ECJ bans meta-processing of certain sensitive user data

The European Court of Justice (ECJ) has put a stop to the processing of certain personal user data by Facebook parent Meta. “An online social network such as Facebook may not use all personal data indefinitely and without distinction according to their type,” the judges wrote in their ruling published on Friday. They followed the recommendation of Attorney General Athanasios Rantos in April.

“We are very satisfied with the verdict, even if this result was entirely to be expected,” says lawyer Katharina Raabe-Stuppnig, who represents Max Schrems. “Meta has basically been building up a huge pool of data about users for 20 years, which is growing every day. However, EU law requires ‘data minimization’. According to this ruling, only a small part of Meta’s data may be used for advertising purposes – even if Users agree to the advertising. This ruling also applies to all other online advertising companies, which often do not have data minimization procedures.

The Austrian data protection activist Maximilian Schrems had sued against the processing of his personal data, particularly regarding his sexual orientation. However, Schrems made this public during a panel discussion. The ECJ ruled that this information may be processed for targeted advertising in compliance with the European General Data Protection Regulation (GDPR).

“The fact that Mr. Maximilian Schrems disclosed his sexual orientation in a public panel discussion does not allow the operator of an online social network platform to process other data about Mr. Schrems’ sexual orientation that he may have provided outside of this platform with a view to aggregating and analyzing them in order to offer Mr Schrems personalized advertising,” said the ECJ.

According to the ECJ, Mr Maximilian Schrems is appealing to the Austrian courts against what he believes to be unlawful processing of his personal data by Meta Platforms Ireland within the framework of the online social network Facebook. This involves, among other things, data on his sexual orientation.

“Meta Platforms collects personal data from Facebook users, including Mr. Schrems, about their activities within and outside of this social network. This includes, among other things, data about access to the online platform as well as third-party websites and applications. For this purpose, Meta Platforms uses “Cookies”1, “social plugins”2 and “pixels”3 built into the relevant websites,” it continues.
“Meta Platforms can also use the data available to it to identify Mr. Schrems’ interest in sensitive topics such as sexual orientation, which enables it to direct targeted advertising to him. This raises the question of whether Mr. Schrems has sensitive issues concerning him obviously made personal data public by disclosing the fact that he was homosexual during a public panel discussion and thus approved the processing of this data in accordance with the General Data Protection Regulation (GDPR)6. In this context, the Austrian Supreme Court has decided Court asked to interpret the GDPR.”

And the ECJ continues: “Firstly, the Court answers that the principle of “data minimization” set out in the GDPR precludes all personal data that a controller, such as the operator of an online social network platform, from the data subject or receives from third parties and which have been collected both on and outside of this platform, will be aggregated, analyzed and processed for the purposes of targeted advertising for an unlimited period of time and without distinction according to their type.”

Secondly, according to the Court, it cannot be ruled out that Mr Schrems obviously made his sexual orientation public through his statement at the panel discussion in question
has. It is up to the Austrian Supreme Court to judge this.

“The fact that a data subject has clearly made data relating to his or her sexual orientation public means that this data can be processed in compliance with the provisions of the GDPR. However, this circumstance alone does not authorize the processing of other personal data relating to the sexual orientation of this person,” said the European judges. Therefore, the fact that a person has commented on his or her sexual orientation in a public panel discussion does not allow the operator of an online social network platform to process other data about his or her sexual orientation that he may have collected outside of that platform from applications and Third party websites with a view to aggregating and analyzing them in order to offer personalized advertising to that person.”