Meta must limit data use for personalised ads, says EU court

The ruling stems from a complaint in which it is alleged that Facebook unlawfully processed personal data pertaining to sexual orientation.

The EU’s highest court has ruled in favour of privacy campaigner Max Schrems, who said Facebook misused data about his sexual orientation to target him with personalised ads.

The Court of Justice for the European Union (CJEU) said that an online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising.

The ruling stems from a complaint Schrems brought to the Austrian courts, in which he said the Meta-owned platform had unlawfully processed his personal data.

Using data Meta collects concerning users’ activity both on and outside of the social network, the company is able to identify interest in sensitive topics, such as sexual orientation.

Data relating to someone’s sexual orientation, race or ethnicity or health status is classed as sensitive and carries strict requirements for processing under EU data protection law.

The CJEU said that the principle of data minimisation provided for by the GDPR, means that all of the personal data obtained by Meta cannot be “aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time and without distinction as to type of data”.

Added to this case was the question of whether or not a public declaration of information such as sexual orientation meant it was lawful to use.

Under GDPR, information that is “manifestly made public” may be processed by a company, because the legislator assumes that the data subject agreed to the use.

Schrems mentioned his sexual orientation at an event in Vienna. However, he argued that his public comments were made years after the processing of other information took place, meaning his later comments could not be seen as an agreement to the processing of previous data.

“The fact that a person has made a statement about his or her sexual orientation on the occasion of a public panel discussion does not authorise the operator of an online social network platform to process other data relating to that person’s sexual orientation, obtained, as the case may be, outside that platform using partner third-party websites and apps, with a view to aggregating and analysing those data, in order to offer that person personalised advertising,” the CJEU said.

Katharina Raabe-Stuppnig, the lawyer representing Schrems said: “Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day. However, EU law requires ‘data minimisation’.

“Following this ruling only a small part of Meta’s data pool will be allowed to be used for advertising – even when users consent to ads. This ruling also applies to any other online advertisement company, that does not have stringent data deletion practices.”

In a statement sent to SiliconRepublic.com, a Meta spokesperson said: “We are studying the court’s judgment and will have more to share in due course. Meta takes privacy very seriously and has invested over €5bn to embed privacy at the heart of all of our products. Everyone using Facebook has access to a wide range of settings and tools that allow people to manage how we use their information.” The company also said it does not use special categories of data that users provide to personalise ads.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.