- The CJEU ruled on 4 October 2024 (case C-446/21) that the data minimisation principle limits the advertising use of personal data.
- Keeping data indefinitely for targeted advertising is a disproportionate interference.
- Someone making a sexual orientation public does not authorise the use of other sensitive data for advertising.
On 4 October 2024 the Court of Justice of the European Union gave judgment in case C-446/21, a preliminary reference made by the Austrian Supreme Court in a user’s dispute with Meta Platforms Ireland, the company that operates Facebook. The Court answers that the data minimisation principle of the General Data Protection Regulation limits which data a social network may use to show personalised advertising, and for how long.
The claimant argued that Meta processed, for advertising purposes, sensitive data obtained even outside Facebook, such as his political views or sexual orientation, without an adequate legal basis. The ruling does not affect only one platform: it sets a rule of interpretation of the Regulation that reaches any company using personal data for marketing. Nor is it limited to social networks: the Court’s reasoning rests on general principles that apply to any collection and use of data.
What the Court said
According to analyses of the judgment, the Court declares that storing users’ data indefinitely for targeted advertising is a disproportionate interference with their rights. It adds that the indiscriminate use of all the personal data a platform holds for advertising purposes is not proportionate, whatever its sensitivity, and that combining activity inside and outside the network is particularly intrusive.
The minimisation principle applies regardless of the legal basis: even someone who has consented to personalised advertising is not giving permission for unlimited use in time or in type of data. It is for national courts to specify the periods and limits in each case, so the judgment sets the criterion, but not a single figure. Put differently, the usefulness of a purpose, such as advertising, does not by itself justify processing everything that is known about a person.
Sensitive data made public
The second point concerns a person who spoke about his sexual orientation at a round table open to the public, a video later circulated online. The Court accepts that this specific piece of data may have been manifestly made public, but warns that this does not allow the platform to use other data on that subject, obtained outside the network, to target him with advertising.
The underlying idea is that the fact that information is accessible does not make it usable for any purpose. This logic applies to special categories of data, which the Regulation protects more strongly: health, ideology, beliefs, and sex life or sexual orientation, among others. Each use requires its own legal basis and its own necessity analysis, and neither consent nor the public nature of the data replaces them.
What to review in your company
Although the ruling concerns a large platform, its criterion is useful for any business with a customer base. Review for how long customer and business-contact data is kept, whether deletion periods exist, and whether all the data collected is really used for each marketing purpose or only what is necessary.
It is also worth checking whether data from different sources is combined, for example from the website, physical shops or third parties, and whether the information given to customers about this is clear. Special-category data calls for particular care. A simple audit of data and purposes, with your adviser, helps spot risks before an authority does. Data protection authorities apply this interpretation when assessing marketing campaigns, and the Regulation’s penalties can reach €20 million or 4% of worldwide turnover.
Holding data is not the same as being free to use it always and for everything.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
