CJEU Limits Use of Meta Data

Nov 1, 2024 Benn-Ibler Rechtsanwälte

The data minimisation principle requires personal data to be ‘adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed’, according to Article 5(1)(c) of the General Data Protection Regulation (GDPR).

Meta Platforms Ireland is the controller of the personal data of users of a social network in the European Union. From November 2023 on, its services have been free only to those users who have consented to the collection and use of their personal data for the purpose of targeting them with personalised advertising. Users have the option to purchase a subscription to access a non-advertising targeted version of these services.

The data controller was able see from the data at their disposal that the plaintiff was interested in sensitive topics such as health, sexual orientation, and political parties, which enabled the data controller to target advertising. The plaintiff had made his homosexuality known to the public. However, he did not identify as homosexual in his profile.

The plaintiff claimed before the Vienna Regional Court for Civil Matters that the processing of his personal data by Meta Platforms Ireland violated several provisions of the GDPR.

The Austrian Supreme Court (Oberster Gerichtshof, OGH) decided to stay the proceedings and refer the matter to the Court of Justice of the European Union (CJEU) for a preliminary ruling, which has recently stated the following:

The principle of ‘data minimisation’ does not allow the aggregation, analysis, and processing of all personal data obtained by a controller from the data subject and collected both on and off this platform for the purposes of targeted advertising without time limit and without distinction as to type.

The fact that a person has made a public declaration of their sexual orientation does not entitle the operator of an online social networking platform to process other data relating to that person’s sexual orientation which the operator may have obtained from applications and websites of third parties outside that platform for the purpose of offering personalised advertising to that person.

CJEU C-446/21 (4 October 2024)