Oct. 4 (UPI) — The European Court of Justice ruled Friday that Meta’s Facebook and other social media cannot use sexual orientation or other sensitive public data from third parties for targeted advertising.
Social media cannot freely use all personal data obtained for advertising without restrictions, the court said. Third parties have to process that data in compliance with GDPR rules.
Privacy activist Maximilian Schrems filed the case in Austria when he was targeted by Facebook ads aimed at homosexuals following his comments during a panel discussion.
The court said the panel discussion disclosure alone “does not authorize the processing of other personal data relating to that data subject’s sexual orientation.”
Schrem’s attorney Katharina Raabe-Stuppnig said in a statement she was happy with the ruling.
“Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day. However, EU law requires ‘data minimization.’ Following this ruling only a small part of Meta’s data pool will be allowed to be used for advertising — even when users consent to ads. This ruling also applies to any other online advertisement company, that does not have stringent data deletion practices.”
The court ruled that the GDPR’s principle of data minimization “precludes all of the personal data obtained by a controller, such as the operator of an online social network platform, from the data subject or third parties and collected either on or outside that platform, from being aggregated, analyzed and processed for the purposes of targeted advertising without restriction as to time and without distinction as to type of data.”
The court said Meta collects personal data of Facebook users related to activities on and outside of that social media platform and used it to target advertising at Schrems.
With that data Meta can identify what the court called “interest in sensitive topics.”
“The fact that Mr Maximilian Schrems has made a statement about his sexual orientation on the occasion of a public panel discussion does not authorize the operator of an online social network platform to process other data relating to his sexual orientation, obtained, as the case may be, outside that platform, with a view to aggregating and analyzing those data, in order to offer him personalized advertising,” the court statement added.
The Court of Justice said a legal data use question arises “as to whether Mr Schrems manifestly made public sensitive personal data about himself by having disclosed, on the occasion of a public panel discussion, the fact that he was homosexual, and thus authorized the processing of those data under GDPR.”
The Court of Justice said that is for the Supreme Court of Austria to verify.
The Austrian court asked the Court of Justice to interpret the GDPR in this case.