Article content
In briefShow moreShow lessOn 31 October 2023, the Norwegian Data Protection Authority announced that the European Data Protection Board (EDPB) had adopted an urgent binding decision at Norway's request.
- On 31 October 2023, the Norwegian Data Protection Authority announced that the European Data Protection Board (EDPB) had adopted an urgent binding decision at Norway's request.
- The Norwegian authority had imposed a temporary national ban in July.
- Directly relevant in Norway: Datatilsynet requested the measure; the resulting EDPB decision was implemented through the GDPR cooperation mechanism across the EEA. It clarified enforcement of existing GDPR rules.
What happened
On 31 October 2023, the Norwegian Data Protection Authority announced that the European Data Protection Board (EDPB) had adopted an urgent binding decision at Norway's request. The decision, adopted on 27 October, instructed the Irish authority to ban Meta from processing personal data for behavioural advertising on Facebook and Instagram on the legal bases of contract and legitimate interests across the EEA.
The Norwegian authority had imposed a temporary national ban in July. It considered that Meta continued to track and profile users unlawfully after earlier European decisions. An urgent national measure under GDPR Article 66 is time-limited, so the authority asked the EDPB for final measures extending beyond Norway.
What this means for organisations
The case demonstrates how the GDPR cooperation system can affect an entire digital business model. Behavioural advertising commonly depends on detailed profiles created from activity, location, interests and ad interactions. When the legal basis fails, editing a privacy notice is not enough. Collection, profiling, ad selection and vendor data flows must be redesigned as one connected system.
Organisations should map every processing purpose to a documented and sustainable legal basis. Contract can only support processing that is objectively necessary to provide the core service. Legitimate interests require a genuine necessity test and balancing assessment. Where an organisation relies on consent for tracking, that consent must be freely given, informed and specific, and withdrawing it must be as easy as giving it.
The decision did not amend the GDPR. It was a binding enforcement measure under rules already applicable in Norway and the rest of the EEA. It also showed that a Norwegian supervisory authority can trigger coordinated European action where risks to individuals are urgent.
Sources
European Data Protection Board: “EDPB Urgent Binding Decision 01/2023,” 27 October 2023.
Datatilsynet: “Datatilsynets vedtak mot Meta utvides til EU/EØS og gjøres permanent,” 31 October 2023.
For discussion
Which decisions, defaults or supplier dependencies in our organisation should we examine first in light of this development?
