Max Schrems sued

ECJ: Facebook may not use data indefinitely

Meta Platforms collects personal data from Facebook users about their activities within and outside this network.

(Bild: AFP)

An online social network such as Facebook may not use all personal data that it has received for targeted advertising for an unlimited period of time and without differentiation, the European Court of Justice (ECJ) ruled in Luxembourg on Friday.

The background to this is a complaint by Austrian data protection activist Maximilian Schrems that the processing of his personal data by Meta Platforms Ireland violates the General Data Protection Regulation.

Not the first dispute
In the past, Schrems had achieved two successes before the ECJ in his disputes with Facebook concerning the exchange of data between the USA and the European Union. The Austrian Supreme Court (OGH) has now referred a number of questions to the ECJ regarding the conditions under which the processing of personal data, including sensitive data, is permitted under the General Data Protection Regulation (GDPR).

There were two questions in particular: May all personal data be processed without time restriction or does the principle of "data minimization" apply here? Under what conditions may Facebook use published sensitive data for advertising?

Data protection activist Max Schrems

(Bild: AFP)

Practice contradicts "data minimization"
Firstly, the Court answers that it would be contrary to the principle of "data minimization" laid down in the GDPR for all personal data received by a controller such as the operator of an online platform and collected both on and off that platform to be collected and processed indefinitely and without distinction as to its nature for the purposes of targeted advertising.

Meta Platforms collects personal data from Facebook users about their activities within and outside this network. The fact that Maximilian Schrems disclosed his sexual orientation during a public panel discussion allows the use of this data under the GDPR. However, this circumstance does not allow the operator to process other data about his sexual orientation that it has obtained elsewhere, the judges continued.

The ECJ never rules on individual cases; it only provides an assessment of the interpretation of EU law. The judgment is made by the requesting court.

Katharina Raabe-Stuppnig, Max Schrems' lawyer, was "very satisfied after the ruling, even though this result was to be expected." Meta had built up a huge pool of data about users over the past 20 years, she said, according to a press release from the data protection organization noyb. "According to this ruling, only a small part of Meta's data pool may be used for advertising purposes - even if users consent to the advertising. This ruling also applies to all other online advertising companies, which often have no data minimization procedures in place." The application of the "principle of data minimization" radically restricts the use of personal data for advertising purposes.