The Board concluded that the NDPA does not have authority to impose coercive fines in ongoing cross-border cases. Only in exceptional cases may concerned data protection authorities, such as the NDPA, adopt provisional measures until three months on its own territory. The GDPR sets out that national powers, such as coercive fines, shall not impair the effective powers of the cooperation and consistency mechanism. The Board found that the Norwegian Data Protection Act and its preparatory works do not address the application of coercive fines in cross-border cases and concluded that the Norwegian Data Protection Act does not give the NDPA authority to issue coercive fines in such instances. Consequently, the NDPA’s decision to impose a coercive fine was revoked. This means that Meta Ireland and Facebook Norway will be reimbursed approximately NOK 83 million paid under the NDPA’s invalid decision.
The Privacy Appeals Board annuls coercive fines against Meta
Advokatfirmaet Simonsen Vogt Wiig has successfully assisted Meta Ireland and Facebook Norway in a complaint before the Norwegian Privacy Appeals Board. In a principled decision on 18 June 2024, the Board found that the Norwegian Data Protection Authority (NDPA) did not have legal authority to impose coercive fines for the alleged breach of the NDPA’s order 14 July 2023 regarding behavioral advertising on Facebook and Instagram.
