The Court of Justice of the European Union has ruled in Case C-446/21 | Schrems. It said that an online social network such as Facebook cannot use all the personal data obtained for targeted advertising, without restriction as to time and without distinction as to type of data.
In 2018, Meta Platforms Ireland started using new Facebook terms of service in the EU. Consent to those terms is required to sign up for, or access, Facebook’s accounts and services. Mr Maximilian Schrems (S) a Facebook user and well-known activist in the field of data protection, accepted these terms.
Following that, he said he had regularly received advertisements directed at homosexuals and invitations to corresponding events. He argued that those advertisements were not based directly on his sexual orientation, but were based on an analysis of his particular interests.
S was dissatisfied with the processing of his data which he considered to be unlawful and so brought an action before the Austrian courts. Subsequently, during a panel discussion, he publicly referred to his homosexuality, but did not publish anything on his Facebook profile.
The Austrian Supreme Court referred the issue to the CJEU, asking if:
- a network such a Facebook may analyse and process all the personal data available to it for an indefinite period to produce targeted advertising; and
- if a statement made by a person about their sexual orientation as part of a panel discussion permits the processing of other data concerning that topic to offer that person targeted advertising.
The Advocate-General gave an opinion in April 2024 and the Court has now given its judgment.
It said that the principle of data minimisation in the GDPR precludes all of the personal data obtained by a controller, such as the operator of an online social network platform, from the data subject or third parties and collected either on or outside that platform, from being aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time and without distinction as to type of data.
Second, the Court said that the possibility cannot be ruled out that, by his statement at the panel discussion in question, S manifestly made his sexual orientation public. It is for the Supreme Court, Austria, to verify if this was the case. If a data subject manifestly makes public data concerning their sexual orientation, that information may be processed in compliance with the GDPR. However, that fact alone does not authorise the processing of other personal data relating to that data.
Consequently, the fact that someone has made a statement about their sexual orientation during a public panel discussion does not authorise an online social network platform to process other data relating to that person’s sexual orientation, with a view to aggregating and analysing that data, to offer that person personalised advertising.
