New Street Research is a talent-driven organization. We are always looking for creative, curious, driven thinkers. If you think you would be a good fit, please reach out to us.
- Earlier this week, the Ireland Data Protection Commissioner (DPC) fined Meta $414 million for violating Europe’s privacy law, the General Data Protection Regulation (GDPR). The order requires Meta to come into compliance with GDPR within 3 months.
- The DPC found that Meta did not establish a proper legal basis for processing European users’ data, including using that data for personalized advertising. It also found that Meta had not provided enough transparency to its users about that legal basis.
- Meta plans to appeal the decision.
- The GDPR requires companies to use a valid legal mechanism to process Europeans’ data. Meta sought to base some of its data processing on its contracts with users.
- In May 2018, when the GDPR came into effect, two European users initiated cases against Meta (then Facebook), claiming that Meta’s revised terms of service did not comply with the GDPR. The DPC’s fines stem from those complaints.
- Meta will not stop running ads: While Meta is appealing the decision, it will not shift its ad practices. And even if European courts ultimately disagree with Meta about whether its contracts with users can serve as an adequate basis for data processing, Meta will simply shift to another GDPR-approved basis so that it can continue to serve ads to Europeans.
- It’s still early in the game: It’s been over 4 years since the case was initiated, and it will take more time to resolve the appeal.
- Meta is not alone: Some of the reporting on the case seems to suggest that the fines are due to behavior that’s unique to Meta, or that the fines break news about past misconduct by the company. Neither is the case. Any company operating a data business in Europe needs a legal basis for data processing. Meta sought to use “contractual necessity” as that legal basis, as many other companies do, and it made that justification public. The DPC’s fine reflects a dispute about an interpretation of new European privacy law but is not a revelation about Meta’s conduct. A resolution of the case will affect not only Meta, but any business that seeks to use “contractual necessity” as a basis for data processing.
- Conflicts between regulators: This case showcases uncertainties in GDPR enforcement that will create difficulties for businesses, particularly smaller platforms. As the DPC explained in its press release, it disagreed with the European Data Privacy Board (EDPB) on the question of whether Meta’s contracts provide a lawful basis for data processing: the DPC determined the contracts to be sufficient, but the EDPB overruled the DPC and decided they were not. These conflicts create uncertainty for businesses trying to understand how to comply with GDPR. Smaller platforms may be harmed by these challenges more than well-established rivals, since smaller platforms typically are disproportionately harmed by compliance costs and burdens.
- This case is unlikely to impose significant constraints on Meta’s business or to disproportionately harm Meta relative to its competitors. The case will likely take years to resolve.
Full 12-month historical recommendation changes are available on request
Reports produced by New Street Research LLP. 52 Cornhill, London EC3V 3PD Tel: +44 20 7375 9111.
New Street Research LLP is authorised and regulated in the UK by the Financial Conduct Authority and is registered in the United States with the Securities and Exchange Commission as a foreign investment adviser.
Regulatory Disclosures: This research is directed only at persons classified as Professional Clients under the rules of the Financial Conduct Authority (‘FCA’), and must not be re-distributed to Retail Clients as defined in the rules of the FCA.
This research is for our clients only. It is based on current public information which we consider reliable, but we do not represent that it is accurate or complete, and it should not be relied on as such. We seek to update our research as appropriate, but various regulations may prevent us from doing so. Most of our reports are published at irregular intervals as appropriate in the analyst's judgment. This research is not an offer to sell or the solicitation of an offer to buy any security in any jurisdiction where such an offer or solicitation would be illegal. It does not constitute a personal recommendation or take into account the particular investment objectives, financial situations, or needs of individual clients.
All our research reports are disseminated and available to all clients simultaneously through electronic publication to our website.
New Street Research LLC is neither a registered investment advisor nor a broker/dealer. Subscribers and/or readers are advised that the information contained in this report is not to be construed or relied upon as investment, tax planning, accounting and/or legal advice, nor is it to be construed in any way as a recommendation to buy or sell any security or any other form of investment. All opinions, analyses and information contained herein is based upon sources believed to be reliable and is written in good faith, but no representation or warranty of any kind, express or implied, is made herein concerning any investment, tax, accounting and/or legal matter or the accuracy, completeness, correctness, timeliness and/or appropriateness of any of the information contained herein. Subscribers and/or readers are further advised that the Company does not necessarily update the information and/or opinions set forth in this and/or any subsequent version of this report. Readers are urged to consult with their own independent professional advisors with respect to any matter herein. All information contained herein and/or this website should be independently verified.
All research is issued under the regulatory oversight of New Street Research LLP.
© Copyright 2022 New Street Research LLP
No part of this material may be copied, photocopied or duplicated in any form by any means or redistributed without the prior written consent of New Street Research LLP.