DaphneJan 6, 2023

RT @[email protected]

Breaking: In decisions just out, Meta is not only on the hook for privacy fines totaling nearly €400 million, but it must also — quickly — find a new legal basis for its sprawling targeted advertising empire. 🧵

https://pro.politico.eu/news/158293

🐦🔗: https://twitter.com/vmanancourt/status/1610652904188174338

POLITICO Pro

Show threadDaphneJan 6, 2023
Can smart EU lawyers with data protection chops help me understand the basic legal proposition of this case?
I get the Art 6 bases for processing, and how Meta’s latest maneuvers (moving from consent to contractual basis) were legally sketchy and made EDPB mad. 1/
Show threadDaphneJan 6, 2023
But I don’t get at a more fundamental level why “take it or leave it” is not an option. I’m probably out of practice.
2/
Show threadTodd KnarrJan 6, 2023
@daphnehk Because the basis Meta is using is "contractual necessity". The DPA is saying "You can fulfill the contract completely without personalizing ads, so you can't claim it's necessary to fulfill the contract.". Meta could get past that by making delivery of personalized ads part of the service they were contracting to deliver, no opt-out of personalization offered, but they don't want to say that openly because users wouldn't accept it.
Show threadSam Gross
@tknarr @daphnehk I suspect the fact that they added the requirement in later, without adding substantial new features, makes this worse. If you didn’t need agreement before, but all of a sudden you do, it is transparent that you’re just manufacturing consent.
Jan 6, 2023 at 12:34pmIvory for iOS
Show threadDaphneJan 8, 2023
@SamTheGeek @tknarr Or that the GDPR made them switch — changed the definition or Recitals etc. about consent, or failed to make some “clarifying” change FB had hoped for?
Show threadTodd KnarrJan 8, 2023
@daphnehk @SamTheGeek I don't think there's been any significant changes to the GDPR or it's interpretation. It's just the GDPR's position is "ask clearly and explicitly for permission", Meta is doing everything they can think of to not do that, and the DPAs are responding to each attempt with "Did we stutter?".
Show threadDaphneJan 8, 2023
@tknarr @SamTheGeek Maybe I’m not understanding the consent/contract difference. Is FB saying “we have a contract” or “we have consent and the contract proves it”?
Show threadTodd KnarrJan 8, 2023
@daphnehk @SamTheGeek They're saying "We have a contract, and we don't need consent because what we would need consent for is necessary to fulfill the contract.".
Show threadTodd KnarrJan 8, 2023
@daphnehk @SamTheGeek I think the real question is why is Meta so resistant to the idea of simply being open about it: "We make our money from personalized advertising. If you don't consent to us collecting your information for that purpose, we won't offer our service to you. Do you consent? Y/N"