AN ONLINE SOCIAL NETWORK THAT HAS OBTAINED A USER'S PERSONAL DATA FOR THE PURPOSE OF TARGETED ADVERTISING CANNOT USE IT WITHOUT A TIME LIMIT AND REGARDLESS OF THE NATURE OF THIS DATA

#134An online social network that has obtained a user's personal data for the purpose of targeted advertising cannot use it without a time limit and regardless of the nature of this data

The Court of Justice ruled in the judgment in case C-446/21 dated 4th October 2024 that an online social network that has obtained the user's personal data for the purpose of targeted advertising cannot use it without a time limit and regardless of the nature of this data.

An Austrian citizen challenged in the Austrian courts the unlawfulness of the processing of his personal data regarding his sexual orientation by Meta Platforms Ireland through the online social network Facebook, when he announced the fact that he was gay during a public forum discussion.

The social network Facebook collects personal data of users through the activities of users on this social network, as well as outside it. This is mainly data related to browsing on websites, third-party applications and the social network Facebook itself.

With regard to the data held by Meta Platforms Ireland, it enables it to offer targeted advertising to the person concerned, even on a sensitive topic such as the person's sexual orientation. In this context, the question therefore arose as to whether an Austrian citizen who announced the fact that he is homosexual during a public podium discussion had demonstrably disclosed his sensitive personal data and thus consented to the processing of this data in accordance with the General Data Protection Regulation (GDPR).

The Austrian Supreme Court therefore asked the Court of Justice to interpret the GDPR in this context.

In its decision, the Court of Justice states that the principle of "data minimization" prevents all personal data from being processed, collected and analyzed for the purposes of targeted advertising without a time limit and regardless of the nature of this data. The Court of Justice further states in the decision that the assessment of the situation, whether the person concerned has demonstrably disclosed his sexual orientation by his statement during a public podium discussion belongs to the Austrian Supreme Court.

According to the court, the subject of processing in accordance with the provisions of the GDPR can also be information about a person's sexual orientation, which the person concerned has demonstrably published, e.g. during the public podium discussion. However, such a circumstance does not allow the processing of other personal data about the sexual orientation of this person, obtained outside the online platform of the social network or website, in order to collect and analyze them for the purpose of offering personalized advertising.