Ireland’s data protection regulator DPC submitted a draft decision and sent it to other data protection authorities in the EU. It’s part of the country’s investigation under GDPR into how Instagram uses kid’s data.
Article 60 Draft Decision
Two separate inquiries were opened in September 2020, examining how Facebook-owned Instagram processes data for minors.
This is part of the process under Article 60 of the GDPR, where we send draft decisions to other Concerned Supervisory Authorities and they have one month to send us their “reasoned and relevant objections”. This is the seventh DPC inquiry to have reached the Article 60 stage under the GDPR. In addition to this Instagram inquiry, two other DPC inquiries into Facebook are currently at the Article 60 stage.
Instagram faced complaints about its data processing. Data scientist David Stier wrote about business accounts on the social media platform. Instagram users can change their personal account to a business account, and this gives them statistics into how popular their content is doing.
But if a child, or anyone else, switches to a business account, personal information such as phone numbers and email addresses are displayed on the profile. “Age verification is typically not required unless you give some indication that you are under the age of 13 (such as writing in your bio that you are in the 4th grade or were born 10 years ago).”
We’ll likely see the results of the inquiries in 2022.