Brussels, 29 July - The EDPB adopted two letters in response to Access Now and BEUC concerning TikTok. In these letters, the EDPB highlights the swift action taken by the Irish, Italian and Spanish Supervisory Authorities (SAs) following TikTok’s announcement that it would no longer seek users’ consent to send personalised advertisements, but that the legal basis for this would be the legitimate interest of TikTok and its partners. As a result of these actions, TikTok announced that it would pause the change in the legal basis used for personalised ads.
EDPB Deputy Chair Ventsislav Karadjov said: “TikTok’s suspension of the envisaged change of legal basis is a testament to the SAs’ determination and their commitment to safeguarding the interests of TikTok users and data subjects in general. I am confident that SAs have the necessary tools to protect the rights of data subjects and that the cooperation within the EDPB ensures that this is done efficiently and consistently across the European Economic Area.”
In addition, the EDPB adopted a dispute resolution decision on the basis of Art. 65 GDPR. The binding decision seeks to address the lack of consensus on certain aspects of a draft decision issued by the Irish SA as lead supervisory authority (LSA) regarding Instagram (Meta Platforms Ireland Limited (Meta IE)) and the subsequent objections expressed by some of the concerned supervisory authorities (CSAs).
The LSA issued the draft decision following an own-volition inquiry into the processing activities of Meta IE. The LSA’s draft decision concerns Meta IE’s compliance with Art. 5(1)(a) and (c), 6(1), 12(1), 13, 24, 25 and 35 GDPR in respect of certain processing of children’s personal data in the context of Instagram. In particular, it concerns the public disclosure of email addresses and phone numbers of children using the Instagram business account feature and a public-by-default setting for personal accounts of children on Instagram during a period falling within the temporary scope of the LSA’s inquiry. On 3 December 2021, the LSA shared its draft decision with the CSAs in accordance with Art. 60(3) GDPR. Several CSAs issued objections pursuant to Art. 60(4) GDPR concerning, among others, the legal basis for processing and the determination of the fine.
The SAs were unable to reach consensus on some of the objections, which were then referred to the EDPB by the LSA for determination pursuant to Art. 65(1)(a) GDPR, thereby initiating the dispute resolution procedure.
The EDPB has now adopted its binding decision. The LSA shall adopt its final decision, addressed to the controller, on the basis of the EDPB decision, without undue delay and at the latest one month after the EDPB has notified its decision. The EDPB will publish its decision on its website without undue delay after the LSA has notified their national decision to the controller.
Note to editors:
For further information on the Art. 65 procedure, please consult the FAQ
EDPB_Press Release_2022_10