EU/Norway: Data regulator to refer ongoing fine against Meta over privacy breaches to EU data authority in move that could make penalty permanent & widen it to EU
Brett Jordan, Unsplash
In July 2023, the Norwegian data protection authority ordered Meta, the parent company of Facebook and Instagram, to stop showing users personalised ads based on their online activity and estimated locations, known as behavioural advertising. Meta's advertising practice on Facebook and Instagram involves the "processing of very private and sensitive personal data through highly opaque and intrusive monitoring and profiling operations," Norway's Datatilsynet agency said.
If it doesn't address the privacy breaches, Meta will face daily fines of 1 million Norwegian Krone (€89,500).
On 14 August, Datatilsynet said Meta had failed to prove it had addressed the issue and imposed the daily fine for the next three months. Meta, seeking a temporary injunction, said it had already committed to ask for consent from users.
In September 2023, Norway's data regulator announced it will refer the ongoing fine to the European data authority, which could make the penalty permanent and widen it to the EU.
Meta said it was surprised by the decision given that it "has already committed to moving to the legal basis of consent for advertising in the EU/EEA", but the Norwegian regulator maintained that it was unclear when, and how, Meta would seek consent from users and that in the meantime users' rights were being violated.