What did the European Court of Justice (ECJ) decide?
The ECJ has restricted the use of personal data by companies. According to the court, it contradicts the principle of “data minimization” set out in the General Data Protection Regulation (GDPR) if all personal data is “aggregated, analyzed and processed for the purposes of targeted advertising for an unlimited period of time and without distinction according to their type”. However, the ECJ did not specify how long data may be stored.
How did the verdict come about?
The background is a lawsuit by the Austrian data protection activist Max Schrems. In the past, Schrems had already achieved two spectacular successes before the ECJ against Facebook, which affected the entire data exchange between the USA and the EU. In the case now decided, he complains that Meta is not adhering to the principle of “data minimization” from the GDPR and is simply storing all online behavior instead of limiting processing to the necessary extent.
The ECJ also addressed the question of whether the information about Schrems’ sexual orientation could be used for personalized advertising. He spoke about his homosexuality in a panel discussion.
What does the ECJ say about the use of particularly personal data?
The ECJ ruled that the blatant public disclosure of sexual orientation information could result in it being allowed to be processed in compliance with the GDPR. “However, this fact alone does not justify the processing of other personal data relating to the sexual orientation of that person,” the Court said.
Just because someone talks about their sexual orientation on a panel discussion, operators of online platforms are not allowed to simply use further data about the user’s sexual orientation for personalized advertising that they have received from third parties, for example. The Austrian Supreme Court must now decide whether the use in this specific case complied with data protection regulations.
What do plaintiffs and defendants say?
“We are very pleased with the verdict,” said Katharina Raabe-Stuppnig, Schrems’ lawyer. Meta has basically been building up a huge database about users for 20 years, which is growing every day. According to this ruling, only a small part of Meta’s data pool may be used for advertising.
Meta emphasized that the company takes data protection very seriously and has invested over five billion euros to integrate data protection into the heart of all products. Meta also pointed out that every Facebook user has access to a variety of settings and tools to control the use of their data.
What effects will companies now face?
The industry association Bitkom expects the ruling to have a major impact. “It increases the uncertainty for companies when processing data for advertising purposes, as it remains unclear how exactly the limit for the intended data processing should be set,” said Susanne Dehmel, member of the Bitkom management team. Companies must now clarify how long and to what extent they are allowed to use personal data.
Before the ruling, data protection lawyer Daniel Rücker did not assume that Facebook’s business model was shaky, but: “Everyone who works with targeted advertising, i.e. target group-specific advertising, is affected by this ruling.” Another aspect is also crucial: “If the General Data Protection Regulation has been violated, users can demand compensation.”
