Personalized advertising
ECJ restricts data use by Facebook and Co
The ECJ ruled on data protection in personalized advertising. (Symbolic image) photo
© Jens Büttner/dpa
Are social networks allowed to store their users’ data indefinitely for advertising purposes? The ECJ has now made a ruling on this issue.
The background is a lawsuit by the Austrian data protection activist Max Schrems. In the past, he had achieved two spectacular successes before the European Court of Justice (ECJ) in his disputes with Facebook, which affected the entire data exchange between the USA and the European Union.
Schrems and his organization noyb complained that Meta did not adhere to the principle of “data minimization” from the GDPR and simply stored all online behavior instead of limiting processing to the necessary extent.
Schrems’ lawyer welcomes the verdict
“We are very pleased with the verdict,” said Katharina Raabe-Stuppnig, a lawyer for Schrems. Meta has basically been building up a huge database about users for 20 years, which is growing every day. According to this ruling, only a small part of Meta’s data pool may be used for advertising.
“Meta takes privacy very seriously and has invested more than five billion euros to build privacy into the heart of all our products. Anyone who uses Facebook has access to a wide range of settings and tools that enable users “to control the use of their data,” explained Meta.
Special protection applies to information about sexual orientation
Another point in the lawsuit was the processing of sensitive data such as sexual orientation. The GDPR provides special protection for this data and may only be used in certain exceptional cases. Such an exception exists, for example, if the information has already been made public. This question arose in the present case because Schrems had spoken about his homosexuality at a panel discussion and thus possibly made it so public that its use by Facebook for personalized advertising could be justified.
“The fact that a data subject has obviously made data about their sexual orientation public means that this data can be processed in compliance with the provisions of the GDPR,” said the ECJ. It cannot be ruled out that Schrems obviously made his sexual orientation public at the event. The Austrian Supreme Court must decide whether this information was used in accordance with data protection regulations.