Inquiry concerning the processing of personal data relating to child users of the Instagram social networking service
(IN-20-7-4)
Date of Decision: 2 September 2022
The DPC commenced this own-volition inquiry on 21 September 2020, based both on information provided by a third party, and in connection with processing identified by the DPC itself. The scope of inquiry concerned two types of processing carried out by Meta Platforms Ireland Limited (as the data controller of the personal data processed in the context of the Instagram platform), as follows
1. Meta Platforms Ireland Limited allowed child users between the ages of 13 and 17 to operate ‘business accounts’ on the Instagram platform. At certain times, the operation of such accounts required and/or facilitated the publication (to the world-at-large) of the child user’s phone number and/or email address.
2. At certain times, Meta Platforms Ireland Limited operated a user registration system for the Instagram service whereby the accounts of child users were set to “public” by default, thereby making public the social media content of child users, unless the account was otherwise set to “private” by changing the account privacy settings.
Following a lengthy and comprehensive inquiry, the DPC submitted a draft decision to all Concerned Supervisory Authorities (“CSAs”), for the purpose of Article 60(3) GDPR, in December 2021. The DPC subsequently received objections from six CSAs. The DPC was unable to reach consensus with the CSAs on the subject-matter of the objections and, in the circumstances, decided to refer the objections to the European Data Protection Board (“EDPB”) for determination pursuant to the dispute resolution process provided for in Article 65 GDPR.
The EDPB adopted its binding decision on the subject-matter of the objections on 28 July 2022. That decision required the DPC to amend certain aspects of its decision to, firstly, include a finding of infringement of Article 6(1) GDPR, and, secondly, to reassess its proposed administrative fines on the basis of a number of factors contained in the EDPB’s decision, including a requirement for the DPC to impose an additional administrative fine in respect of the finding of infringement of Article 6(1) GDPR that had been established by the EDPB.
With regard to the processing outlined above, the DPC’s decision, which was adopted on 2 September 2022, records findings of infringement of Articles 6(1), 5(1)(a), 5(1)(c), 12(1), 24, 25(1), 25(2) and 35(1) GDPR.
Corrective Powers Exercised:
The DPC’s decision imposed administrative fines totalling €405 million on Meta Platforms Ireland Limited. In addition to these administrative fines, the DPC also imposed a reprimand and an order requiring Meta Platforms Ireland Limited to bring its processing into compliance by taking a range of specified remedial actions.
For more information, you can download a copy of the full decision at this link: Meta Platform Ireland Limited, formerly Facebook Ireland Limited, and the "Instagram" social media network - September 2022 (PDF, 3.1 MB)