Irish DPC submits Article 60 draft decision on inquiry into Meta

The Data Protection Commission (DPC) has submitted a draft decision in a large scale inquiry into Meta Platforms Ireland Limited (“MPIL”) to other Concerned Supervisory Authorities across the EU. This inquiry was commenced in April 2021 after media reports highlighted that a collated dataset of Facebook user personal data had been made available on the internet. The inquiry concerned the question of MPIL’s compliance with its obligations under Articles 25(1) and 25(2) GDPR (“data protection by design and by default”).

Deputy Commissioner, Graham Doyle commented:

“As the EU Lead Supervisory Authority for Meta Platforms Ireland Limited (“MPIL”), the DPC opened this inquiry in April 2021 following media reports which highlighted that a collated dataset of Facebook user personal data had been made available on the internet. This dataset was reported to contain personal data relating to approximately 533 million Facebook users worldwide. The Inquiry was scoped to consider a number of features provided by MPIL and whether MPIL had complied with its obligations regarding data protection by design and by default. The DPC submitted its draft decision to its colleagues last Friday, 30 September, for their views on it. This is part of the process under Article 60 of the GDPR, where the DPC sends draft decisions to other Concerned Supervisory Authorities and they have one month to review its draft decision and raise any ‘relevant and reasoned objections’ that they may have.”