The Spanish Data Protection Agency AEPD has made orders to stop two election products from Meta Platforms Ireland Limited. The products were meant to go live ahead of the upcoming European Parliament elections, but have been blocked over GDPR concerns.

The Election Day Information and Voter Information Unit functionalities will provide Facebook and Instagram users with information about the EU elections. However, AEPD, Agencia Española de Protección de Datos, is concerned that Meta will process unnecessary personal data while delivering the service.

The functionalities were due to roll out on June 6. Meta plans to process personal data such as user name, IP address, age and gender, or information on how it interacts with those functionalities, and more. According to AEPD, this could breach data protection principles of lawfulness, data minimization and storage limitation.

“The Agency considers that the data collection and storage planned by the company would put at serious risk the rights and freedoms of Instagram and Facebook users, who would see an increase in the volume of information Meta collects about them, allowing for more complex, detailed and exhaustive profiling, and generating more intrusive processing,” the AEPD said.

Italian action

The two tools are planned to be launched for all users who have the right to vote in the European elections – with the exception of Italy, which has also taken similar action.

The AEPD says that making personal data available to third parties would “entail a disproportionate interference in the rights and freedoms of data subjects.” And says that the loss of control carries “a high risk of such data being used by unknown controllers and for non-explicit purposes.”

“The Agency considers that the data collection and storage planned by the company would put at serious risk the rights and freedoms of Instagram and Facebook users.”

AEPD

In a statement to Reuters, a spokesperson from Meta said: “Our election tools have been expressly designed to respect users’ privacy and comply with the GDPR. While we disagree with the AEPD’s assessment in this case, we have cooperated with their request.”

The Spanish temporary ban on these functionalities is valid for a maximum period of three months.

Proceedings by the European Commission

Earlier in April, the European Commission also announced formal proceedings against Meta for potential breaches of the Digital Services Act relating to its policies and practices around deceptive advertising and political content on its sites.

The Commission’ announced it would look into:

• potentially deceptive advertisements and disinformation;
• visibility of political content;
• the non-availability of an effective third-party real-time civic discourse and election-monitoring tool ahead of the upcoming elections to the European Parliament and other elections in various Member States;
• the mechanism to flag illegal content. 

If Meta is found to be breaching all those pillars, the Commission says it would constitute infringements of Articles 14(1), 16(1), 16(5), 16(6), 17(1), 20(1), 20(3), 24(5), 25(1), 34(1), 34(2), 35(1) and 40(12) of the Digital Services Act.

“This Commission has created means to protect European citizens from targeted disinformation and manipulation by third countries. If we suspect a violation of the rules, we act. This is true at all times, but especially in times of democratic elections,” said Commission President Ursula von der Leyen. “Big digital platforms must live up to their obligations to put enough resources into this and today’s decision shows that we are serious about compliance.”