Instagram has been forced to fix a dangerous problem.
Dr Johnny Ryan, Senior Fellow of ICCL, said:
"We hope this fine will be dissuasive. The fine is .08% of Instagram’s turnover.[1]
On the whole, we are happy with this outcome. It forced Instagram to fix a specific problem that it had repeatedly denied.[2]
The decision is not perfect, however. The binding decision imposed on Ireland by the European Data Protection Board raises a few issues of concern. Germany, Finland, France, Italy, Netherlands, and Norway criticised the DPC’s draft decision for accepting that Meta uses an obscure contract[3] or other inappropriate basis (“legitimate interest” without adequate balancing test) to claim that it lawfully processes children’s data.[4] The EDPB was sharply critical of the DPC’s investigation on this point,[5] and ordered the DPC to correct it and impose an additional fine.[6]
There must be no risk that Meta, which owns Facebook and Instagram, can expect any latitude in enforcement of something as important as our childrens and teenagers digital lives.
We are concerned also that that additional fine may have materialised in name only. (The DPC’s draft decision proposed a possible range of fines from 202 to 405 million in its draft decision,[7] and the EDPB voted for the higher range.[8] Presumably therefore the fine should have been 405+ the additional fine, but the DPC says the new additional fine is now included in the 405 million fine[9].)
It is clear from other data protection authorities examination of the DPC’s work that there are problems, but the DPC has succeeded in forcing Instagram to fix a problem that had exposed children to risk for years. We applaud it for doing so, and David Stier, the independent researcher who brought the issue to light several years ago."
Notes
[1] Instagram had revenue of almost €47 Billion last year.
[2] David Stier, who uncovered and reported the problem, said “I'm amazed Meta seems to think that by making changes a year ago they shouldn't be subject to a rather lightweight fine. After all, these changes were made only after repeatedly denying wrongdoing and being challenged by investigators & media.” 6 September 2022 https://twitter.com/i/web/status/1567125607074627585
[3] See for example paragraphs 33, 36, and 45 of “Binding Decision 2/2022 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding Meta Platforms Ireland Limited (Instagram) under Article 65(1)(a) GDPR”, European Data Protection Board, 28 July 2022 (published 15 September 2022), (URL: https://edpb.europa.eu/system/files/2022-09/edpb_bindingdecision_20222_ie_sa_instagramchildusers_en.pdf).
[4] ibid., paragraph 242.
[5] ibid., paragraph 45, 81, 96, 114, 117, 118, 127.
[6] ibid., paragraph 244 (12) 3
[7] ibid., paragraph 172
[8] ibid., paragraph 252
[9] Note that the EDPB also invited the DPC to re-examine the financial benefit to Instagram from the infringement and consider whether to increase the fine. See ibid., paragraph 244 (12) 1.