The Irish Data Protection Commission (DPC) yesterday fined Facebook and Instagram a total of €390m after the conclusion of two inquiries into the platforms' parent company Meta.
The breaches related to the processing of personal data for the purposes of behavioural advertising.
A €210m fine was imposed on Facebook while Instagram was hit with a €180m penalty.
Helen Dixon, the Data Protection Commissioner for Ireland, told RTÉ's Morning Ireland that a "significant quantum (of money is) pending" to the Irish exchequer as a result of the breaches of user data by Facebook and Instagram in 2018.
Ms Dixon said that she does not expect Facebook and Instagram to carry on as they have been when it comes to issues like personalised ads as a result of the investigation.
She said the complaints received in May 2018 - and which were investigated - reflected a concern that new terms of service introduced by Facebook and Instagram alongside a new legal basis for processing of personal data on the platform, amounted to a "forcing of consent" to the processing of personal data under GDPR.
Before a fine can be imposed, the DPC must bring a draft of the decision to all other peer EU data protection authority, and any can lodge relevant and reasoned objections to the decision which they did.
The issues of dispute was around whether Facebook and Instagram could rely on the contract of "I accept", which includes serving behavioural ads on individuals.
We need your consent to load this rte-player contentWe use rte-player to manage extra content that can set cookies on your device and collect data about your activity. Please review their details and accept them to load the content.Manage Preferences
Due to being unable to resolve the objections from some of the authorities, the DPC was obliged to trigger the dispute resolution process where the EU Data Protection Board takes over, and it decides the matter.
It already rejected some objections that were not relevant or reasoned but found in favour on the issue of legal basis, and so the Board differed from DPC as Facebook could not rely in principle on contract as the legal basis for the process.
Following this, the DPC has 30 days to incorporate into a final decision
Helen Dixon said the DPC took the view that based on commercial freedom, it is open to a company to design the service and contract to support the service it wants to offer, and then users have the free will to accept or not accept.
She also said that she does not expect Facebook and Instagram to carry on as they have been, as corrective orders have been imposed that requires bringing processing to compliance within three months and will have to do that.
She added that fines can be collected once confirmed by courts in Ireland, but they can only get them if an appeal has not been lodged and legal proceedings have been finalised.
But once confirmed, the money goes to the central Irish exchequer account and it will remain to be seen when and how much is collected this time but there is a "significant quantum pending", she added.
