Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
In Maximillian Schrems v Meta Platforms Ireland Ltd (C-446/21) the Court of Justice of the European Union (“the CJEU”) made a ruling arising out proceedings in Austria between Mr Schrems and Facebook in relation to the social media platform’s use of data pertaining to his sexuality.
Like other users of the social media platform, Mr Schrems had consented to Facebook’s processing of his personal data by accepting their terms of use. The case explained that Meta Platforms Ireland uses, amongst other things, “plug-ins” some of which are embedded within third party websites. Some of these plug-ins were found on websites that targeted homosexual users and by way of the transmission of information from those plug-ins to Meta, Meta had been able to follow Mr Schrems’ internet behaviour which resulted in the collection of certain sensitive personal data that was used to facilitate personalised advertising.
Mr Schrems did not post any sensitive data on his Facebook page and did not consent to the processing of this personal data for the purpose of personalised advertising. Despite this, he did receive targeted adverts which related to his sexuality.
The CJEU determined, by reference to its earlier decision on 24 February 2022 of Valsts ieņēmumu dienests (Processing of personal data for tax purposes), C‑175/20, that in the light of the principle of data minimisation provided for in article 5(1)(c) of the GDPR, a data controller cannot engage in the collection of personal data in a generalised and indiscriminate manner and must refrain from collecting data which is not strictly necessary having regard to the purpose of the processing. Therefore, the indiscriminate use of all of the personal data held by a Meta for advertising purposes, irrespective of the level of sensitivity of the data, was not a proportionate interference with the rights guaranteed by the GDPR to users of that platform. The implication of the principle of data minimisation as enshrined within article 5(1)(c) of the GDPR therefore precludes all of the personal data obtained by a data controller, whether collected on or outside that platform, from being aggregated, analysed and processed for the purposes of targeted advertising without any restrictions on time and type of data.
Furthermore, the CJEU decided that the simple fact that Mr Schrems had made his sexuality known to the public outside of his Facebook page, did not mean that he gave his consent within the meaning of article 9(2)(a) of the GDPR to Meta processing other data relating to his sexuality that came from outside the platform using third-party websites and apps, with a view to aggregating and analysing the data, in order to offer personalised advertising.
Maximillian Schrems v Meta Platforms Ireland Ltd (C-446/21)
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
