Today October 4, 2024, the Court of Justice of the European Union (CJEU) has fully backed a lawsuit brought against Meta, C-446/21 (Schrems v. Meta) over its Facebook service. The Court decided on two questions: First, massively limiting the use of personal data for online advertisements. Secondly, limiting the use of publicly available personal data to the originally intended purposes for publication.
The case concerns a civil procedure between Max Schrems, as an individual, and Meta Ireland Platforms Limited (as the operator of “Facebook”) before the Austrian Courts. The case was first filed in 2014 and first fully heard in Austria in 2020 and concerns a large number of GDPR violations, including the lack of a legal basis for advertising and the like. Mr Maximilian Schrems brought an action before the Austrian courts challenging the, in his submission unlawful, processing of his personal data by Meta Platforms Ireland in the context of the online social network Facebook. Those data include inter alia data concerning his sexual orientation. With the data available to it, Meta Platforms Ireland is also able to identify Mr Schrems’ interest in sensitive topics, such as sexual orientation, which enables it to direct targeted advertising at him. In that regard, the question then arises as to whether Mr Schrems manifestly made public sensitive personal data about himself by having disclosed, on the occasion of a public panel discussion, the fact that he was homosexual, and thus authorised the processing of those data under the General Data Protection Regulation (GDPR). the Supreme Court, Austria, requested the Court of Justice to interpret the GDPR.
Original Question 2: “Is Article 5(1)(c) of the GDPR (data minimisation) to be interpreted as meaning that all personal data held by a platform such as that in the main proceedings (by way of, in particular, the data subject or third parties on and outside the platform) may be aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time or type of data?”
Response of the Court: Use of data for advertising must be “minimised” The application of the ‘data minimisation principle’ radically restricts the use of personal data for advertising. The principle of data minimisation applies regardless of the legal basis used for the processing, so even a user who consents to personalised advertising cannot have their personal data used indefinitely. That principle precludes all of the personal data obtained by a controller, such as the operator of an online social network platform, from the data subject or third parties and collected either on or outside that platform, from being aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time and without distinction as to type of data.
Original Question 4: “Is Article 5(1)(b) of the GDPR, read in conjunction with Article 9(2)(e) thereof, to be interpreted as meaning that a statement made by a person about his or her own sexual orientation for the purposes of a panel discussion permits the processing of other data concerning sexual orientation with a view to aggregating and analysing the data for the purposes of personalized advertising?”
Response of the Court: Public criticism does not allow processing. The consequence of the fact that a data subject has manifestly made public data concerning his or her sexual orientation is that those data may be processed in compliance with the provisions of the GDPR.
However, that fact alone does not authorize the processing of other personal data relating to that data
subject’s sexual orientation. Thus, the fact that a person has made a statement about his or her sexual orientation on the occasion of a public panel discussion does not authorize the operator of an online social network platform to process other data relating to that person’s sexual orientation, obtained, as the case may be, outside that platform using partner third-party websites and apps, with a view to aggregating and analyzing those data, in order to offer that person personalized advertising.
Source: https://noyb.eu/en/cjeu-meta-must-minimise-use-personal-data-ads ;
Add a Comment