Oslo District Court has rejected a request by Meta Platforms Ireland and Facebook Norway for a temporary injunction against a compulsory fine imposed by the Norwegian Data Protection Authority to enforce a temporary ban on behavioural marketing. The compulsory fine applies to Facebook and Instagram, both owned by Meta.
The Data Protection Authority’s urgency decision concerns a ban on the two companies processing personal data for behaviour-based marketing based on GDPR Art 6 (1) b) and f) in connection with the services Facebook and Instagram. The administrative decision was made on 14 July 2023 to take effect from 4 August 2023. On 7 August 2023 the Data Protection Authority decided to impose a compulsory fine on Meta Ireland and Facebook Norway as jointly and severally liable in the amount of NOK 1 million for each day of non-compliance. Both companies requested a temporary injunction against the Authority’s decision and the court heard the case on 22 – 23 August 2023.
In order for a temporary injunction to be granted by the court, the plaintiff must prove with a preponderance of evidence the existence of a legal claim and a so-called security reason. In this case, the security reason would be a need for “a temporary arrangement regarding a disputed legal claim in order to avert significant damage or inconvenience.”
Meta made a number of allegations before the court regarding the requirement of security reason, including publicity loss and economic loss. However, the court found that even if Meta Ireland and Facebook were to suffer damage or inconvenience if the Authority’s decision is not set aside, such damage or inconvenience would not be “significant”. Consequently, the court did not find that the requirement of security reason was met.
Meta Ireland and Facebook also made a number of allegations in respect of the requirement of existence of a legal claim, including submissions that the order could not be directed against Facebook Norway and that the decision was invalid due to lack of prior notification and sound investigation by the Authority. However, the court did not find in favour of the plaintiffs on any of these points either. Nor did the court find that the conditions for urgent measures pursuant to GDPR Art. 61 (8) or Article 66 (1) were met, however under considerable doubt. The State, represented by the Data Protection Authority was awarded legal costs.
The court’s order may be appealed. The Data Protection Authority’s decision has a duration of three months but the Authority may take the case to the European Data Protection Board in order to ask for the decision to be made final.
Read an unofficial translation of the court order here: https://www.datatilsynet.no/contentassets/4096b3bd53094eb5bf2c184bd6ae4aef/avgjorelse-i-oslo-tingrett-060923_en-unofficial-machine-translation.pdf
