[ad_1]
Even if users have consented to Facebook processing personal data for advertising purposes, this information may not be used indefinitely and indiscriminately. The European Court of Justice has this today in a judgment decided.
How long can Facebook store data?
The proceedings involve two questions. The first concerns how long Facebook can use data once it has been collected. The decision now says: not forever. Even if personal data was collected lawfully and with users’ consent, the GDPR principle of data minimization applies. At some point, Facebook and Co. will have to delete it. National courts must now clarify which specifications apply in detail to deletion periods.
The lawsuit was filed by data protection activist Max Schrems. His lawyer Katharina Raabe-Stuppnig now explained in the organization’s statement Noybthat Meta has built up a huge pool of data about users over 20 years. “According to this ruling, only a small part of Meta’s data may be used for advertising purposes – even if users agree to the advertising“, says Raabe-Stuppnig. This also has consequences for other online advertising companies.
Public statements are not an all-encompassing endorsement
The second point concerns the question of the extent to which Facebook is allowed to use data that is publicly available. Schrems spoke publicly about his sexual orientation a few years ago. According to the GDPR, it is fundamentally legitimate to use this data – but only this. It is therefore not justified to use information about Schrem’s sexual orientation that has been collected elsewhere for advertising purposes.
Facebook collects user data both on the platform and outside of it – for example through cookies and technologies such as social plugins and pixels, which website operators can use to link their website with Facebook.
According to the Noyb announcement, Schrems particularly criticized the fact that Facebook wanted to use his data that had already been collected before his public statements. The company would have wanted to legitimize the data collection retroactively. However, such a “time travel” is not possible with approval.
As usual, the ECJ rulings are preliminary rulings. In this case, the Supreme Court in Austria passed the proceedings on to the ECJ judges. These should clarify how EU law should be interpreted. Now the case ends up back before the Austrian court.
Judgment with consequences
The data protection activists are very satisfied with the verdict, but had also expected such a result, explained lawyer Raabe-Stuppnig.
Meanwhile, the IT industry association Bitkom is critical. The ruling therefore increases uncertainty for companies in the area of online advertising. It is now unclear how long and to what extent personal data may now be processed for advertising purposes. Courts will probably have to decide again what period of time is proportionate.
[ad_2]
Source link
