An urgent binding decision adopted by the European Data Protection Board (EDPB) last Friday instructs the DPC to impose a ban on the processing of personal data for behavioural advertising on the legal bases of contract and legitimate interest across the entire European Economic Area (EEA).

The DPC previously imposed a €390 million fine on Meta in connection with this processing at the behest of the EDPB.

The latest EDPB decision follows a request from Norway’s data protection authority. The ban on processing will become effective one week after Meta’s notification by the DPC, which happened on Tuesday.

Meta has now proposed to rely on a consent-based approach as its legal basis for processing personal data for behavioural advertising. The DPC is currently evaluating this together with the concerned supervisory authorities.

Anu Talus, chair of the EPDB, said: “After careful consideration, the EDPB considered it necessary to instruct [the DPC] to impose an EEA-wide processing ban, addressed to Meta IE.

“Already in December 2022, the EDPB binding decisions clarified that contract is not a suitable legal basis for the processing of personal data carried out by Meta for behavioural advertising. In addition, Meta has been found by [the DPC] to not have demonstrated compliance with the orders imposed at the end of last year.

“It is high time for Meta to bring its processing into compliance and to stop unlawful processing.”