{"id":18238,"date":"2023-01-18T12:29:39","date_gmt":"2023-01-18T11:29:39","guid":{"rendered":"https:\/\/www.rosello-mallol.com\/?p=18238"},"modified":"2023-01-18T12:29:43","modified_gmt":"2023-01-18T11:29:43","slug":"meta-sanction","status":"publish","type":"post","link":"https:\/\/www.rosello-mallol.com\/en\/meta-sanction\/","title":{"rendered":"Meta Sanction: how does it affect my company?"},"content":{"rendered":"\n

2023 is starting strong as far as GDPR sanctions are concerned, due to the 390M euros META sanction<\/a><\/strong> imposed by the Irish Authority because of the manner in which it processes its users\u2019 data from<\/strong> Facebook and Instagram<\/strong>.<\/p>\n\n\n\n

The sanction, which occurred after the involvement of the European Data Protection Council<\/strong>, has forced the Irish Authority to change its initial criteria and multiply its sanction by 10.<\/p>\n\n\n\n

Meta Sanction:<\/strong> Why has been penalised?<\/strong><\/h2>\n\n\n\n

In short, the terms and conditions of META included the fact that data from Facebook and Instagram users<\/strong> could be used for custom advertising purposes and, more importantly, it did not request any specific consent for this purpose, considering this data processing necessary to fulfil the contract (the terms and conditions) accepted by users.<\/p>\n\n\n\n

What do the data protection authorities say?<\/strong><\/h2>\n\n\n\n

Essentially, they say that receiving custom advertising does not fall within the expectations of users when they register on one of the two social networks, and that their expectation or the service they expect to receive is none other than to communicate with others or to remain informed.<\/p>\n\n\n\n

In conclusion, the processing of data for advertising purposes is not part of the service that users expect to receive, so the use of their data for this purpose requires their express and prior consent<\/strong>.<\/p>\n\n\n\n

META Sanction:<\/strong> OK, but how does it affect my company?<\/strong><\/h2>\n\n\n\n

Well, this decision deals with the core of the GDPR<\/strong>, which is none other than what is known as the lawful basis of processing<\/strong>. This is what justifies a company or public authority to process someone’s personal data.<\/p>\n\n\n\n

Regarding the lawful bases, some important considerations:<\/p>\n\n\n\n