Docs unearthed by show that the Irish data regulator lobbied to get EU guidelines to allow social networks to bypass GDPR consent requirements to use people's data to target advertising.🧵
Conversation
Replying to
The documents show that the Irish regulator argued that companies could use data to fulfil a contract with users to provide a personalized ad-funded platform, rather than relying on consent.
1
7
24
The Irish view was roundly rejected by other EU data protection regulators, with one saying that it "undermines the system and spirit of the GDPR," according to the documents.
noyb.eu/sites/default/
1
4
35
The Irish lobbying came after Facebook had changed its terms to include data processing in a contract rather than by relying on user consent, which the social media firm said resulted from discussions with the Dublin regulator.
1
3
17
The Irish DPC eventually failed to get its proposals into the final guidelines, which include strict requirements for what data is necessary to fulfil a contract with users (and don't approve data-use for ads).
edpb.europa.eu/sites/default/
1
2
24
According to figures provided by the European Data Protection Board, only one regulator voted against the final guidelines. The lone dissenting regulator was Ireland, according to one official. Another two said it was likely to be Ireland based on their recollection of talks.
1
3
24
The evidence of Ireland’s lobbying comes after the regulator proposed fining Facebook up to €36 million for transparency failures — but said it could in principle use the "performance of a contract legal basis".
1
3
17
At the time, one data regulator official said that Ireland’s ruling would entail “the end of data protection as we know it” and that the idea that people sign up to Facebook to receive personalized advertising is “absurd.”
1
3
28
The revelations that the Irish regulator lobbied for a looser interpretation of EU privacy rules after receiving a complaint against Facebook will raise fresh questions around the relationship between the watchdog and the social media firm.
2
20
47
UPDATE The Irish DPC: “there is absolutely nothing unusual” about to and fro between regulators when developing guidelines. “To suggest that there is any issue with how this process worked then, or now, demonstrates a lacking of basic understanding of the workings of the EPDB.
1
2
9
"and how, through an iterative process, divergent views relating to complex issues of principle are typically reconciled through dialogue, and through respectful and mature engagement. Such was the case in relation to the development of [these] EDPB’s guidelines."
1
1
6
The Irish DPC also noted the ECJ is separately reviewing a case where an Austrian court also ruled that Facebook was entitled to use the “performance of a contract” legal basis, and that guidance may have to be updated accordingly.
1
1
7