DATA PROTECTION
EU Court of Justice: an online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data.
The fact that Mr Maximilian Schrems has made a statement about his sexual orientation on the occasion of a public panel discussion does not authorise the operator of an online social network platform to process other data relating to his sexual orientation, obtained, as the case may be, outside that platform, with a view to aggregating and analysing those data, in order to offer him personalised advertising.
Maximilian Schrems brought an action before the Austrian courts challenging the, in his submission unlawful, processing of his personal data by Meta Platforms Ireland in the context of the online social network Facebook. Those data include inter alia data concerning his sexual orientation. Meta Platforms Ireland collects the personal data of Facebook users, including Maximilian Schrems, concerning those users’ activities both on and outside that social network, including in particular data relating to online platform visits and third-party websites and apps. To that end, Meta Platforms Ireland uses ‘cookies’, ‘social plug-ins’ and ‘pixels’, embedded on the relevant websites. With the data available to it, Meta Platforms Ireland is also able to identify Maximilian Schrems’ interest in sensitive topics, such as sexual orientation, which enables it to direct targeted advertising at him in that regard, the question then arises as to whether Maximilian Schrems manifestly made public sensitive personal data about himself by having disclosed, on the occasion of a public panel discussion, the fact that he was homosexual, and thus authorised the processing of those data under the General Data Protection Regulation (GDPR).
In that context, the Supreme Court, Austria, requested the Court of Justice to interpret the GDPR.
First, the Court replies that the principle of data minimisation provided for by the GDPR precludes all of the personal data obtained by a controller, such as the operator of an online social network platform, from the data subject or third parties and collected either on or outside that platform, from being aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time and without distinction as to type of data.
Second, the Court finds that the possibility cannot be ruled out that, by his statement on the occasion of the panel discussion in question, Maximilian Schrems manifestly made his sexual orientation public. It is for the Supreme Court, Austria, to verify whether this is so.
The consequence of the fact that a data subject has manifestly made public data concerning his or her sexual orientation is that those data may be processed in compliance with the provisions of the GDPR. However, that fact alone does not authorise the processing of other personal data relating to that data subject’s sexual orientation.
Thus, the fact that a person has made a statement about his or her sexual orientation on the occasion of a public panel discussion does not authorise the operator of an online social network platform to process other data relating to that person’s sexual orientation, obtained, as the case may be, outside that platform using partner third-party websites and apps, with a view to aggregating and analysing those data, in order to offer that person personalised advertising.
Maximilian Schrems brought an action before the Austrian courts challenging the, in his submission unlawful, processing of his personal data by Meta Platforms Ireland in the context of the online social network Facebook. Those data include inter alia data concerning his sexual orientation. Meta Platforms Ireland collects the personal data of Facebook users, including Maximilian Schrems, concerning those users’ activities both on and outside that social network, including in particular data relating to online platform visits and third-party websites and apps. To that end, Meta Platforms Ireland uses ‘cookies’, ‘social plug-ins’ and ‘pixels’, embedded on the relevant websites. With the data available to it, Meta Platforms Ireland is also able to identify Maximilian Schrems’ interest in sensitive topics, such as sexual orientation, which enables it to direct targeted advertising at him in that regard, the question then arises as to whether Maximilian Schrems manifestly made public sensitive personal data about himself by having disclosed, on the occasion of a public panel discussion, the fact that he was homosexual, and thus authorised the processing of those data under the General Data Protection Regulation (GDPR).
In that context, the Supreme Court, Austria, requested the Court of Justice to interpret the GDPR.
First, the Court replies that the principle of data minimisation provided for by the GDPR precludes all of the personal data obtained by a controller, such as the operator of an online social network platform, from the data subject or third parties and collected either on or outside that platform, from being aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time and without distinction as to type of data.
Second, the Court finds that the possibility cannot be ruled out that, by his statement on the occasion of the panel discussion in question, Maximilian Schrems manifestly made his sexual orientation public. It is for the Supreme Court, Austria, to verify whether this is so.
The consequence of the fact that a data subject has manifestly made public data concerning his or her sexual orientation is that those data may be processed in compliance with the provisions of the GDPR. However, that fact alone does not authorise the processing of other personal data relating to that data subject’s sexual orientation.
Thus, the fact that a person has made a statement about his or her sexual orientation on the occasion of a public panel discussion does not authorise the operator of an online social network platform to process other data relating to that person’s sexual orientation, obtained, as the case may be, outside that platform using partner third-party websites and apps, with a view to aggregating and analysing those data, in order to offer that person personalised advertising.
