Norway court upholds miniscule fine against Meta for flouting privacy rules
- Reference: 1694068085
- News link: https://www.theregister.co.uk/2023/09/07/norway_meta_fine/
- Source link:
In July, the data protection agency, known as [1]Datatilsynet , temporarily [2]banned Meta and its Facebook social ad business from serving behaviorally targeted ads within the country, based on litigation in Europe initiated by privacy group None Of Your Business (NOYB) in 2018.
Those cases led to [3]a decision [PDF] in July by the Court of Justice of the European Union (CJEU) that Meta could not bypass consent requirements under the General Data Protection Regulation (GDPR). GDPR applies to the European Economic Area (EEA) in which Norway participates.
[4]
Meta had argued that it obtained consent for targeted advertising when users of its services accepted its terms and conditions, but the CJEU rejected that argument.
[5]
[6]
The Irish Data Protection Commission (DPC), which oversees Meta's Ireland-based EU business unit, then asked various other regulatory bodies to comment on its assessment that Meta Ireland failed to meet GDPR data processing requirements.
Datatilsynet told the DPC it would move to temporarily ban Meta's rule-violating ads. And as of August 14, the Norwegian data agency [7]imposed a fine of one million Kroner (~$93,200) per day on Meta Ireland for failing to comply with its targeted ad ban – up to a maximum of around $8.5 million in fines in total.
[8]
Meta Ireland and Facebook Norway challenged the fine and behavioral ad ban, arguing that the decision is invalid and that Meta was not given sufficient time to respond. Meta also objected to the application of GDPR Article 66, which allows data authorities to enact measures immediately when "there is an urgent need to act in order to protect the rights and freedoms of data subjects."
In its defense, Meta told the Oslo court it would have to suspend Facebook and Instagram services in Norway to comply with the order.
"Behavioral marketing is very widespread and has been going on for many years, including the entire period GDPR has been in effect," explains Meta in its machine translated [9]submission [PDF] to the court.
[10]
The social ad biz noted in its court argument that the social media megalith recently [11]changed its policies to give users more control over how their data gets handled, and thus the urgent action under Article 66 is unnecessary.
And Meta argued it simply could not comply: "In addition, the urgency procedure will interfere with the ongoing process for the [Irish Data Protection Commission] and in practice represent an impossible obligation. The decision entails de facto that Meta Ireland must temporarily stop Facebook and Instagram services in Norway."
The Oslo court was unmoved by Meta's protestations and sided with Datatilsynet.
"We are very pleased with the Court’s ruling and the result," declared Line Coll, director general of Datatilsynet, in [12]a statement . "This is a big victory for people’s data protection rights."
[13]Norway bans Meta's behavioral advertising with threats of wrist-slap fines
[14]Norway to hit Meta with fines over Facebook user privacy from next week
[15]Meta's data-hungry Threads skips over EU but lands in Britain
[16]Google accused of ripping off advertisers with video ads no one saw. Now, the expert view
Meta, unsurprisingly, had the opposite reaction.
"We are disappointed by today’s decision and will now consider our next steps," a Meta spokesperson told The Register in an email. "We have already announced our intention to transition all EU and EEA users to the GDPR legal basis of Consent, and will continue to work with the Irish Data Protection Commission to facilitate this."
Meta must obtain approval from the Irish Data Protection Commission for any consent mechanism it deploys. Meanwhile, Meta's services in Norway continue unchanged, as do the fines, which will be imposed at most until November 3, 2023. As [17]previously noted , the maximum extent of the penalty comes to about $8.5 million at current exchange rates, or about 0.15 percent of Meta's Q1 2023 profit.
The Register asked Datatilsynet whether the agency anticipates further legal resistance from Meta.
"On the one hand, Meta is a notoriously litigious company. Taking legal action against regulators appears to be integral to their business model," Tobias Judin, head of the international section for Datatilsynet responded.
"On the other hand, today's court decision was very thorough and clear. Therefore, we do not know whether Meta will appeal. I think only Meta has the answer to that question." ®
Get our [18]Tech Resources
[1] https://www.datatilsynet.no/
[2] https://www.theregister.com/2023/07/19/norway_meta_advertising_ban/
[3] https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-07/cp230113en.pdf
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZPmfTUlE8pEjAHplsiDamAAAA4w&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZPmfTUlE8pEjAHplsiDamAAAA4w&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZPmfTUlE8pEjAHplsiDamAAAA4w&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/08/08/norway_meta_fines/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZPmfTUlE8pEjAHplsiDamAAAA4w&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.datatilsynet.no/contentassets/4096b3bd53094eb5bf2c184bd6ae4aef/avgjorelse-i-oslo-tingrett-060923_en-unofficial-machine-translation.pdf
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZPmfTUlE8pEjAHplsiDamAAAA4w&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2023/08/02/meta_eu_gdpr_advertising/
[12] https://www.datatilsynet.no/en/news/aktuelle-nyheter-2023/the-norwegian-data-protection-authority-won-against-meta-in-oslo-district-court/
[13] https://www.theregister.com/2023/07/19/norway_meta_advertising_ban/
[14] https://www.theregister.com/2023/08/08/norway_meta_fines/
[15] https://www.theregister.com/2023/07/05/threads_comes_to_uk/
[16] https://www.theregister.com/2023/06/29/google_trueview_skepticism/
[17] https://www.theregister.com/2023/07/19/norway_meta_advertising_ban/
[18] https://whitepapers.theregister.com/
The current few million fine isn't even pocket change for them, more like pocket lint...
...BUT...
I can understand why they are fighting it tooth and nail. If the Norway regulator wins this case, it opens them up to similair litigation from every other data regulator in Europe. And by saying that to comply they have to exit Norway completely, they admit that they basically can't really comply because their whole site is built around data-slurping. Which means that if they come under proper GDPR scrutiny, they are toast.
That's not how law works in most European countries - there is no rule of precedent.
Whether they win or lose in Norway has no bearing on outcomes in other countries.
I think, to keep these arrogant companies in check, fines should start at one penny (or cent or whatever the local currency is) and then double for every day of non-compliance (as in the wheat and chessboard problem). When they realise exactly how much it could cost them, it should focus their attention on rapidly becoming compliant!
T&Cs
"argued that it obtained consent for targeted advertising when users of its services accepted its terms and conditions, but the CJEU rejected that argument."
Good on the CJEU!!
Putting something illegal in the T&Cs does not make it legal.
"We have already announced our intention to transition all EU and EEA users to the GDPR legal basis of Consent..."
Yeah, because GDPR appeared overnight, with absoulutely no warning and it's taking you a bit of time to catch up.
... and it has not been in effect for two years or so. OK, correction. Five f'ing years (since mid 2018)! And it had been decided in 2016 already.
How about filing something like "contempt of the court" or whatever that is called, since they are clearly unwilling to do anything.
As is the Irish DPR which clearly needs to actually start applying the law after all this time.
Fine?
Fine.
So "fine" has become a synonym of cost of doing business.
Also the regulator communicates that privacy laws are just a gimmick and designed so that small players are afraid to breach them, but are up for pickings to the big guys.
Like parking tickets - the poor thinks twice before parking, but the rich doesn't even know they exist as their PA takes care of everything and so they park wherever they want.
Sp. "minuscule"
GDPR works
If only the Irish Data Protection Commission was making its job correctly, rather than siding with megacorps when possible.
I am still waiting for that 4% of global turnover fine. Then I think they might show a willingness for a real change. Everything else has been pocket money for them.