The Court of Justice of the European Union (CJEU) recently delivered a significant ruling concerning the use of public information by social media companies for personalised advertising. This development represents a landmark moment in the enforcement of the European Union’s General Data Protection Regulation (GDPR), a famously stringent data privacy framework, and underscores the growing judicial oversight on data usage by major technology firms.
The Case: Max Schrems vs. Meta
Central to this ruling is the case of Max Schrems, an Austrian privacy activist renowned for challenging large technology companies on their data handling practices. Schrems’ complaint against Facebook’s parent company, Meta, accused the firm of unlawfully processing data relating to his sexual orientation. The data, purportedly obtained outside Meta’s platform, was allegedly used to target him with specific advertising. Schrems had only disclosed his sexual orientation during a public panel discussion and not on social media, highlighting potential breaches in data privacy compliance.
The Court’s Decision
The CJEU’s decision, which is applicable across all 27 EU member states, emphasized that information about a person’s sexual orientation, or any other sensitive data, obtained outside a platform cannot be utilised for personalised advertising without explicit consent and adherence to GDPR mandates. The court announced, “An online social network such as Facebook cannot use all of the personal data obtained for purposes of targeted advertising, without restriction as to time and without distinction as to type of data.”
Specifically, the ruling imposes several key restrictions on data usage:
- There must be time limits on how long data can be used for advertising purposes.
- Data must only be used for expressly defined purposes under GDPR.
- Meta cannot aggregate, analyze, and process data for targeted advertising without restrictions on time or data type.
Importantly, the court clarified that making information public does not equate to consent for its use in advertising under GDPR. This aspect of the ruling is particularly significant as it addresses the common practice of scraping publicly available data for various purposes, including targeted advertising and AI model training.
Implications for Tech Companies and Data Practices
This ruling holds substantial implications for social media platforms like Facebook, which have historically drawn on vast pools of user data for targeted advertising. It not only reinforces the GDPR’s robust privacy protections but also further complicates the landscape for tech companies currently navigating regulatory environments. By drawing boundaries on how companies like Meta can leverage external data, the ruling prompts an industry-wide reconsideration of compliance strategies regarding data aggregation and personalisation efforts.
The GDPR, in force since 2018, is a comprehensive data protection law applicable to all individuals within the EU and the European Economic Area. Among its core principles is ‘data minimisation’, mandating companies to handle only the necessary amount of data for the stated purpose. As such, the court’s decision dictates a reduced capacity for Meta to use its extensive user data pool for advertising, irrespective of user consent.
The decision is likely to have far-reaching consequences for tech companies operating in Europe, particularly those involved in online advertising. It affects AI training practices, as companies often scrape online data for purposes not initially intended by the data subjects. Furthermore, the ruling applies to other online advertising companies that may lack stringent data deletion practices.
Meta’s Response and Industry Impact
As Meta awaits the court’s full judgment documentation, it acknowledged the ruling’s seriousness. The company stated it “takes privacy very seriously,” and emphasised the availability of various existing user settings and tools designed to manage personal data usage. However, the ruling dictates a reduced capacity for Meta to use its extensive user data pool for advertising, irrespective of user consent.
This development is likely to have a significant impact on Meta’s business model, which heavily relies on targeted advertising. Other tech giants and smaller companies in the advertising technology space will also need to reassess their data handling practices in light of this ruling.
Legal Implications and Future Outlook
With this precedent, legal departments and corporate entities now must revisit their data management practices to ensure alignment with these clarified legal expectations. This ruling amplifies the need for clear adherence to GDPR requirements, especially concerning sensitive data processing, validating compliance not just in spirit but in practice.
Legal teams are tasked with continuous vigilance, adapting to evolving judicial interpretations and regulatory expectations within the EU, maintaining the integrity of data privacy practices. This ruling may also inspire similar legal challenges and regulatory scrutiny in other jurisdictions, potentially leading to a global shift in how personal data is handled in the context of targeted advertising and AI development.
The court’s decision reinforces two key principles of the GDPR:
- Data minimisation: Companies should only process the minimum amount of data necessary for a specific purpose.
- Purpose limitation: Personal data should only be collected for specified, explicit, and legitimate purposes.
These principles now need to be more strictly adhered to in the context of targeted advertising and data processing.
The CJEU’s ruling marks a significant milestone in the ongoing debate about data privacy, targeted advertising, and the responsibilities of tech companies. As the industry grapples with these new restrictions, it is clear that the balance between personalized services and individual privacy rights will continue to be a central issue in the digital age. The ruling not only impacts Meta but sets a precedent that could reshape data practices across the tech industry in the European Union and potentially beyond.
Read the complete article at EU Court Ruling Limits Meta’s Use of Personal Data for Advertising (complexdiscovery.com)
This content has been produced in collaboration with a partner organisation through our Global Visibility Programme. Our programme helps companies and organisations boost their digital presence and strengthen the thought leadership of their experts. Find out more here.
Add Comment