from the regular cooperation procedure.

169. TheurgentinterventionoftheEDPBpursuanttoArticle66(2)GDPRisexceptional,andderogatesfrom
the general rules applicable to the regular consistency and cooperation mechanisms.

170. Considering the fact that the urgency procedure under Article 66(2) GDPR is a derogation to the

standardconsistencyand cooperationmechanisms,itmustbeinterpretedrestrictively.Therefore,the
EDPB may request final measures under Article 66(2) GDPR only if the regular cooperation or

consistency mechanisms cannot be applied in their usual manner, due to the urgency of the
situation30.

171. In addition, Article 61(8) GDPR provides that, where an SA does not provide the information referred

to in Article 61(5) GDPR within one month of receiving a mutual assistance request from another SA,
the ‘urgent need to act under Article 66(1) [GDPR] shall be presumed to be met and require an urgent

binding decision from the Board pursuant to Article 66(2) [GDPR]’. If such a presumption applies, the
urgent natureofan Article 66(2)requestforan urgentbinding decisioncan be presumed and doesnot
306
need to be demonstrated .

299
LetterfromNO SAtoMetaIE andFacebookNorway of17September2023 in relationtotherighttobeheard,
p. 9.
30See paragraphs 98-99, and 152 above.
30See paragraphs 148 and 153 above.
30IE SA Final Position Paper, section 8, p. 25.
303
NO SA Request to the EDPB, p. 6.
304
30EDPB Urgent Binding Decision 01/2021, adopted on 12 July 2021, paragraph 167.
30EDPB Urgent Binding Decision 01/2021, adopted on 12 July 2021, paragraph 170.

Adopted 45172. In the present procedure, the NO SA requested the EDPB to adopt a decision pursuant to Article 66(2)

GDPR, in order to urgently request the IE SA to impose final measures on Meta IE. The request has
been made following to the adoption of provisional measures pursuant to Article 66(1) GDPR 307which
are only applicable in Norway, and are only valid for three months.

173. In the sections below, the EDPB analyses first whether the circumstances of the present case
demonstrate theexistence ofurgencyandtheneedtoderogatefromthecooperationandconsistency

mechanisms(section4.2.1below)beforeanalysingwhetherthepresumptiondescribedinArticle61(8)
GDPR is applicable to the circumstances of the case (section 4.2.2).

4.2.1 On the existence of urgency and the need to derogate from the cooperation and
consistency mechanisms

4.2.1.1 Summary of the position of the NO SA

174. The NO SA considers that ‘Regardless of the applicability of the Article 61(8) presumption, in the

present case there is an urgent need for a binding decision from the EDPB in accordance with Article
66(2) GDPR, in order to protect the rights and freedoms of data subjects’ 30.

175. According to the NO SA, the processing in question is detrimental to individuals’ fundamental rights,

and failing to put an end to this processing would thus expose these data subjects to a risk of serious
and irreparable harm 309. In more details, the NO SA takes the view that:

• Theinfringementshavebeenoccurringforasignificantamountoftimeandareofanespecially

serious nature, as they have a considerable impact on the users of Meta’s products whose
online activities are ‘constantly, intrusively and opaquely monitored and profiled by Meta’,

which ‘may give rise to the feeling that their private life is being continuously surveilled’.10

• The infringements affect over 250 million average monthly active users in the EU, including
vulnerable data subjects in need of particular protection, such as minors, elderly people and
311
people with cognitive disabilities .
• The filtering of the specific ads that are displayed on Facebook or Instagram has an adverse
312
effect on data subjects’ freedom of information and on political participation while creating
‘a potential for reinforcement of existing stereotypes, and it can leave data subjects open to

discrimination’ 313.

• Not taking urgent action to ensure compliance with the IE SA Decisions would deprive data
subjects of the right to seek an effective remedy against a data controller from SAs under
314
Article 77 GDPR .

307
Art. 66(4) GDPR; as described in Section 2.1 above.
308NO SA Request to the EDPB, p. 10.
309NO SA Request to the EDPB, p. 10.
310NO SA Request to the EDPB, p. 10, referring to CJEU Bundeskartellamt Judgment, paragraph 118.
311
NO SA Request to the EDPB, p. 10.
312NO SA Order, p. 22.
313NO SA Request to the EDPB, p. 10; NO SA Order, p. 22.
314NO SA Order, p. 28.

Adopted 46 • The NO SA is of the view that there is no measure that could be applied retroactively to repair
the violation of the rights and freedoms of data subjects 315.

176. In addition, the NO SA states that there has been a ‘continued refrainment from enforcement’ on the
part of the IE SA 31. The NO SA takes the view that despite the fact that infringements are taking place

appears uncontroversial among supervisory authorities, ‘the IE SA appears to be unwilling to demand
that such infringements be ceased without any further delays’ 31. In this respect, the NO SA states that

thefailuretofirmlyandexpedientlyreacttonon-compliancewiththeIESADecisionsnotonlydeprives
datasubjectsoftheprotectiontheyareentitledto,butisalsocontrarytosupervisoryauthorities’duty

to ensure that the GDPR is respected in practice 318.

177. More generally, in the view of the NO SA, not reacting to Meta IE’s prolonged state of non-compliance
319
would set a dangerous precedent as it would ‘invite dilatory strategies from non-compliant
controllers’andunderminetheauthorityoftheIESA,theCSAsandtheEDPB 320.FortheNOSA,afailure

to adopt the requested urgent binging decision in the present circumstances would entail serious risks
that the Article 66 GDPR mechanism would turn in to a ‘paper tiger’ 32.

178. The NO SA argues that an EDPB urgent binding decision would be a narrow and strictly limited
exceptiontotheprimacyoftheLSAinensuringcompliancewithanArticle60GDPRdecisionandwould
322
not set a precedent for derogating from the standard one-stop-shop cooperation procedure as it
would be issued after the completion of an Article 60 GDPR process, following the adoption by the IE
323
SA of the IE SA Decisions and given the fact that the IE SA does not envisage to start a new Article
60 GDPR procedure 32.

179. Further, the NO SA argues that final measures would not interfere with
commitment to change the legal basis for behavioural
325
advertising to consent . According to the NO SA, ‘if Meta [IE] would be ordered to stop all such
processing activities based on Article 6(1)(b) [GDPR] and [Article 6(1)] (f) pending the identification of

a valid legal basis, it would have an incentive to expeditiously identify adequate and lawful solutions to
resume its processing activities as soon as possible’ 326.

180.

315
NO SA Rejection of Meta IE and Facebook Norway’s Request for Deferred Implementation of the Order dated
7 August 2023, p. 1.
316NO SA Order, p. 12.
317
NO SA Request to the EDPB, p. 6.
318NO SA Request to the EDPB, p. 6.
319Letter of NO SA to IE SA of 11 October 2023, p. 11.
320NO SA Order, p. 28; NO SA Request NO SA Request to the EDPB, p. 12.
321
NO SA Request to the EDPB, p. 12, referring to the opinion of Advocate General Bobek in Case C‑645/19,
Facebook Ireland and Others, paragraph 119 and paragraph 122.
322NO SA Request to the EDPB, p. 12.
323
NO SA Request to the EDPB, p. 10-11, referring to IE SA Information on Procedure (response to SE SA) of 4
May 2023 where the IE SA had indicated via the IE SA IMI Informal Consultations that they would ‘not be
preparing any further decision in this matter’.
324NO SA Request to the EDPB, p. 11.
325
NO SA Request to the EDPB, p. 11-12.
326NO SA Request to the EDPB, p. 11-12.

Adopted 47 327
’ .

328
.

181. The NO SA also recalls that in any event, the Meta IE’s Consent Proposal does not eliminate the urgent
need to adopt final measures 329.

330.

331. Therefore, in
the NO SA’s view, final measures constitute ‘the only way’ to stop the harm to data subjects’

fundamental rights 33.

4.2.1.2 Summary of the position of the controller

182. According to Meta IE, the circumstances of the case do not justify an urgent decision of the EDPB
pursuanttoArticle66(2)GDPR 333.Inparticular,MetaIE recallsapriordecisionoftheEDPBstatingthat

‘the urgency procedure under Article 66(2) GDPR is a derogation to the standard consistency and
cooperation mechanisms, it must be interpreted restrictively. Therefore, the EDPB will request final

measures underArticle66(2)[GDPR] onlyif theregularcooperationor consistencymechanismscannot
be applied in their usual manner due to the urgency of the situation’ 334.

183. In this respect, Meta IE notes that the comments received by the IE SA from the CSAs show that the
cooperation and consistency mechanism being led by the IE SA (which incorporates the views of

numerous CSAs in addition to the views of the NO SA), is clearly functioning in accordance with Article
60 GDPR, and argues that there is no reason to derogate from that mechanism 335. For this reason, in

Meta IE’s view, the NO SA’s invocation of Article 66(1) GDPR and the NO SA Request to the EDPB are
improper 33.

184. According to Meta IE, the urgency procedure interferes with the regular cooperation mechanism that
the IE SA has been following to implement the IE SA Decisions 337. Meta IE’s view is that the process of

327LetterofNOSAtoIESAof11October2023,p.2.SeealsoNOSARejectionofMetaIE’sandFacebookNorway’s
RequestforDeferredImplementationoftheCoerciveFineof7August2023,p.1-2,wheretheNOSAgivesseveral
arguments related to the fact that Meta IE has ‘not implemented any measures that would warrant lifting the

Orderorwaivingthecoercivefine,as thepersonal
data of data subjects in Norway continue to be unlawfully processed for behavioural advertising purposes [...],

.
328NO SA Request to the EDPB, p. 11.
329NO SA Request to the EDPB, p. 11.
330NO SA Request to the EDPB, p. 8.
331
NO SA Request to the EDPB, p. 8.
332NO SA Request to the EDPB, p. 12.
333Letter from Meta IE to IE SA of 31 May 2023, p.5; Letter from Meta IE to IE SA regarding potential urgent

334ceedings of 21 June 2023, p. 4.
Letter from Meta IE to IE SA dated 31 May 2023, p. 5, referring to EDPB Urgent Binding Decision 01/2021,
paragraphs 195-196.
335Meta IE’s Submissions of 16 October 2023, p. 4.
336
Meta IE’s Submissions of 16 October 2023, p. 4.
337Meta IE’s Submissions of 26 September 2023, p. 12-13.

Adopted 48 engagement between Meta IE and the IE SA pursuant to Articles 56(6) GDPR and Article 60(10) GDPR

remains ongoing, and that there are no exceptional circumstances that would allow the NO SA to
bypass such process 338.

185. In addition, according to Meta IE, ‘the NO SA’s action directly conflicts with and undermines (i) the
authority of the LSA, (ii) the role of other supervisory authorities across the EU/EEA who are
339
appropriately engaging via the LSA-led process and (iii) the GDPR’s one-stop-shop mechanism’ .

186. Meta IE also states that the existence of a disagreement between a LSA and a CSA does not, in itself,
create a situation of urgency as such 340. In this respect, it states that ‘the fact that the [NO SA] appears

to disagree with the [IE SA] cannot justify it resorting to the use of Article 66(2)
[GDPR]’ 341. Meta IE also states that there is no precedent for a SA using Article 66(2) GDPR to seek to

‘overrule and dictate the process that a LSA has put in place to assess compliance with the LSA’s own
orders’ 342.

187. Regarding the nature of the infringements, Meta IE is of the view that the NO SA does not provide
evidence of their alleged seriousness, and states that behavioural advertising is a common practice,
widespread beyond Meta’s services 343.

188. Meta IE also argues that the fact that the behavioural advertising processing has been ongoing for
manyyearsdoesnotjustifyanyurgencybut,rather,provesthatthereisnonewelementofurgency 344.

Meta IE highlights that the processing at stake in this case is the same processing as the one that has
been ‘thesubject of detailed consideration by the[IE SA] (...)for over 4 years and by the EDPB, with the
345
awareness of SAs throughout’ . In this respect, Meta IE also recalls that in the EDPB Urgent Binding
Decision 01/2021, the EDPB has established that ‘the mere continuation of processing, cannot, on its
346
own, justify an urgent need to act’ .

189. Meta IE considers that the EDPB Binding Decisions did not mandate it to rely on Article 6(1)(a) GDPR
forbehaviouraladvertising processinganddidnotconcludeeither thatArticle6(1)(f)GDPRwasnotan

338
Letter from Meta IE to IE SA of 31 May 2023, p. 5; Letter from Meta IE to IE SA regarding potential urgent
proceedings of 21 June 2023, p. 4.

.
339Letter from Meta IE to the IE SA of 10 August 2023, p. 2.
340Meta IE’s Submissions of 26 September 2023, p. 1-2, 8. See also Meta IE’s Submissions of 16 October 2023, p.

5.
341Meta IE’s Submissions of 26 September 2023, p. 12.
342Meta IE’s Submissions of 26 September 2023, p. 2.
343MetaIE’sSubmissionsof26September2023,p.9.Morespecifically,MetaIEhighlightsthattheminimumage

for using Facebook and Instagram is 13 andfor users agedbetween 13 and 17 only theage and locationare used
to display ads.
344Meta IE’s Submissions of 26 September 2023, p. 8-9. Meta IE also reiterated that the ‘alleged “urgency”
claimed by the [NO SA] cannot be premised on the relevant processing (i.e. [Meta IE]’s use of on-platform data

for behavioural advertising purposes), given this processing has been ongoing for years with the full knowledge
of regulators, and the only recent development is that [Meta IE] has increased the level of data subjects’ control
over this processing’, see Meta IE’s Submissions of 16 October 2023, p. 5.
345See also Letter from Meta IE to IE SA of 31 May 2023, p. 5. Also see Letter from Meta IE to IE SA regarding

potential urgent proceedings of 21 June 2023, p. 3.
346Letter from Meta IE to IE SA of 31 May 2023, p. 5, referring to the EDPB Urgent Binding Decision 01/2021,
paragraphs 195-196.

Adopted 49 appropriate legal basis for the processing of personal data collected on Meta’s products for the
347
purpose of behavioural advertising . Meta IE argues that it was only with the IE SA Final Position
Paper that it became clear to it that its reliance on Article 6(1)(f) GDPR for such processing did not
348
comply with the IE SA Decisions .

190. Meta IE also argues that the IE SA is not refraining from enforcing the GDPR against it, given that the

IE SA shared a timeline with the CSAs and issued the IE SA Provisional Position Paper and then the IE
SAFinalPositionPaper 34.

35.

191. Meta IE states further that any urgent binding decision would be counterproductive

, and ultimately harm the interests of data
subjects while generating administrative work for the EDPB, the IE SA, the CSAs and Meta IE 35. In this

respect, it also highlights that the measures requested by the NO SA through the urgency proceedings
had already been considered as objections during the previous Article 65 GDPR process, and rejected
352
by the EDPB in the EDPB Binding Decisions .

353
.

4.2.1.3 Analysis of the EDPB

192. Article 66(2) GDPR requires the SA requesting an urgent binding decision to provide reasons for

requesting such opinion. This includes the need for the requesting SA to demonstrate an urgent need
to act.

193. Therefore, the EDPB analyses, whether, on the basis of the views of the NO SA and of the controller,
as well as on the basis of the elements in the file, the condition of urgency is met.

194. In this respect, the EDPB considered in a past decision that the nature, gravity and duration of an

infringement, as well as the number of data subjects affected and the level of damage suffered by
them, may play an important part when deciding whether or not there is an urgent need to act in a
354
particular case .

195. In relation to the nature and gravity of the infringements, the EDPB notes that its findings that Meta

IE still relies inappropriately on Article 6(1)(b) GDPR to process personal data, including location data
and advertisement interaction data collected on its products for the purpose of behavioural
355
advertising and on Article 6(1)(f) GDPR to process personal data collected on its products for the

347Meta IE’s Submissions of 26 September 2023, p. 10.
348Meta IE’s Submissions of 26 September 2023, p. 10 (Meta IE refers to national courts in the EU holding, prior

totheIESADecisions,thatArt.6(1)(b)GDPRisanappropriatelegalbasis,andtothefactthat previousdecisions
from the IE SA initially confirmed the possibility to rely on Art. 6 (1) (b) GDPR). See also Meta IE’s Submissions of
16 October 2023, p. 5.
349Meta IE’s Submissions of 26 September 2023, p. 7 and 9.
350
Meta IE’s Submissions of 26 September 2023, p. 11.
351Meta IE’s Submissions of 26 September 2023, p. 3; see also Meta IE’s Submissions of 25 August 2023,
paragraphs 46-48.
352Meta IE’s Submissions of 26 September 2023, p. 7-8.
353
Meta IE’s Submissions of 26 September 2023, p. 9.
354EDPB Urgent Binding Decision 01/2021, adopted on 12 July 2021, paragraph 169.
355See paragraphs 98-995 and 152 above.

Adopted 50 356
purpose of behavioural advertising relate to the same processing activities as those referred to in
the IE SA Decisions adopted on the basis of EDPB Binding Decisions.

196. In this respect, the EDPB recalls its finding from the EDPB Binding Decisions, i.e. that the nature and

gravity of the infringement of Article 6(1) GDPR are such that a risk of damage caused to data subjects
is consubstantial with the finding of the infringement itself 357. In relation to Meta IE’s infringements of

Article 6(1) GDPR with respect to behavioural advertisement practices, the EDPB found that they
constituted a very serious situation of non-compliance with the GDPR, in relation to processing of

extensive amounts of data 358, which is essential to the controller’s business model, and harming the
rights and freedoms of millions of data subjects in the EEA 359.

197. The EDPB also already highlighted in its EDPB Binding Decisions the ‘complexity, massive scale and
intrusiveness of the behavioural advertising practice that [Meta IE] conducts’ 36. This view is still

currently shared by the NO SA, which finds that Meta IE’s users’ online activities are ‘constantly,
intrusively and opaquely monitored and profiled’ by Meta IE, which ‘may give rise to the feeling that
361
their private life is being continuously surveilled’ . This view is also still shared by the NL SA, which
expressed greatconcerns withrespect to the processingactivities atstakeinlightof‘thelargeamount

of personal data being processed, the number of data subjects involved as well as the nature of the
data that is being processed – including video, audio and mouse movement’ 362.

198. The EDPB also clarified that at the time of the adoption of the EDPB Binding Decisions, bringing the
processingintocompliancewiththeGDPRwouldallowtominimisethepotentialharmtodatasubjects
363
created by the violations of the GDPR . In the EDPB Binding Decisions, the elements of the ‘nature
and gravity of the infringement’ 364and the ‘number of data subjects affected’ - which were and still
365
aresignificant -ledtheEDPBtoconcludethat‘itisparticularlyimportantthatappropriatecorrective
measuresbeimposed[...]inorderto ensurethat[MetaIE]complieswiththisprovisionoftheGDPR’ 366.

199. When determining the transition period for bringing Meta IE’s processing into compliance with the
GDPR, the EDPB requested that the IE SA gives ‘due regard to the harm caused to the data subjects by
367
the continuation of [Meta IE]’s infringement of Article 6(1) GDPR during this period’ .

200. The need for urgent action was fully acknowledged and clearly indicated in the IE SA Decisions 368.

356
See paragraphs 148 and 153 above.
357EDPB Binding Decision 3/2022, paragraph 446 and EDPB Binding Decision 4/2022, paragraph 415.
358EDPB Binding Decision 3/2022, paragraph 444 and EDPB Binding Decision 4/2022, paragraph 413.
359
EDPB Binding Decision 3/2022, paragraph 282 and EDPB Binding Decision 4/2022, paragraph 284.
360EDPB Binding Decision 3/2022, paragraph 96 and EDPB Binding Decision 4/2022, paragraph 99.
361NO SA Request to the EDPB, p. 10, referring to CJEU Bundeskartellamt Judgment, paragraph 118.
362NL SA Mutual Assistance Request, p. 2.
363
EDPB Binding Decision 3/2022, paragraph 282 and EDPB Binding Decision 4/2022, paragraph 284.
364EDPB Binding Decision 3/2022, paragraph 279 and EDPB Binding Decision 4/2022, paragraph 281.
365EDPB Binding Decision 3/2022, paragraph 445 and EDPB Binding Decision 4/2022, paragraph 414.
366
367EDPB Binding Decision 3/2022, paragraph 279 and EDPB Binding Decision 4/2022, paragraph 281.
EDPB Binding Decision 3/2022, paragraph 286 and Binding Decision 4/2022, paragraph 288.
368IESAFBDecision,paragraph8.10(‘[...]IdonotagreewithFacebook’ssubmissionthatthe[IESA]hasdiscretion

to delay the activation of the timeline for compliance [...]. It is clear, from paragraph 286 of the Article 65 [GDPR]
Decision, that the EDPB considered it necessary for Facebook to take the remedial action required to address the
relevant infringements “within three months”. While Facebook has correctly identified that the EDPB has not
expressly identified the starting point of this compliance period, the [IE SA]’s view is that it goes without saying

that the starting point has to be the adoption and notification of the [IE SA]’s final decision, given that this is the
earliest time from which the applicable timeline for compliance can start to run. Any contrary suggestion would

Adopted 51201. In relation to the duration of the infringement and considering the above findings that Meta IE still

relies inappropriately on Article 6(1)(b) GDPR and Article 6(1)(f) GDPR to process personal data
collected on its products for the purpose of behavioural advertising 369 despite the fact that the

deadline for complying with the IE SA Decisions was 5 April 2023, the EDPB finds that data subjects are
still faced with data processing activities that are unlawful 37. In relation to Meta’s argument that it is

only on 18 August 2023 that the IE SA concluded that Meta IE’s reliance on Article 6(1)(f) GDPR for
behaviouraladvertisingpurposewasinsufficienttocomplywiththeIESADecisions 371,theEDPBshares

the view of the NL SA expressed already on 30 May 2023 that ‘the controller could not have been
unaware of already established guidance from the EDPB, nor of the position of several CSAs on the
372
matter, but chose to explore the path of Article 6(1)(f) [GDPR] regardless’ .

202. In this respect, the EDPB can only note that every additional day during which the processing activity

at stake takes place without reliance on an appropriate legal basis causes supplementary harm to the
data subjects and allows Meta to continue to collect significant amounts of personal data of millions

of European individuals on a daily basis and to generate significant revenue from the unlawful
processing of the personal data of millions of data subject in the EEA 37. It also observes, in line with

the position of the NO SA, that there are no measures that could be applied retroactively to repair the
violation of the rights and freedoms of data subjects 374.

203. Therefore, while in some cases the fact that an infringement has been continuing for a long time may
serve to demonstrate that an urgent need to act does not arise 37, as recalled by Meta IE 376, the EDPB

considers in this case that the situation is different. To the contrary, in this case, the fact that the
processing activities are still performed without reliance on an appropriate legal basis represents an

element in favour of concluding that there is an urgent need for final measures to be adopted, since
despite the orders given in the IE SA Decisions and the different discussions regarding their

implementations, Meta IE still processes unlawfully personal data and still does not comply with the
IE SA decisions 377This is not dispelled by Meta IE’s arguments on the fact that more transparency and
an opt-out mechanism were implemented 378, as these elements do not solve the underlying issue of

the lawfulness of the processing 379and the related harm caused on data subjects.

be inconsistent with the need for urgent action that was clearly indicated to be required in paragraphs 286, 288

and 290 of the Article 65 Decision. It would further render meaningless the EDPB’s consideration of the
compliance period in terms of a fixed number of months (in this case, three)’). An analogous wording is present
in paragraph 214 of the IE SA IG Decision.
369See paragraphs 152 and 153 above.
370
EDPB Binding Decision 3/2022, paragraph 446 and EDPB Binding Decision 4/2022, paragraph 415.
371Meta IE’s Submissions of 26 September 2023, p. 11 and Meta IE’s Submissions of 16 October 2023, p.5.
372NL SA Mutual Assistance Request, p. 2.
373In this respect, Meta IE states that ‘any suspension of behavioural advertising in Norway for nearly a three

month period would irreparably damage [Meta IE] as it would suffer (i) many millions of Euros in lost advertising
revenue during this period’, see Meta IE’s Letter to the NO SA of 14 August 2023, p.9.
374NOSARejectionofMetaIE’sandFacebookNorway’sRequestforDeferredImplementationoftheOrderdated
7 August 2023, p. 1.
375
See, for instance, EDPB Urgent Binding Decision 01/2021, paragraphs 195-196.
376Letter from Meta IE to IE SA of 31 May 2023, p. 5, referring to the EDPB Urgent Binding Decision 01/2021,
paragraphs 195-196.
377See sections 4.1.1.4 and 4.1.2.4 above.
378
Meta IE’s Submissions of 26 September 2023, p. 9.
379See paragraphs 152 and 153 above.

Adopted 52204. The EDPB recalls in this respect the NO SA’s argument that the failure to firmly and expediently react

to non-compliance with the IE SA Decisions deprives data subjects of the protection that they are
entitled to 380.

205. The EDPB finds, in light of the above and in line with the view of the NO SA, that failing to put an end
tothe processingactivities atstakeand toenforcetheIESADecisionsexposes datasubjects toarisk
381
of serious and irreparable harm . The NO SA, alongside other CSAs, have also expressed the view
that further measures are urgently needed in this case not only to address the situation of non-

compliance with the GDPR but also put an end to the harm to data subjects.

206. The SE SA expressed the need for further action after the circulation of Meta IE Compliance Reports
382
and asked ‘the [IE] SA what procedure [the SE SA] can expect going forward’ .

207. The NL SA
”383, echoing its previous call to the IE SA “to swiftly undertake adequate actions in

order to cease the continuous illegality of the invasive processing of personal data of millions of
users’ 38. It is also important to recall the NL SA Mutual Assistance Request 38, according to which

‘appropriate and expedient action is required to protect the fundamental rights of millions of data
subjects in the Netherlands as well as throughout the European Economic Area’ 386 and that SAs should

be ‘acting together’ on this ‘as cooperating European supervisory authorities under the lead of the [IE
SA]’ 38.

208. Similarly, already after the circulation of the IE SA Provisional Position Paper to the CSAs, the DE
Hamburg SA requested the IE SA ‘to swiftly reach a consolidated position that [Meta IE] has not

demonstrated the legal basis and suspend the processing, which is based on Art[icle] 6 (1) [(b) GDPR]
and [Article 6 (1)] (f) GDPR for behavioural advertising’ 388.

209. In the EDPB Binding Decisions, the EDPB made clear that urgent action was already required in

December 2022 and decided that, at that time, the order for compliance to be imposed on Meta IE
should require Meta IE to restore compliance within a short period of time 389. In doing so, the EDPB

380
381NO SA Request to the EDPB, p. 6.
See paragraph 175 above, and NO SA Request to the EDPB, p. 10.
382SE SA comment in IE SA IMI Informal Consultations of 4 May 2023.
383 .
384
Views of the NL SA on the Compliance Reports of 4 May 2023, in IMI informal consultation on FB case and in
IMI informal consultation on IG case, paragraph 4.
385The NL SA made the NO SA Mutual Assistance Request on 30 May 2023 and requested the IE SA to inform
them by 30 June 2023:

(i) ‘Of its conclusion as to whether [Meta IE] can or canno invoke Article 6(1)(f) GDPR for the processing of the
personal data of its users for the purposes of behavioural advertising, more specifically for a large part of the
processing operations for which [Meta IE] previously relied on Article 6(1)(b) [GDPR];’ and
(ii) ‘Of its conclusion as to whether [Meta IE] does or does not comply with the [IE SA]’s final decision of 31

December 2022, ordering [Meta IE] to bring these processing operations in line with Article 6 GDPR;’ and
(iii) ‘Of a timeframe in which appropriate and expedient action will be taken to ensure that [Meta IE] acts in
compliance with Article 6 GDPR, to protect the fundamental rights of millions of data subjects affected by this
processingoperation,intheNetherlandsaswellasthroughouttheEuropeanEconomicArea(EEA).Inthisrespect,

the [NL SA] attaches significant weight to the connection between the controller’s non-compliance with Article 6
GDPR and its failure to comply with the [IE SA]’s order. In our view, this warrants prompt intervention’
386NL SA Mutual Assistance Request, p. 1.
387NL SA Mutual Assistance Request, p. 2.
388
Views of the DE Hamburg SA on IE SA Provisional Position Paper of 21 July 2023, p. 2.
389Binding Decision 3/2022, paragraph 286 and Binding Decision 4/2022, paragraph 288.

Adopted 53 recalled the IE SA’s reasoning on the three-month deadline already provided by the IE SA its draft
390
decision forcomplianceforthetransparencyinfringements,whichitconsideredtobenecessaryand
proportionate in light of: (1) the potential for harms to the data subjects’ rights that such a measure
entails, considering that the interim period for compliance ‘will involve a serious ongoing deprivation

of their rights’, (2) the significant financial, technological, and human resources and (3) the clear
instructions provided to Meta IE to comply with GDPR 39. The EDPB therefore instructed the IE SA to

include in itsfinaldecision anorder for Meta IE tobringitsprocessingof personaldata forthepurpose
of behavioural advertising in the context of the Facebook service into compliance with Article 6(1)
392
GDPR within three months .

210. Importantly, the understanding that the timeframe to be left to Meta IE to achieve compliance with
the GDPR needed to be a fixed one was also shared by the IE SA in the IE SA Decisions, where the IE SA

referredto theEDPBBindingDecisions andexplainedthatclearly ‘theEDPBconsidereditnecessary for
[Meta IE] to take the remedial action required to address the relevant infringements ‘within three
393
months’ and indicated a ‘need for urgent action’, and with ‘a fixed number of months’ .

211. The EDPB previously established that urgency procedures under Article 66 GDPR are derogations from
the standard consistency and cooperation mechanism and that the requirements of Article 66 GDPR
394
must be interpreted restrictively . Therefore, the EDPB considers that it may request final measures
underArticle 66(2)GDPRonlyiftheregularcooperationorconsistency mechanismscannotbeapplied
395
in their usual manner due to the urgency of the situation . Therefore, the EDPB assesses in this
section whether there is a need to derogate from the regular cooperation and consistency

mechanisms in this case.

212. In this particular case, the IE SA already adopted the IE SA Final Decisions under the one-stop-shop
procedure on the basis of the EDPB Binding Decisions, containing an order for compliance with Article

6(1) GDPR. Pursuant to Article 60(10) GDPR, the controller shall notify the measures taken for
complying with a decision taken in the cooperation mechanism with the LSA, which shall inform the

CSAs.

213. The EDPB Guidelines on the application of Article 60 GDPR highlight that the ‘obligation [of the
controllertonotifytotheLSAthemeasurestakentocomplywiththedecision]ensurestheeffectiveness

of the enforcement. It is also the basis of possible necessary follow-up actions to be commenced by the
LSA, also in cooperation with the other CSAs’ 396.

214. These guidelines further point out that if the LSA concludes that the measures taken are insufficient,

the LSA should, as part of its legal duty to inform the CSAs, consider providing the other CSAs with its
assessmentofthemeasuresadoptedbythecontroller,inparticularinordertodecidewhetherfurther

390
IE SA draft decision relating to Facebook, paragraph 8.4, IE SA draft decision relating to Instagram, paragraph
202.
39Binding Decision 3/2022, paragraph 286 and Binding Decision 4/2022, paragraph 288.
39Binding Decision 3/2022, paragraph 288 and Binding Decision 4/2022, paragraph 290.
39IE SA FB Decision, paragraph 8.10; IE SA IG Decision, paragraph 214.
394
EDPB Urgent Binding Decision 01/2021, adopted on 12 July 2021, paragraphs 165-167.
395EDPB Urgent Binding Decision 01/2021, adopted on 12 July 2021, paragraph 167. Also see paragraph 169
above.
39EDPB Guidelines 02/2022 on the application of Article 60 GDPR, adopted on 14 March 2022, paragraph 248.

Adopted 54 actions are necessary 397.This indicates that where the measures adopted by the controller are

considered to be insufficient, there may be a need for the LSA to take further actions.

215. In the case at hand, the IE SA concluded in the IE SA Final Position Paper, also relying upon the

comments shared and views expressed by the CSAs, that Meta IE failed to demonstrate compliance
with the IE SA Decisions 398. However, it also considered that it was ‘fair’ and ‘reasonable’ to provide

Meta IE with an opportunity to demonstrate that it can rely on consent as a lawful basis rather than
engaging in enforcement measures 399.

216. The IE SA has also reiterated its position, as LSA, that no further urgent actions are necessary in this
case, as the course of action already being taken, consisting in ‘an enforcement procedure[...] in which

adefinedsetofproposals,bywhich[MetaIE]proposestoachievecompliancewithitsobligationsunder
Article 6 GDPR (and the terms of the [IE SA] Decisions), is the subject of ongoing assessment by the [IE
400
SA] and the CSAs’, is adequately addressing the situation .

217. In this respect, the EDPB acknowledges the need to evaluate the proposal being made by the
controller, and that this entails the ‘examination of a number of particularly complex (and novel)

issues’ 401. The EDPB also fully acknowledges that a ‘regulatory process’ is ‘being conducted under the
GDPR’s cooperation and consistency framework’, led by the IE SA,

402.

218.
403
.

404
.

he EDPB therefore finds that the existence of the Meta IE’s Consent

Proposal does not undermine the need to take actions to ensure that the unlawful processing comes
to an end.

219. In this context, the EDPB notes that the IE SA acknowledged in its Final Position Paper - more than four
monthsafter the deadlineforcompliance-that Meta IEstill infringesthe GDPR 405.The EDPBfindsthat

the fact that the IE SA did not take supervisory measures to put an end to Meta IE’s inappropriate
reliance on 6(1)(b) and 6(1)(f) GDPR and to enforce the IE SA Decisions, despite the risk of serious and

397
EDPB Guidelines 02/2022 on the application of Article 60 GDPR, adopted on 14 March 2022, paragraph 249.
398IE SA Final Position Paper, paragraph 9.2.
399IE SA Final Position Paper, paragraph 9.2.
400Letter of IE SA to NO SA of 13 October 2023, p. 4.
401
Letter of IE SA to NO SA of 13 October 2023, p. 4-5.
402Letter of IE SA to NO SA of 13 October 2023, p. 6.
403Letter of IE SA to NO SA of 13 October 2023, p. 4-5.
404IE SA’s Response to Meta IE of 11 August 2023 p. 2. The

405IE SA Final Position Paper, paragraph 8.1.

Adopted 55 irreparable harm caused to data subjects 406, shows that the regular cooperation and consistency

mechanismisnotprovidingsatisfactoryresults,andthatthereisaneedtorequesttheIESAtourgently
order final measures due to the urgency of the situation. In this respect, the EDPB notes that while

now six months after the deadline for compliance have passed, there is still no clear indication that
compliancewillbereached soonnoristhereaclearindicationthatthe IESA -asLSA-intendstoadopt
407
corrective measures in order to end the ongoing infringements .

220. In conclusion, the EDPB finds, in light of the circumstances described above, that the regular
cooperation or consistency mechanisms cannot be applied in their usual manner, and that due to

the risk of serious and irreparable harm without urgent final measures, there is a need to derogate
from the regular cooperation and consistency mechanisms to order final measures due to the urgency

of the situation.

221. Lastly, the EDPB considers it relevant to recall the SAs’ duty to monitor the application of the GDPR in
order to protect the fundamental rights and freedoms of natural persons in relation to processing and
408
to facilitate the free flow of personal data within the EU . In particular, the EDPB has stated that
when a violation of the GDPRhas been established, competent supervisory authorities are required to
409
react appropriately to remedy this infringement . The powers afforded to SAs by Article 58 GDPRare
aimed to fulfilling this goal. Similarly, the Court of Justice of the European Union held that ‘(...)

[a]lthough the supervisory authority must determine which action is appropriate and necessary (...),
the supervisory authority is nevertheless required to execute its responsibility for ensuring that the
410
GDPR is fully enforced with all due diligence’ .

4.2.2 On the application of a legal presumption of urgency justifying the need to derogate

from the cooperation and consistency mechanisms

222. Intheprecedentsection,theEDPBfoundthatthereisaneedtoderogatefromtheregularcooperation
411
and consistency mechanisms to order final measures due to the urgency of the situation . In this
section, the EDPB assesses whether such urgency and need to derogate from the regular cooperation
and consistency mechanisms may also be presumed on the basis of Article 61(8) GDPR.

412
223. Considering the facts of the case , the EDPB will assess whether this case falls within the description
provided by Article 61(8) GDPR, which refers to the situation where an SA does not provide the

information referred to in Article 61(5) GDPR within one month of receiving a mutual assistance
request from another SA. Article 61(8) GDPR provides that the ‘urgent need to act under Article 66(1)

[GDPR] shall be presumed to be met and require an urgent binding decision from the Board pursuant
to Article 66(2) [GDPR]’. If such a presumption applies, the urgent nature of an Article 66(2) request
413
for an urgent binding decision can be presumed and does not need to be demonstrated .

406See paragraph 205 above.
407
408See paragraphs 215-216 above
Article 51(1) GDPR and Recital 123 GDPR.
40EDPBBindingDecision3/2022,paragraph278 and EDPB Binding Decision 4/2022, paragraph 280 (referring to
CJEU Judgment of 16 July 2020, Facebook Ireland and Schrems, C‑311/18, ECLI:EU:C:2020:559, paragraph 111).
410
411Judgment of 16 July 2020, Facebook Ireland and Schrems, C‑311/18, ECLI:EU:C:2020:559, paragraph 112.
See EDPB analysis under 4.2.1.3
412See Section 1 of this urgent binding decision.
413EDPB Urgent Binding Decision 01/2021, adopted on 12 July 2021, paragraph 170.

Adopted 56224. As mentioned, the NO SA Mutual Assistance Request was made on 5 May 2023 - see paragraphs 10,

13, and 15 above describing the NO SA Mutual Assistance Request and the response provided by the
IE SA.

4.2.2.1 Summary of the position of the NO SA

225. The NO SA considers that Article 61(8) GDPR is applicable in this case 414 because the IE SA replied ‘No,

I cannot comply with the request’ to the NO SA Mutual Assistance Request ‘without providing any
specific justification other than referring to another letter it sent to all of the CSAs on 31 May 2023’ 415.

The NO SA also argues that the ‘IE SA did not provide a reasoned refusal’ as per Article 61(4) GDPR,
‘nor did it inform [the NO SA] of results or progress of any measures taken in order to respond to [their]
request to ban the unlawful processing of personal data and to enforce compliance with Article 6(1)

[GDPR]’ 41. According to the NO SA, the content of the letter of 31 May 2023 was a simple
announcement of when the IE SA would finalise its review of the Meta IE Compliance Reports, but it

‘didnotprovideanyinformationonthespecific enforcementplan[they]requested,nordiditannounce
any specific or envisaged enforcement action with respect to Meta IE, despite [their] request to that
417
effect’ .

226. In view of the NO SA there ‘were no measures taken in order to respond to the request’, and within a

month from the NO SA Mutual Assistance request, ‘the IE SA had complied with neither of [their]
demands’ 41. The NO SA also indicates that their demands remain unfulfilled due to the fact that the

IE SA considers it fair and reasonable not to engage in enforcement measures despite its conclusion
that Meta IE is currently failing to rely on a valid lawful basis for behavioural advertising 419.

227. To support the view that Article 61(8) GDPR is applicable to the present case, the NO SA refers to an

opinion of Advocate General Bobek stating that where a LSA fails to address a CSA mutual assistance
request, the latter may adopt provisional measures in circumstances in which ‘the urgent need to act
420
ispresumed andneednotbeproven’ .TheNOSAalsomentionsthe existenceofprecedentdecisions
applying the Article 61(8) GDPR presumption, in particular a decision from the IT SA related to Meta IE

where the SA similarly considered that a failure from the LSA to address their request legitimately
allowed for a derogation to the cooperation mechanism and the triggering of an Article 66 GDPR
421
urgency procedure .

228. The NO SA underlines that - contrary to the factual circumstances that led the EDPB to conclude that
422
Article 61(8) was not applicable in a previous case - ‘the communications regarding the present
matter between the NO SA and the IE SA were made using the procedure for MA [Mutual Assistance]

414NO SA Request to the EDPB, p. 7-8.
415NO SA Request to the EDPB, p. 8.
416NO SA Request to the EDPB, p. 8.
417
NO SA Request to the EDPB, p. 8.
418NO SA Request to the EDPB, p. 8;
419NO SA Request to the EDPB, p. 8, referring to the IE SA Final Position Paper. It may be useful to also note that
the NO SA, in its Letter to the IE SA of 21 September 2023 (p.1), states they understand the IE SA has chosen not

to follow the NO SA Mutual Assistance Request because in spite of preliminarily concluding that Meta IE is still
notoperatingincompliancewithArt.6(1)GDPRtheydidnotindicateanycorrespondingenforcementmeasures.
420NO SA Request to theEDPB,p. 9, referring to Opinion of Advocate General Bobek in Case C‑645/19, Facebook
Ireland and Others, paragraph 119 and paragraph 135.
421
NO SA Request to the EDPB, p. 9, referring to Italian SA’s decision of 21 December 2022 [9853406], available
at https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9853406#english.
422NO SA Request to the EDPB, p.9 referring to EDPB Urgent Binding Decision 01/2021, paragraphs. 171-181.

Adopted 57 requests pursuant to Article 61(1) GDPR, and not the procedure for Voluntary Mutual Assistance
423
(“VM[A]”) requests’ .

4.2.2.2 Summary of the position of the controller

424
229. Meta IE argues that, in this case, no ‘presumption of urgency arises under Article 61(8) GDPR’ . Meta
IE indicates that in order to rely on Article 61(8) GDPR presumption of urgency, the NO SA ‘must show

that the [IE SA] failed to respond to the [NO SA’s Mutual Assistance Request]’ but considers that the
NO SA ‘cannot show this’ 425. Meta IE states that the NO SA’s ‘attempt to rely on the presumption of

urgency in Article 61(8) GDPR is misconceived as a matter of law and contradicts the factual record of
communications’ between the IE SA and the NO SA 426. According to Meta IE, the IE SA ‘adequately
addressed the [NO SA Mutual Assistance Request] by providing the information the [NO SA]requested’

and the NO SA ‘distort[s] and mischaracterize[s] the substance and nature of the correspondence’ with
the IE SA427.

230. In MetaIE’sview,the NO SA MutualAssistance Requestdid not ‘request the[IE SA] to detail a “specific
enforcement plan” or “specific or envisaged enforcement action” that it would “impose on [Meta IE] in

the event of non-compliance”, as this is not what is entailed by the request of the NO SA to the IE SA
to share “a timeline specifying how it will ensure in an expedient manner that Meta [IE] complies with
428
Article 6(1) GDPR”’ . Rather, according to Meta IE, this wording referred to a request to share a
timeline, which the IE SA provided ‘on numerous occasions’ 429and this demonstrates that there was

‘noinactionorfailuretocommunicatebythe[IESA]whichthe[NOSA]cannowrelyontoinvokeArticle
61(8) [GDPR]’ 430.

231. According to Meta IE, ‘the [IE SA]’s decision not to immediately implement the[NOSA]’s own preferred

enforcement measures did not amount to a failure to adequately respond to the [NO SA Mutual
AssistanceRequest].NothinginArticle61(1)GDPRrequiressuchblindobediencebyanLSAtowhatever

actions a CSA might request it to take. [...] The [IE SA] adequately addressed the [NO SA Mutual
Assistance Request] by providing the information the [NO SA] requested’ 431. It also states that ‘Article

61(5) GDPR [...] does not require an LSA to commit in advance to impose any specific corrective
measures within any specific timeframe’ 43. Meta IE further elaborates that while ‘Article 61 GDPR

cannot be used by a single SA to demand that an LSA adopt corrective measures with respect to
processing that is subject to an ongoing LSA-led compliance proceeding’, the IE SA later provided
433
reasons ‘for declining to issue an immediate ban on processing’ . In this regard, Meta IE is of the
opinion that corrective measures cannot be requested ‘with respect to processing that is subject to an

ongoing LSA-led compliance proceeding’ as this could ‘undermine the one-stop shop mechanism and

423NO SA Request to the EDPB, p.9-10.
424Meta IE’s Submissions of 25 August 2023, p. 18-21; Meta IE’s Submissions of 16 October 2023, p. 5-8;
Annexure 1 to Meta IE’s 16 October 2023 Letter, p.17; Annexure 12 to Meta IE’s 16 October 2023 Letter, p.49-

53.
425Meta IE’s Submissions of 25 August 2023, p. 19; Meta IE’s Submissions of 16 October 2023, p. 5.
426Meta IE’s Submissions of 26 September 2023, p. 5.
427Meta IE’s Submissions of 16 October 2023, p. 5.
428
Meta IE’s Submissions of 26 September 2023, p. 5, referring to the NO SA Mutual Assistance Request.
429Meta IE’s Submissions of 25 August 2023, p. 19.
430Meta IE’s Submissions of 26 September 2023, p. 7.
431Meta IE’s Submissions of 26 September 2023, p. 2; Meta IE’s Submissions of 16 October 2023, p. 5.
432
Meta IE’s Submissions of 16 October 2023, p. 5.
433Meta IE’s Submissions of 16 October 2023, p. 6, referring to (i) Meta IE’s Merit Complaint submitted to the
OsloDistrictCourtannexedtoMetaIE’sSubmissionsof16October2023,andto(ii)theIESAFinalPositionPaper.

Adopted 58 the LSA’s duty to consider all CSAs views in connection with that mechanism’ 434. In addition, Meta IE

argues that the request ban on processing had already been ‘considered and rejected by the EDPB in a
prior Article 65 GDPR binding decision’ 435.

232. In Meta IE’s view, the IE SA addressed the NO SA’s Mutual Assistance Request via the IE SA Update to
CSAs of 31 May 2023as it contained ‘relevant information’ and allowed to inform the NO SA of ‘the
436
progress of the measures taken in order to’ address the request . Considering that the IE SA did
address the request on 31 May 2023, it therefore did not refuse to do so when it provided its negative
response on IMI on 2 June 2023 because this response was accompanied with a reference to the IE SA

Update to CSAs of 31 May 2023 437. Meta IE further details that the IE SA had explained that the
negativeresponseonIMIwastheresultofa‘mistake’andthattheNOSA’smessagetotheIESAshows

that the NO SA ‘did not believe [...] that the [IE SA] had failed to respond’ to the request 438. In support
of this, Meta IE mentions a message from the NO SA to the IE SA stating: ‘Thank you for your message

of 2 June 2023. We understand that you will revert towards the end of June’ and ‘we will await your
response towards the end of June’ 439.

233. Meta IE considers that the NO SA did not object to the IE SA Provisional Position Paper and did not
mention any alleged failure by the IE SA to respond to the NO SA Mutual Assistance Request, ‘despite

invoking Article 61(8) GDPR in the [NO SA] Order to attempt to argue that urgency may be presumed
due to an alleged failure to respond by the [IE SA]’ 440. Furthermore, Meta IE argues that the NO SA ‘did

not raise any complaints about the[IE SA]’s proposed timetable prior to issuing theOrder, even though
that is what it would have been expected to do first if it had genuine concerns about urgency’ 44.

234. Concerning the NO SA’s reference to the opinion of Advocate General Bobek in Case C-645/19, Meta

IE indicates that ‘considering the lengthy procedural history, which includes the [IE SA] imposing the
NOYB Decisions and properly conducting an ongoing compliance procedure, the NO SA cannot

reasonably argue that the[IE SA] has failed to act. The [IE SA] is acting, and also fully cooperating with,
the other SAs’ 442.

4.2.2.3 Analysis of the EDPB

235. The cooperation mechanism in the GDPR provides for different tools for the SAs to exchange among

themselves and perform their tasks. One of such tools is mutual assistance pursuant to Article 61
GDPR. Under this provision, SAs ‘shall provide each other with relevant information and mutual

assistance in order to implement and apply [the GDPR] in a consistent manner, and shall put in place

434
Meta IE’s Merits Complaint submitted to the Oslo District Court annexed to Meta IE’s Submissions of 16
October 2023, p. 52.
435Meta IE’s Merits Complaint submitted to the Oslo District Court annexed to Meta IE’s Submissions of 16
October 2023, p. 52, referring to (i) EDPB Binding Decision 3/2022, paragraph 285 and to (ii) EDPB Binding

Decision 4/2022, paragraph 287.
436Meta IE’s Submissions of 16 October 2023, p. 5, referring to the IE SA Update to CSAs of 31 May 2023.
437Meta IE’s Submissions of 16 October 2023, p. 6.
438Meta IE’s Submissions of 16 October 2023, p. 6.
439
Meta IE’s Submissions of 16 October 2023, p. 6, referring to the message sent by the NO SA to the IE SA via
the IMI flow relating to the NO SA Mutual Assistance Request on 9 June 2023.
440Meta IE’s Submissions of 25 August 2023, p.9, referring to an email dated 14 July 2023 from the NO SA to the
IE SA informing of the Provisional Measures being taken.
441
Meta IE’s Submissions of 26 September 2023, under footnote 41 p. 12.
442Meta IE’s Complaint to the NO SA regarding the NO SA Order, 1 August 2023, p. 17; Meta IE’s Submissions of
25 August 2023, p.21.

Adopted 59 443
measuresfor effective cooperationwith oneanother’ .Thesame provisionalsoexplains that mutual
assistance ‘shall cover, in particular, information requests and supervisory measures, such as requests
444
to carry out prior authorisations and consultations, inspections and investigations’ .

236. The EDPB recalls that Article 61 GDPR on mutual assistance belongs to Section 1 of Chapter VII of the
GDPR related to cooperation. In this regard, the EDPB considers Article 61 GDPR to be one of the

mechanismsforsupervisoryauthorities toensure properand efficient cooperation.Consequently, the
concept of mutual assistance rooted in the GDPR entails ‘sincere and effective cooperation’ 445and
requires concrete actions from a supervisory authority receiving a mutual assistance request

(hereinafter, ‘Requested SA’). More specifically, the obligations of a Requested SA can be listed in a
logical sequence as follows:

• Article 61(2) GDPR: ‘each SA shall take all appropriate measures required to reply to a request

of another SA’;
• Article 61(2) GDPR: the Requested SA shall reply within a specific timeframe (‘without undue

delay and no later than one month after receiving the request’);
• Article61(4) GDPR:the Requested SAmust‘complywiththerequest’inallcases exceptforthe

situations mentioned in Article 61(4) (a) and (b);
• Article61(5)GDPR,firstsentence:‘therequestedSAshallinformtherequestingSAoftheresult

or, as the case may be, of the progress of the measures taken in order to respond to the
request’;

• Article 61(5) GDPR,secondsentence: ‘therequested SAshall providereasonsforany refusal to
comply with a request pursuant to paragraph 4’;

• Article 61(6) GDPR: the Requested SA shall, as a rule, supply the information by electronic
means, using a standardised format.

237. Article 61(9) GDPR provides the possibility for the European Commission (hereinafter the ‘EC’) to
specify, by means of implementing acts, the format and procedures for mutual assistance and the

arrangementsfortheexchangeofinformationbyelectronicmeansbetweenSAs.On16May2018,the
EC adopted an implementing act relating to the use of the EC Internal Market Information system for
GDPR consistency and cooperation procedures, including for Article 61 GDPR mutual assistance

requests (IMI) (hereinafter, the ‘IMI Implementing Act’) 446.

238. The IMI procedure dedicated to Article 61 GDPR mutual assistance requests is a one-to-one workflow.
This entails that the request can only be addressed to, and received by, the Requested SA. Similarly,

the reply will only be addressed to, and received by, the SA that made the mutual assistance request
(hereinafter, the ‘Requesting SA’). Pursuant to Article 3(3) of the IMI Implementing Act, this dedicated

workflow is to be used for the different exchanges between authorities in the framework of an Article

44Article 61(1) GDPR.
44Article 61(1) GDPR.
44Onhow a ‘lead supervisory authority cannot, in the exercise of its competences, [...]eschew essential dialogue

with and sincere and effective cooperation with the other supervisory authorities concerned’, see Judgment of
the Court of Justice (Grand Chamber) of 15 June 2021, in case Facebook Ireland Ltd and Others v
Gegevensbeschermingsautoriteit, C-645/19, ECLI:EU:C: 2021:483, paragraph 63.
44EC Implementing Decision (EU) 2018/743 of 16 May 2018 on a pilot project to implement the administrative
cooperation provisions set out in Regulation (EU) 2016/679 of the European Parliament and of the Council by
means of the Internal Market Information System C/2018/2814, https://eur-lex.europa.eu/legal-

content/EN/TXT/?uri=uriserv%3AOJ.L .2018.123.01.0115.01.ENG&toc=OJ%3AL%3A2018%3A123%3ATOC.

Adopted 60 61 GDPR mutual assistance request. This includes, in particular, ‘requesting mutual assistance from
another supervisory authority in the form of information and/or supervisory measures’, ‘responding to
a mutual assistance request including acceptance or in exceptional cases refusals to comply with the

request’, and ‘communication of the progress and the result of measures taken in order to respond to
the request’44. The use of this dedicated IMI workflow also allows for the automatic monitoring of the

one-month deadline to reply to a request pursuant to Article 61(2) GDPR.

239. Being a one-to-one workflow in the IMI, an Article 61 GDPR mutual assistance procedure is a type of
bilateral communication to be distinguished from other bilateral or multilateral communication

channels that are made available in IMI for other types of GDPR cooperation mechanisms. While a
mutual assistance request can be connected to developments occurring within multilateral
communication channels, the initiation of a mutual assistance request by a supervisory authority

opens a dedicated workflow for exchanges between the Requesting and Requested SAs only.

240. Pursuant to Article 61 GDPR, a Requested SA is under a legal obligation to address a mutual assistance
request. The only possibility for a Requested SA to refuse to address a request is where it provides
448
reasons for refusing to comply, in line with the two limited exceptions of Article 61(4) GDPR and as
provided in the last sentence of Article 61(5) GDPR 44. While the possibility to provide information on
the results or progress of the measures taken within the one-month timeframe gives some discretion

to the Requested SA, the duty to cooperate also implies that the Requested SA must always take
certain concrete steps to address the given request, or duly justify why it does not do so. In an
exceptional situation where a Requested SA does not provide appropriate information on the

measurestaken,theprogressmade,oronthedulyreasonedgroundswhyitcannotsatisfytherequest,
within one month of receiving the request, the Requesting SA may consider that the conditions of

Article 61(8) GDPR are met.

241. In light of the above developments, the EDPB considers that the obligation for the Requested SA to
address a mutual assistance request implies the need to fulfil procedural and substantive criteria.

242. The need to fulfil the procedural criteria mainly derives from Article 61, paragraphs 6 and 9 GDPR,

togetherwithArticle3(3)oftheIMIImplementingAct.Theproceduralcriteriarelateto theprocedural
formalities that need to be respected to address a mutual assistance request.

243. For what concerns, on the other hand, the obligation to fulfil substantive criteria, the EDPB considers
thatthisarisesfromtheprovisionsmentionedabove,namely (i)thewordingofArticle61(4)GDPRand

Article61(5)GDPR,providingforapossibilitytorefusetocomplywithmutualassistancerequestsonly
based on the limited grounds listed in the GDPR, and providing reasons for any refusal, and (ii) the

qualification of mutual assistance as a tool for cooperation. This imposes the need to examine the
content of the reply and the actions taken by a Requested SA to evaluate whether or not a given
request has been addressed.

244. The list provided by Article 61(1) GDPR is not exhaustive (‘in particular’). As such, it does not list or

excludespecificallytheimpositionofcorrectivemeasures.However,theEDPBconsidersthat thisdoes

44EC Implementing Decision (EU) 2018/743 of 16 May 2018, Article 3(3).
44Art. 61(4) GDPR states ‘The requested supervisory authority shall not refuse to comply with the request unless:
(a) it is not competent for the subject-matter of the request or for the measures it is requested to execute; or (b)

compliance with the request would infringe this Regulation or Union or Member State law to which the
supervisory authority receiving the request is subject.’
44‘The requested supervisory authority shall provide reasons for any refusal to comply with a request pursuant
to paragraph 4’.

Adopted 61 not, in any event, remove the duty of the Requested SA, pursuant to Article 61 (4) and 61 (5) GDPR
and the general duty of cooperation, to provide reasons for any refusal to comply with a request.

245. Moving on to the case at hand, the EDPB notes that on 5 May 2023 a formal Article 61 GDPR mutual
assistance request was initiated by the NO SA via the creation of a dedicated IMI workflow. The NO SA
Mutual Assistance Request contained two different requests:

(i) ‘that the IE SA issues a temporary ban on Meta IE’s processing of personal data for
behavioural advertising purposes on Facebook and Instagram based on Article 6(1)(f) GDPR, in
accordance with Article 58(2)(f) GDPR’ 45;

(ii) ‘that the IE SA shares a timeline specifying how it will ensure in an expedient manner that
[Meta IE] complies with Article 6(1) GDPR’.

246. In the NO SA Mutual Assistance Request, the NO SA also specified that they would ‘be grateful if the

IE SA, by 5 June 2023, would share the timeline and confirm that a temporary ban will be issued’ and
that ‘If the IE SA is not in a position to comply with our request regarding [Meta IE], we may need to
consider our options in relation to the adoption of provisional measures in Norway pursuant to Article

66 of the GDPR. We hope that this will not be necessary and look forward to cooperating further with
the IE SA within the framework of the cooperation mechanisms set out in Chapter VII of the GDPR’.

247. The NO SA Mutual Assistance Request was also uploaded by the NO SA as a comment on the Meta IE

Compliance Reports, shared with the LSA and all CSAs within the IE SA IMI Informal Consultations.
Other CSAs shared their feedback on the Compliance Reports in the same period, as described above
451
in paragraph 10, and some of them also addressed concerns on actions taken by the IE SA . In this
context, on 30 May 2023, the NL SA also made a mutual assistance request, as described above in
paragraph 12. Analysing, first of all, whether the procedural criteria were met by the IE SA’s response

to the NO SA Mutual Assistance Request, the EDPB notes that it is on 2 June 2023 that the first

450The wording of the NO SA Mutual Assistance Request then goes on as follows: ‘The ban should last until the
lead and concerned supervisory authorities are satisfied that [Meta IE] has provided adequate and sufficient

commitments to ensure compliance with Articles 6(1) and 21 GDPR, in line with Article 31 GDPR. This will give us
the opportunity to further engage with Meta and make sure that it commits to fully respect its obligations under
the GDPR, while preventing any further risks for data subjects stemming from [Meta IE]’s non-compliant
behavioural advertising practices. Please note that in our view, behavioural advertising includes any activities
where advertising is targeted on the basis of a data subject’s behaviour or movements, including advertising

451ed on perceived location’.
Several CSAs expressed concerns about:
(i) The IE SA not sharing its own legal assessment (e.g. FR SA on 25 April 2023; DE Hamburg SA on 4 May 2023).
In response, the IE SA invited the CSAs to ‘carry out their own assessments of the compliance material’ and
outlined that ‘the finding of infringement of Article 6(1) [GDPR] and the requirement for a corresponding order
to be imposed, were determined by the EDPB’ which ’overturned the views originally expressed by the IE SA in its

draft decision‘ (IE SA request for CSAs views circulated via the IMI on 26 April 2023);
(ii) The measures suggested by the controller to comply with the IE SA decisions - in particular the reliance on
Article 6(1)(b) GDPR and Article 6 (1)(f) GDPR for behavioural advertising - which raised concerns and criticisms
forwhichseveralCSAsrequestedimmediateactionsfromtheIESA (e.g.viewsofDEHamburgSAon4May2023;
views of NL SA on 4 May 2023; comment of the SE SA on 4 May 2023).

Similarly, theNO SAhadpreviouslycontacted theIE SAviaemail on 5 April to express their ‘strongdoubts’about
Meta using Article 6(1)(f) in the context of behavioural advertising, as well as their fear of a ‘real risk to data
subject's rights’, and asking the IE SA for their assessment and intentions for regulatory action. On 4 May 2023,
the IE SA had indicated via the IE SA IMI Informal Consultations that they would ‘not be preparing any further
decision in this matter’ and that they would rely on their assessment of compliance, carried out jointly together

with all CSAs, IE SA Information on Procedure (response to SE SA), dated 4 May 2023.

Adopted 62 procedural development from the IE SA occurred within the Art. 61 IMI workflow initiated by the NO

SA. This is when the IE SA specified they ‘cannot comply with the request’ (by way of checking a pre-
filled text box on IMI), and indicated in a comment they had further detailed their response under
452
previous communications located in the IMI Informal Consultations . The IE SA made reference to
the IE SA Update to CSAs of 31 May 2023 (see above paragraph 13). Therefore, the EDPB considers

that the IE SA addressed the NO SA Mutual Assistance Request from a procedural standpoint.

248. The EDPB also analyses the substance of the reply provided by the IE SA to assess whether the NO SA
Mutual Assistance Request was addressed within the one-month deadline set by the legislator. It is in

particular relevant to assess whether the IE SA, refusing to comply with the NO SA Mutual Assistance
Request,providedthereasonsforsuch refusalinaccordancewith Article61(5)GDPR.Whilespecifying

they‘cannotcomplywiththerequest’,theIESAindicatedinacommenttheyhadfurtherdetailedtheir
response under previous communications located in the IE SA IMI Informal Consultations 453. The IE SA
454
made reference to the IE SA Update to CSAs of 31 May 2023 (see above paragraph 13) .

249. AccordingtotheIESA,the IESAUpdate toCSAsof31 May2023whichitsreplyof2June2023referred

to was ‘directed to the subject matter of the NO SA [Mutual Assistance Request]’ and was ‘clearly
engaging with the substance of the NO SA [Mutual Assistance Request] [...] directly, and in a fulsome
455
manner’ . Consequently, the IE SA considers it did not refuse to engage with the NO SA’s request for
mutual assistance by means of its communication of 2 June 2023 456.

250. The content of the IE SA Update to CSAs of 31 May 2023 relates to the information about the
457
continuation oftheassessmentof the Meta IECompliance Reportspursuant to Article60(10)GDPR .
In fact, it was a mere confirmation of the approach already suggested to all CSAs prior to the NO SA
458
Mutual Assistance Request .

452NO SA mutual assistance request IMI dedicated flow. 453More specifically the message from the IE SA stated:
‘Dear Colleagues, Please see detailed response uploaded by the [IE SA] under [the IMI Informal Consultations]

453 further information. Best regards, IE SA’.
Morespecifically themessage from the IE SA stated:‘DearColleagues, Please seedetailed responseuploaded
by the [IE SA] under [the IMI Informal Consultations] for further information. Best regards, IE SA’.
Such response was the IE SA Update to CSAs of 31 May 2023 (see paragraph 13 above). The LSA referred to two

454ferent communications issued to all CSAs via the IMI Informal Consultations.
The IE SA indicated that they had ‘received all of the assessments from CSAs’ and ‘forwarded them to [Meta
IE] for it to consider the views expressed and to detail any changes that it proposes to implement on foot of the
CSA assessments’. Furthermore, the IE SA stated that it will ‘complete its own assessment of [Meta IE]’s

compliance reports’ ‘once the IE SA receives [Meta IE]’s response’. The IE SA also stated ‘it will be in a position to
completeitsownassessmentof[MetaIE]’s[ComplianceReports]andtoshareitsassessmentwiththeNorwegian
and Dutch supervisory authorities (both of which have lodged Article 61 requests for mutual assistance) and with
all other CSAs by the end of June 2023‘.
455
456Views of IE SA on NO SA Order, p.2.
Views of IE SA on NO SA Order, p.2, referring to IE SA’s Response to the NO SA Mutual Assistance Request.
457The LSA indicated that they had ‘received all of the assessments from CSAs’ and ‘forwarded them to [Meta IE]
for it to consider the views expressed and to detail any changes that it proposes to implement on foot of the CSA

assessments’. Furthermore, the LSA stated that it will ‘complete its own assessment of Meta [IE]’s [C]ompliance
[R]eports’ ‘once the IE SA receives Meta IE’s response’. The LSA also stated ‘it will be in a position to complete its
own assessment of Meta’s compliance reports and to share its assessment with the Norwegian and Dutch
supervisory authorities (both of which have lodged Article 61 requests for mutual assistance) and with all other
CSAs by the end of June 2023’.
458
IE SA Information on Procedure (response to SE SA), dated 4 May 2023 (prior to the NO SA Mutual Assistance
Request). In this communication, the LSA indicated to all CSAs - via the IMI Informal Consultations - that the ‘IE
SA will not be preparing any further decision in this matter’ and that they would rely on their assessment of
compliance, carried out jointly together with all CSAs.

Adopted 63251. The EDPB notes that the IE SA Update to CSAs of 31 May 2023 makes reference to the NO SA Mutual
Assistance Request, by saying: ‘The IE SA anticipates that it will be in a position to complete its own
assessment of Meta IE Compliance Reports and to share its assessment with the [NO SA] and [NL SA]

(both of which have lodged Article 61 requests for mutual assistance) and with all other CSAs by the
end of June 2023’.

252. However, the EDPB considers that:

• the second request in the NO SA Mutual Assistance Request was a request for ‘a timeline

specifying how [the IE SA] will ensure in an expedient manner that [Meta IE] complies with
Article 6(1) GDPR’. The IE SA Update to CSAs of 31 May 2023 does provide a timeline of the

next steps in the process envisaged by the IE SA for the assessment of the Meta IE Compliance
Reports (with the last step being the completion of the IE SA’s own assessment and its sharing

with the CSAs by the end of June 2023). However, there are no details as to how the IE SA
considered that the completion of the assessment of the Compliance Reports would ‘ensure
in an expedient manner that [Meta IE] complies with Article 6(1) GDPR’. While there is an

implicit (and, in any event, only partial) connection, further motivation in this regard would
have been necessary.

• the first request in the NO SA Mutual Assistance Request was a request for the imposition of
a “temporary ban on Meta’s processing of personal data for behavioural advertising purposes

on Facebook and Instagram based on Article 6(1)(f) GDPR, in accordance with Article 58(2)(f)
GDPR’. The IE SA Update to CSAs of 31 May 2023 does not include any reasoning as to the IE

SA’s acknowledgement or consideration of this request.

253. The EDPB notes that while the IE SA explained after the expiry of the one-month deadline that the
negative answer to the NO SA Mutual Assistance Request was the result of a mistake (a text box
459
‘incorrectly (and inadvertently) checked’) , the IE SA does not state it tried to amend its answer - for
instance to provide the reasons for any refusal to comply with the request - or sought assistance to do

so within the one-month deadline.

254. The EDPB also takes note of the IE SA’s view shared on 27 September 2023 that the part of the NO SA
Mutual Assistance Request pertaining to a ban was not ‘validly made by reference to the provisions of
Article 61 GDPR’ and that it was not ‘open to the [NO SA] to demand, by way of mutual assistance
460
request, that the [IE SA] impose a temporary ban on the Processing Operations’ at stake .

255. However, Article 61(4), letter (b) GDPR envisages the possibility for the Requested SA to refuse to
complywithamutualassistancerequestinasituationwhereitconsidersthatcompliancewithitwould

infringe the GDPR or EU or Member State law to which the Requested SA is subject. Nevertheless, in
thiscircumstance,asalreadyunderlinedunderparagraph240,theRequestedSAthatwishestoinvoke
thisgroundforrefusalneedstomotivateitsresponsepursuanttoArticle61(5)GDPR.TheIESAUpdate

to CSAs of 31 May 2023 or the message in the MA Request workflow of 2 June 2023 do not provide
any justification for not addressing the request under the limited exceptions of Article 61(4) GDPR. In
addition, the views shared on 27 September 2023 were way beyond the expiration of the one month

459
460Communication of IE SA to all CSAs dated 20 July 2023, p. 2.
Letter from the IE SA to the NO SA dated 27 September 2023, p. 3. In this regard the IE SA further argued that
the EDPB Binding Decisions ‘explicitly declined to impose a temporary ban’ (p. 3) and that ‘Putting in place an
immediatebanonprocessingwhichisisolatedanddivorcedfromanyunderlyinglegalprocedurewouldinevitably
expose the [IE SA] to significant legal risk and lead to litigation’ (p. 4).

Adopted 64 deadline. Therefore, the EDPB considers that, within one month of receiving the request, the LSA did
not provide the reasons for refusal to comply with the request pursuant to Article 61(5) GDPR.

256. In light of the above, the EDPB considers that the IE SA failed to provide a substantive reply the NO SA
Mutual Assistance Request.

257. ConsideringthefactthatArticle61(8)GDPRprovidesexplicitlythatthepresumptionofurgencyapplies

in case the [Requested SA] does not provide the information in [Article 61(5)] within the one month of
receiving the request, the EDPB therefore considers that the presumption set by Article 61(8) GDPR
is applicable in this specific case. Consequently, the EDPB finds that urgency may be presumed on

the basis of Article 61(8) GDPR, which further corroborates the need to derogate from the regular
cooperation and consistency mechanisms 46.

4.2.3 Conclusion as to the existence of urgency

258. The EDPB considers that the elements analysed above justify the urgency for the EDPB to request the
IE SA to order final measures under Article 66(2) GDPR. The EDPB considers that the urgent need to

order final measures is clear in light of the risks that the infringements represent for the rights and
freedoms of the data subjects without the adoption of final measures 462. Furthermore, the EDPB
463
considers that such urgency may be presumed pursuant to Article 61(8) GDPR . The EDPB therefore
considers that there is urgency for the IE SA to order final measures in this case.

5 ON THE APPROPRIATE FINAL MEASURES

259. On the basis of the analysis above (see sections 4.1 and 4.2), the conditions relating to the existence

of infringements and to an urgent need to act in this case are met. The EDPB therefore proceeds with
the analysis of which final measures, if any, it should order in this specific case. A request from a SA

under Article 66(2) GDPR is aimed to address a situation where such SA, after adopting provisional
measures under Article 66(1) GDPR, ‘considers that final measures need urgently be adopted’.

5.1 Content of the final measures

5.1.1 Summary of the position of the NO SA

260. In the NO SA Request to the EDPB, the NO SA requests that ‘final measures, in line with the provisional
measures [the NO SA] imposed in Norway, be imminently adopted’ 464. In the NO SA Order, the NO SA
prohibited for three months Meta IE and Facebook Norway from processing personal data of data

subjects residing in Norway for behavioural advertising on the basis of Article 6(1)(b) GDPR or Article
6(1)(f) GDPR from 4 August 2023 to 3 November 2023 465. The NO SA provides that the NO SA Order

will be lifted before that date if remedial measures are implemented so that adequate and sufficient
commitments to ensure compliance with Article 6(1) GDPR and Article 21 GDPR can be provided 466. In
casetheorderisnot compliedwith,theNOSAannounces,intheNOSAOrderitself,thatit maydecide

to impose a coercive fine of up to NOK 1 000 000 per day of non-compliance on Meta IE and/or

461
462lso see the EDPB Urgent Binding Decision 01/2021, paragraph 181.
As demonstrated in section 4.2.2.3 above.
46As demonstrated in section 4.2.1.3 above.
46NO SA Request to the EDPB, p. 12.
46NO SA Order, p. 3.
466
NO SA Order, p. 3.

Adopted 65 FacebookNorway,individuallyorcollectively 467.AsMetaIEandFacebookNorwaydidnotcomplywith

the NO SA Order, the NO SA imposed a daily coercive fine, which started to accrue on 14 August
2023 46.

261. The NO SA also points out that, with respect to the objective that the final measures should seek to
achieve, ‘it is necessary to ensure that “[p]ersonal data shall not be processed for Behavioural
469
Advertising based on Article 6(1)(b) [GDPR] or [Article] 6(1)(f) GDPR in the context of the Services”’ .
TheNOSArequeststhatanyfinalmeasureshoulddemand“swiftcompliance”withoutfurtherdelay 47.

262. With respect to the geographical scope of the final measures requested, the NO SA asked that ‘the
measures should be applied EEA-wide, to avoid derogating from the harmonisation and consistency
471
that the GDPR aims to ensure’ .

263. The NO SA considers that Meta IE has a ‘readily available procedure to terminate this processing
rapidly’, as it already implemented an objection mechanism in the EEA in relation to its processing for

behavioural advertising in reliance of Article 6(1)(f) GDPR. In other words, the NO SA argues that
suspending this processing activity could be achieved through the use of a process similar to the one

used by Meta IE in the context of the objection mechanism, and that nothing - from a technical
perspective - prevents Meta IE from suspending the behavioural advertising processing in the EEA 472.

264. To support this request, the NO SA points out that (1) final measures should urgently be adopted
because the processing of personal data violates the rights and freedoms of data subjects in all EEA

states, (2) the IE SA Decisions are applicable for users in all EEA states, and (3) there is consensus at
European level between the IE SA and the CSAs that the processing continues to be unlawful 473.

5.1.2 Summary of the position of Meta IE and Facebook Norway

265. Meta IE points out that in its view ‘it is not clear which final measures the [NO SA] is seeking to request
474
from the EDPB’ . According to Meta IE, the NO SA Order ‘comprises three core elements: (i) the
imposition of a temporary ban [...]; (ii) the imposition of daily administrative fines [...]; and (iii) the
475
lifting of that ban subject to receiving adequate commitments from [Meta IE]’ . Meta IE alleges it is
not clear whether the NO SA intends to pursue each of these elements, or others, as part of its
476
request .

266. Meta IE considers that the NO SA Request to the EDPB constitutes partly ‘an attempt to re-litigate
objections that the [NO SA] has already raised in the NOYB Inquiries at the Article 65 GDPR stage and

which have already been rejected by the EDPB’ 477. According to Meta IE, the NO SA’s actions ‘appear
to be motivated by (unwarranted) dissatisfaction with the [IE SA]’s handling of the enforcement of the

467NO SA Order, p. 4.
468NO SA’s Decision to impose a coercive fine on Meta IE and Facebook Norway of 7 August 2023, p. 3.
469
NO SA Request to the EDPB, p. 12.
470NO SA Request to the EDPB, p. 12.
471NO SA Request to the EDPB, p. 12.
472NO SA Request to the EDPB, p. 12-13.
473
NO SA Request to the EDPB, p. 12.
474Meta IE’s Submissions of 26 September 2023, p. 13.
475Meta IE’s Submissions of 26 September 2023, p. 13.
476Meta IE’s Submissions of 26 September 2023, p. 13.
477
Meta IE’s Submissions of 26 September 2023, p. 3, 13. See also Meta IE’s Submissions of 16 October 2023, p.
8.

Adopted 66 NOYB Decisions’. The controller states then that it ‘cannot be sanctioned based on factors that are
outside its sphere of influence’ 47.

267. In addition, Meta IE provided arguments in respect of the possible content of the final measures to be
ordered by the EDPB, setting out elements for each possible measure identified. Meta IE also argues

that, in general, only the provisional measures adopted by the requesting SA can be adopted as final
measures under the Article 66(2) GDPR procedure 47. In Meta IE’s view, it is unclear whether the EDPB

is competent to order final measures on an EEA-wide basis, or whether it is limited to only ordering
measures with respect to the country of the requesting CSA, and it is unclear whether the EDPB is
480
competent to adopt final measures permanently . On this matter, Meta IE also made reference to
the fact that the EDPB has itself requested the EU legislator to clarify this 481.

268. Regarding a possible deletion order for data already unlawfully collected
whiletheNOSA has notexplicitlyrequestedsuchfinal measure,Meta
482
IE clarified its view that such request would be unlawful and unnecessary . More specifically, Meta
IE argues that the NO SA Order did not issue a deletion order as part of its Provisional Measures
483
adopted under Article 66(1) GDPR . Further, Meta IE highlights that the EDPB Binding Decisions
rejected objections from the NO SA that aimed to impose a deletion order on Meta IE 484.

485.

486.

487. In any event, Meta IE notes that the personal data previously collected for

behavioural advertising is also processed for other purposes that are not related to advertising, such
488
as security, fraud and safety . Meta IE considers that ‘a controller cannot be compelled to delete
personal data where it is validly collected and processed for different purposes pursuant to valid legal

bases, even in cases where its legal basis for one distinct set of processing is subsequently held to be
invalid’489.

478Meta IE’s Submissions of 26 September 2023, p. 17.
479
480Meta IE’s Submissions of 26 September 2023, p. 13-14.
Meta IE’s Submissions of 26 September 2023, p. 13, footnote 44.
481Meta IE’s Submissions of 26 September 2023, p. 13, footnote 44, referring to section 6.2 of EDPB-EDPS Joint
Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down

additionalprocedural rules relating tothe enforcementof Regulation(EU) 2016/679, atparagraphs 113-116 and
121. In this Joint Opinion, the EDPB and the EDPS provided their views on the proposed regulation made by the
EuropeanCommissionwhich,accordingtotheEDPBandtheEDPS,undulyrestrictstheapplicationoftheurgency

procedure under Article 66(2) GDPR.
482Meta IE’s Submissions of 26 September 2023, p. 14-15.
483Meta IE’s Submissions of 26 September 2023, p. 14.
484Meta IE’s Submissions of 26 September 2023, p. 14. This argument relates to the objections made by the NO

SAtothedraftdecisionsoftheIESAintheFacebookandInstagramcases,requestinganordertodeletepersonal
dataprocessedunderArt.6(1)(b)GDPR,whichtheEDPBconsiderednottomeetthethresholdofArt.4(24)GDPR
(in EDPB Binding Decision 3/2022, paragraph 483 and EDPB Binding Decision 4/2022, paragraph 450).
485
Meta IE’s Submissions of 26 September 2023, p. 14.
486Meta IE’s Submissions of 26 September 2023, p. 14.
487Meta IE’s Submissions of 26 September 2023, p. 14.
488
489Meta IE’s Submissions of 26 September 2023, p. 14-15.
Meta IE’s Submissions of 26 September 2023, p. 15.

Adopted 67269. Regarding a possible suspension order or ban applicable to all EEA users, Meta IE considers that the
490
NOSA’srequestforashortimplementationdeadlineisallegedly‘flawedandnotfeasible’ .According
to Meta IE, building the supporting infrastructure and rolling out the objection mechanism entailed

‘hundreds of thousands of hours of work’ on Meta IE’s side by multi-disciplinary teams including
product, machinelearning andinfrastructure engineers,userexperience designers,operations,policy,

marketing and legal to design, build and implement the systems, processes and user experience
required to enable Meta IE to meet the different requirements of Article 6(1)(f) GDPR 49. In Meta IE’s

view, the NO SA’s assertion that implementing a process similar to the objection mechanism could
form some ‘sort of instant compliance solution’ is ‘flawed’ 49.

493. In other

words, Meta IE argues that a change of legal basis for its behavioural advertising processing before
would simply not be feasible.

270. Meta IE also quotes the arguments put forward by the IE SA in that regard: ‘Putting in place an
immediate ban on processing which is isolated and divorced from any underlying legal procedure (...),

would inevitably expose the [IE SA] to significant legal risk and lead to litigation. In the context of such
litigation,the[IESA]wouldbecalledontojustifyitsdecisiontodepartfromthecourseofactionrooted

in [IE SA Decisions] (uncontested by the EDPB and/or the CSAs), in favour of an alternative, summary
procedure involving the immediate imposition of a ban on processing’ 494.

271. Regarding fines specifically, Meta IE argues that the NO SA is not entitled to ask for a fine as a final
measure 49, since the NO SA Order did not include fines as a provisional measure under Article 66(1)

GDPR. More generally, Meta IE also claims that fines are not an appropriate form of final measures
underArticle 66(2)GDPR 49,andthattheEDPBisnotcompetenttoadoptsuchadecisionunderArticle
497
66(2) GDPR . As the Article 66(2) GDPR procedure constitutes a derogation to the standard
cooperation procedure, Meta IE, highlighting the need for a restrictive interpretation of Article 66
GDPR, is of the opinion that any final measures ‘can only be those that are urgently needed to bring

the infringement to an end’ 498. According to Meta IE, all the final measures that do not achieve this
objective must be adopted within the framework of the one-stop-shop and the consistency

mechanism 499. Lastly, in Meta IE’s view, fines are not appropriate to ensure the immediate protection
of data subjects 50. Meta IE also argues that fines would be inappropriate in the circumstances of this

case, where high fines have already been imposed by the IE SA in the IE SA Decisions and where Meta
IE engagedingoodfaithwiththeIESA 501.

490Meta IE’s Submissions of 26 September 2023, p. 15.
491Meta IE’s Submissions of 26 September 2023, p. 15.
492Meta IE’s Submissions of 26 September 2023, p. 15.
493
Meta IE’s Submissions of 25 August 2023, p. 23-24.
494Meta IE’s Merits Complaint submitted to the Oslo District Court, p. 26, referring to the Letter of the IE SA to
the NO SA of 27 September 2023.
495Meta IE’s Submissions of 26 September 2023, p. 3.
496
Meta IE’s Submissions of 26 September 2023, p. 16.
497Meta IE’s Submissions of 26 September 2023, p. 16.
498Meta IE’s Submissions of 26 September 2023, p. 16.
499Meta IE’s Submissions of 26 September 2023, p. 16.
500
Meta IE’s Submissions of 26 September 2023, p. 16.
501Meta IE’s Submissions of 26 September 2023, p. 16.

Adopted 68 According to Meta IE, the
NO SA Request to the EDPB ‘already has, and will continue to, generate a huge amount of

administrative work for the EDPB, the CSAs, the LSA and Meta [IE],

502
. Meta IE considers that, in light of the fact that a potential urgent binding decision may
extend beyond Norway, ‘any attempt to perpetuatetheprovisions of the [NO SA] Order by way of such

a decision only serves to exacerbate this misuse of the urgency procedure and the violation of [Meta
IE]’s rights’0.

272. Facebook Norway highlights that it is not, and has never been, a party to the inquiries leading to the
adoptionoftheIESADecisions 504.ItalsohighlightsthattheIESADecisionsareonlyaddressedtoMeta

IE, in its capacity of sole data controller for the purpose of behavioural advertising on Facebook and
Instagram. Facebook Norway points out that it is a separate and independent legal entity that does

not offer Facebook or Instagram either in Norway or elsewhere, and is not the data controller for the
concerned behavioural advertising processing 50. Furthermore, Facebook Norway maintains that it
506
should not have been the addressee of the NO SA Order .

273. Meta IE and Facebook Norway have also expressed the view that the IE SA has already exercised

corrective powers against Meta IE in the IE SA Decisions, and that anyways the enforcement of
corrective orders is a matter for the LSA and governed by the applicable national law 507.

5.1.3 Analysis of the EDPB

274. In addition to the elements enshrined in the NO SA Request to the EDPB, the EDPB takes into

consideration the elements and arguments put forward by the IE SA. The IE SA considers that the NO
SA Request to the EDPB seeks to obtain an urgent binding decision from the EDPB, ‘the net effect of
508
which would be to compel the [IE SA], as LSA, to impose an EEA-wide ban’ . However, according to
the IE SA, it is already leading an ongoing ‘enforcement procedure’, whereby it is, along with the CSAs,
assessing ‘a defined set of proposals, by which [Meta IE] proposes to achieve compliance’ with Article

6(1) GDPR and the IE SA Decisions 50. This process is happening by involving the CSAs in accordance
withtheGDPR’scooperationand consistencyframework 510.Morespecifically,the IESAhighlightsthat

it ‘is currently engaged in a cooperative process to give effect to these orders in a manner that permits
all CSAs to make observations on [Meta IE]’s proposed course of action’ 51.

502Meta IE’s Submissions of 16 October 2023, p. 9.
503
Meta IE’s Submissions of 25 August 2023, p. 28.
504Facebook Norway’s Submissions of 25 August 2023, p. 13. See also Facebook Norway’s Submissions of 16
October 2023, p. 4.
505Facebook Norway’s Submissions of 25 August 2023, p. 13; Facebook Norway’s Submissions of 16 October

2023, p. 4; see also Letter from Facebook Norway to Ministry of Local Government and Regional Development
of 8 August 2023, p. 2.
506Facebook Norway’s Submissions of 26 September 2023, p. 1. See also Facebook Norway’s Submissions of 16
October 2023, p. 4.
507
Meta IE’s and Facebook Norway’s Submissions of 19 October 2023, p. 1-2.
508Letter from the IE SA to the NO SA of 13 October 2023, p. 3.
509Letter from the IE SA to the NO SA of 13 October 2023, p. 4.
510CommunicationofIESAtoCSAsof20July2023,p.1.SeealsoLetterfromtheIESAtotheNOSAof13October

2023, p. 4-6.
511Letter from the IE SA to the NO SA of 27 September 2023, p. 3

Adopted 69275. AccordingtotheIESA,nofinalmeasuresorderedbytheEDPBwouldbeappropriate,asitwoulddivert
resources from the IE SA-led process under the GDPR’s cooperation and consistency framework 512. In

addition, according to the IE SA, the NO SA’s legal justifications to suggest immediate enforcement
action by the LSA are ‘rooted in hypothetical arguments’ 513.

276. In this regard, the EDPB acknowledges that, since the moment the IE SA shared with the CSAs the
Compliance Reports on 5 April 2023, there has been an ongoing process consisting in the assessment
of the compliance efforts by Meta IE represented by the switch on 3 April 2023 to Article 6(1)(f) GDPR

as legal basis for most of the personal data collected on Meta’s products for behavioural advertising
purposes and later on, by the Meta IE’s Consent Proposal, and that this process was led by the IE SA in

its role as LSA in cooperation with the CSAs, which were invited to submit their views on multiple
occasions.

277. However, in light of the elements described above, namely the existence of ongoing infringements of
514
Article6(1)GDPR-thattheEDPBhasalreadylabelledasa‘veryserioussituationofnon-compliance’ ,
and of the duty to comply with decisions of SAs, and the existence of an urgent need to act despite the

ongoing process led by the IE SA, as motivated above in Section 4.2 of this urgent binding decision, the
EDPB considers that, at this point of time, there is a need to order final measures as further
enforcement measures are necessary.

278. With respect to the possible content of the specific final measures, the EDPB considers that it can
order final measures other than the provisional measures adopted under Article 66(1) GDPR or than

those referred to in the request made pursuant to Article 66(2) GDPR. The GDPR does not indeed
provide such limitations on the final measures, and the EDPB, while taking into consideration the
request made pursuant to Article 66(2) GDPR as well the other elements of the file, is entrusted to

ensure the correct and consistent application of GDPR when performing activities under the
consistency mechanism 515. Therefore, the EDPB is competent under Article 66(2) GDPR to order the

final measures that are appropriate on the basis of the circumstances of the case.

279. Inthecaseathand,theEDPBconsidersitappropriatetoanalysewhetherabanonprocessingshould
beimposed, bearing in mind that the NOSA Request to the EDPB asksthat ‘finalmeasures, inlinewith
516
the provisional measures [the NO SA] imposed in Norway, be imminently adopted’ , and that the NO
SA Order included a prohibition from processing personal data of data subjects residing in Norway for

behavioural advertising on the basis of Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

280. Inrespect of thepossible impositionof aban onprocessing,theIE SAconsiders that ‘the formoforder
sought by the [NO SA] is not one that could lawfully be delivered by the [IE SA] in the manner now
517
demanded’ . Thisis,first, because the EDPBdeclined toinstruct theIESA to imposeatemporaryban

512
513etter from the IE SA to the NO SA of 13 October 2023, p. 5.
Letter from the IE SA to the NO SA of 27 September 2023, p. 4.

514
EDPB Binding Decision 3/2022, paragraph 282 and EDPB Binding Decision 4/2022, paragraph 284.
51Art. 63 GDPR, Art. 65 GDPR, Art. 70(1) GDPR, Art. 70(1)(a) GDPR, and Art. 70(1)(t) GDPR.
51NO SA Request to the EDPB, p. 12.
51Letter from the IE SA to the NO SA of 27 September 2023, p. 3.

Adopted 70 in the EDPB Binding Decisions 518, and secondly because the IE SA Decisions ‘made provision for
enforcement measures, namely, the orders for compliance, under which [Meta IE]’s proposals for the

adoption of one or more alternative legal bases for the Processing Operations would be assessed, and
ruled on, on their respective merits’ 51. The IE SA concludes that ‘the EDPB recognised, explicitly, that

a process would need to be put in place in which the Controller would identify the means by which it
proposed to achieve compliance with its obligations, and, further, that, acting together in the context

of the co-operation and consistency mechanism provided for at Chapter VII of the GDPR, the [IE SA]
and the CSAs would in turn be required to test those proposals and assess whether or not they are
sufficient to achieve compliance with the requirements of Article 6(1) [GDPR] and the [IE SA]
520
Decisions’ .

281. According to the IE SA, the imposition of a ban on processing ‘which is isolated and divorced from any

underlying legal procedure would inevitably expose the [IE SA] to significant legal risk and lead to
litigation’,wheretheIESA‘wouldbecalledontojustifyitsdecisiontodepartfromthecourseofaction
rooted in [the IE SA Decisions] (uncontested by the EDPB and/or the CSAs), in favour of an alternative,
521
summary procedure involving the immediate imposition of a ban on processing’ . In this regard the
IE SA also argues that ‘it is inaccurate to suggest that the [IE SA] could impose an immediate ban on

processing, whilst continuing to progress its assessment of [Meta IE]’s proposed consent model, in
conjunction with its CSA colleagues’ 52.

282. In this respect, the EDPB highlights that the fact that it chose not to instruct the IE SA to impose a

temporary ban in the EDPB Binding Decisions, considering at that time that the imposition of an order
to bring processing into compliance within a short time frame would be appropriate, does not in itself

rule out the possibility than a ban would be needed today. Likewise, the fact that the IE SA Decisions,
adopted on the basis of the EDPB Binding Decisions, do not provide for a ban on processing does not
prevent the EDPB from ordering final measures in the form of a ban on processing in the context of

this urgent procedure, taking into account the facts that occurred following the adoption of the IE SA
Decisions. In this regard, the EDPB also recalls that the IE SA acknowledged in the IE SA Final Position
523
Paper that ‘enforcement measures may [...] have been necessary at this juncture’ .

283. In the next paragraphs, the EDPB will assess the appropriateness, necessity and proportionality of a
ban on processing. Article 58(2)(f) GDPR provides supervisory authorities with the power to impose a

temporary or definitive limitation including a ban on processing.

284. Recital 129 GDPR provides elements to assess whether a specific measure is appropriate. More
specifically, consideration should be given to ensuring that the measure chosen does not create

‘superfluous costs’ and ‘excessive inconveniences’ for the persons concerned in light of the objective
pursued. When choosing the appropriate corrective measure, there is a need to assess whether the

chosen measure is necessary to enforce the GDPR and achieve protection of the data subjects with
regard to the processing of their personal data, which is the objective being pursued. Compliance with

518Letter from the IE SA to the NO SA of 27 September 2023, p. 3. See also Letter from the IE SA to the NO SA of
13 October 2023, p. 3-4 (where the IE SA also states the EDPB did not instruct the IE SA to adopt an automatic
ban or a ban to be imposed should Meta IE fail to achieve compliance within a defined date).
519
520Letter from the IE SA to the NO SA of 27 September 2023, p. 3.
Letter from the IE SA to the NO SA of 13 October 2023, p. 4.
521Letter from the IE SA to the NO SA of 27 September 2023, p. 4.
522Letter from the IE SA to the NO SA of 27 September 2023, p. 4.
523IE SA Final Position Paper, paragraph 9.2.

Adopted 71 the principle of proportionality requires ensuring that the chosen measure does not create
disproportionate disadvantages in relation to the aim pursued 52.

285. As a first element, the EDPB would like to recall its reasoning in the EDPB Binding Decisions. In such
decisions, as pointed out by the IE SA and by Meta IE, the EDPB analysed at that point of time whether

a ban constituted an appropriate corrective measure to be imposed in the IE SA Decisions, due to the
presence of some relevant and reasoned objections putting forward this request 52. Several of the
elements that the EDPB considered at the time are helpful to be considered in this urgent binding

decision, too.

286. The EDPB highlighted in the EDPB Binding Decisions that the infringement of Article 6(1) GDPR found
in the case at hand constituted a very serious situation of non-compliance with the GDPR, in relation

to processing of extensive amounts of data, which is essential to the controller’s business model, thus
harming the rights and freedoms of millions of data subjects in the EEA; therefore, the corrective

measure chosen in the circumstances of this case should aim to bring the processing into compliance
with the GDPR thus minimising the potential harm to data subjects created by the violations of the
526
GDPR .

287. Therefore, according to the EDPB Binding Decisions, considering the nature and gravity of the
infringementofArticle6(1)(b)GDPR,aswellasthenumberofdatasubjectsaffected,itwasparticularly

important that appropriate corrective measures be imposed, in addition to a fine, in order to ensure
that Meta IE complies with this provision of the GDPR 52.

288. It is also important to note that the EDPB considered that it is not necessary to establish an urgent

necessity for imposing a temporary ban because nothing in the GDPR limits the application of Article
58(2)(f) GDPR to exceptional circumstances 52.

289. While in the EDPB Binding Decisions the EDPB took note of the elements raised by the objections to

justify the need for imposing a temporary ban, consisting in essence in the need to halt the processing
activities that are being undertaken in violation of the GDPR until compliance is ensured in order to

avoid further prejudicing data subject rights, it considered that the objective of ensuring compliance
and bringing the harm to the data subjects to an end could be adequately met also by amending the

order to bring processing into compliance envisaged in the IE SA draft decisions to reflect Meta IE’s

524EDPB Binding Decision 3/2022, paragraph 284 and EDPB Binding Decision 4/2022, paragraph 286.
525More specifically, in the dispute leading to the adoption of EDPB Binding Decision 3/2022, certain objections
requestedtheimpositionofabanorlimitationonprocessingoranordertoabstainfromtheprocessingactivities

intheabsenceofavalidlegalbasis(inparticular,theobjectionsoftheAT,NL,DEandNOSAs).TheEDPBanalysed
the merits of the objections of the AT and NL SAs (found to be relevant and reasoned in paragraph 266 of EDPB
Binding Decision 3/22) and did not take any position on the merits of the other objections on this matter that
were found to be not relevant and reasoned, namely the objections of the DE and NO SAs (see paragraph 268 of
Binding Decision 3/2022).

Concerning, instead, the dispute leading to the adoption of EDPB Binding Decision 4/2022, certain objections
requestedtheimpositionofabanorlimitationonprocessingoranordertoabstainfromtheprocessingactivities
intheabsenceofavalidlegalbasis(inparticular,theobjectionsoftheAT,NL,DEandNOSAs).TheEDPBanalysed
the merits of the objections of the AT and NL SAs (found to be relevant and reasoned in paragraph 269 of EDPB
Binding Decision 4/2022) and did not take any position on the merits of the other objections on this matter that

were found to be not relevant and reasoned, namely the objections of the DE and NO SAs (see paragraph 271 of
Binding Decision 4/2022).
526EDPB Binding Decision 3/2022, paragraph 282 and EDPB Binding Decision 4/2022, paragraph 284.
527EDPB Binding Decision 3/2022, paragraph 279 and EDPB Binding Decision 4/2022, paragraph 281.
528EDPB Binding Decision 3/2022, paragraph 283 and EDPB Binding Decision 4/2022, paragraph 285.

Adopted 72 infringement of Article 6(1) GDPR 529. The EDPB noted in this regard that this measure would require

Meta IE to put in place the necessary technical and operational measures to achieve compliance
within a set timeframe 530. Such timeframe was established to be necessarily a ‘short period of
531
time’ .The EDPB Binding Decisions comprised, eventually, instructions to the IE SA to include in the
IE SA Decisions orders for Meta IE to bring its processing of personal data for the purpose of

behavioural advertising in the context of the Facebook service into compliance with Article 6(1) GDPR
within three months 53. In this respect, the EDPB considered this deadline for compliance to be

necessary and proportionate, considering that the interim period for compliance ‘will involve a
serious ongoing deprivation of their rights’ and the significant financial, technological, and human
533
resources available to Meta IE .

290. The fact that the three-month timeframe has expired several months ago is an important element to
be considered, that marks a significant difference compared to the situation that the EDPB analysed in

the EDPB Binding Decisions. Already the three-month interim period for compliance was considered
by the EDPB to involve ‘a serious ongoing deprivation’ of data subjects’ rights: the need to ensure that

this deprivation comes to an end is therefore even clearer now that three times the time initially
envisaged has passed.

291. As a consequence, the reasoning of the EDPB in the EDPB Binding Decisions on whether a ban needed
to be imposed in the IE SA Decisions provides arguments in favour of considering that the imposition

of a ban would be appropriate, necessary and proportionate today, rather than against this.

292. The EDPB also takes note of the NO SA’s argument that Meta IE has a ‘readily available procedure to
terminate this processing rapidly’, as it already implemented an objection mechanism in the EEA in

relation to its processing for behavioural advertising in reliance of Article 6(1)(f) GDPR, which allows
the suspension of the processing 53.

293. The EDPB also notes Meta IE’s argument that a short implementation deadline would not be
feasible535, considering the need for a complex process for the implementation of a ban involving
536
several teams and many hours of work . More specifically, Meta contests that it can comply ‘(i)
through blanket application of the [objection mechanism] to all users across the EEA, and then “as a

next step” (ii) “expanding the [objection mechanism] to include categories of data processing covered
by the [NO SA Order]”, since already the NO SA acknowledges for step (ii) that this “would require
537
redesigning the [objection mechanism]”’ .

529EDPB Binding Decision 3/2022, paragraph 285 and EDPB Binding Decision 4/2022, paragraph 287. In reaching

thisconclusion,theEDPBhighlightedthatcompliancewiththeprincipleofproportionalityrequiresensuringthat
the chosen measure does not create disproportionate disadvantages in relation to the aim pursued, and Recital
129 GDPR provides that consideration should be given to ensuring that the measure chosen does not create
‘superfluous costs’ and ‘excessive inconveniences’ for the persons concerned in light of the objective pursued.

EDPB Binding Decision 3/2022, paragraph 284 and EDPB Binding Decision 4/2022, paragraph 286.
530EDPB Binding Decision 3/2022, paragraph 285 and EDPB Binding Decision 4/2022, paragraph 287.
531EDPB Binding Decision 3/2022, paragraph 286 and EDPB Binding Decision 4/2022, paragraph 288.
532EDPB Binding Decision 3/2022, paragraph 288 and EDPB Binding Decision 4/2022, paragraph 290.
533
EDPB Binding Decision 3/2022, paragraph 286 and EDPB Binding Decision 4/2022, paragraph 288.
534NO SA Request to the EDPB, p. 12-13.
535Meta IE’s Submissions of 26 September 2023, p. 15.
536Meta IE’s Submissions of 26 September 2023, p. 15.
537
Meta IE’s Submissions of 26 September 2023, p. 15 (‘Ignoring [Meta IE]’s arguments, the [NO SA] claims that
[Meta IE] can comply (i) through blanket application of the [objection mechanism] to all users across the EEA,
and then “as a next step” (ii) expanding the [objection mechanism] to include categories of data processing

Adopted 73294. According to the EDPB, the NO SA’s argument on the existence of the objection mechanism is

reasonableatleastforwhatconcernstheprocessingcurrentlycarriedoutonthebasisofArticle6(1)(f)
GDPR (i.e. the majority of the processing of personal data collected on Meta’s products currently
538
carried out for the purposes of behavioural advertising) , also considering that Meta IE did not
explain why for the processing based on Article 6(1)(f) GDPR a ‘redesigning’ of the mechanism would

benecessary;also,MetaIEconfirmsthat‘allrelevantobjections’arehonouredleadingtothe‘theuser
[being] “opted out” of this processing’ 539.

295. Additionally, while certainly the imposition of a ban causes significant disadvantages to the
540
controller , the EDPB considers that such disadvantages are not at this point in time, per se,
disproportionate compared to the harm caused to data subjects by the unlawful processing and

continued non-compliance. In this regard, moreover, the EDPB notes that the controller was granted
the opportunity to take remedies without facing these disadvantages. As highlighted above 541, several

months have passed since the adoption of the IE SA Decisions and the expiry of the deadline for the
orders to bring processing into compliance contained therein. At this stage, the controller has

undertaken efforts to comply with the GDPR but compliance has not yet been achieved, as indicated
in the IE SA Final Position Paper, and there is still no clear indication that compliance will be reached
soon 542.The impositionofan orderto bringprocessing intocompliancewithin ashortdeadline didnot

succeed in reaching the objective it pursued, consisting in ‘ensuring compliance and bringing the harm
to the data subjects to an end’ 54.

covered by the [NO SA Order]. As the [NO SA]’s argument itself acknowledges in step (ii), compliance with the
[NO SA Order] (or an urgent binding EDPB decision based on the [NO SA Order]) would require redesigning the

[objection mechanism]. As a reminder, building the supporting infrastructure and rolling out the [objection
mechanism] entailed hundreds of thousands of hours of work by multi-disciplinary teams including product,
machine learning and infrastructure engineers, user experience designers, operations, policy, marketing and
legal to design, build and implement the systems, processes and user experience required to enable [Meta IE] to

meet the different requirements of Article 6(1)(f) GDPR. The [NO SA]’s speculative assertion that this could form
some sort of instant compliance solution is fundamentally flawed’).
538See Meta IE Compliance Report on IE SA FB Decision, paragraphs 3.1.3 and 5.8.2, and Meta IE Compliance
Report on IE SA IG Decision, paragraphs 3.1.3 and 5.8.2. See also paragraphs 103-106 above.
539
Meta IE’s Merits Complaint submitted to the Oslo District Court on 16 October 2023, p. 14-15 (‘since the
launch of the Objection Mechanism, Meta [IE] has honoured all relevant objections without qualification and
without undertaking a balancing assessment to determine whether it has compelling legitimate grounds to
override the user’s objection. All that is checked is that the objection (i) relates to behavioural advertising
processing that Meta [IE] presentlyundertakes underArticle 6(1)(f) GDPR, and(ii) is submitted byagenuineuser

based in the EU/EEA (to confirm Meta [IE] is the controller and the GDPR applies). As soon as Meta [IE]’s
operations team have confirmed (i) and (ii) based on the limited information that the user is asked to provide,
the user is “opted-out” of this processing’).
This is without prejudice to the conclusion of the IE SA in the IE SA Final Position Paper whereby the compliance

withtheGDPRoftheobjectionmechanismsetupbyMetaIEhasnotbeendemonstrated(paragraphs7.60-7.66).
540In Meta IE’s Letter to the NO SA of 14 August 2023, Meta IE lists challenges possibly arising from ‘stopping’
processingofpersonaldataofNorwegianusersforbehaviouraladvertisingpurposes,involvingtheneedtomake
changestoMetaIE’scodeandrelatedinfrastructure,informusers,provideadvertiserswithappropriateadvance

notice, waiting for users to update their apps. Meta IE also highlights the possible damage arising from a
suspension of behavioural advertising in Norway, connected to lost revenue, reputational harm, and future
revenue losses (p. 8-10).
541See paragraph 290 above. See also Meta Ireland’s Submissions of 25 August 2023, p. 23-24; Letter from Meta

542land to NO SA of 14 August 2023, p. 8-9.
See also Meta IE’s Submissions of 25 August 2023, p. 23-24; Letter from Meta IE to NO SA of 14 August 2023,
p. 8-9. .
543EDPB Binding Decision 3/2022, paragraph 285 and EDPB Binding Decision 4/2022, paragraph 287.

Adopted 74296. In light of the elements above, the EDPB considers it appropriate, necessary and proportionate to
order final measures consisting in a ban on processing, to be adopted on the basis of Article 58(2)(f)

GDPR.

297. The EDPB considers that, in this particular case, it would be proportionate that a period of
implementation be provided to enable Meta IE to implement it.

298. The EDPB seizes the occasion to specify that also the NO SA Order was issued on 14 July 2023 but
544
envisaged that it would only become applicable as of 4 August 2023 .

299. At the same time, the period of implementation should be a short one, in light of the urgency of the
situationasdescribedextensivelyinthesectionsaboveofthisurgentbindingdecisionandinparticular

of the urgent need to put an end to the unlawful processing being carried out to the detriment of data
subjects.

300. AccordingtotheEDPB,inlightoftheelementsinthefile,theimplementationofabaninashortperiod

of time should be technically and practically feasible for Meta IE. This is in particular the case
considering that Meta IE already envisages the implementation of a consent mechanism
. Additionally, Meta IE has been aware of the need to bring the unlawful processing to

an end since the notification of the IE SA Decisions adopted in December 2022.

301. Therefore, the EDPB considers that, in this particular case, it is proportionate for the ban on
processing to be effective one week after the notification of the final measures to the controller.

302. Additionally, the EDPB clarifies that the ban should refer to Meta IE’s processing of personal data
collected on Meta’s products for behavioural advertising purposes on the basis of Article 6(1)(b)
GDPRandArticle6(1)(f)GDPR.Theprocessingactivitiestowhich thebanrefersare:(i)theprocessing

of personal data, including location data and advertisement interaction data, collected on Meta’s
products for behavioural advertising purposes, having established in this respect the infringement of

Article6(1)GDPRarisingfrominappropriaterelianceonArticle6(1)(b)GDPR;(ii)processingofpersonal
data collected on Meta’s products for behavioural advertising purposes, having ascertained in this
respect the infringement of Article 6(1) GDPR arising from inappropriate reliance on Article 6(1)(f)
545
GDPR .

303. The EDPB considers that, in general, the geographical scope of the final measures ordered pursuant
to Article 66(2)GDPR should be broader than the territory of the requesting SA. While it is provided by

Article 66(1) GDPR that the urgent provisional measures adopted by a requesting SA only apply to the
territory of that SA, the intervention of the EDPB aims to ensure a consistent application of the GDPR,
in light of Articles 63 and 70 GDPR. The final measures should therefore have a broader geographical

scope to ensure the protection of the rights and freedoms of all the data subjects affected; this scope
can, depending on the matter, cover several Member States 546. The NO SA requested that final

measures, if any, ‘should be applied EEA-wide, to avoid derogating from the harmonisation and
consistency that the GDPR aims to ensure’ 547. Since in this case the unlawful processing takes place
and affect the rights and freedom of data subjects in the entire EEA, the EDPB agrees that the

appropriate territorial scope is for the final measures to be applicable throughout the entire EEA, and

54NO SA Order, p. 3-4.
54A more thorough analysis can be found above in paragraphs 97-99, 103-104, 147-148 and 152-153.
54EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the

Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679,
paragraph 114.
54NO SA Request to the EDPB, p. 12.

Adopted 75 concurswiththeNOSAontheneedtoavoidfragmentationintheprotectionaffordedtodatasubjects.
Limiting the scope of the final measures to the Norwegian territory would indeed lead to
fragmentation in the protection as it would require each CSAs to adopt provisional measures on its

own territory under Article 66(1) GDPR and to request an EDPB urgent binding decision under Article
66(2) GDPR leading to the need to adopt final measures limited to their own territory. Such situation

could also result in a patchwork of final measures and a fragmentation in countries where the SA has
not acted 54.

304. The EDPB considers that the addressee of the final measures consisting of a ban on processing should

beMetaIE,whichshalltakethenecessarymeasurestoensurecompliancewiththedecisionasregards
processing activities in the context of all its establishments in the EEA. In line with this, and since
Facebook Norway was subject to the NO SA Order alongside Meta IE and considering its submissions,

Facebook Norway – which is the Norwegian establishment of Meta IE – should be informed of the
outcome and receive a copy of the final measures and of the EDPB urgent binding decision.

5.1.4 Conclusion

305. In light of all the elements above, the EDPB considers it necessary to order final measures, consisting
in a ban on processing pursuant to Article 58(2)(f) GDPR.

306. This ban on processing should be addressed to Meta IE, and become effective one week after the
notification of the final measures to them.

307. The EDPB considers that the ban should refer to Meta IE’s processing of personal data for behavioural
advertising purposes on the basis of Article 6(1)(b) GDPR and Article 6(1)(f) GDPR across the entire
EEA, as described above in paragraphs 303-304.

5.2 Adoption of the final measures and notification to the controller

308. The GDPR does not specify the procedural steps to be taken following the adoption of an urgent
binding decision by the EDPB pursuant to Article 66(2) GDPR. It is however important to note that the

two-weekdeadlineforadoptionisspecified‘byderogationfrom[...]Article65(2)[GDPR]’(Article66(4)
GDPR). Consequently, the EDPB considers that, in addition to Article 65(2) GDPR, the procedure set by

Article 65(5) GDPR and Article 65(6) GDPR represents a point of reference.

309. The EDPB’s urgent binding decision shall be addressed to the LSA and to all the CSAs and be binding
on them 54. The Chair of the Board shall notify, without undue delay, the urgent binding decision to
550
the supervisory authorities concerned, and inform the European Commission thereof .

310. Taking into consideration that the final measures will have to be applicable throughout the entire EEA
(as provided in the above sections 5.1.3 and 5.1.4), the EDPB considers that the IESA, in its role of LSA,
will have to adopt a national decision imposing the measures that the EDPB has considered necessary

548
EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the
Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679,
paragraph 115.
549Art. 65(2) GDPR. According to Art. 66(4) GDPR, this provision is derogated in respect of the deadline for
adoption; therefore, the last sentence of Art. 65(2) GDPR fully applies.
55See Art. 65(5) GDPR. Considering the fact that the NO SA was the SA making the request pursuant to Article

66(2), the EDPB will also inform the EFTA Surveillance Authority, in light of Article 1, second paragraph, letter m
of Decision of the EEA Joint Committee No. 154/2018.

Adopted 76 551
to order as final measures pursuant to Article 66(2) GDPR . This was already envisaged by the IE SA
itself5.

311. While the procedure set by Article 65(5) GDPR and Article 65(6) GDPR represents a point of reference,

as mentioned above, the EDPB considers that the deadline set in Article 65(6) for the SA to adopt its
national decision (one month in Article 65 proceedings) may need to be shortened, on a case by case
basis, in Article 66 proceedings. The urgency of the procedure is highlighted by the shortening of the

deadline for the Board to adopt its urgent binding decision or opinion under Article 66(4) GDPR. It
would therefore counterintuitive, and against the legislator’s will, to imagine that the deadline for the

SA to adopt its national decision should remain unchanged in Article 66 proceedings. While the EDPB
acknowledges the need for time allowing the SA to draft a national decision and possibly hear the
company, in this particular case it is necessary to bear in mind the date of expiry of the Provisional

Measures (3 November 2023) as well as the prolonged situation of non-compliance leading to the
urgency of the situation as described above.

312. In this case, the EDPB considers that the national decision needs to be adopted by the IE SA without

undue delay and at the latest by two weeks after the EDPB has notified its urgent binding decision
totheIESAandtoalltheCSAs.TheEDPBhighlights,inthisregard,thatadoptingthenationaldecision
prior to the expiry of the Provisional Measures on 3 November 2023 would be desirable as it would

allow avoiding a gap in the legal situation for what concerns the Norwegian territory. Additionally, the
IE SA will have to notify the national decision to Meta IE, attaching the urgent binding decision 553.

313. The EDPB also requests the NO SA to inform Facebook Norway about the outcome of these

proceedings, by sharing a copy of the national decision of the IE SA and of the urgent binding decision,
following the notification by the IE SA of its national decision to Meta IE.

6 URGENT BINDING DECISION

314. In light of the above and in accordance with the tasks of the EDPB under Article 70(1)(t) GDPR to issue

urgent binding decisions pursuant to Article 66 GDPR, the Board issues the following binding decision
in accordance with Article 66(2) GDPR.

315. As regards the existence of infringements, based on the evidence provided, the EDPB concludes that
there is an ongoing infringement of Article 6(1) GDPR arising from inappropriate reliance on Article

6(1)(b) GDPR for processing of personal data, including location data and advertisement interaction
data, collected on Meta’s products for behavioural advertising purposes.

316. The EDPB also concludes that there is an ongoing infringement of Article 6(1) GDPR arising from

inappropriate reliance on Article 6(1)(f) GDPR for processing personal data collected on Meta’s
products for behavioural advertising purposes.

317. In addition, the EDPB concludes that Meta IE is currently in breach of its duty to comply with decisions

by supervisory authorities.

55See Art. 65(6) GDPR.
55The IE SA considers theNO SA Requestto the EDPB seeksto obtain an urgentbindingdecision from the EDPB,
‘the net effect of which would be to compel the [IE SA], as LSA, to impose an EEA-wide ban (...) (In that regard, it
is ofcoursethecasethat itisnotopentotheEDPBtoexercise correctivepowersdirectly asagainst any controller

553processor)’. Letter from the IE SA to the NO SA of 13 October 2023, p. 3.
As described in Art. 65(6) GDPR and paragraph 308 above.

Adopted 77318. On the existence of urgency, the EDPB considers that, the urgent need to order final measures is clear
in light of the risks that the infringements represent for the rights and freedoms of the data subjects
554
without the adoption of final measures . Because of such risks, the EDPB also finds that there is a
need to derogate from the regular cooperation and consistency mechanisms to order final measures
due to the urgency of the situation 555.

319. The EDPBalsoconsiders that the IE SA, bynot providing theinformation referredin Article 61(5) GDPR
within the one-month deadline, failed to address the NO SA Mutual Assistance Request and that the
presumption of urgency set by Article 61(8) GDPR is therefore applicable in this specific case, which

further corroborates the need to derogate from the regular cooperation and consistency
mechanisms 55.

320. ConsideringtheexistenceoftheaforementionedongoinginfringementsoftheGDPRandtheexistence

of an urgent need to act despite the ongoing process led by the IE SA, the EDPB considers that, at this
point of time, further enforcement measures are necessary.

321. Therefore,inlightoftheanalysiscarriedoutabove 557theEDPBconsidersitappropriate,proportionate

and necessary to order final measures, consisting in a ban on processing pursuant to Article 58(2)(f)
GDPR.

322. This ban on processing should be addressed to Meta IE, and become effective one week after the

notification of the final measures to them.

323. The EDPB considers that the ban should refer to Meta IE’s processing of personal data collected on
Meta’s products for behavioural advertising purposes on the basis of Article 6(1)(b) GDPR and Article

6(1)(f) GDPR across the entire EEA. The processing activities to which the ban refers are: (i) the
processing of personal data, including location data and advertisement interaction data, collected on
Meta’s products for behavioural advertising purposes, having established in this respect the

infringement of Article 6(1) GDPR arising from inappropriate reliance on Article 6(1)(b) GDPR; (ii)
processing of personal data collected on Meta’s products for behavioural advertising purposes, having

ascertained in this respect the infringement of Article 6(1) GDPR arising from inappropriate reliance
on Article 6(1)(f) GDPR.

324. The EDPB instructs the IE SA to adopt a national decision containing the final measures ordered by the
EDPBwithoutunduedelayandatthelatestbytwoweeksaftertheEDPBhasnotifieditsurgentbinding

decision to the IE SA and to all the CSAs. The IE SA shall notify the national decision, attaching the
urgent binding decision of the EDPB, to Meta IE without undue delay.

325. The EDPB instructs the NO SA to inform Facebook Norway about the outcome of these proceedings.

7 FINAL REMARKS

326. This urgent binding decision is addressed to the IE SA, the NO SA and all the other CSAs.

327. TheEDPBconsidersthatitscurrentdecisioniswithoutanyprejudicetoanyassessmentstheEDPBmay
be called upon to make in other cases, including with the same parties.

55See section 4.2.1.3 above.
555
556ee paragraph 220 above.
See section 4.2.2.3 above, including paragraph 257.
55See Sections 5.1.3 and 5.1.4 above.

Adopted 78328. TheIESAshalladoptitsnationaldecisionnolaterthantwoweeksafternotificationoftheEDPBurgent

binding decision.

329. The IE SA shall notify its national decision and this urgent binding decision to Meta IE without undue
delay. The IE SA shall inform the EDPB of the date when the national decision is notified to the
controller.

330. The NO SA shall inform Facebook Norway of the outcome of these proceedings without undue delay

after the notification of the national decision to Meta IE.

331. The IE SA will communicate itsfinal decisionto the EDPB.Pursuant to Article 70(1)(y)GDPR, theIE SA’s
final decision communicated to the EDPB will be included in the register of decisions that have been
subject to the consistency mechanism.

For the European Data Protection Board

The Chair

(Anu Talus)

Adopted 79

@@ Line 80: / Line 80: @@
 === Facts ===
-On 31 December 2022, the Irish DPC as Lead Supervisory Authority in a cross-border case, issued two final decisions concerning, respectively Meta’s Facebook and Instagram services. These were adopted on the basis of two binding decisions by the EDPB, Binding Decisions 3/2022 and 4/2022 adopted by the EDPB on 5 December 2022 pursuant to [[Article 65 GDPR#1a|Article 65(1)(a) GDPR]].
+On 31 December 2022, the Irish DPC as Lead Supervisory Authority in a cross-border case, issued two final decisions concerning, respectively Meta’s Facebook and Instagram services as controllers. These were adopted on the basis of two binding decisions by the EDPB, Binding [[EDPB - Binding Decision 3/2022 - 'Meta (Facebook)'|Decisions 3/2022]] and [[EDPB - Binding Decision 4/2022 - 'Meta (Instagram)'|4/2022]] adopted by the EDPB on 5 December 2022 pursuant to [[Article 65 GDPR#1a|Article 65(1)(a) GDPR]].
-On 5 April 2023, the DPC communicated to the CSAs via the IMI system Meta’s compliance reports showing their efforts to comply with the decisions by the DPC. In these reports, Meta stated that it changed its legal basis for behavioural advertising from [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] to [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]], backed by Legitimate Interest assessments. These documents were submitted to the CSAs so that they could assess whether the measures adopted by Meta could be considered effective in guaranteeing compliance with the orders in the DPC decision.
-The Norwegian DPA (Datatilsynet) communicated to the DPC that it had doubts regarding the legitimacy of Meta’s choice of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] as a legal basis. Thereafter, the DPC shared two other letters from Meta to the CSAs substantiating its compliance efforts and the CSAs submitted their opinion to the DPC which were then sent back to Meta for feedback.
+On 5 April 2023, the DPC communicated to the concerned supervisory authorities (CSAs) via the IMI system Meta’s compliance reports showing their efforts to comply with the decisions by the DPC. In these reports, Meta stated that it changed its legal basis for behavioural advertising from [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] to [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]], backed by a legitimate Interest assessments. These documents were submitted to the CSAs so that they could assess whether the measures adopted by Meta could be considered effective in guaranteeing compliance with the orders in the DPC decision.
-On 5 May 2023, the Datatilsynet transmitted a mutual assistance request to the DPC under [[Article 61 GDPR#1|Article 61(1) GDPR]], asking the DPC to issue a temporary ban on Meta’s processing for purposes of behavioural advertising based on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] and requesting the DPC to specify how it will ensure that Meta complies with [[Article 6 GDPR#1|Article 6(1) GDPR]].
-On 30 May 2023, the Dutch DPA also asked the Irish DPC to provide its conclusions on the compliance efforts undertaken by Meta in a mutual assistance request under [[Article 61 GDPR|Article 61 GDPR]].  The DPC stated that it would be able to respond to the mutual assistance requests and draw its conclusion on the compliance reports only at the end of June 2023. The DPC also replied to the Datatilsynet request for mutual assistance stating that it could not comply with its request and the Datatilsynet asked the DPC to at least inform it as to whether it would follow the Datatilsynet’s mutual assistance request.
+The Norwegian DPA (''Datatilsynet'') communicated to the DPC that it had doubts regarding the legitimacy of Meta’s choice of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] as a legal basis. Thereafter, the DPC shared two other letters from Meta to the CSAs substantiating its compliance efforts and the CSAs submitted their opinion to the DPC which were then sent back to Meta for feedback. On 5 May 2023, the Norwegian DPA transmitted a mutual assistance request to the DPC under [[Article 61 GDPR#1|Article 61(1) GDPR]], asking the DPC to order a temporary ban on Meta’s processing for purposes of behavioural advertising based on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] and requesting the DPC to specify how it will ensure that Meta complies with [[Article 6 GDPR#1|Article 6(1) GDPR]]. On 30 May 2023, the Dutch DPA also asked the Irish DPC to provide its conclusions on the compliance efforts undertaken by Meta in a mutual assistance request under [[Article 61 GDPR]].  The DPC stated that it would be able to respond to the mutual assistance requests and draw its conclusion on the compliance reports only at the end of June 2023. The DPC also replied to the Norwegian DPA request for mutual assistance stating that it could not comply with it. The Norwegian DPA asked the DPC to at least inform it as to whether it would potentially follow the Norwegian DPA’s mutual assistance request, but indicated that it would still wait for the DPC's position at the end of June.
-On 13 June 2023, the DPC stated that it would do so onnly after the delivery of CJEU judgment in the C-252/21 Bundeskartellamt case in July 2023. On 11 July 2023, the Irish DPC issued a provisional position paper with its preliminary conclusion, stating that Meta failed to comply with the orders of its decisions. The DPC’s provisional position paper was then submitted to the CSAs for feedback.
-On 14 July 2023, the Datatilsynet imposed a temporary ban on Meta and Facebook Norway on the processing of personal data of Norwegian data subjects for purposes of behavioural advertising based on [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] and [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. After a further set of exchanges between Meta and the Datatilsynet, and Meta’s statement that it would shift to [[Article 6 GDPR#1a|Article 6(1)(a) GDPR]] as a legal basis, the Datatilsynet imposed a coercive fine on Meta and Facebook Norway for non-compliance with its order.
+On 13 June 2023, however, the DPC stated that it would share its provisional assessment only after the delivery of CJEU judgment in [[CJEU - C-252/21 - Meta Platforms and Others v Bundeskartellamt|case C-252/21 Meta Platforms and Others v Bundeskartellam]]<nowiki/>t in July. Following the publication of judgment, the Irish DPC issued a provisional position paper with its preliminary conclusion on 11 July 2023, stating that Meta failed to comply with the orders of its decisions. The DPC’s provisional position paper was then submitted to the CSAs for feedback.
-On 18 August 2023, the DPC communicated to the CSAs its final position on Meta’s compliance with tis decisions and concluded that Meta failed to demonstrate compliance but that it is reasonable to give Meta a chance to rely on consent as a legal basis. On 21 September 2023, the Datatilsynet submitted to the DPC its view on the state of the proceedings and argued that it still considered the adoption of urgent measures necessary, asking the DPC to reconsider its position.
-Given the contrary response of the DPC, on 26 September 2023 the Datatilsynet made a request to the EDPB to issue an urgent binding decision under [[Article 66 GDPR#2|Article 66(2) GDPR]], asking that final measures be adopted.
+Preoccupied by the inactivity of the DPC, the Norwegian DPA imposed a temporary ban on Meta and Facebook Norway on the processing of personal data of Norwegian data subjects for purposes of behavioural advertising based on [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] and [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] on 14 July 2023. After a further set of exchanges between Meta and the Norwegian DPA, and Meta’s statement that it would shift to [[Article 6 GDPR#1a|Article 6(1)(a) GDPR]] as a legal basis, the Norwegian DPA imposed a coercive fine on Meta and Facebook Norway for non-compliance with its order.
+On 18 August 2023, the DPC communicated to the CSAs its final position on Meta’s compliance with its decisions and concluded that Meta failed to demonstrate compliance but that it was reasonable to give Meta a chance to rely on consent as a legal basis.
+On 21 September 2023, the Norwegian DPA submitted to the DPC its view on the state of the proceedings and argued that it still considered the adoption of urgent measures necessary, asking the DPC to reconsider its position.
+Given the negative response of the DPC, on 26 September 2023, the Norwegian DPA made a request to the EDPB to issue an urgent binding decision under [[Article 66 GDPR#2|Article 66(2) GDPR]], asking that final measures be adopted.
 === Holding ===
-First of all, the EDPB Secretariat assessed the request and asked the Datatilsynet to submit further documentation paying particular attention to scrutinize the right to good administration under Article 41 CFREU. On 17 October, the EDPB assessed the completeness of the file and established its competence to deal with the request to issue an urgent binding decision.
+First of all, the EDPB Secretariat assessed the request and asked the Norwegian DPA to submit further documentation paying particular attention to scrutinize the right to good administration under Article 41 CFREU. On 17 October, the EDPB assessed the completeness of the file and established its competence to deal with the request to issue an urgent binding decision.
-.	Competence of the EDPB
-For the EDPB to be competent to issue an urgent binding decision, two conditions must be given, namely: that a DPA has taken provisional measures under [[Article 66 GDPR#1|Article 66(1) GDPR]] and the same DPA made a request to issue a binding decision under [[Article 66 GDPR#2|Article 66(2) GDPR]]. In this case, the Datatilsynet followed these steps.
+<u>1. Competence of the EDPB</u>
-.	The right to good administration
-In the second place, the EDPB made sure to act in accordance with the right to good administration under Article 41 CFREU and Article 11(1) EDPB RoP. It also considered Meta’s position and ascertained that all the documents it received were also known to Meta, so that the procedure would respect Meta’s right to be heard. The EDPB concluded that Meta did not have an opportunity to make its views known on the procedure and asked Meta to provide written submissions.
+For the EDPB to be competent to issue an urgent binding decision, two conditions must be given, namely: that a DPA has taken provisional measures under [[Article 66 GDPR#1|Article 66(1) GDPR]] and the same DPA made a request to issue a binding decision under [[Article 66 GDPR#2|Article 66(2) GDPR]]. In this case, the Norwegian DPA followed these two steps, hence the EDPB considered itself competent to deal with the request.
-.	On the need to request final measures
+<u>2. The right to good administration</u>
+In the second place, the EDPB made sure to act in accordance with the right to good administration under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012P%2FTXT Article 41 of the ''Chartere of Fundamental Rights of the European Union'' (''CFREU'')] and [https://edpb.europa.eu/our-work-tools/our-documents/rules-procedure/rules-procedure-version-8_en Article 11(1) of the EDPB Rules of Procedure]. It also considered Meta’s position and ascertained that all the documents it received were also known to Meta, so that the procedure would respect Meta’s right to be heard. The EDPB concluded that Meta did not have an opportunity to make its views known on the procedure and asked Meta to provide written submissions.
+<u>3. On the need to request final measures</u>
 Further, the EDPB considered whether the adoption of urgent final measures was necessary, which is the case when one or several infringements exist and when an urgency situation justifies derogation from the ordinary procedure.
-.1.	Infringment
-First, as regards the existence of GDPR infringement(s) by Meta, the EDPB considered both the position of the Datatilsynet and of the DPC in relation to the reliance of Meta on [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] for behavioural advertising. The EDPB concluded that Meta was still processing location data and advertisement interaction data for purposes of behavioural advertising relying on [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]], although it was previously declared unlawful by the DPC. Hence the EDPB held that Meta was still acting in violation of [[Article 6 GDPR#1|Article 6(1) GDPR]].
+''<u>3.1.Infringments of the GDPR</u>''
-Secondly, the EDPB assessed whether Meta was still processing personal data for purposes of behavioural advertising on the basis of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. The EDPB considered that in line with the DPC’s decision, Meta was supposed to bring its processing into compliance with [[Article 6 GDPR#1|Article 6(1) GDPR]], specifying that it may include but is
-“not limited to the identification of an appropriate alternative legal basis”.
+First, as regards the existence of GDPR infringement(s) by Meta, the EDPB considered both the position of the Norwegian DPA and of the DPC in relation to the reliance of Meta on [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] for behavioural advertising. The EDPB concluded that Meta was still processing location data and advertisement interaction data for purposes of behavioural advertising relying on [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]], although it was previously declared unlawful by the DPC. Hence the EDPB held that Meta was still acting in violation of [[Article 6 GDPR#1|Article 6(1) GDPR]].
-The EDPB assessed the existence of the three cumulative conditions needed to satisfy the requirements of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] and concluded that Meta unlawfully relied on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] as a legal basis, since
-“the interests and fundamental rights of data subjects override the legitimate interests put forward by Meta IE for the processing of personal data collected on Meta’s products for the purposes of behavioural advertising”
+Secondly, the EDPB assessed whether Meta was still processing personal data for purposes of behavioural advertising on the basis of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. The EDPB considered that in line with the DPC’s decision, Meta was supposed to bring its processing into compliance with [[Article 6 GDPR#1|Article 6(1) GDPR]], specifying that it may include but is ''“not limited to the identification of an appropriate alternative legal basis”.''
+The EDPB assessed the existence of the three cumulative conditions needed to satisfy the requirements of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] and concluded that Meta unlawfully relied on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] as a legal basis, since ''“the interests and fundamental rights of data subjects override the legitimate interests put forward by Meta IE for the processing of personal data collected on Meta’s products for the purposes of behavioural advertising”''
 In light of these findings, the EDPB concluded that there was an ongoing infringement of [[Article 6 GDPR#1|Article 6(1) GDPR]] by Meta.
-Thirdly, the EDPB considered Meta’s infringement of the duty to comply with decisions by supervisory authorities, against [[Article 60 GDPR#10|Article 60(10) GDPR]], which constitutes an independent violation of the GDPR. On he basis of the positions of the Irish and Norwgian DPAs, the EDPB held that
-“Meta IE did not achieve compliance with the IE SA Decisions within the deadline for compliance and is therefore currently in breach of its duty to comply with decisions by supervisory authorities.”
+Thirdly, the EDPB considered Meta’s infringement of the duty to comply with decisions by supervisory authorities, against [[Article 60 GDPR#10|Article 60(10) GDPR]], which constitutes an independent violation of the GDPR. On he basis of the positions of the Irish and Norwgian DPAs, the EDPB held that ''“Meta IE did not achieve compliance with the IE SA Decisions within the deadline for compliance and is therefore currently in breach of its duty to comply with decisions by supervisory authorities.”''
-.2.	 Urgency
+''<u>3.2. Urgency</u>''
 The EDPB reiterated in its decision that the issuing of an urgent binding decision is an exceptional circumstance and it can only be granted if the regular consistency mechanism cannot be applied due to such urgency, as per [[Article 66 GDPR#2|Article 66(2) GDPR]].
-First, the EDPB assessed the existence of urgency on the basis of the position of the Datatilsynet, the elements in the file and the circumstances of the infringement, that is the nature, gravity, duration and number of data subjects affected by the infringement. In this regard, the EDPB held, as it also previously stated in its binding decisions that the nature and gravity of the infringements were significant. Also the duration of the infringement was considered that “, the fact that the processing activities are still performed without reliance on an appropriate legal basis represents an element in favour of concluding that there is an urgent need for final measures to be adopted”. Hence the EDPB concluded that “failing to put an end to the processing activities at stake and to enforce the IE SA Decisions exposes data subjects to a risk of serious and irreparable harm”.
-Secondly, the EDPB addressed the necessity to derogate from the standard cooperation and consistency mechanism, and it concluded that the fact that the DPC did not adopt any final measures to put an end to Meta’s GDPR infringements despite the risk of serious and irreparable harm for data subjects “shows that the regular cooperation and consistency mechanism is not providing satisfactory results”.
+First, the EDPB assessed the existence of urgency on the basis of the position of the Norwegian DPA, the elements in the file and the circumstances of the infringement, that is the nature, gravity, duration and number of data subjects affected by the infringement. In this regard, the EDPB held, as it also previously stated in its binding decisions that the nature and gravity of the infringements were significant. Also the duration of the infringement was considered. In particular, ''“the fact that the processing activities are still performed without reliance on an appropriate legal basis represents an element in favour of concluding that there is an urgent need for final measures to be adopted”''.
-Thirdly, the EDPB examined whether the legal presumption of urgency provided in [[Article 61 GDPR#8|Article 61(8) GDPR]] was given in the case in question. Under [[Article 61 GDPR#8|Article 61(8) GDPR]], if a DPA does not provide the information requested in a mutual assistance request within one month, urgency will be presumed. In this case, the Datatilsynet had made such a request but received an unmotivated negative answer from the Irish DPC. The EDPB reiterated the importance of the cooperation mechanism and the fact that mutual assistance is at the core of such cooperation. Further, the authorities receiving a mutual assistance request have a series of procedural and substantive obligations under [[Article 61 GDPR|Article 61 GDPR]] to respond to such request. The EDPB also stressed that the mutual assistance request is a one-to-one procedure between the requesting and requested authorities. From a procedural point of view, the EDPB considered that the Irish DPC fulfilled its duty to respond to the request within the established time limit. As regards the substance of the reply by the DPC, however, the EDPB held that even though the DPC later explained that its “cannot comply with the request” answer was a mistake, the DPC “does not state it tried to amend its answer – for instance to provide the reasons for any refusal to comply with the request - or sought assistance to do so within the one-month deadline.” Under [[Article 61 GDPR#4|Article 61(4) GDPR]], the DPC might have refused to comply with the request but it also needed to give reasons explaining that compliance would infringe the GDPR or Member state law. Hence, the EDPB concluded that the DPC failed to provide a substantive reasoned response to the Datatilsynet’s mutual assistance request within one month, thus the urgency could be presumed in accordance with [[Article 61 GDPR#8|Article 61(8) GDPR]].
-.	On the appropriate final measures
+Hence the EDPB concluded that ''“failing to put an end to the processing activities at stake and to enforce the IE SA Decisions exposes data subjects to a risk of serious and irreparable harm”.''
-In its last point, the EDPB considered all the elements brought forward by the DPAs and the nature, gravity and duration of the infringements by Meta in order to assess the appropriateness of a ban on processing as a final measure. In particular, the seriousness of the infringement and the fact that the deadline for compliance had expired three months before, “provide arguments in favour of considering that the imposition of a ban would be appropriate, necessary and proportionate today”. As a consequence, the EDPB ordered a ban on processing of personal data collected on Meta’s products for behavioural advertising purposes on the basis of [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] and [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]], pursuant to [[Article 58 GDPR#2f|Article 58(2)(f) GDPR]], to be effective one week after notification to Meta. The EDPB added that the geographical scope of the measures should extend to the entire EEA.
+Secondly, the EDPB addressed the necessity to derogate from the standard cooperation and consistency mechanism, and it concluded that the fact that the DPC did not adopt any final measures to put an end to Meta’s GDPR infringements despite the risk of serious and irreparable harm for data subjects ''“shows that the regular cooperation and consistency mechanism is not providing satisfactory results”.''
+Thirdly, the EDPB examined whether the legal presumption of urgency provided in [[Article 61 GDPR#8|Article 61(8) GDPR]] was given in the case in question. Under [[Article 61 GDPR#8|Article 61(8) GDPR]], if a DPA does not provide the information requested in a mutual assistance request within one month, urgency will be presumed. In this case, the Norwegian DPA had made such a request but received an unmotivated negative answer from the Irish DPC. The EDPB reiterated the importance of the cooperation mechanism and the fact that mutual assistance is at the core of such cooperation. Further, the authorities receiving a mutual assistance request have a series of procedural and substantive obligations under [[Article 61 GDPR]] to respond to such request. The EDPB also stressed that the mutual assistance request is a one-to-one procedure between the requesting and requested authorities. From a procedural point of view, the EDPB considered that the Irish DPC fulfilled its duty to respond to the request within the established time limit. As regards the substance of the reply by the DPC, however, the EDPB held that even though the DPC later explained that its answer that it could not comply with the request was a mistake, the DPC ''“does not state it tried to amend its answer – for instance to provide the reasons for any refusal to comply with the request - or sought assistance to do so within the one-month deadline.”''
+Under [[Article 61 GDPR#4|Article 61(4) GDPR]], the DPC might have refused to comply with the request but it also needed to give reasons explaining that compliance would infringe the GDPR or Member state law. Hence, the EDPB concluded that the DPC failed to provide a substantive reasoned response to the Norwegian DPA’s mutual assistance request within one month, thus the urgency could be presumed in accordance with [[Article 61 GDPR#8|Article 61(8) GDPR]].
+<u>4. On the appropriate final measures</u>
+In its last point, the EDPB considered all the elements brought forward by the DPAs and the nature, gravity and duration of the infringements by Meta in order to assess the appropriateness of a ban on processing as a final measure. In particular, the seriousness of the infringement and the fact that the deadline for compliance had expired three months before, ''“provide arguments in favour of considering that the imposition of a ban would be appropriate, necessary and proportionate today”''.
+As a consequence, the EDPB ordered a ban on processing of personal data collected on Meta’s products for behavioural advertising purposes on the basis of [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] and [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]], pursuant to [[Article 58 GDPR#2f|Article 58(2)(f) GDPR]], to be effective one week after notification to Meta. The EDPB added that the geographical scope of the measures should extend to the entire EEA.
 == Comment ==