EU data protection rules don't allow the company to use personal data for an unlimited period of time, the Advocate General said.
ADVERTISEMENTFacebook cannot use publicly available data to target users with personal advertising, Athanasios Rantos, an Advocate General at the EU's Court of Justice, said in an opinion published today (25 April).
Austria's Supreme Court had asked the EU judges to clarify whether data protection rules allow the social network to analyse and process personal data for targeted ads without any time bar.
The case involves privacy lawyer Max Schrems, an Austrian user of Facebook, which is owned by US tech giant Meta.
Schrems filed a complaint about the targeted advertising he received about his sexual orientation after he publicly stated he is gay, without ever mentioning it on his Facebook profile.
Today’s court opinion said that Schrems' statements about his own sexual orientation during a panel discussion “may constitute an act by which he ‘manifestly made public’ those data under the EU’s General Data Protection Regulation (GDPR).”
Information about sexual orientation falls into a category of particularly sensitive data under GDPR — meaning processing is often prohibited. But this does not apply when it's made public by the data subject itself.
Making this personal data public does not mean that it can be processed and used for personalised advertising, the opinion added.
Reacting to the opinion, Schrems' lawyer Katharina Raabe-Stuppnig said that, just because some information is public, “it does not mean it can be used for any other purposes.”
“If you make a political comment on social media, it cannot be used for targeting political advertising at you. If users lose all their rights to published information, it would have a huge chilling effect on free speech,” she said.
A spokesperson for Meta told Euronews that the company does not use sensitive data that users provide to it in order to personalise ads.
“We also prohibit advertisers from sharing sensitive information in our terms and we filter out any potentially sensitive information that we’re able to detect. Further, we've taken steps to remove any advertiser targeting options based on topics perceived by users to be sensitive,” the company said.
Data minimisation
The Advocate General’s advisory opinion said that the GDPR effectively imposes time limits on the processing of personal data for targeted ads.
If EU judges concur, it would be up to the Austrian courts to further assess whether the amount and timing of data processing are justified and proportionate.
"Meta has basically been building a huge data pool of users for 20 years now, and it is growing every day," Raabe-Stuppnig said. "If the Court follows the opinion, only a small part of this pool will be allowed to be used for advertising — even if they have consented to ads."
The Meta spokesperson said that “since 2019, we have overhauled privacy at Meta and invested over €5 billion to embed privacy at the heart of our products. Everyone using Facebook has access to a wide range of settings and tools that allow people to manage how we use their information.”
The final judgement from the EU's highest court will follow at a later date.
