The Advocate General has delivered his opinion in Case C-446/21 | Schrems.
In 2018, Meta Platforms Ireland started using new Facebook terms of service in the EU. Consent to those terms is required to sign up for, or access, Facebook’s accounts and services. Mr Maximilian Schrems (S) a Facebook user and well-known activist in the field of data protection, accepted these terms.
Following that, he said he had regularly received advertisements directed at homosexuals and invitations to corresponding events. He argued that those advertisements were not based directly on his sexual orientation, but were based on an analysis of his particular interests.
S was dissatisfied with the processing of his data which he considered to be unlawful and so brought an action before the Austrian courts. Subsequently, during a panel discussion, he publicly referred to his homosexuality, but did not publish anything on his Facebook profile.
The Austrian Supreme Court referred the issue to the CJEU, asking if:
- a network such a Facebook may analyse and process all the personal data available to it for an indefinite period to produce targeted advertising; and
- if a statement made by a person about their sexual orientation as part of a panel discussion permits the processing of other data concerning that topic to offer that person targeted advertising.
First question: Advocate General Athanasios Rantos proposes that the Court should rule that the GDPR prohibits the processing of personal data for targeted advertising without a time restriction. The national court should consider the principle of proportionality and assess the extent to which the data retention period and the amount of data processed are justified having regard to the legitimate aim of processing that data for personalised advertising.
Second question: The Advocate General takes the view, subject to the findings of fact to be made by the Austrian Supreme Court, that the fact that S has made a statement concerning his own sexual orientation during a panel discussion open to the public may constitute an act by which he ‘manifestly made public’ that information under the GDPR. While data concerning sexual orientation falls into the category of data that enjoys special protection and the processing of which is prohibited, that prohibition does not apply when the information is manifestly made public by the data subject. Nevertheless, this does not in itself permit the processing of that data for personalised advertising.
