Austrian activist Schrems wins privacy case against Meta over personal data on sexual orientation

BRUSSELS (CN) — In a significant judgement for the European Union’s strict privacy rules, the bloc’s highest court backed a lawsuit brought against Facebook owner Meta over the use of private data obtained outside its platforms for personalized advertising.

The Court of Justice for the European Union in its ruling sided with Austrian privacy data activist Max Schrems, who brought the case to a court in his home country, which in turn sought guidance from the Luxembourg-based court in 2021.

Schrems says he was targeted by advertisements tailored toward gay people as a result of Facebook’s misuse of personal data about his sexual orientation; he had never shared information about his sexuality on the social platform, and had done so only once during a public event.

“An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data,” the EU’s highest court said in Friday’s ruling.

Even if a statement is publicly available, that “does not authorize the operator of an online social network platform to process other data relating to his sexual orientation, obtained, as the case may be, outside that platform, with a view to aggregating and analyzing those data, in order to offer him personalized advertising.”

In consequence, data relating to someone’s sexual orientation, race, ethnicity or health status is classed as sensitive and carries strict requirements for processing under EU privacy rules known as GDPR, or General Data Protection Regulation.

“We are very pleased by the ruling, even though this result was very much expected,” Schrems’ lawyer Katharina Raabe-Stuppnig said in a statement.

“Meta has basically been building a huge data pool on users for 20 years now, and it is growing every day. However, EU law requires ‘data minimization,’" Raabe-Stuppnig said, and “following this ruling, only a small part of Meta’s data pool will be allowed to be used for advertising — even when users consent to ads.”

Meta, the parent company of some of the world’s largest social media platforms, said in response that it would “take privacy very seriously" and has invested more than five billion euros “to embed privacy at the heart of all of our products”.

“Everyone using Facebook has access to a wide range of settings and tools that allow people to manage how we use their information,” the social media company said in a statement.

Earlier in June, Meta postponed the launch of its new artificial intelligence program in the EU, following complaints in several member states that the company was abusing users’ profile data.

Schrems, through his NGO None of Your Business, filed complaints opposing Meta’s plans in 11 European countries — Austria, Belgium, France, Germany, Greece, Italy, Ireland, the Netherlands, Norway, Poland and Spain — which stopped the plans.