The Irish arm of Meta has filed a High Court challenge against an immediate ban on its Facebook and Instagram platforms from processing personal data for use in behavioural advertising.
Last week, the Data Protection Commission served the tech giant with an enforcement notice informing Meta Platforms Ireland Ltd that it had seven days to cease processing data for use in advertising based on users’ online activities and interests.
Any failure to comply with the enforcement notice is a criminal offense, and could also result in fines, Mr Justice Cian Ferriter was told on Monday.
Represented by Declan McGrath SC, Emily Egan McGrath SC with Shelley Horan Bl, Meta has asked the court to quash the enforcement order on grounds including that it is vague and unclear in terms of what the company has to do to be compliant with its obligations under GDPR.
It also claims that the decision to issue the notice breaches Meta’s legitimate expectation of a fair hearing and fair procedures. Meta further claims that the decision renders certain sections of the 2018 Data Protection Act, the legislation which established the DPC, unconstitutional.
Both Ireland and the Attorney General have been included as respondents to Meta’s proceedings. It claims that the proposed ban would prevent Facebook and Instagram from using users’ personal information to inform and provide details to advertisers.
The DPC issued the enforcement notice after the European Data Protection Board (EDPB), the EU’s data protection authority that oversees the application of the GDPR and other data protection rules, issued a binding decision requiring the Irish data protection body to act against Meta.
Meta says that Facebook and Instagram’s processing of data for behavioural advertising had been the subjects of probes by the DPC into alleged data protection breaches.
Meta had denied the breaches and had claimed that it was allowed under Article 6 of GDPR to process the data in question on the legal grounds of ‘contractual necessity’ and ‘legitimate interest’. Those arguments were ultimately not accepted when the issue was referred to the EDPB.
Counsel said the findings against it are already the subject of separate legal challenges before the domestic and European courts.
Meta also claims that it was seeking to have its consent-based solution to the issues assessed by the DPC, which if accepted would ensure its compliance with its GDPR obligations.
Earlier this month, Meta received the enforcement notice which was issued by the DPC some four days earlier.
Mr McGrath said the main problem from his client’s point of view was the prospect of a criminal sanction for any non-compliance. Counsel said that given the vague nature of the enforcement order Meta had asked the DPC to clarify what it needed to do so it would not be in breach of the order.
After considering Meta’s submissions, Mr Justice Ferriter, on an ex-parte basis, granted Meta permission to bring its judicial review action. The judge said that he was also prepared to grant a temporary stay on the enforcement notice from coming into effect.
The matter will return before the court later this week. The judge said he was giving all sides liberty to return before the court before the matter is to be heard next should the need arise.
