In principle, Facebook could have collected personal data from users since its founding in 2004 and used it for advertising. This is exactly what the European General Data Protection Regulation (GDPR) is intended to prevent; the principle of “data minimization” applies.
This means that only absolutely necessary data may be processed for online advertising – even if you have agreed in principle to the use of personal data. The Max Schrems NGO noyb criticizes in a broadcast that practically no one in the industry adheres to this principle. “So far, Meta and many players in the online advertising sector have simply ignored this rule and have not provided for deletion periods or restrictions based on the type of personal data,” it says.
But that could now change with the ECJ ruling. “An online social network such as Facebook may not use all personal data indefinitely and without distinguishing between their types,” the Court refers to the GDPR – thereby agreeing with Schrems’ point of view.
Facebook also collects data outside of its own platform
He had complained in Austria about the use of his – not least sensitive – personal data. Schrems spoke about his sexual orientation at a public panel discussion, but did not indicate it in his Facebook profile.
APA/AFP/Joe Klamar The ECJ found Schrems right in key points
Meta collects personal data from Facebook users on the platform itself and outside of it, as the ECJ explained. This included visits to other websites. In this case, Meta could use the data to recognize that the man is interested in certain topics and send targeted advertising to him.
The ECJ was involved in the panel discussion
An analysis of his data stored by Meta showed that conclusions could be drawn about Schrems’ sexual orientation. In addition, he had received relevant advertising years before the event, said Schrems in an interview with the Reuters news agency.
The ECJ has now ruled that Schrems’ statements from the panel discussion could be processed for targeted advertising in compliance with the GDPR. “However, this fact alone does not authorize the processing of other personal data relating to the sexual orientation of that person.”
Noyb sees the judgment as fundamental
Schrems also points out in the broadcast that the principle of “purpose limitation” applies and “that information that is passed on for the purpose of criticizing unlawful processing by Meta does not (retroactively) allow the use of personal data for a completely different purpose. such as B. advertising, can enable”.
Schrems told Reuters he was satisfied with the verdict. “Companies now have to think about a deletion concept for the data they have collected and think about which data they have collected in recent years they can keep.” Katharina Raabe-Stuppnig, Schrems’ lawyer, pointed out that the decision is fundamental. “This ruling also applies to all other online advertising companies, which often do not have data minimization procedures in place.”
Meta refers to investments in data protection
Meta pointed out that it had invested more than five billion euros in data protection. Advertisers are also not allowed to share sensitive data. “Everyone who uses Facebook has access to a wide range of settings and tools that allow users to control how their data is used.”
In the past, Schrems had already achieved two successes before the ECJ in his disputes with Facebook. These concerned data exchange between the USA and the European Union.
