Data Protection Commission’s two statutory inquiries into Facebook’s processing of children’s data on Instagram (opened in Sept 2020)

The protection of children’s data rights is one area which is of key importance to the Data Protection Commission (“DPC”).  In today’s digital world in which vast numbers of children are prevalently active on social media, it is vital that data controllers are compliant with their obligations under the GDPR and the Data Protection Act 2018 in relation to their processing of children’s personal data on their platforms. Instagram is a social media platform which is used widely by children in Ireland and across Europe. The DPC has been actively monitoring complaints received from individuals in this area and has identified potential concerns in relation to the processing of children’s personal data on Instagram which require further examination. The Instagram platform is owned and provided by Facebook Ireland Limited (“Facebook”) which is the data controller of the personal data processed via Instagram.

Inquiry Number 1

This Inquiry will assess Facebook’s reliance on certain legal bases for its processing of children’s personal data on the Instagram platform. The DPC will set out to establish whether Facebook has a legal basis for the ongoing processing of children’s personal data and if it employs adequate protections and or restrictions on the Instagram platform for such children. This Inquiry will also consider whether Facebook meets its obligations as a data controller with regard to transparency requirements in its provision of Instagram to children.

Inquiry Number 2

This Inquiry will focus on Instagram profile and account settings and the appropriateness of these settings for children. Amongst other matters, this Inquiry will explore Facebook’s adherence with the requirements in the GDPR in respect to Data Protection by Design and Default and specifically in relation to Facebook’s responsibility to protect the data protection rights of children as vulnerable persons.