Legitimate Interest. On 4 July 2023, the CJEU published its judgment in the Meta v. Bundeskartellamt case.1304 Among other questions related to Meta’s OBA practices, the CJEU considered whether Meta could rely on Article 6(1)(f) GDPR to process consumers’ personal data for OBA. The court echoed the earlier guidance of the EDPB that the legitimate interest clause under Article 6(1)(f) GDPR requires that the processing of personal data meets three cumulative conditions:1305 (i) the publishers have a legitimate purpose; (ii) processing of personal data is necessary to meet this purpose (“necessity test”); and (iii) this purpose is balanced against the consumers’ interests and fundamental rights (“balancing test”).1306 The CJEU evaluated the case based on these criteria and established that Meta’s reliance on Article 6(1)(f) GDPR for OBA was not compliant with the GDPR.1307 Regardless of the CJEU judgment in the Meta v. Bundeskartellamt case, Meta continued to process behavioral data on the ground of the “legitimate interest”.1308 On 14 July 2023, the Norwegian DPA introduced “urgent and provisional measures” against Meta, banning the company’s OBA practices for three months within Norway.1309 It also referred the issue to the EDPB, which on October 27, 2023 decided to extend the ban on Meta’s OBA practices across the EU.1310 The Norwegian DPA conducted a thorough analysis of Article 6 (1)(f) GDPR based on the three conditions (legitimate purpose, necessity, and balancing test), which can be 1303 See How Meta Uses Legal Bases for Processing Ads in the EU, META, supra note 210. 1304 Case C‑252/21, Meta v. Bundeskartellamt, supra note 1017. 1305 Id. at 106. 1306 ARTICLE 29 DATA PROTECTION WORKING PARTY, Opinion 06/2014 on the Notion of Legitimate Interests of the Data Controller under Article 7 of Directive 95/46/EC (WP217), (2014). See ▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇, supra note 1210 at 167–170. (1) of the GDPR.”) 1308 Norwegian Data Protection Authority (Datatilsynet) Urgent and Provisional Measures - Meta 21/03530-16 (Jul. 14, 2023) (No.), ▇▇▇▇▇://▇▇▇▇▇▇▇▇.▇▇/akEIR (last visited Jul 20, 2023). 1309 Id. 1310 See European Data Protection Board Press Release. “EDPB Urgent Binding Decision on processing of personal data for behavioral advertising by Meta”, 1 November 2023. ▇▇▇▇▇://▇▇▇▇.▇▇▇▇▇▇.▇▇/news/news/2023/edpb-urgent-binding-decision-processing-personal-data- behavioural-advertising-meta_en Norway is not a Member State of the EU, but is a member of European Economic Area. The GDPR applies to Norway, and NO DPA is a member of the EDPB. extrapolated to apply to all digital service providers that would like to rely on Article 6(1)(f) for engaging in OBA.
Appears in 2 contracts