We have more details on the record GDPR fine of last week:
- the core issue was indeed the lawful ground for processing personal data for targeted advertising.
- more precise, 6(1)(b) #GDPR (contract) was found not to be the correct lawful ground for the targeted advertising. 1/n https://t.co/3dEUmskzfF

- the fine comes w attachments: there is also an order to stop the sanctioned conduct within 6 months (which could mean, for example, switching the lawful ground), otherwise a further penalty of 736K EUR per day could be added until remedied;
- the EDPB approved the decision. 2/n

We don't have insight into the decision-making within the EDPB, which I presume was a part of the consistency mechanism. This mechanism allows the self-identified concerned DPAs in a cross-border case, like this one, to raise objections to the draft decision within 4 weeks 3/n

If there is no objection being raised, the Lead DPA (Luxembourgish DPA in this case) can proceed to adopt the decision. We can only presume that there were no objections raised to the findings, the amount of the fine etc. In other cases (eg Twitter-DPC),objections were raised 4/n

The decision is in line with the Guidelines issued in 2019, on the use of Article 6(1)(b) - contract - in the context of the provisions of online services to data subjects. The question is: will the 2018 1st wave of #GDPR complaints become a tsunami? 5/5
https://t.co/h8aIC52BY1

OK, I know I said 5/5, but I'll add one more. See how the geekiest of GDPR provisions, Art. 6, is the one that really matters? This is why breaching Art. 6 falls in the higher tier of fines, as opposed to, say, data breaches, which falls in the lower tier. 6/5 😅