Warning to CSPs going OTT
The sanctions imposed on Facebook and Instagram publisher Meta could have important implications for anyone publishing mobile internet content, a top technology regulations lawyer has warned. This week Europe’s data protection authorities hit Meta Platforms Ireland with a €390 million ($414m) fine for unlawfully relying on contractual agreements with Facebook and Instagram users.
The social media sites collected their subscribers’ personal information to serve them targeted advertising. Meta’s advertising delivery system has drawn the ire of the privacy protectors to the whole mobile data sector.
“This is very bad news for Meta indeed,” said Eddie Powell, Partner and leading tech and regulatory lawyer at City of London legal firm Fladgate. The Irish data protection commission (DPC) was always going to fine Meta for lack of transparency, said Powell, because it was not being clear with users about the legal basis on which personal data was used.
However, the DPC was overruled by the EU, which determined that Meta’s practice of forcing users to accept personalised ads as part of the Facebook or Instagram service contract, was an additional breach of GDPR. As a result, the DPC has increased its fine to against Meta.
Less attractive to advertisers
The muti-million euro fine will be minimal collateral damage to a company the size of Facebook, but there is a line in the sand for all companies wishing to exploit their mobile data ‘communities’. “The order that Facebook and Instagram users cannot be forced to accept their data being used to serve personalised ads must massively reduce the platforms’ attractiveness to advertisers,” said Powell, “too many users are likely, if given a choice, to decline personalised ads.”
Joe Jones, the new Director of Research and Insights at the International Association of Privacy Professionals (IAPP), warned the DPC’s decisions could be “hugely consequential” for content and communications services providers. “The decisions may serve as a multi-million dollar reminder of the importance of clarity and transparency when giving notice on how personal data will be used,” said Jones. It sheds light on the parameters for their reliance on different legal bases for the processing of that personal data, he said.
According to Reuters, Meta said it will appeal both the substance of the rulings and the fines, and that the decisions do not prevent personalised advertising on its platforms. The order on personalised advertising related to a 2018 change in the terms of service at Facebook and Instagram following the introduction of new EU privacy laws where Meta sought to rely on the so-called “contract” legal basis for most of its processing operations.
Having previously relied on the consent of users to the processing of their personal data for targeted advertising, the DPC said Meta instead considered that a contract was entered into upon acceptance of the updated 2018 terms and that this made such advertising lawful.
“We want to reassure users and businesses that they can continue to benefit from personalised advertising across the EU through Meta’s platforms,” said a Meta statement. The penalties brought the total fines levied against Meta to date by the Irish regulator to €1.3 billion. It currently has 11 other inquiries open into its services.