EU’s top court sets time-limits on using personal data for targeted ads

Personal data collected by social networking platforms for targeted advertising, cannot be used indefinitely, the Court of Justice of the EU (CJEU) ruled on Friday (4 October), according to a press release seen by Euractiv. 

Data privacy activist and lawyer Max Schrems filed a complaint with an Austrian court in 2020, arguing that Meta, formerly Facebook, did not respect the principles of "data minimisation" and "purpose limitation" set in EU's data protection law, the General Data Protection Regulation (GDPR) when processing data for personalised advertising. The complaint was eventually brought to the CJEU in 2021.

"An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restrictions," on time and distinctions on the type of data, the CJEU stated in a press release.

"Meta has basically been building a huge data pool on users for 20 years now," said Katharina Raabe-Stuppnig, the lawyer representing Schrems, in a Friday press release by the activist's organisation, European Center for Digital Rights, Noyb.

"However, EU law requires 'data minimisation'. Following this ruling, only a small part of Meta's data pool will be allowed to be used for advertising," she added.

This decision was expected as "individuals have a right not to be haunted by past data," privacy lawyer Özer Zivali at Dutch law firm Van Doorne wrote on LinkedIn.

Public data is not consent for processing

In the case, Schrems also challenged the extent to which Meta adhered to the principle of "purpose limitation" when processing sensitive data.

The activist specifically challenged the use of public sexual orientation data for advertising purposes.

Schrems talked about his sexual orientation in a streamed panel discussion in February 2019. Though Schrems and Meta both agree the information about his sexual orientation was "manifestly made public," this sensitive data used for advertising purposes is subject to protections under GDPR.

The CJEU ruled in a public statement, that it "does not authorise the operator of an online social network platform to process," the data.

The CJEU ruling "may also be highly relevant for AI training," wrote Noyb, founded by Schrems, in a press release.

"Companies such as Meta, X (Twitter) or OpenAI have simply scraped the internet or user data and used it to train AI models, even if this was not the initial purpose," states Noyb.

In April 2024, Advocate General Athanasios Rantos advised the CJEU that a public statement about someone’s sexual orientation does not, by itself, permit the processing of this sensitive data.

Max Schrems is widely known for  Schrems I and Schrems II rulings by the Court of Justice of the EU in 2015 and 2020, which invalidated EU-US data transfer agreements, the Safe Harbor and Privacy Shield Framework.

[Edited by Eliza Gkritsi/Rajnish Singh]