Thought Leadership
The EU’s highest court is today ruling on issues relating to data processing by Facebook’s parent company Meta. The plaintiff is no stranger.
In the past, data protection activist Maximilian Schrems achieved two spectacular successes before the European Court of Justice (ECJ) in his disputes with Facebook, which concerned the entire exchange of data between the USA and the European Union. Now he is once again taking aim at the tech giant.
What exactly does the ECJ decide on?
The current case concerns several alleged violations of the General Data Protection Regulation (GDPR) by Meta. The ECJ had already answered some questions in earlier proceedings and, for example, strengthened the competition supervision of the antitrust authorities vis-à-vis Meta. The group also owns the services Instagram and Whatsapp.
Schrems now complains that Meta does not adhere to the principle of “data minimization” from the GDPR and simply stores all online behavior instead of limiting processing to what is necessary. Another aspect of his complaint is the processing of sensitive data such as sexual orientation. This data is subject to special protection under the GDPR and may only be used in certain exceptional cases. Such an exception exists, for example, if the information has already been made public. This question arose in the present case, as Schrems had spoken about his homosexuality at a panel discussion and thus possibly made it public in such a way that its use by Facebook for personalized advertising could be justified.
There are therefore two main questions: Can all personal data be processed without time restrictions? And: When has someone made sensitive data public in such a way that Facebook is allowed to use it for advertising?
Why is the complaint relevant?
The GDPR itself does not specify a concrete time limit for which data may be stored and for how long, but only sets out general principles. The ECJ could now clarify for the first time that the processing of data for advertising purposes is only permitted within narrow time and content limits, explains data protection lawyer Daniel Rücker from the law firm Noerr. It is also crucial to what extent the ECJ will emphasize the protection of particularly sensitive data: “Because this will not only apply to sexual orientation, but also, for example, to religious beliefs or political opinions expressed on Facebook,” says Rücker.
What would be the impact if Facebook loses?
“Online data would then also have an “expiration date” for advertising and even with consent, only certain data could be used”, Schrems announced via his organization noyb. Meta and the advertising industry would therefore have to delete a good portion of all online tracking data. According to the digital association Bitkom, the ruling could have “significant consequences” for the entire digital economy.
Data protection lawyer Rücker does not assume that this will shake Facebook’s business model, but: “Anyone who works with targeted advertising is affected by this ruling.” Another aspect is also crucial: “If the General Data Protection Regulation has been violated, users can demand compensation.” In Meta’s case, this could mean further extensive mass and class action lawsuits, which may be more problematic for the company than individual fines from authorities. According to Rücker, a lawsuit industry is already forming, similar to the diesel scandal.
Is there any indication of how the case might end?
An Advocate General of the Court of Justice presented his recommendation a few months ago and largely agreed with Schrems. He came to the conclusion that it would be in breach of the GDPR if any data was stored without time restriction. Furthermore, data on sexual orientation should not necessarily be processed for advertising just because someone has already made it public. The judges often follow the opinion, but not always.
dpa
