Maximilian Schrems v Meta Platforms Ireland Limited

1.

This request for a preliminary ruling from the Oberster Gerichtshof (Supreme Court, Austria) has been made in proceedings between Mr Maximilian Schrems (‘the applicant’), a user of the social network Facebook, and Meta Platforms Ireland Limited, formerly Facebook Ireland Limited (‘Meta Platforms Ireland’ or ‘the defendant’), concerning the allegedly unlawful processing by that company of his personal data.

2.

The questions referred for a preliminary ruling in the present case concern, on the one hand, the application of the principle of ‘data minimisation’ laid down in Article 5(1)(c) of Regulation (EU) 2016/679 ( 2 ) and, on the other hand, the interpretation of the concept of ‘personal data which are manifestly made public by the data subject’ referred to in Article 9(2)(e) of that regulation, read in conjunction with Article 5(1)(b) of that regulation, which establishes the principle of ‘purpose limitation’. The referring court asks, in essence, first, whether the principle of data minimisation permits the processing of personal data without restriction as to time or type of data and, second, whether a person’s statements concerning his or her own sexual orientation, made during a panel discussion, allow the processing of other data relating to that person’s sexual orientation for the purposes of personalised advertising.

3.

Article 4 of the GDPR, entitled ‘Definitions’, provides in paragraph 11 thereof:

‘For the purposes of this Regulation:

…

4.

Article 5 of that regulation, entitled ‘Principles relating to processing of personal data’, provides, in paragraphs 1 and 2 thereof:

‘1.   Personal data shall be:

…

2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’

5.

Article 6 of that regulation, entitled ‘Lawfulness of processing’, provides in paragraphs 1 and 3 thereof:

‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:

…

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

…

3.   The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

…

… The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.’

6.

Article 7 of that regulation, entitled ‘Conditions for consent’, is worded as follows:

‘1.   Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.

…

3.   The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

4.   When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.’

7.

Article 9(1) and (2) of the GDPR, entitled ‘Processing of special categories of personal data’, provides:

‘1.   Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

2.   Paragraph 1 shall not apply if one of the following applies:

…

…’

8.

Article 13 of that regulation, concerning ‘information to be provided where personal data are collected from the data subject’, provides, in paragraph 1 thereof:

‘Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

…

…’

9.

Meta Platforms Ireland, a company incorporated under the law of Ireland, operates the closed communications network ‘Facebook’, which is, in essence, an online social network for sharing content. ( 3 ) Its business model is essentially to offer free social networking services to its private users and to sell online advertising, including advertising tailored to its users. ( 4 ) That advertising is primarily based on the automated creation of relatively detailed profiles of the users of that social network. ( 5 )

10.

In 2018, following the entry into force of the GDPR, Meta Platforms Ireland presented new Facebook terms of service to its users in the European Union with a view to obtaining their consent, which is, moreover, required in order to sign up for or access the accounts and services provided by Facebook. ( 6 ) Those new terms of service also enable users to have an overview of and control over the data stored. ( 7 )

11.

The applicant is a Facebook user who accepted the new terms of service presented by Facebook. As is apparent from the order for reference, he has publicly referred to his homosexuality but, on his Facebook profile, he has never mentioned his sexual orientation and has not published any sensitive data. ( 8 ) Nor has the applicant authorised the defendant to use, for the purposes of targeted advertising, the fields in his profile relating to his relationship status, employer, job title or education.

12.

However, the applicant allegedly received an advertisement for a female politician, and that advertisement was sent to him on the basis of the analysis that he was similar to other ‘customers’ who had ‘liked’ her; he regularly received advertising aimed at homosexuals and invitations to corresponding events, even though he had never previously shown an interest in such events and was not even familiar with the venues in which they were held. Those advertisements and invitations were based not directly on the applicant’s sexual orientation or that of his ‘friends’ on the social network, but on an analysis of their particular interests. ( 9 ) Moreover, he claims that Meta Platforms Ireland recorded all data relating to the applicant, including those obtained through third parties or plug-ins, and stored them for an indefinite period.

13.

In those circumstances, the applicant brought, before the Landesgericht für Zivilsachen Wien (Regional Court for Civil Matters, Vienna, Austria), an action seeking enforcement, a declaration and an injunction concerning the allegedly unlawful processing of his personal data by Meta Platforms Ireland. ( 10 )

14.

Subsequently, on the occasion of a panel discussion organised by the Representation of the European Commission in Vienna (Austria) and held on 12 February 2019, ( 11 ) the applicant referred to his sexual orientation during a speech aimed at criticising the allegedly unlawful processing, by Meta Platforms Ireland, of data relating to his sexual orientation. ( 12 )

15.

His action having been dismissed, at first instance, by judgment of 30 June 2020 and, on appeal, by the Oberlandesgericht Wien (Higher Regional Court, Vienna, Austria), by judgment of 7 December 2020, ( 13 ) the applicant lodged an appeal on a point of law before the Oberster Gerichtshof (Supreme Court), the referring court.

16.

In that context, the Oberster Gerichtshof (Supreme Court) decided to stay the proceedings and to refer four questions to the Court of Justice for a preliminary ruling. ( 14 ) Since the first and third questions were withdrawn following the judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), ( 15 ) the present case concerns the second and fourth questions, which are worded as follows:

17.

Written observations were lodged by the applicant, Meta Platforms Ireland, the Austrian, French, Italian and Portuguese Governments and the Commission. Oral argument was presented by the applicant, Meta Platforms Ireland, the Austrian Government and the Commission at the hearing held on 8 February 2024.

18.

By its second question, the referring court asks, in essence, whether Article 5(1)(c) of the GDPR, which lays down the principle of data minimisation, must be interpreted as meaning that all the personal data available to a network such as Facebook, in particular through the data subject or third parties on and outside that platform, may be aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time or type of data.

19.

As a preliminary point, all processing of personal data must comply, first, with the principles relating to processing of data set out in Article 5 of the GDPR and, second, with one of the conditions relating to lawfulness of processing listed in Article 6 of that regulation. ( 16 )

20.

As regards, more specifically, the principles relating to processing of personal data, the Court has stated, inter alia, that the principle of data minimisation set out in Article 5(1)(c) of the GDPR provides that personal data are to be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, which reflects, in essence, the principle of proportionality. ( 17 ) Accordingly, the principle of data minimisation aims to minimise the restrictions on the right to the protection of personal data caused by the processing in question.

21.

In the present case, it seems clear to me that the possible absence of any limitation, as assumed by the referring court, is, by definition, contrary to the application of the principle of data minimisation. However, it is not apparent from the documents before the Court that there is anything to confirm or exclude such an assumption, which, in any event, it is for the referring court to assess. I shall nevertheless endeavour to provide that court with some useful guidance on the interpretation of the provision under consideration, which may enable that court to rule on the case pending before it.

22.

As regards, first, the restriction of processing of personal data as to time, I consider that, in the absence in the GDPR of a specific provision in that connection, the EU judicature cannot set a mandatory time limit for the retention of such data. Moreover, the Court has held that even initially lawful processing of accurate data may over time become incompatible, in particular, with Article 5(1)(c) to (e) of the GDPR, where those data are no longer necessary in the light of the purposes for which they were collected or processed. ( 18 ) It is therefore for the referring court to assess, in the light of the circumstances of the case and by applying the principle of proportionality, ( 19 ) the extent to which the period of retention of personal data by Meta Platforms Ireland is justified having regard to the legitimate aim of processing those data for the purposes of personalised advertising.

23.

As regards, second, the restriction of processing of personal data as to type of data, it is also for the referring court to determine, in the circumstances of the present case, the personal data the processing of which may be considered to be lawful, in accordance with the principle of proportionality.

24.

Moreover, the references, in the wording of Article 5(1)(c) of the GDPR, to very general conditions, such as ‘adequacy’, ‘relevance’ and ‘necessity’, demonstrate, in my view, that the EU legislature intended to leave a wide discretion to the competent authorities in the application of that provision, since those conditions can be interpreted only on a case-by-case basis, in the light of the circumstances of the case.

25.

That said, I consider that, as the Commission notes in its written observations, certain distinctions may be drawn depending on the degree to which the various forms of processing interfere with the rights of the data subject. The referring court could, therefore, where it considers it appropriate, on the one hand, draw a distinction between the use of ‘static’ data concerning the data subject (such as age ( 20 ) or sex) and the use of ‘behavioural’ data (such as the monitoring of users’ browsing habits), the latter use being, as a general rule, more intrusive as regards the data subject’s rights. With regard, in particular, to ‘behavioural’ data, a further distinction could be drawn between the collection of data relating to ‘active’ behaviour (such as clicking on the ‘Like’ button) and the collection of data relating to ‘passive’ behaviour (such as simply visiting a website), the latter normally being more intrusive for the user. On the other hand, a distinction could also be drawn between the processing of personal data collected on the Facebook platform and outside that platform, that is to say on web pages, on applications other than Facebook or on users’ devices, the latter processing being more intrusive than the former. ( 21 )

26.

In the context of that analysis, it is also important, in my view, to take account of the reasonable expectations of data subjects. ( 22 )

27.

Moreover, in a situation such as that prevailing before the entry into force of the GDPR, in which the processing of data collected outside the Facebook platform was based not on consent but rather on the necessary nature of the processing for the performance of the contract in accordance with Article 6(1)(b) of that regulation, ( 23 ) account must be taken of the Court’s strict interpretation of that provision. ( 24 ) It is therefore important, as emphasised by the Italian Government in its written observations, to ensure that a broad interpretation of the principle of data minimisation under Article 5 of that regulation does not allow controllers to extend the categories of personal data considered to be necessary for the performance of the contract under Article 6(1)(b) of that regulation.

28.

In the light of the foregoing, I propose that the answer to the second question referred for a preliminary ruling should be that Article 5(1)(c) of the GDPR must be interpreted as precluding the processing of personal data for the purposes of targeted advertising without restriction as to time or type of data and that it is for the referring court to assess, in the light of the circumstances of the case and by applying the principle of proportionality, the extent to which the data retention period and the amount of data processed are justified having regard to the legitimate aim of processing those data for the purposes of personalised advertising.

29.

By its fourth question, the referring court asks, in essence, whether Article 5(1)(b) of the GDPR, read in conjunction with Article 9(2)(e) thereof, must be interpreted as meaning that a statement made by a person about his or her sexual orientation as part of a panel discussion permits Meta Platforms Ireland to process other data concerning his or her sexual orientation for the purposes of offering him or her personalised advertising. More generally, the referring court asks about the scope of the latter provision and raises, more specifically, the question as to how that person’s sensitive data would have had to be made public in order for Article 9(2) of the GDPR to apply.

30.

Meta Platforms Ireland stated in its written and oral observations, without this being disputed by the other parties at the hearing, that at no time during the proceedings before the national courts did it rely on the exemption provided for in Article 9(2)(e) of the GDPR as the legal basis for processing the data at issue. ( 25 )

31.

In such circumstances, the fourth question clearly appears to be irrelevant, since that exemption is not applicable in the present case. ( 26 )

32.

That said, it should be recalled that, according to the settled case-law of the Court, in the context of the procedure provided for in Article 267 TFEU, which is based on a clear separation of functions between the national courts and the Court of Justice, questions on the interpretation of EU law referred by a national court, in the factual and legislative context which that court is itself responsible for defining, ( 27 ) and the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevance. ( 28 )

33.

In the following points, therefore, I shall propose an answer to the fourth question raised by the referring court, without prejudice to the Court’s decision as to the relevance of that question.

34.

As a preliminary point, it should be recalled that, in accordance with Article 5(1)(b) of the GDPR, which lays down the principle of purpose limitation, personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Under Article 9(1) of that regulation, the processing of personal data concerning, inter alia, a natural person’s sex life or sexual orientation is to be prohibited, unless such processing falls within the scope of one of the exemptions provided for in Article 9(2) of that regulation. ( 29 )

35.

In particular, pursuant to Article 9(2)(e) of the GDPR, the prohibition on processing sensitive personal data does not apply if the processing relates to personal data which are manifestly made public by the data subject. As I pointed out in my Opinion in Meta Platforms and Others (General terms of use of a social network), ( 30 ) the use in the wording of that provision of the adverb ‘manifestly’ and the fact that that provision constitutes an exemption to the general prohibition on processing sensitive personal data require a particularly stringent application of that exemption, on account of the significant risks to the fundamental rights and freedoms of data subjects. ( 31 ) In order for that exemption to apply, the user must, in my opinion, be fully aware that, by an explicit act, he or she is making his or her personal data accessible to anyone. ( 32 )

36.

In the case in the main proceedings, the sensitive data relating to the applicant’s sexual orientation were disclosed, outside the Facebook platform (‘off site’) and outside any other platform or computer application, as part of a panel discussion organised by the Commission ( 33 ) and with the aim of criticising the allegedly unlawful processing by Meta Platforms Ireland of data relating to that sexual orientation. ( 34 )

37.

In that regard, the Court has already had occasion to rule on the use of ‘off-site’ data, in the context of other platforms, in the judgment in Meta Platforms and Others (General terms of use of a social network). ( 35 ) On that occasion, the Court ruled that Article 9(2)(e) of the GDPR must be interpreted as meaning that, where the user of an online social network visits websites or apps to which one or more of the categories set out in Article 9(1) of the GDPR relate, the user does not manifestly make public, within the meaning of the first of those provisions, the data relating to those visits collected by the operator of that online social network via ‘cookies’ or similar storage technologies and that, where he or she enters information into such websites or apps or where he or she clicks or taps on buttons integrated into those sites and apps, such as the ‘Like’ or ‘Share’ buttons or buttons enabling the user to identify himself or herself on those sites or apps using login credentials linked to his or her social network user account, his or her telephone number or email address, that user does not manifestly make public, within the meaning of Article 9(2)(e) of the GDPR, the data thus entered or resulting from the clicking or tapping on those buttons unless he or she has explicitly made the choice beforehand, as the case may be on the basis of individual settings selected with full knowledge of the facts, to make the data relating to him or her publicly accessible to an unlimited number of persons. ( 36 )

38.

That said, the referring court considered it necessary to maintain the fourth question which it had referred for a preliminary ruling on the ground that the acts examined by the Court in that last case related to visits to websites or apps and clicking or tapping on buttons integrated into them, whereas the present case concerns a statement made by the data subject about his sexual orientation during a panel discussion. In that connection, the referring court considers that consent for the purposes of Article 9(2)(e) of the GDPR cannot be inferred from such a statement.

39.

In that regard, it seems to me appropriate to draw a distinction between, on the one hand, the preliminary question of whether the applicant’s statement concerning his sexual orientation constitutes an act by which he manifestly makes public that sexual orientation within the meaning of Article 9(2)(e) of the GDPR and, on the other hand, if the answer to that question is in the affirmative, the question of whether the fact of having made his sexual orientation manifestly public permits the processing of data related to that orientation for personalised advertising purposes, in accordance, inter alia, with Articles 5 and 6 of that regulation.

40.

As regards, in the first place, the classification which must be given to the applicant’s statement for the purposes of Article 9(2)(a) of the GDPR, in the absence of any useful guidance deriving from the origin of that provision and its application by the Court, ( 37 ) I note that the exemption set out in Article 9(2)(e) of that regulation requires, in essence, two conditions to be met cumulatively, namely, first, an ‘objective’ condition that the personal data in question must be ‘manifestly made public’ and, second, a ‘subjective’ condition that it is the ‘data subject’ who must make those data manifestly public.

41.

In the case in the main proceedings, subject to the checks to be carried out by the referring court, it seems to me that those two conditions are fulfilled. Although disclosed incidentally as part of a wider discussion critical of Meta Platforms Ireland’s processing of sensitive data, I consider that the statement made by the applicant constitutes an act by which, with full knowledge of the facts, he manifestly made public his sexual orientation.

42.

As regards the first condition, it seems to me highly likely that, in the light of the open nature of the panel discussion, which was broadcast live and then as a stream, ( 38 ) and in view of the public’s interest in the subject addressed by that panel, the applicant’s statement may reach an indefinite public, much wider than that in attendance. ( 39 )

43.

As regards the second condition, it is, in my view, entirely possible to presume that, by openly referring to his sexual orientation in the circumstances of the present case (in particular in the context of an event which was open and accessible to the press), the applicant had, if not the intention, at least full awareness of making that orientation ‘manifestly public’ for the purposes of the case-law cited in point 35 of this Opinion. ( 40 )

44.

Moreover, the objective of the protection conferred by Article 9(1) of the GDPR is, in my view, to prevent the data subject from being exposed to harmful consequences (such as public opprobrium or discriminatory acts) deriving, in particular, from a negative perception, from a social or economic point of view, of the situations set out therein. ( 41 ) That provision therefore provides for special protection of such personal data by means of a fundamental prohibition, which is not absolute, and the application of which in the present case is subject to the assessment of the data subject, who is in the best position to assess the harmful consequences which could result from disclosure of the data in question and who may, where appropriate, waive that protection or not avail himself of it, with full knowledge of the facts, by manifestly making public, within the meaning of Article 9(2)(e) of that regulation, his situation, and in particular his sexual orientation.

45.

With regard, in the second place, to the examination of the consequences, which manifestly making public one’s sexual orientation has, as regards the processing of those sensitive data by Meta Platforms Ireland for the purposes of Articles 5 and 6 of the GDPR, I consider that the fact that data are manifestly made public within the meaning of Article 9(2)(e) of that regulation does not, in itself, allow processing of those data to be carried out for the purposes of that regulation.

46.

The application of that provision simply has the effect of lifting the ‘special protection’ afforded to certain particularly sensitive personal data. Once that protection has been knowingly waived by the data subject (who has manifestly made public those data), those initially ‘protected’ personal data become ‘ordinary’ (that is to say non-sensitive) data which, like all other personal data, may be processed lawfully only under the conditions laid down in particular in Articles 6 and 7 of the GDPR and in compliance with the principles laid down in particular in Article 5 of that regulation, ( 42 ) including the principle of purpose limitation set out in Article 5(1)(b) of that regulation, which requires that personal data be collected for specified, explicit and legitimate purposes, a matter which it is for the controller to demonstrate, in accordance with paragraph 2 of the provision in question. ( 43 )

47.

Accordingly, the fact that the applicant made a statement about his sexual orientation as part of a panel discussion, though it may lead to the conclusion that, in the circumstances of the present case, that person ‘manifestly made public’ those data within the meaning of Article 9(2)(e) of the GDPR, cannot, in itself, justify the processing of personal data revealing that person’s sexual orientation. ( 44 )

48.

In the light of the foregoing, I propose that the answer to the fourth question referred should be that Article 5(1)(b) of the GDPR, in conjunction with Article 9(2)(e) thereof, must be interpreted as meaning that a statement made by a person about his or her own sexual orientation for the purposes of a panel discussion open to the public, while capable of constituting an act by which the data subject has ‘manifestly made public’ those data for the purposes of Article 9(2)(e) of that regulation, does not in itself permit the processing of those or other data concerning the sexual orientation of that person with a view to aggregating and analysing the data for the purposes of personalised advertising.

49.

In the light of the foregoing considerations, I propose that the Court answer the second and fourth questions referred by the Oberster Gerichtshof (Supreme Court, Austria) as follows: