Meta Ireland – Court Ruling (Norway, 2024)

On 31 December 2022, the Irish DPA (“DPC”) prohibited Meta Ireland from using a contract under Article 6(1)(b) GDPR as a legal basis for behavioural advertising in connection with the Facebook and Instagram services. Meta Ireland was required to bring its processing activities related to behavioural advertising into compliance with Article 6(1) GDPR within three months. Meta Ireland responded by changing its processing basis to legitimate interest under Article 6(1)(f) GDPR. On 5 May 2023, the Norwegian DPA (“Datatilsynet”) requested under Article 61(1) GDPR the DPC to introduce a temporary ban on Meta Ireland’s processing of personal data for purposes related to behavioural advertising. The Datatilsynet held that legitimate interest was not a proper legal basis, either. The DPC did not comply with the request. On 14 July 2023, the Norwegian DPA issued a temporary ban themselves against the controllers Meta Ireland and Facebook Norway under Article 66(1) GDPR in combination with Article 58(2)(f) GDPR (see summary of the DPA's decision here). This only concerned processing activities in Norway. The DPA also stated its intention to request an urgent binding decision from the EDPB under Article 66(2) GDPR. On 3 and 4 August 2023, Meta Ireland and Facebook Norway applied for a temporary injunction against the DPA's decision, demanding that the DPA would be prohibited from implementing the decision. The Oslo District Court issued a ruling on 6 September 2023 and concluded that there was no probable cause for temporary injunction and dismissed the cases. The court also found that the conditions had been met under Article 66(1) GDPR for making an urgent binding decision. The deadline for compliance with the ban was 4 August 2023, however, Meta Ireland and Facebook Norway did not comply. Therefore, on 7 August 2023, the DPA issued a penalty of €86,992.56 (NOK one million) per day for failure to comply with the decision of 14 July 2023 based on §29 of the Norwegian Person