DPA case Binding Decision 2/2022 – Order (European Union, 2022)

The DPC had conducted an investigation into Meta, specifically into Instagram. The DPC focused its investigation on two aspects. First: displayed information on business accounts of child users and second: default settings of newly created Instagram accounts. Based on this investigation, the DPC formulated a draft decision under Article 60(3) GDPR. Processing of contact information on child user’s business accounts The DPC held that Instagram permitted child users to switch from personal accounts to business accounts. During this switch from personal to business account, the child user was presented with an option screen (titled “Review Your Contact Info”). This screen was automatically filled with the user’s information, which was collected at the time of registration. The child user had the opportunity to modify this information. However, in order to complete switching process from personal- to business account, the child user also had to provide an email address or a phone number (contact information). Before September 2019, the phone number and e-mail were published on the respective user page in the form of a contact button. These contact details were not encrypted and visible in plain text. Since 4 September 2019, an updated version of this option screen was presented, with possibilities to modify contact details. Also, the user could choose not to provide any contact details at all. Before march 2019, the contact details of child users were also visible as plain text in the HTML source code of the web-version of Instagram. Also, for a time between August 2020 and November 2020, e-mail addresses of Instagram business accounts were visible in the HTML source code of the Instagram website as plain text, including to persons not registered as Instagram users. According to the DPC, by registering for a personal Instagram account, a data subject had to agree to the Instagram Terms of Use. The DPC held that Meta used two legal grounds in these terms o