Apoteket AB – €3,256,000 Fine (Sweden, 2024)

A Swedish pharmacy company - Apoteket AB (the controller) was using [https://www.facebook.com/business/tools/meta-pixel the Meta pixel] for marketing purposes since 2017. The purpose of the pixel was to measure the controller’s marketing activity within Facebook and Instagram and additionally to promote controller’s products to visitors of certain pages (self-care product category). By default, the controller disabled the pixel within the part of the website dedicated to the prescription goods. At the same time, the pixel collected the data about other products offered by the controller, in particular products to treat variety of disorders (for example allergy or stomach disorder) or sexual wellness products. In 2020, an employee of controller, acting without the authorisation or knowledge of the controller, activated [https://developers.facebook.com/docs/meta-pixel/advanced/advanced-matching/ Advanced Matching] function of the pixel. The employee was one of three employees managing the pixel within the controller structure. As a result, the controller was provided with supplementary data, which was not necessary for the purposes of data processing, as the pixel collected more data referring to the customers. Additionally, the additional data was transferred to Meta. When a customer made a purchase with the controller, Meta received hashed data related to the customer, namely the contact data, name and surname, social security data, address data. Meta was then able to match the data with Facebook user ID and eventually deleted the hashed data. The estimated number of data subjects affected by the incident was up to 930,000. As soon as the controller identified the new settings of the pixel (2022), they disabled the Advanced Matching function. The controller requested Meta to delete the data collected via the pixel. Meta explained they already deleted the data older than two years and regarding newer data, Meta claimed to be unable to delete them manually. Additi