NOTE: Compare the DPC's summaries of the submissions by the complainant against the relevant documents, as arguments are partly missing, not accurately reflected or taken out of context.
analysis to Facebook in relation to the correct interpretation of the provisions in question and the requisite information that is absent from the relevant user-facing documents. This specificity should negate any need for extensive engagement with the Commission during the period of implementation, and provides clarity for Facebook as to what objective its very significant resources should be directed towards in order to comply with this order. As such, I am not satisfied that it would be impossible or indeed disproportionate to make an order in these terms, having regard to the importance of the data subject rights involved, the specificity of the order and Facebook’s resources. 8.5 I therefore order that the Terms of Service and Data Policy be brought into compliance within three months. 8.6 I consider that this order is necessary to ensure that full effect is given to Facebook’s obligations under Articles 5(1)(a), 12(1), and 13(1)(c) GDPR in light of the infringements outlined above. The substance of this proposed order is the only way in which the defects pointed out in this Preliminary Draft Decision can be rectified, which is essential to the protection of the rights of data subjects. It is on this basis that I am of the view that this power should be imposed. Facebook disagrees and states that it is already voluntarily attempting to alter the documents to express the views set out in the Preliminary Draft Decision, and would therefore like to continue using “less onerous means” to ensure compliance.122 8.7 However, having regard to the non-compliance in this Draft Decision, in my view, such an order is proportionate and is the minimum order required in order to guarantee that compliance will take place in the future. The fact that Facebook is already taking steps to bring its information into compliance would be nothing practically onerous about an order to carry out something that Facebook already intends to carry out. On that basis I see nothing in these arguments to suggest a lack of proportionality arises in relation to such an order.
9
ADMINISTRATIVE FINE
9.1 I note that Article 58(2)(i) GDPR permits me to consider the imposition of an administrative fine, pursuant to Article 83 GDPR, “in addition to, or instead of” the other measures outlined in Article 58(2), depending on the circumstances of each individual case. This is also reflected in Section 115 of the 2018 Act, which permits the Commission to impose an administrative fine on its own or in combination with any other corrective power specified in Article 58(2) GDPR. Article 83(1) GDPR, in turn, identifies that the administration of fines “shall in each individual case be effective, proportionate and dissuasive”. 122
Ibid, paragraphs 12.2 and 12.3.
