In early July, the Court of Justice of the European Union (CJEU) ruled that Facebook/Meta may not process personal data of internet users for online behavioural advertising purposes without their consent. As a follow-up to the ruling, the Norwegian data protection authority (Datatilsynet) decided to: 

(i) temporarily ban such processing until Meta fixes it or until the European Data Protection Board (EDPB) adopts final measures instead of temporary ones. Meta has asked Oslo District Court to temporary postpone the imposed ban but lost the case; 

(ii) request an urgent decision from the EDPB, so that final measures may urgently be adopted.

The temporary ban was valid from 4 August to 3 November covering Norway-based internet users.

On 27th October, the EDPB took its binding decision against Facebook/Meta in accordance with the Datatilsynet’s request. The decision is not published yet, but it is already known that:

– the ban for Facebook/Meta to process personal data for online behavioural advertising purposes without users’ consent has been transformed from temporary into permanent;

– the ban will be extended to apply to the entire EU/EEA (not just Norway).

The permanent EEA-wide ban has not yet come into effect. The EDPB’s decision serves as a prescription to the Irish Data Protection Authority (DPC) to place a permanent EEA-wide ban on Meta’s European head office in Ireland. Once this has happened, the ban will come into effect.

 As for potential Meta’s response, it is yet to be seen. In October 2023, Meta announced that it will introduce paid subscription options for Facebook and Instagram in the EU. For a monthly fee, users can continue using the services without targeted ads based on their online behaviour data. However, data protection authorities in some EU countries have already questioned the legality of such a scheme.

***

As IAPP reports, “French Member of European Parliament Philippe Latombe filed an appeal of the EU General Court decision to reject his original petition for annulment of the EU-U.S. Data Privacy Framework. Latombe’s appeal argues, in part, the U.S. Data Protection Review Court is not an independent tribunal because it was created by presidential executive order and not an act of Congress and U.S. law “does not provide for any general safeguard against automated decision-making”. 

***

As Yahoo reports, “Amazon is rolling out an independent cloud for Europe as it looks to address strict regulations that companies and those in the public sector face in the European Union. 

Amazon Web Services said Wednesday that its AWS European Sovereign Cloud, which will be located in and operate out of Europe, will have the same security, availability, and performance as existing AWS regions but will be separate from them. The cloud will let customers keep all metadata they create in the European Union and will have its own billing and usage metering systems”. Click here to find out more.