I. General information
Date of Judgement: 04.10.2024
Issuing Authority: Court of Justice of the European Union (4th Chamber), EU
Category: Personal data protection
Plaintiff/Appellant: Max Schrems
Defendant/Respondent: Meta Platforms Inc. (formerly Facebook)
Keyworks: Personal data; Facebook; GDPR; CJEU
II. Dispute
Plaintiff: Max Schrems, a renowned Austrian activist in the field of privacy and personal data protection.
Defendant: Meta Platforms Inc. (formerly Facebook), the company that owns major social networking platforms such as Facebook and Instagram.
Content: Schrems discovered that he received personalized advertisements based on his sexual orientation, even though he had never disclosed this information on his Facebook account. He argued that Meta collected and used this sensitive information from sources outside the platform without his consent, violating the regulations of the GDPR. GDPR (General Data Protection Regulation).
III. Legal basis
The court is being asked to interpret several important provisions in the GDPR, including:
Article 5(1)(b) and (c): Principles of purpose limitation and data minimization – meaning that data should only be collected for specific purposes and only to the extent necessary.
Article 6(1)(a) and (b): Lawful bases for processing data, including:
(a) Based on the explicit consent of the user.
(b) Necessary for the performance of a contract.
Article 9(1) and (2)(e): Regulations on sensitive data (e.g., data concerning health, race...), which is generally prohibited from processing, unless there is an exception, such as: the person has voluntarily made the data public (paragraph 2(e)).
IV. Judgement
On October 4, 2024, the CJEU ruled in favor of Schrems, with the following key points:
● Limitation on the use of personal data for targeted advertising: The CJEU emphasized that social networks like Facebook cannot use all collected personal data for targeted advertising purposes without time limits and without distinguishing between types of data.
● Protection of sensitive data: The use of sensitive data, such as information about sexual orientation, for advertising purposes requires clear and specific consent from the user. The fact that the user makes this information public in another context does not mean that the platform is allowed to use that information for advertising purposes.
V. Remarks
Although this case does not directly relate to the development or use of AI systems, it has significant implications for AI products and services that collect and process personal data for various purposes, including personalizing user experiences or targeting advertising. AI developers and deployers need to comply with data protection regulations such as the GDPR, especially when processing sensitive data. The collection and use of user data to train AI models also needs to consider the requirements for consent and transparency.
