Article written by Haim Ravia and Dotan Hammer
Facebook is not necessarily required to obtain separate consent for the processing of personal data for personalized ads, the Irish Data Protection Commissioner (DPC) has provisionally ruled in a draft decision in the matter of LB v Facebook Ireland.
The decision was drafted following a complaint by an Austrian Facebook user who alleged that Facebook breached its obligations under the GDPR both by not obtaining her express consent to process her data for ad purposes and by not transparently disclosing its data processing practices.
In a 96-page decision, the Irish regulator found that the users’ consent to Facebook’s terms of use constitutes a contractual obligation for Facebook, on which it may be able to rely as a lawful basis for processing personal data for ad purposes. The DPC found that because users are aware that personalized advertisement is at the core of Facebook’s service, Facebook is not obligated to obtain their separate consent for this processing.
The DPC found, however, that Facebook has breached its transparency obligations under the GDPR. It found that Facebook’s privacy policy does not sufficiently describe which data it processes, how it processes it, and under which lawful basis.
CLICK HERE to read the Data Protection Commissioner’s Draft Decision on the matter of LB v Facebook Ireland Ltd.
