# Record fine for Instagram following EDPB intervention - Type: News - Source: EDPB - Date: 2022-09-15 - Original: https://edpb.europa.eu/news/news/2022/record-fine-instagram-following-edpb-intervention_en#entry-378 - Canonical: https://overview.legal/posts/6279 - Topics: Lawful Basis, Social Media, Notified Body Competence Challenges and Dispute Resolution, Legitimate Interest, Processing Agreement, Marketing, Right to Object, Minors, Supervisory Authorities, Personal Data ## Summary > Following the EDPB’s binding dispute resolution decision of July 28th, the Irish Data Protection Authority (DPA) has adopted its decision regarding Instagram (Meta Platforms Ireland Limited (Meta IE)) and has issued a record GDPR fine of €405 million. ## Full text Brussels, 15 September - Following the EDPB’s binding dispute resolution decision of July 28th, the Irish Data Protection Authority (DPA) has adopted its decision regarding Instagram (Meta Platforms Ireland Limited (Meta IE)) and has issued a record GDPR fine of €405 million.The LSA’s final decision follows an own-volition inquiry into Instagram’s public disclosure of email addresses and/or phone numbers of children using the Instagram business account feature and a public-by-default setting for personal Instagram accounts of children, during the period falling within the temporal scope of the inquiry. A practice which has since ended as a consequence of the LSA’s inquiry. EDPB Chair Andrea Jelinek said: “This is a historic decision. Not just because of the height of the fine - this is the second highest fine since the entry into application of the GDPR - it is also the first EU-wide decision on children’s data protection rights. With this binding decision, the EDPB makes it extra clear that companies targeting children have to be extra careful. Children merit specific protection with regard to their personal data.”The EDPB’s binding decision was adopted on the basis of Art. 65 GDPR, after the Irish DPA as lead supervisory authority (LSA) had triggered the dispute resolution procedure concerning the objections raised by several concerned supervisory authorities (CSAs). Among others, the CSAs issued objections concerning the legal basis for processing and the determination of the fine. The DPC subsequently made amendments to its draft decision following the dispute resolution process.This is the first binding decision of the EDPB addressing one of the fundamental pillars of EU data protection law: the lawfulness of processing in accordance with Art. 6 GDPR. In particular, the EDPB provided further clarification on the applicability of the legal bases of ‘performance of contract’ and ‘legitimate interest’.Meta IE relied on these two legal bases alternatively for the publication of email addresses and/or phone numbers of children who used Instagram business accounts. The EDPB found that there were no grounds for the LSA to conclude that the processing at stake was necessary for the performance of a contract. Consequently, Meta IE could not have relied on Art. 6(1)(b) GDPR as a legal basis for this processing.As regards legitimate interest, as an alternative legal basis for the processing, the EDPB found that the publication of the email addresses and/or phone numbers of children did not meet the requirements under Art. 6(1)(f) GDPR, since the processing was either unnecessary or, if it were to be considered necessary, it did not pass the balancing test required when determining legitimate interest.The EDPB therefore concluded that Meta IE processed children’s personal data unlawfully without a legal basis and instructed the LSA to amend its draft decision in order to establish the infringement of Art. 6(1) GDPR.Finally, the EDPB instructed the LSA to reassess its envisaged administrative fine in accordance with Art. 83(1) and 83(2) GDPR to:This current decision is without any prejudice to any assessments the EDPB may be called upon to make in other cases, including with the same parties.The final decision taken by the Irish DPA is available in the Register for Decisions taken by supervisory authorities and courts on issues handled in the consistency mechanism.For further information regarding the Art. 65 GDPR procedure, please consult the Art. 65 FAQ ## Cited law provisions (6) ### GDPR — gdpr-art-6-par-1-en Processing shall be lawful only if and to the extent that at least one of the following applies: ### GDPR — gdpr-art-6-par-1-pnt-b-en processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; ### GDPR — gdpr-art-6-par-1-pnt-f-en processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. ### GDPR — gdpr-art-83-par-1-en Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive. ### GDPR — gdpr-art-6-en Lawfulness of processing ### GDPR — gdpr-art-65-en Dispute resolution by the Board --- Generated by overview.legal · https://overview.legal/posts/6279 · 2026-08-22