DP News – Week 32

As DPOrganizer reported last week, the Norwegian data protection authority (Datatilsynet) decided to temporarily ban the processing of personal data for the purposes of online behavioral advertising based on ‘legitimate interest’ lawful basis. The ban is effective until Meta fixes the flaws or until the European Data Protection Board (EDPB) adopts final measures instead of temporary ones.The temporary ban is valid from 4 August to 3 November and covers Norway-based internet users.

Now, Meta has asked the Oslo district court to suspend this temporary ban. As Datatilsynet’s representative Tobias Judin says, “It is as expected that Meta will go to trial, because that is generally their strategy when they receive a decision against them. Regardless, our position is that the Norwegian Data Protection Authority’s decision is valid. We believe that Meta has no grounds for requesting a temporary injunction because the conditions have not been met”.

Previously, in response to enforcement activities against it, Meta proposed a consent-based scheme for online behavioral advertising. However, for now it is not clear how this proposed scheme might work and what types of advertising will exactly be covered.

***

According to the EDPB’s official press-release, it adopted ‘a dispute resolution decision on the basis of Art. 65 GDPR concerning a draft decision of the Irish Data Protection Authority (DPA) regarding TikTok Technology Limited (TTL). The binding decision addresses legal questions arising from objections to the draft decision of the Irish DPA as lead supervisory authority (LSA) regarding TTL. […] The objections concerned, among other things, whether there had been an infringement of data protection by design and default with regard to age verification, and whether there had been an infringement of the principle of fairness with regard to certain design practices’.

As a matter of next steps, ‘The LSA shall adopt its final decision, addressed to the controller, on the basis of the EDPB binding decision taking into account the EDPB’s legal assessment, at the latest one month after the EDPB has notified its decision. The EDPB will publish its decision on its website after the LSA has notified its national decision to the controller and, if applicable, any necessary redactions have been made to the EDPB’s Binding Decision’.