Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Norway: Datatilsynet temporarily bans behavior-based marketing on Facebook and Instagram

The Norwegian data protection authority (Datatilsynet) announced, on July 17, 2023, its decision No. 21/03530-16, as issued on July 14, 2023, in which it prohibited Meta Platforms Ireland Limited and Facebook Norway AS from processing personal data for behavioral advertising purposes, based on Articles 6(1)(b) and 6(1)(f) of the General Data Protection Regulation (GDPR), for a period of 3 months, starting from August 4, 2023.

Background to the decision

The Datatilsynet explained that, on December 31, 2022, the Data Protection Commission (DPC) had issued two decisions, in which it held, among other things, that Meta Platforms Ireland could not rely on Article 6(1)(b) of the GDPR for its processing of personal data for the purposes of behavioral advertising in the context of its Facebook and Instagram services. Accordingly, the DPC ordered Meta Platforms Ireland to bring the processing activities in question into compliance with Article 6(1) of the GDPR within three months. Subsequently, the Datatilsynet reported, the DPC had shared compliance reports and supporting material that Meta Platforms Ireland submitted to it with the data protection supervisory authorities concerned, confirming that Meta Platforms Ireland had shifted its legal basis to Article 6(1)(f) for a number of processing activities. However, on that occasion, the Datatilsynet expressed concerns that Meta Platforms Ireland had failed to show compliance with Article 6(1) and hence with the DPC's order, and that the changes adopted by Meta Platforms Ireland had also led to a violation of Article 21 of the GDPR.

Further to the above, on May 5, 2023, the Datatilsynet formally requested the DPC to impose a temporary ban on the processing of personal data for behavioral advertising purposes by Meta Platforms Ireland, which the DPC did not second.

In addition, the Datatilsynet highlighted that the Court of Justice of the European Union (CJEU) confirmed, in July 2023, that Meta Platforms Ireland cannot rely on Article 6(1)(f) of the GDPR for the processing of personal data for the purposes of personalized advertising, and setting out strict criteria for relying on contract necessity as a legal basis under Article 6(1)(b) of the GDPR.

Findings of the Datatilsynet

The Datatilsynet took the view that the persistent state of non-compliance following the DPC's decision demands immediate action to protect the rights and freedoms of data subjects in the EU. As such, the Datatilsynet imposed a temporary ban on Meta Platforms Ireland's and Facebook Norway's processing of personal data of data subjects in Norway for behavioral advertising, for which Meta Platforms Ireland relies on Articles 6(1)(b) or 6(1)(f) of the GDPR. In this regard, the Datatilsynet specified that the order is addressed to both Meta Platforms Ireland as the data controller, and Facebook Norway as its Norwegian establishment.

Outcomes

In conclusion, the Datatilsynet detailed that the ban applies only with respect to data subjects in Norway and remains valid provisionally for three months, from August 4, 2023, until November 3, 2023. Nonetheless, the Datatilsynet outlined that the order would be lifted before November 3, 2023, if remedial measures are implemented so that adequate and sufficient commitments to ensure compliance with Articles 6(1) and 21 of the GDPR can be provided.

Lastly, the Datatilsynet requested Meta Platforms Ireland and Facebook Norway to confirm compliance with the order by August 4, 2023, highlighting that, in case of failure to comply with the order, it may decide to impose a fine of up to NOK 1 million (approx. $99,578) per day of non-compliance on Meta Platforms Ireland and/or Facebook Norway, individually or collectively.

You can read the press release, only available in Norwegian, here and the decision here.

Update: August 9, 2023

Datatilsynet warns fines will be imposed if Meta fails to comply with processing ban

The Datatilsynet announced, on August 8, 2023, that, the day before, it had decided to impose a fine of NOK 1 million (approx. $97,857) per day, starting from August 14, 2023, if Meta fails to comply with the behavior-based marketing ban.

Background to the decision

In particular, the Datatilsynet explained that, following the decision of July 17, 2023, Meta filed a petition with the Oslo District Court for a temporary injunction against the ban. Further to this, the Datatilsynet highlighted that Meta had confirmed its intention to look at how it can align its operations with the indications of the Datatilsynet in the future, but had still not stopped the illegal activity.

Findings of the Datatilsynet

As such, the Datatilsynet made the decision to impose a fine of NOK 1 million (approx. $97,857) per day, starting from August 14, 2023, should Meta fail to comply with the ban.

Outcomes

In conclusion, the Datatilsynet indicated that the District Court is expected to decide on the case in August, and confirmed that, should the petition be granted, Meta will not be required to comply with the ban pending a full trial.

You can read the announcement, only available in Norwegian, here.

Update: September 6, 2023

District Court upholds Datatilsynet's temporary ban

The Datatilsynet announced, on September 6, 2023, that the District Court issued a ruling rejecting Meta's and Facebook Norway's petition for a temporary injunction against the the behavior-based marketing ban.

Background to the case

Following the decision of July 17, 2023, Meta and Facebook Norway filed a petition with the District Court for a temporary injunction against the ban, alleging that the decision of July 17, 2023 was invalid due to a lack of advance notice and that the Datatilsynet did not have the authority to make an emergency decision.

Findings of the District Court

Further to the above, the District Court held hearings on August 22 and 23, 2023, and upheld the decision of July 17, 2023, finding no grounds to stop the same.

Outcomes

Notably, the Datatilsynet highlighted that it is considering bringing the matter to the European Data Protection Board (EDPB) to extend the ban to the entire EU/EEA, and explained that the process is currently ongoing.

You can read the press release here and the ruling here, both only available in Norwegian.

Update: September 29, 2023

Datatilsynet requests binding decision on its temporary ban on behavior-based marketing on Facebook and Instagram

On September 28, 2023, the Datatilsynet requested the European Data Protection Board (EDPB) provide a binding decision regarding its temporary ban on behavior-based marketing on Meta Platforms Ireland's Facebook and Instagram services. 

The Datatilsynet specifically requested that the Norwegian temporary ban on behavior-based marketing on Facebook and Instagram be made permanent and extended to the entire EU/EEA, noting that Meta continues the illegal activities and has not yet adjusted to the decision. 

Notably, the Datatilsynet highlighted that Meta disagreed with the matter being raised to the European level, asserting, among other things, that the Datatilsynet's decision was invalid and more generally questioning the Datatilsynet's authority to request a binding decision from the EDPB.  

Meta further stated it would soon ask users for consent before using personal data for behavior-based marketing.  

You can read the press release, only available in Norwegian, here

Update: October 26, 2023

EDPB to discuss urgent binding decision regarding Meta in 86th plenary meeting

The EDPB published, on October 25, 2023, the agenda for its 86th plenary meeting, which will take place on October 27, 2023. The agenda notes that the EDPB will discuss the urgent binding decisions requested by the Datatilsynet for the ordering of final measures regarding Meta. 

You can read the agenda here.

Update: October 26, 2023

Meta asks Oslo District Court to annul Datatilsynet's ban on behavior-based marketing

On October 25, 2023, the Datatilsynet announced that Meta had requested the Oslo District Court to annul the Datatilsynet's decision to ban behavior-based marketing on Facebook and Instagram.

You can read the press release, only available in Norwegian, here.

Feedback