Facebook is not necessarily required to obtain separate consent for the processing of personal data for personalized advertising, the Irish Data Protection Commissioner (DPC) has provisionally ruled in a draft ruling in the LB v Facebook case Ireland.
The decision was drafted following a complaint by an Austrian Facebook user who alleged that Facebook had violated its obligations under the GDPR both by not obtaining its express consent to process its data for advertising purposes. and by not transparently disclosing its data handling practices.
In a 96-page decision, the Irish regulator ruled that users’ consent to Facebook’s terms of service is a contractual obligation for Facebook, which it can rely on as a legal basis for processing personal data for purposes advertising. The DPC found that because users are aware that personalized advertising is at the heart of Facebook’s service, Facebook is not obligated to obtain their separate consent for this processing.
CLICK HERE to read the Data Protection Commissioner’s draft ruling in the LB case against Facebook Ireland Ltd.