The EU Court of Justice Limits Data Processing for Targeted Advertising

info@josefelgueroso.com

2024-11-28

The Court of Justice of the European Union has imposed restrictions on Meta's ability to process personal data for targeted advertising. The case, brought by privacy activist Maximilian Schrems, addresses two critical aspects of data protection: the scope of data minimization requirements and the processing of sensitive personal data that has been made public.

Background

Meta Platforms Ireland, which manages Facebook's services in the European Union, operated under a significant business model change in late 2023. Until November 5, 2023, Facebook services were provided free of charge to private users. Starting November 6, 2023, Meta introduced a "pay-or-consent" model: users must either consent to having their personal data collected and processed for personalized advertising to maintain free access or pay for an ad-free subscription.

The platform's core business model relies on online advertising tailored to individual users based on their consumer attitudes, interests, and personal circumstances. This personalization is achieved through the automated creation of detailed user profiles, analyzing data collected through multiple sources:

User-provided data through the Facebook platform
Off-Facebook data through cookies, pixels, and social plugins embedded in third-party websites
Data from other Meta group services, including Instagram and WhatsApp

Schrems challenged Meta's data processing practices before the Austrian courts, arguing that the company violated several provisions of the General Data Protection Regulation. Specifically, he contested Meta's processing of his personal data for personalized advertising without valid consent and the company's handling of sensitive data revealing his political beliefs and sexual orientation.

The case progressed through multiple courts: first the Regional Court for Civil Matters in Vienna, then the Higher Regional Court in Vienna, and finally reaching the Austrian Supreme Court. Facing questions about the interpretation of key Data Protection Regulation provisions, particularly regarding data minimization requirements and the processing of special category data, the Austrian Supreme Court referred several questions to the EU Court for preliminary ruling.

Analysis

1. Data Minimization

The Court examined whether Meta’s data processing practices adhered to the principle of data minimization, which mandates that personal data must be “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.”

The judgment clarified that the aggregation and analysis of personal data by Meta for targeted advertising—without limitations on time, type, or necessity—violates the Data Protection Regulation. The Court emphasized that the indiscriminate collection of data, including activities both on and outside Facebook, such as browsing behavior tracked through social plug-ins and pixels, represents a disproportionate interference with users’ fundamental rights to privacy and data protection.

Temporal Limitations: The Court reiterated that data must be processed only for as long as strictly necessary for the purpose of the processing. Prolonged storage or processing for advertising purposes, as in this case, contravenes the Data Protection Regulation.
Proportionality: Even initially lawful data processing may become incompatible with the Data Protection Regulation if the data is no longer necessary for the purpose for which it was collected. Meta’s retention of users’ data for an indefinite period was deemed excessive.
Comprehensive Monitoring: The Court highlighted the extensive nature of Meta’s data processing, which covers nearly all of a user’s online activities, and indicated that it affected users’ private lives and created a sense of constant surveillance.

Ultimately, the Court held that the principle of data minimization prohibits the aggregation of all personal data obtained by a platform like Meta for targeted advertising purposes without appropriate restrictions. Data controllers must strictly limit data collection and processing to what is genuinely necessary for their stated purposes.

2. Processing of Special Categories of Data

The Court evaluated the processing of special categories of personal data under Article 9 of the Data Protection Regulation. The primary question was whether Meta was justified in processing sensitive data related to Mr. Schrems' sexual orientation, derived both from public statements he made and from third-party sources, for the purpose of targeted advertising.

Article 9(1) of the Data Protection Regulation prohibits the processing of special categories of personal data, including data revealing an individual's sexual orientation, unless a specific exception under Article 9(2) applies. Among these exceptions, Article 9(2)(e) permits processing where the data has been "manifestly made public by the data subject."

The Court examined whether Mr. Schrems' statement about his sexual orientation during a panel discussion in Vienna on February 12, 2019, constituted a manifest act of making such data public under Article 9(2)(e). The Court noted that the panel discussion was accessible to the public through tickets, was streamed live, and was later published as a podcast and on the Commission's YouTube channel. While Mr. Schrems made this statement solely to criticize Facebook's data processing practices, the Court indicated that this could potentially qualify as manifestly making the data public, though it left the final verification to the national court.

However, the Court firmly rejected Meta's argument that such public disclosure would authorize the processing of all data related to Mr. Schrems' sexual orientation. The Court emphasized that a restrictive interpretation of Article 9(2)(e) is required - the fact that someone has made their sexual orientation public does not remove Article 9(1) protection from all data relating to that orientation. Furthermore, such public disclosure does not constitute consent under Article 9(2)(a) for processing additional sexual orientation-related data.

The Court concluded that Article 9 of the Data Protection Regulation prohibits Meta from processing additional data about Mr. Schrems' sexual orientation obtained through third-party websites and apps for targeted advertising, even if he had publicly disclosed his orientation in another context. This interpretation reinforces the protective purpose of Article 9(1) and ensures strict limits on the processing of sensitive personal data.

Role of the National Court in Implementing the Judgment

The EU Court referred several key determinations back to the Austrian Supreme Court as the referring court, which must verify:

Whether specific storage periods for personal data are justified under the principle of proportionality for the purpose of enabling personalized advertising
Whether Meta actually processed data about Mr. Schrems' sexual orientation after February 12, 2019
Whether Mr. Schrems's statement during the panel discussion constitutes "manifestly making public" his sexual orientation under Article 9(2)(e) of the Data Protection Regulation
The specific circumstances of the panel discussion and its public nature

This division of responsibilities reflects the EU Court's role in interpreting EU law while leaving factual determinations to the national court. The Austrian Supreme Court must now apply these interpretations to the specific circumstances of Mr. Schrems' case to reach its final judgment.

Practical Impact

The judgment establishes boundaries for data processing in targeted advertising. Data controllers must now:

Justify specific retention periods for different categories of personal data
Demonstrate why particular types of data are necessary for advertising purposes
Refrain from generalized and indiscriminate data collection
Respect strict limitations when processing sensitive personal data, even when some related information has been made public

Sources

Maximilian Schrems v Meta Platforms Ireland Limited (Court of Justice of the European Union, Fourth Chamber, 2024-10-04)

General Data Protection Regulation (GDPR)

Jose Felgueroso Abogado | Attorney