European Union: Issued ruling in lawsuit concerning processing and analysis of personal data for targeted advertising (Maximilian Schrems v Facebook Ireland Ltd) (Case C-446/21)

On 4 October 2024, the Court of Justice of the European Union issued a ruling addressing the processing of personal data for targeted advertising under the General Data Protection Regulation (GDPR). The case involved Meta Platforms Ireland and privacy activist Maximilian Schrems, focusing on the legality of using personal data, particularly sexual orientation for targeted advertising. It was contended that Schrems made his sexual orientation public during a panel discussion, but never disclosed it on Facebook. Meta collected data on users both within and outside its platform through methods such as cookies and social plug-ins, using this information for targeted advertising. The Austrian Supreme Court referred the case to the Court of Justice, asking if Schrem's disclosure of his sexual orientation at a public event authorised Meta to process sensitive data under the GDPR. The Court held that the GDPR's data minimisation principle prevents the unrestricted aggregation, analysis, and processing of personal data for targeted advertising, regardless of how or where the data is collected. The Court also clarified that even the public disclosure of information a person's sexual orientation does not authorise Meta to process other related personal data unless in compliance with GDPR provisions.