The Norwegian Data Protection Authority won over Meta in court

Behavioural marketing is one of the most invasive uses of personal data that takes place and is often perceived as private surveillance of those affected.

"Yesterday's ruling from Oslo District Court, which, for now, upholds the decision to impose a compulsory fine of NOK 1 million per day against Meta, Facebook's owner, helps put an end to this surveillance," says Bull partner and privacy expert Kristian Foss.

"With the decision, which originally originated in Max Schrem's NOBY complaint from 2018, the Data Protection Authority shows impressive vigor." he adds.

The decision could have consequences for advertisers, who now need to consider more carefully whether they can legally continue with their advertising. If advertisers are regarded as joint controllers, for which we have some judgments from the European Court of Justice, advertisers are also obliged to have a legal basis for processing.

What is the case about?

The case concerns the legal basis for the processing. Meta had assumed that the processing was necessary for the performance of an agreement (GDPR. art. 6(1)(b). After the Irish Data Protection Authority decided that this basis for processing did not hold, Meta changed the basis to legitimate interest (art. 6(1)f). On Tuesday 4 July this year, the European Court of Justice ruled (in case C-252/21) that legitimate interest could not be a legal basis either. The Norwegian Data Protection Authority then struck with its emergency decision on 14 July. Meta responded that the company could switch to consent as a legal basis (Art. 6(1)(a), but that it would take three months to prepare technically.

And this is the core of the contention lies: The Data Protection Authority believed Meta could easily turn the consent function on, and upheld its decision. Thus, Meta filed for a preliminary injunction to temporarily halt the decision. This is the lawsuit Meta lost in Oslo District Court. In short, the reason was that the financial and reputational consequences of complying with the decision had not been substantiated. In a somewhat original turn suggesting an clever judge, the positive aspects of the reputation of complying with the ruling are highlighted, without it being invoked by either party.

Whether the decision to impose a penalty was invalid will be finally settled in a regular lawsuit later, so just keep an eye on the continuation.

Here you can read the ruling from Oslo District Court.