Facebook cannot use your data for advertising purposes indefinitely. (Image source: Pixelkult via Pixabay)
“An online social network like Facebook is not allowed to use all personal data that it has received for the purposes of targeted advertising indefinitely and without distinguishing between their types.”
The press release begins with these words Court of Justice of the European Union (ECJ), which revolves around the lawsuit brought by data protection activist Max Schrems. However, the actual impact of this ruling remains to be seen. Basically, two points were clarified by the EU ruling.
Question 1: How long can Facebook use data that has already been collected?
In simple words: not forever.
As the Court explains, the principle of “data minimization” applies in the GDPR. Even if you have consented to personalized advertising, your personal data “cannot be used indefinitely,” as Schrem’s lawyer Katharina Raabe-Stuppnig said in a statement further communication executes.
However, the European Court of Justice did not answer exactly when Facebook or its parent company Meta must delete this data. In any case, the answer to such questions is left to the national courts.
According to Raabe-Stuppnig, it’s not just Facebook that has to be careful in terms of the ruling: “This ruling also applies to all other online advertising companies, which often do not have data minimization procedures.”
1:09
Meta presents the new Quest 3S, the price is aimed at beginners
Question 2: Can Facebook use sensitive data if it is publicly available?
The other point answered in the ECJ ruling is the question of Facebook’s use of publicly available and sensitive data.
A few years ago, Schrems spoke about his sexual orientation at a public panel discussion. In Facebook’s opinion, this gave implicit consent to the processing of this personal data.
The crux of the matter: Data such as sexual orientation is under special protection and may only be used in exceptional cases within the meaning of the GDPR – this includes, for example, if this information has already been “obviously made public” beforehand. In Schrems’ case, Facebook argued that this had happened through the panel discussion and that its use for personalized advertising was justified.
The European Court of Justice followed this argument – more or less. It is “not ruled out that Mr. Schrems obviously made his sexual orientation public through his statement at the panel discussion in question.” Ultimately, however, this must be assessed by the Austrian Supreme Court.
In principle, Raabe-Stuppnig was “satisfied with the verdict, even if this result was definitely to be expected.” This is in contrast IT industry association Bitkomwho commented on the verdict as follows:
Today’s ruling by the European Court of Justice has far-reaching implications for the digital economy, particularly for companies that use personal data for targeted advertising.
Susanne Dehmel, member of the Bitkom management
It is now unclear for companies “how exactly the limitation for the intended data processing should be determined.” It is also difficult to estimate what is still considered proportionate in terms of the use of personal data. In particular, the duration and manner of processing must be clarified so that companies can meet the requirements or possibly have to obtain new consent.
