Judgment of the Court of Justice of the European Union in Schrems v. Meta
In early October, the Court of Justice of the European Union issued a preliminary ruling in the case of Schrems v Meta Platforms Ireland, Ltd.
Content of the dispute
Meta collects data about users and their activities on and off the social network (using cookies, social plugins and pixels) and associates it with the Facebook accounts of the users concerned. This “profile” of each user is then used by the company to create personalised advertising.
Mr Schrems, a Facebook user, has never posted any sensitive information on his profile, for example he has never disclosed his sexual orientation on social media. However, it is precisely thanks to the data available to Meta (e.g. the pages visited) that Meta can identify even this sensitive data.
The Court of Justice has already commented on this procedure, and we have already discussed this judgment in previous articles, including the “pay-or-accept” model that Meta has introduced following this decision.
Mr. Schrems received advertisements targeting the homosexual public and invitations to relevant events, even though he had never been interested in them before. Also, a list of his non-Facebook activities maintained by Meta included websites offering introductions to homosexuals. Although Mr Schrems had publicly disclosed the fact that he was homosexual, he had never mentioned his sexual orientation on his social network profile. Schrems therefore claims that Meta’s processing of his personal data violates several provisions of the GDPR and has filed a lawsuit in an Austrian court.
The Austrian Supreme Court referred the matter to the Court of Justice of the European Union for preliminary rulings.
Opinion delivered by the Court of Justice of the European Union
Data minimisation principle
According to the Court of Justice, such data processing is characterised by a serious interference with the fundamental rights of data subjects and the principle of data minimisation prevents all personal data obtained by such a controller (such as a social network operator) from the data subject or third parties from being aggregated, analysed and processed for the purposes of personalised advertising, without time limitation and without distinction as to the nature of the data.
Blatant disclosure?
Although Mr Schrems made a statement about his sexual orientation in the public debate, Meta was already processing personal data about Mr Schrems’ sexual orientation at the time of the debate. Even though Mr Schrems has clearly disclosed his sexual orientation within the meaning of Article 9(2)(e) of the GDPR, this circumstance does not in itself allow for the processing of further personal data relating to his sexual orientation. Further, the fact that a person has apparently disclosed information relating to his sexual orientation does not make it possible to consider that he has given his consent within the meaning of the GDPR to the processing of further data relating to his sexual orientation.
If you would like more information in this regard, please do not hesitate to contact us.
This article is for informational purposes only and does not constitute legal advice or guidance for any particular case.