The Privacy Appeals Board annuls coercive fines against Meta

The Board concluded that the NDPA does not have authority to impose coercive fines in ongoing cross-border cases. Only in exceptional cases may concerned data protection authorities, such as the NDPA, adopt provisional measures until three months on its own territory. The GDPR sets out that national powers, such as coercive fines, shall not impair the effective powers of the cooperation and consistency mechanism. The Board found that the Norwegian Data Protection Act and its preparatory works do not address the application of coercive fines in cross-border cases and concluded that the Norwegian Data Protection Act does not give the NDPA authority to issue coercive fines in such instances. Consequently, the NDPA’s decision to impose a coercive fine was revoked. This means that Meta Ireland and Facebook Norway will be reimbursed approximately NOK 83 million paid under the NDPA’s invalid decision.