Norway’s data protection watchdog is seeking an extension in the continuing fine it announced against Meta in July. The regulator has forwarded the matter to the European Data Protection Board (EDPB) for a binding decision on whether the penalty should be made permanent and widened to other EU markets.
The EU regulator’s decision could have a significant impact on Meta’s advertising practices across the region. The fine, which amounts to nearly $100,000 a day, was initiated in August over Meta’s violation of personal data of Instagram and Facebook users.
Meta tracked and profiled users for targeted advertising without obtaining informed consent, Norway’s data protection authority, Datatilsynet, had stated. Meta, despite promising to obtain permission in connection with tracking and profiling purposes, has not made any satisfactory progress in the case.
The action was taken in light of the EU’s data protection rules, the General Data Protection Regulation (GDPR). The legislation enables EU markets to implement temporary (three-month) restrictions against tech companies in case of data breaches that require immediate action.
If the penalty is made permanent and extended over to other EU markets, Meta could face a blanket ban on its popular social networking platforms, primarily Facebook and Instagram. The company could also be mandated to obtain explicit user consent before targeting them with personalised ads.
Meta was directed to adopt corrective measures in order to avoid the fine, but it continued running tracking ads in the country, landing the daily $93,000 fine. The company challenged the penalty in court, seeking a temporary injunction against Datatilsynet’s order.
The regulator, however, firmly stood by its decision. It said it would legally defend the fine and that there was no basis for Meta to seek injunction against data breaches committed as a result of its behavioural advertising.
Meta’s arguments were subsequently tossed out of the court, which backed the regulator’s decision to fine the company and require remedial measures regarding targeted ads in the country.
Meta is not respecting the regulator’s decision and continues to violate the data protection law across Europe, Datatilsynet said in a statement. Over 250 million consumers are affected by Meta’s violation of sensitive user data, including tracking of their physical location, according to the watchdog.
“Therefore, it is necessary to get a final decision from the EDPB so that we can force compliance on the European level.”
Meta, on the other hand, expressed surprise over the regulator’s decision to take the matter to the EDPB. “We remain in active discussions with the relevant data protection authorities on this topic via our lead regulator in the EU, the Irish Data Protection Commission, and will have more to share in due course,” a company spokesperson said.
It is not clear, however, how long the EU regulator will take to issue its decision on the Norwegian regulator’s request.
