Can companies deal with personal data that a user has made public?
Companies must have legitimacy to process the personal data of their customers/users. In the following case, we analyze the use by Meta of personal data, in this case about sexual orientation, which a user makes public in his daily and professional life, but which he has never registered in Meta or any of the related platforms.
In this case, the Court of Justice of the European Union (CJEU) in its Judgment on Case C-446/21 limits the use of personal data by Meta Platforms in Personalized Advertising. The most relevant considerations are set out below:
Main facts
> Context of the Case: Maximilian Schrems filed a lawsuit against Meta Platforms Ireland Ltd (formerly Facebook Ireland Ltd) in relation to the processing of his personal data, including sensitive data such as his sexual orientation.
> Data Collection: Meta Platforms collected personal data from users both inside and outside the Facebook platform, using cookies, social plug-ins and tracking pixels.
> Data Use: This data was used to create detailed profiles and deliver targeted advertising, which included sensitive data such as Schrems' sexual orientation
Main findings of the Tribunal
> Data Minimization: The Court of Justice of the European Union (CJEU) ruled that the data minimization principle of the GDPR precludes the collection and processing of all personal data without time limitation and without distinction based on the nature of the data.
> Sensitive Data: Although Schrems made his sexual orientation public at a round table, this does not authorize Meta Platforms to process other data relating to his sexual orientation obtained outside the platform for personalized advertising purposes.
> Processing Authorization: The fact that a user makes public certain sensitive information does not automatically imply that other related sensitive data can be processed without complying with the provisions of the GDPR.
Need help with GDPR compliance?
We advise and help companies to comply with GDPR regulations. We put experts at your disposal - find out more!
