Cybersecurity Policy Report, EU Court Calls for Limits on Personal Data Use by Social Media Platforms, (Oct 4, 2024)
The Court of Justice of the European Union (CJEU) has ruled that online social networks, such as Facebook, cannot harvest users’ personal data for targeted advertising without restrictions.
Meta Platforms, Inc., collects personal data from Facebook users, including information about their activities both on and outside the social network, the court noted. This includes data about online platform visits and third-party websites and apps. By using cookies, social plug-ins, and pixels embedded on relevant websites, the company can identify users' interests, including sensitive topics like sexual orientation, and direct targeted advertising towards them, it said.
The CJEU decision comes after Max Schrems, a European privacy activist, sued Meta in Austria, alleging that Facebook unlawfully processed his personal data, including data regarding his sexual orientation, in violation of the European Union’s General Data Protection Regulation (GDPR).
The Supreme Court of Austria asked the CJEU to interpret the GDPR as it relates to whether Mr. Schrems manifestly made public sensitive personal data about himself by disclosing his sexual orientation during a public panel discussion, thereby authorizing the processing of that data under the GDPR.
The CJEU clarified that the principle of data minimization, as outlined in the GDPR, prevents online social network platforms from aggregating, analyzing, and processing all personal data obtained from users without any time restrictions or distinctions as to type of data.
Furthermore, the CJEU acknowledged that Mr. Schrems may have made his sexual orientation public during a public panel discussion, but that did not give the operator of an online social network platform the authorization to process other personal data related to that individual's sexual orientation.
The CJEU ruling emphasizes that while a person's public statement about their sexual orientation may allow the processing of that specific data under the GDPR, it does not grant permission to process additional personal data obtained from partner third-party websites and apps outside the platform.
“We are very pleased by the ruling, even though this result was very much expected,” Katharina Raabe-Stuppnig, Mr. Schrems’ lawyer, said in a news release from Mr. Schrems’ organization, the European Center for Digital Rights.
“Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day. However, EU law requires ‘data minimisation.’ Following this ruling only a small part of Meta's data pool will be allowed to be used for advertising—even when users consent to ads,” Ms. Raabe-Stuppnig added. “This ruling also applies to any other online advertisement company that does not have stringent data deletion practices.”
News: DataPrivacy GDPR LitigationEnforcement