The European Court of Justice has ordered Ireland's Data Protection Commission (DPC) to increase its vigilance over the collection of personal data in Europe by Meta, the parent company of Facebook, WhatsApp, and Instagram.
The Irish regulator oversees Meta for the EU because the company’s regional headquarters is in Ireland. However, the European Data Protection Board (EDPB) can assert itself as the top authority in some cases.
The two sides have been at odds in recent years over Meta’s compliance with the General Data Protection Regulation (GDPR), which has governed data processing in the EU since 2018.
On Wednesday, the EU Court, based in Luxembourg, supported the EDPB by rejecting DPC challenges to three of its decisions.
The court stated in a press release that EDPB can issue binding instructions to the lead supervisory authority, the DPC, to conduct more thorough investigations and adopt new decisions if there are gaps or insufficient analysis in the initial decision.
The case was sparked by complaints from three citizens from Belgium, Germany, and Austria, supported by the NOYB ('None of your business') association, led by Austrian lawyer Max Schrems, about data collection practices by Facebook, Instagram, and WhatsApp.
The complainants argued that these practices violated the GDPR, particularly concerning targeted advertising and the lack of user consent.
The DPC issued its initial opinion, which was then reviewed by other regulatory authorities in the EU. A lack of consensus led to the EDPB’s intervention, and some of its 2022 decisions were contested by the Irish authority.
“We are pleased with the court’s decision to dismiss the DPC’s claims, but it also means the case is back to square one,” commented Max Schrems, a prominent data protection advocate. He noted that the matter would now return to the Irish judges and that a final decision could take years.
