Data Protection Commission announces decision in Instagram Inquiry

The Data Protection Commission (DPC) has today announced a conclusion to an inquiry into Meta Platforms Ireland Limited (Instagram) imposing a fine of €405 million and a range of corrective measures.

The inquiry concerned the processing of personal data relating to child users of the Instagram social networking service. It was initiated by the DPC on 21 September 2020 in response to information provided by David Stier (a US data scientist), and also in connection with issues identified by the DPC itself, following examination of the Instagram user registration process. The inquiry examined, in particular, the public disclosure of email addresses and/or phone numbers of children using the Instagram business account feature and a public-by-default setting for personal Instagram accounts of children.

Following a comprehensive investigation, the DPC submitted a draft decision to all peer regulators in the EU, also known as Concerned Supervisory Authorities (“CSAs”), under Article 60 of the GDPR in December 2021. Six of these national regulators raised objections to the DPC’s draft decision. The DPC was unable to reach consensus with the CSAs on the subject matter of the objections and it therefore referred the case to the European Data Protection Board (“EDPB”), in line with the Article 65 dispute resolution process of the GDPR.

On 28 July 2022, the EDPB adopted its binding decision, which rejected a considerable quantity of the objections but upheld objections requiring the DPC to amend its draft decision to include a finding of infringement of Article 6(1) GDPR and to reassess its proposed administrative fines on the basis of this additional infringement. Having incorporated these amendments, the DPC’s decision was adopted on 2 September, 2022. The decision records findings of infringement of Articles 5(1)(a), 5(1)(c), 6(1), 12(1), 24, 25(1), 25(2) and 35(1) of the GDPR.

The DPC’s original draft decision had recommended a fine of up to €405 million and, having taken account of the EDPB’s binding decision, the fine imposed on Meta Platforms Ireland Limited (Instagram) totals €405 million, including a fine of €20 million for the infringement of Article 6(1).

In addition to these administrative fines, the DPC has also imposed a reprimand and an order requiring Meta Platforms Ireland Limited to bring its processing into compliance by taking a range of specified remedial actions.

The EDPB has published the Article 65 decision and the final decision on its website (click here).