DUBLIN - Ireland’s data privacy regulator fined Meta €390 million (S$554 million) on Wednesday for breaches at its Facebook and Instagram services, and said both services must reassess the legal basis of how they run advertising based on personal data in the European Union.

The decision follows a binding order by the European Data Protection Board (EDPB), the EU body overseeing national data watchdogs, laying out which way the Irish regulator’s final decision concerning Meta’s units should go.

It related to a 2018 change in the terms of service at Facebook and Instagram following the introduction of new EU privacy laws, where Meta sought to rely on the so-called “contract” legal basis for most of its processing operations.

Having previously relied on the consent of users to the processing of their personal data for targeted advertising, Meta instead considered that a contract was entered into upon acceptance of the updated 2018 terms and that this made such advertising lawful.

Ireland’s Data Privacy Commissioner (DPC), which is the lead privacy regulator for many of the world’s largest technology companies within the EU, directed Meta to bring its data processing operations into compliance within three months.

The penalties brought the total fines levied against Meta to date by the DPC to €1.3 billion. It currently has 11 other inquiries open into Meta services.

The DPC said that as part of its decision, the EDPB had purported to direct the Irish regulator to conduct a fresh probe that would span all of Facebook and Instagram’s data processing operations.

The DPC said it was not the role of the board to direct an authority to engage in such probes and that it intended to ask the EU Court of Justice to set aside the board’s direction, as it may involve an “overreach”.

Meta said it will appeal against the DPC’s decision.

REUTERS, BLOOMBERG