The Norwegian Data Inspectorate has temporarily banned Meta Ireland and Facebook Norway from processing personal data for behavioral marketing on Facebook and Instagram, citing non-compliance with GDPR. This decision, effective from 4 August 2023 for three months, could extend if Meta fails to align with legal standards, risking a daily fine of up to one million NOK. The ban, rooted in a broader legal dispute over Meta’s data practices, underscores Norway’s stringent stance on data protection and privacy, potentially setting a precedent for regulatory actions across Europe.
Facts
Meta Ireland based in Dublin is a party to agreements that provide the services Facebook and Instagram to users in Norway and the rest of Europe and is also the data controller for the processing of users’ personal data for the purpose of providing Facebook and Instagram. Facebook Norway AS is a Norwegian limited liability company. The company is a subsidiary of Facebook Global Holdings II LLC, which in turn is a subsidiary of Meta Platforms Inc.
The dispute in this case is part of a comprehensive complex of cases relating to the legality of Meta Ireland’s processing of personal data for behavioral marketing under Article 6 (1) of the General Data Protection Regulation (Regulation (EU) 2016/679 – General Data Protection Regulation – GDPR).
The dispute is based on the complaints as submitted by NOYB (Max Schrems) to the Austrian Data Protection Authority back in May 2018 1. The original complaint cases concerned the processing of personal data for behavioral marketing through the services Facebook and Instagram. The complaints were processed by the Irish Data Protection Commission (DPC) because it is a cross-border processing and Meta Ireland has its main activities in Ireland, cf. Art. 4 (23) GDPR cf. Art. 56 GDPR. The DPC dealt with the complaints in accordance with the cooperation mechanism pursuant to Art. 60 GDPR and, on 6 October 2021 (regarding the service Facebook) 2 and 1 April 2022 (regarding the service Instagram), sent out draft decisions in the cases of the supervisory authorities concerned, including the Norwegian Data Protection Authority. No agreement was reached between the DPC and the various supervisory authorities on all the issues raised by the complaints, and the DPC therefore submitted some of the questions to the European Data Protection Board (EDPB), cf. Art. 65 GDPR.
On 5 December 2022, the EDPB made decisions on the issues related to the relevant services Facebook 3 and Instagram 4. The decision regarding the service Facebook states that the complaint concerns the question of whether there was a breach of the specified provisions of the GDPR and the EU Charter of Fundamental Rights in that Meta Ireland built the processing of personal data on forced consent (“forced consent”).5 In the decisions, among other things, it was assumed that the processing of personal data for behavior-based marketing could not be based on Art. 6 (1) b GDPR 6.
On 31 December 2022, the DPC found that Meta Ireland could not base its processing of personal data for the purpose of behavioral marketing on Art. 6 (1) b) GDPR.7 Meta Ireland was given a deadline of three months to correct the matter and at the same time subjected to substantial fines/benefits.8
During the next months, Meta Ireland stated it would change its legal basis for behavioral marketing from Art. 6 (1) b) to Art 6 (1) f) GDPR. The Norwegian Data Inspectorate addressed the DPC in an e-mail on 5 April 2023 requesting DPC’s view of Meta Ireland’s change of processing basis for behavioral marketing from Art. 6 (1) b) to Art. 6 (1) f) GDPR. Following this, the DPC forwarded Meta Ireland’s own reports on how the company planned to meet the requirements that DPC had set for behavior-based marketing. The Norwegian Data Protection Authority also requested the DPC to issue a temporary ban which stated that Meta Ireland could not base its processing of personal data for the purpose of behavioral marketing on GDPR Art. 6 (1) f) GDPR. If the DPC were not to follow up on the request, the Norwegian Data Inspectorate notified that it would consider taking temporary measures in Norway pursuant to Art. 66 (1) GDPR. On 9 June 2023, the Norwegian Data Inspectorate requested a response from the DPC to whether the Norwegian Data Protection Authority’s request for a temporary ban would be followed. The request was not answered. In request of 13 June 2023 to the other relevant supervisory authorities, the DPC informed that it would await the decision of the Court of Justice of the European Union (CJEU) in Case C-252/21 Facebook Inc. and Others v. Bundeskartellamt before deciding whether Meta Ireland could base the processing of personal data in connection with behavioral marketing on Art. 6 (1) b) or f) GDPR. On 4 July 2023, the CJEU issued its judgment in case C-252/21 9 which concluded that the provision of Art. 6 (1) f) GDPR could not constitute a legal basis for the processing of personal data for behavioral marketing purposes. 10
The DPC then sent out a new preliminary assessment on 11 July 2023, in which the relevant regulatory bodies were invited to comment on the DPC’s assessment that Meta Ireland did not process the personal data in accordance with GDPR legislation. Furthermore, the DPC informed that it would communicate the views of the supervisory bodies to Meta Ireland by 4 August 2023, and that the DPC would finalize its assessments by 21 August 2023.
In the Norwegian Data Protection Authority’s e-mail on 14 July 2023, the DPC was informed that the Norwegian Data Protection Authority would decide on the same day temporary measures against Meta Ireland in Norway. In a decision on the same day, the Data Protection Authority decided that Meta Ireland and Facebook Norway could not base the processing of personal data for behavioral marketing on the provisions of Art. 6 (1) b) or f) GDPR 11.
It is stated in the decision that it applies to registered persons in Norway and that the order should have a duration of three months. At the same time, it was informed that the ban would be lifted if Meta Ireland and Facebook Norway took measures to ensure that the processing was in accordance with Art. 6 (1) and 21 GDPR. It was further announced that the Norwegian Data Protection Authority would consider imposing on Meta Ireland and Facebook Norway a forcible fine of up to one million kroner per day, collected or separately, if Meta Ireland and Facebook Norway did not comply with the ban.
Meta Ireland and Facebook Norway appealed in a letter of 1 August 2023, the Norwegian Data Protection Authority’s decision on 14 July 2023. The letter stated:
– that the decision was invalid, and the decision was requested to be reversed;
– a request for a postponed implementation as long as the Data Inspectorate or the Ministry processes the complaint; and
– a notification that the companies would file an application for temporary injunction if the decision was not reversed or postponed implementation was not made no later than 3 August 2023. In a letter of 3 August 2023, the Data Inspectorate rejected the appeal and refused to reverse the decision on 14 July 2023.
Meta Ireland and Facebook Norway submitted on 3 and 4 August 2023 petitions for a temporary injunction to Oslo District Court. In the petitions, demands were made that the Data Protection Authority should be prohibited from implementing the decision of July 14, 2023, against Meta Ireland and Facebook Norway.
The Data Protection Authority decided on 7 August 2023, to impose a joint coercive fine on Meta Ireland and Facebook Norway (as jointly liable) for failing to comply with the decision of July 14, 2023. The coercive fine started to accrue from August 14, 2023, and amounted to one million kroner for each day that passes without the prohibition being complied with.
Joint oral hearings for both cases were conducted in the Oslo District Court on August 22 and 23, 2023 12, 13.
Held
In summary, the Oslo District Court found that “there is no legal basis for granting a temporary injunction, either under paragraph a) or b) of Section 34-1 of the Civil Procedure Act, and therefore, the request for temporary injunction was not accepted”. The District Court raised the question of whether a principal claim had been established. However, the District Court only briefly and in a more overview-like manner commented on the most central arguments presented by the plaintiffs related to the principal claim. The assessments must be viewed in light of the fact that the court determined that the petitions did not succeed because there was no legal basis (no reason for urgency) for granting a temporary injunction. The attention given to the principal claim must also be viewed in connection with the fact that this concerns an injunction case where the parties needed a swift resolution.
According to Norwegian Civil Procedure Act (Tvisteloven) (’Civil Procedure Act’), for a plaintiff to succeed in obtaining a temporary injunction, the plaintiff must typically establish both a main claim (hovedk rav) and a reason for urgency (sikringsgrunn). No exceptions apply to the need for such establishing of urgency.
The principal claim in this case was that the Data Protection Authority’s decision of 14 July 2023, was invalid. However, the fine was based on the non-compliance with the July 14 decision. If the July 14 decision was held to be invalid, the District Court believed there would be no basis for enforcing the fines, eliminating the need for separate assessments of the validity of the two decisions.
The District Court considered first whether urgency had been sufficiently demonstrated. The plaintiffs argued that urgency could be established based on two different subsections of the Act, Section 34-1 paragraph a) and b).
No reason for urgency
The District Court discussed whether Meta Ireland and Facebook Norway had sufficient grounds to request a temporary injunction to halt the execution of the decision from Norway’s Data Protection Authority (“Datatilsynet”). In Norway, the law requires two main conditions for granting a temporary injunction: a principal claim and a justifying reason (“sikringsgrunn”). The Court concluded that neither Meta Ireland nor Facebook Norway had demonstrated a justifying reason (“sikringsgrunn”) under Section 34-1 of the Act.
As mentioned, the decision from the Data Protection Authority was related to violations of GDPR, and the Court analyzed whether failing to comply with this decision would lead to significant damage or disadvantage to the companies, which would justify a temporary injunction. The Court stated that it was held to be unclear whether the companies would suffer any financial or reputational damage from the Data Protection Authority’s decision. Also, any such damage would likely be temporary and could be compensated. And even if they did face such damage, it would not be severe enough to justify a temporary injunction.
Did the defendant’s actions significantly complicate the claim?
According to the second provision under section 34-1 paragraph a) Civil Procedure Act, a temporary injunction may be necessary if the defendant’s actions significantly complicate the claim. In this specific case, the principal claim (“hovedkravet”) was that the decision by the Data Protection Authority is invalid. The request for a temporary injunction (“forføyningskravet”) aims to make the decision ineffective until there is a legally binding judgment on the matter. The Court found that the request for a temporary injunction essentially preempts the principal claim, which disqualifies it under Section 34-1, paragraph a) Civil Procedure Act. Furthermore, the Court concluded that there is no need for temporary injunction because the plaintiff’s ability to pursue or implement the claim would not be complicated if the injunction is not granted.
The Court also discussed whether the decision’s time limitation of three months could complicate matters. It was suggested that the plaintiffs might not have enough time to legally challenge the decision before it expires. However, the Court concluded that it is not “necessary” for temporary protection of the claim, as the plaintiffs still have the option to sue for damages or other economic loss, even after the decision’s time limitation expires.
In summary, the Court found that there is no legal basis for granting a temporary injunction, either under paragraph a) or b) of Section 341 Civil Procedure Act, and therefore, the request for temporary injunction was not accepted.
Was a principal claim established?
Even though the District Court found that there was no legal basis for granting a temporary injunction, ref above, the Court did comment on the most central arguments presented by the plaintiffs related to the principal claim:
i) Could the order be directed against Facebook Norway AS?
Meta Ireland and Facebook Norway claim that the order, which prohibits the processing of personal data for behavior-based marketing – cannot be applied to Facebook Norway, as they are not defined as data controllers under the GDPR. In the decision dated 14 July 2023, it was determined that the mandate should also apply to Facebook Norway because they are considered an establishment of Meta Irland. The reason for this decision is the necessity to ensure compliance, and that Facebook Norway contributes to the unlawful processing activity in Norway.
It is agreed that Facebook Norway does not determine the purpose or means for the processing of data and that the company is not a subsidiary of Meta Ireland. Facebook Norway is primarily involved in the sales and dissemination of digital advertising on Facebook and Instagram. The Norwegian Data Inspectorate argues that Facebook Norway, as a contracting party in agreements with advertisers, should be subject to the same restrictions as Meta Ireland. The Court refers to Art. 61 No. 8 GDPR and Article 66 No. 1 GDPR, which do not clearly define whether measures can be directed at companies that are not data controllers.
The Norwegian Data Inspectorate also refers to a judgment of the CJEU (C-210/16 Wirtschaftsakademie Schleswig-Holstein 14) indicating that measures can be directed at an establishment like Facebook Norway, even if they themselves are not data controllers, as long as the processing of data that takes place is within the scope of their activities. The Court finds this case to be parallel and based on the CJEU’s decision in case C-645/19, the Court found that the crucial point here is whether the measure concerns processing carried out within the scope of the activities of the establishment. In both judgments, the CJEU assumed that the activity undertaken by the establishments related to marketing, etc., is closely linked to – or constitutes an integral part of – the operations of Facebook Ireland.
Overall, the discussion revolves around whether Facebook Norway, given its role and activities, can be subjected to restrictions and mandates in accordance with the GDPR, even if they technically are not defined as data controller. The Court found that the order could be directed against Facebook Norway.
ii) Were the conditions for urgent measures pursuant to GDPR Art. 61 (8) or Article 66 (1) met?
In the decision of 14 July 2023, the Norwegian Data Inspectorate referred to Art. 66 (1) GDPR as the basis for the decision to take urgent measures. Subsidiary grounds are referred to as Art. 61 (8) GDPR.
The question is whether there were extraordinary circumstances that required immediate action to protect the rights and freedoms of data subjects. The wording in Art 66 (1) GDPR suggests that it would take a lot for the exception provision to apply. The Court referred to the use of the words “exceptional”/“exceptionnelles”/außergewöhnlichen” and the phrases “urgent need”/“urgent d’intervenir”/“dringender Handlungsbedarf”, in conjunction with Recital 137 GDPR, where it is pointed out that there might be grounds for taking urgent measures where there is a risk that the enforcement of registered rights could be significantly impeded. The Court assumed that the exception provision should be applied restrictively.
The plaintiffs argued that the provision of Art. 66 (1) GDPR does not apply because the decision was not urgent. Among other things, it had been shown that the case is being processed by the leading audit (DPC), that the Norwegian Data Inspectorate has not objected to the DPC’s procedures for processing, that behavior-based marketing is common practice and has been considered legal for a long time, and that it does not matter that the Norwegian Data Inspectorate has the ability to act faster than the DPC. The Court found these arguments to be valid, especially when the illegal behavior is extensive, invasive and concerns large groups. In a situation where it is uncertain where the further threshold for applying the exemption provision lies, the Court – under considerable doubt – concluded that the conditions of Art. 66 (1) GDPR for taking urgent measures had been met.
iii) The entries
Meta Ireland and Facebook Norway further claimed that the decision is disproportionate, unclear, impossible to comply with, in violation of other legislation (including ECHR) and that it has already been fulfilled.
In the District Court’s view, none of these statements could be heard. When assessing whether the decision was disproportionate, the District Court stated that the question in this case is not whether the processing in question is legal or whether Meta Ireland and Facebook Norway will comply with the decisions. Both companies have confirmed that they will follow the order to change the processing basis.
The court agrees with the Norwegian Data Inspectorate that it cannot be considered disproportionate to impose the cessation of an illegal activity.
Comments
The Norwegian Data Protection Authority won in the initial round, but it’s likely that the final verdict is yet to come. It may not be ruled out that Meta will appeal, especially because the conclusion that the conditions for the temporary injunction were met have been handed down under strong doubt.
It is also important to note that the District Court Oslo has not considered the validity of the Data Protection Authority’s urgent decision from 14 July 2023.
The Norwegian ban following the urgent decision from 14 July 2023, expires on 3 November 2023. The Norwegian Data Protection Authority stated on 28 September 2023, that they have forwarded a request for a binding decision to the European Data Protection Board. In the request, they ask that the Norwegian temporary ban on behavioral advertising on Facebook and Instagram be made permanent and extended to the entire EU/EEA. Meta disagrees with the referral to the EDPB and argues not only that the urgent decision from July is invalid, but also that the Data Protection Authority lacks legal basis for requesting such binding decision from the EDPB.
Meta has stated that it will switch to consent as a legal basis for processing personal data for behavioral marketing in November 2023. Until Meta changes its legal basis, the practice is banned, at least when personal information about Norwegian citizens is used for behavioral marketing. The Norwegian Data Protection Authority states that it does not ban personalized advertising on Facebook or Instagram as such. The decision does not, for example, stop Meta from targeting advertising based on information a user put in their bio, such as place of residence, gender and age, or based on interests a user has provided themselves. Nor does the decision stop Meta from showing behavioral advertising to users who have given valid consent to it.
In a national context, we see businesses that use behavioral marketing services on Facebook or Instagram are reviewing their use of the services until Meta has changed its legal basis for consent. Marketing that is not considered behavioral advertising is still allowed. The procedure at EDPB to extend the prohibition to the whole EEA and with an unlimited duration, has not yet started.
_______
Note
1 https://noyb.eu/sites/default/files/2020-05/complaint-facebook.pdf.
2 https://noyb.eu/sites/default/files/2021-10/IN%2018-5-5%20Draft%20Decision%20of%20the%20IE%20SA.pdf.
3 EDPB, Binding Decision 3/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its Facebook service (Art. 65 GDPR), 5 December 2022, available at: https://edpb.europa.eu/system/files/2023-01/edpb_bindingdecision_202203_ie_sa_meta_facebookservice_redacted_en.pdf.
4 EDPB, Binding Decision 4/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its Instagram service (Art. 65 GDPR), 5 December 2022, available at: https://edpb.europa.eu/system/files/2023-01/edpb_binding_decision_202204_ie_sa_meta_instagramservice_redacted_en.pdf ; see also https://edpb.europa.eu/news/news/2022/edpbadopts-art-65-dispute-resolution-binding-decisions-regarding-facebook-instagram_en.
5 EDPB, Binding Decision 3/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its Facebook service (Art. 65 GDPR), 5 December 2022, at para. 3.
6 EDPB, Binding Decision 3/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its Facebook service (Art. 65 GDPR), 5 December 2022, at para. 448 and 449; EDPB, Binding Decision 4/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its Instagram service (Art. 65 GDPR), 5 December 2022, at para. 451.
8 EDPB, Binding Decision 3/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its Facebook service (Art. 65 GDPR), 5 December 2022, at para. 484; EDPB, Binding Decision 4/2022 on the dispute submitted by the Irish SA on Meta Platforms Ireland Limited and its Instagram service (Art. 65 GDPR), 5 December 2022, at paras. 417 and 418.
9 https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-07/cp230113en.pdf.
10 CJEU, decision of 4 July 2023 in case C-252, CRi 2023, p. 115 (p 122 at paras. 116 and 117).
14 https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62016CJ0210.
