Are social networks allowed to store their users’ data indefinitely for advertising purposes? This question can now be answered with “no”. The European Court of Justice (ECJ) has now made a corresponding ruling on this issue.
Data use contradicts the principle of data minimization
The reasoning behind the judgment states: It is contrary to the principle of “data minimization” set out in the General Data Protection Regulation (GDPR) if all personal data is “aggregated, analyzed and processed for an unlimited period of time and without distinction according to their type for the purposes of targeted advertising”. the highest European court.
The background is a lawsuit by the Austrian data protection activist Max Schrems. In the past, he had achieved two spectacular successes before the ECJ in his disputes with Facebook, which affected the entire data exchange between the USA and the European Union.
Schrems and his organization noyb complained that the Internet company Meta, which, among other things, Facebook does not adhere to the principle of data minimization set out in the GDPR. Meta would simply store all online behavior rather than limiting processing to what is necessary.
Plaintiff’s lawyer welcomes the verdict: data is growing every day
“We are very pleased with the verdict,” said Katharina Raabe-Stuppnig, a lawyer for Schrems, in an initial reaction. Meta has basically been building up a huge database about users for 20 years, which is growing every day. According to this ruling, only a small part of Meta’s data pool may be used for advertising.
“Meta takes privacy very seriously and has invested more than five billion euros to build privacy into the heart of all our products. Anyone who uses Facebook has access to a wide range of settings and tools that enable users “to control the use of their data,” explained Meta.
Special protection applies to information about sexual orientation
Another point in the lawsuit was the processing of sensitive data, such as sexual orientation. The GDPR provides special protection for this data and may only be used in certain exceptional cases. Such an exception exists, for example, if the information has already been made public.
This question arose in the present case because Schrems had spoken about his homosexuality at a panel discussion and thus possibly made it so public that its use by Facebook for personalized advertising could be justified.
“The fact that a data subject has obviously made data about their sexual orientation public means that this data can be processed in compliance with the provisions of the GDPR,” said the ECJ. It cannot be ruled out that Schrems obviously made his sexual orientation public at the event. The Austrian Supreme Court must decide whether this information was used in accordance with data protection regulations.
