Volkswacht Bodensee - Meta must limit data use for targeted ads: EU court

Austria's Supreme Court had asked the European Court of Justice (ECJ) for guidance after privacy activist Max Schrems brought a case against US tech giant Meta.

Schrems had contested what he called the "unlawful" processing of personal data, saying that publicly referring to his sexual orientation does not mean "consenting" to its use for personalised advertising.

Schrems had regularly received advertisements directed at LGBTQ people and invitations to corresponding events.

In its ruling, the ECJ cited the "principle of data minimisation" laid down by the European Union's landmark General Data Protection Regulation (GDPR).

The regulation "precludes" all data obtained by a social network operator "from being aggregated, analysed and processed for the purposes of targeted advertising", the court said.

The court said the use of such data should be subjected to a "restriction as to time" and a "distinction as to type" of information.

Meta did not immediately return an AFP request for comment.

Privacy campaign group NOYB (None Of Your Business), founded by Schrems, welcomed the decision.

"Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day," Schrems's lawyer Katharina Raabe-Stuppnig said in a statement.

"Following this ruling only a small part of Meta's data pool will be allowed to be used for advertising -- even when users consent to ads," she added.

The court also said that just because Schrems mentioned his sexual orientation at a public panel discussion to criticise Facebook's personal data processing, "that fact alone does not authorise" Meta to "process other personal data" relating to his sexual orientation.

"It would have a huge chilling effect on free speech, if you would lose your right to data protection in the moment that you criticise unlawful processing of personal data in public," Raabe-Stuppnig said.

Vienna-based NOYB has launched a myriad of legal cases against internet giants such as Meta.

The group started work in 2018, at the same time as the European Union implemented its GDPR legislation aimed at making it simpler for people to control how companies use their personal information.

H.Gerber--VB