The Norwegian Data Protection Authority won over Meta in court
Behavioural marketing is one of the most invasive uses of personal data that takes place and is often perceived as private surveillance of those affected.
"Yesterday's ruling from Oslo District Court, which, for now, upholds the decision to impose a compulsory fine of NOK 1 million per day against Meta, Facebook's owner, helps put an end to this surveillance," says Bull partner and privacy expert Kristian Foss.
"With the decision, which originally originated in Max Schrem's NOBY complaint from 2018, the Data Protection Authority shows impressive vigor." he adds.
The decision could have consequences for advertisers, who now need to consider more carefully whether they can legally continue with their advertising. If advertisers are regarded as joint controllers, for which we have some judgments from the European Court of Justice, advertisers are also obliged to have a legal basis for processing.
What is the case about?
The case concerns the legal basis for the processing. Meta had assumed that the processing was necessary for the performance of an agreement (GDPR. art. 6(1)(b). After the Irish Data Protection Authority decided that this basis for processing did not hold, Meta changed the basis to legitimate interest (art. 6(1)f). On Tuesday 4 July this year, the European Court of Justice ruled (in case C-252/21) that legitimate interest could not be a legal basis either. The Norwegian Data Protection Authority then struck with its emergency decision on 14 July. Meta responded that the company could switch to consent as a legal basis (Art. 6(1)(a), but that it would take three months to prepare technically.
And this is the core of the contention lies: The Data Protection Authority believed Meta could easily turn the consent function on, and upheld its decision. Thus, Meta filed for a preliminary injunction to temporarily halt the decision. This is the lawsuit Meta lost in Oslo District Court. In short, the reason was that the financial and reputational consequences of complying with the decision had not been substantiated. In a somewhat original turn suggesting an clever judge, the positive aspects of the reputation of complying with the ruling are highlighted, without it being invoked by either party.
Whether the decision to impose a penalty was invalid will be finally settled in a regular lawsuit later, so just keep an eye on the continuation.
A stricter board responsibility for cyber security
The board is responsible for proper organization of the company, which also means that both the General manager and b...
Read moreBull brings in artificial intelligence expertise
We have the pleasure of welcoming Christian Bendiksen as new Bull partner. Christian is highly specialised within artificial intelligence.
Read moreThe Legal 500 highlights a record number of Bull profiles
Bull is assigned good ratings in several specialties in The Legal 500's latest overview. This year's recommendations also include several new individuals.
Read more
How can we help?
In need of legal assistance? Call or email us, and we'll figure out how we can help.