OGH - 6Ob56/21k (request for preliminary ruling under Article 267 TFEU)
|OGH - 6Ob56/21k (request for preliminary ruling under Article 267 TFEU)|
|Relevant Law:||Article 5(1)(c) GDPR|
Article 6(1)(a) GDPR
Article 6(1)(b) GDPR
Article 9(1) GDPR
Article 9(2) GDPR
|National Case Number/Name:||6Ob56/21k (request for preliminary ruling under Article 267 TFEU)|
|European Case Law Identifier:||ECLI:AT:OGH0002:2021:0060OB00056.21K.0623.000|
|Original Source:||Rechtsinformationssystem des Bundes (in German)|
The Supreme Court of Austria requested the CJEU's preliminary ruling on several questions, including whether processing operations for the provision of personalised advertising are to be assessed under the requirements of Article 6(1)(a) GDPR, or whether they can be replaced by relying on Article 6(1)(b) GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
In the proceedings, the plaintiff filed a total of 12 applications. The court ruled on 6 of these applications by partial judgment of 23 June 2021. The proceedings were interrupted with regard to the remaining 5 applications until the CJEU has ruled on the preliminary ruling proceedings initiated by order of 23 June 2021. An overall short summary can be found here.
This order for preliminary ruling only concerns applications 5 to 9, so that only the relevant facts are presented in a very abbreviated form below. The facts relevant for the proceedings already decided by partial judgment are presented there.
The plaintiff is Max Schrems. The defendant is Facebook Ireland.
Facebook provides a platform on which more than 2.2 billion users worldwide can upload data and respond to data uploaded by other users. This includes text posts, pictures, videos, events, comments, "likes", tags on photos and much more. The court explains all the functions of the Facebook platform. In particular, it explains that users network with each other in so-called "friendships". Practically all information from all users is linked to each other - especially via the friendship network. This linking allows an evaluation of the individual user beyond the data provided by the user himself. The research into the "preferences" and the "profile" of the users does not only include interests or information provided by the user himself, but all personal data available to the defendant.
Facebook does not generate any content itself and only provides the infrastructure (free of charge). Facebook receives the (linked) personal data. The economic model of the defendant is to generate revenue through personalised advertising and commercial content based on the same preferences and interests. For this purpose, Facebook provides so-called business tools, which in turn can be differentiated into three tools described by the court in more detail. The respective advertisers must accept conditions before using them.
The court then explains in detail to what extent Facebook offers personalised advertising to the plaintiff and what information the so-called business tools work with. The latter are Facebook's rating and analysis services that allow advertisers to determine the effectiveness of advertising and how website users interact with content on their websites. There are three different tools: "Custom Audience Tool", "Look-A-Like Audience Tool" and "Core Audience Function".
In particular, Facebook then relies in the data policy on the consent of its users to process data with special protection, citing as examples "political opinions" and "who you are "interested in""). The plaintiff did not give such consent.
The plaintiff selected the option offered by Facebook not to use data from advertisers and other partners about activity outside of Facebook products for the purpose of customising ads. The plaintiff has not added any sensitive data to his profile. Only his "friends" can see his future posts or posts on his timeline; his "friends list" is not public. The plaintiff has also opted out of allowing Facebook to use information on the profile fields of relationship status, employer, job title and education for targeted advertising.
The defendant processed (also with the plaintiff) the interest in "sensitive topics" such as health issues, sexual orientation, ethnic groups and political parties. It is possible to define a target group for advertising also according to these interests. Facebook therefore allows advertising to men based on interest in men, and to people based on interest in homosexuality, political parties or diseases.
The plaintiff was shown an advertisement for an Austrian politician based on the analysis that he resembled other "customers" who had marked this politician with "like". The plaintiff also regularly received advertisements targeting homosexual persons and invitations to corresponding events, although he had not been interested in the specific event beforehand and did not know the venues. These advertisements or invitations were not directly based on the sexual orientation of the plaintiff or his "friends", but on an analysis of their interests.
The list of his activities outside Facebook includes apps or websites of Romeo Gay Dating & Chat, Grindr Gay chat and Facebook. His data includes an email address that does not exist and an email address that he did not enter in his profile, but which he had used when contacting the defendant.
Ultimately, the court elaborates on various deletion options on Facebook.
The decision was based on the applicant's applications 5 to 10:
Requests 5 to 10 relate to the lawfulness of the data processing carried out by Facebook:
The plaintiff seeks, firstly, a declaratory judgment,
- that the consents obtained by Facebook do not constitute valid consents within the meaning of the GDPR.
- that Facebook does not have consent to process data obtained from third parties for its own purposes as described in more detail.
Secondly, the plaintiff wants Facebook to be obliged to refrain from using his data in the future
- for personalised advertising, aggregation and analysis for the purposes of advertising.
- when processing data relating to the visit or use of third-party sites (in particular through the use of so-called "social plugins" or similar), provided this is done solely for the purpose of displaying the website elements or effective consent (opt-in) has been obtained
- that Facebook has received from third parties for its own purposes, unless valid consent (opt-in) has been obtained.
- within the framework of the data application 'Graph Search' as well as through similar techniques, unless effective consent (opt-in) has been obtained
The court of first instance and the court of appeal had still rejected the applications, in particular with reference to lawfulness under Article 6(1)(b) GDPR because of a contract to provide a "personalised" platform.
Holding[edit | edit source]
The following questions were referred to the CJEU for a preliminary ruling under Article 267 TFEU:
- Is Article 5(1)(c) GDPR (data minimisation) to be interpreted as meaning that all personal data held by a platform such as that in the main proceedings (in particular by the data subject or by third parties on and off the platform) may be aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time or type of data?
- Is Article 9(1) GDPR to be interpreted as applying to the processing of data that permits the targeted filtering of special categories of personal data such as political opinion or sexual orientation (for example, for advertising), even if the controller does not differentiate between these data?
- Is Article 5(1)(b) in conjunction with Article 9(2)(e) GDPR to be interpreted as meaning that a statement about one's sexual orientation for the purposes of a panel discussion permits the processing of other sexual orientation data for the purposes of aggregating and analysing data for the purposes of personalised advertising?
The court justifies these questions for a preliminary ruling as follows:
Facebook does not rely on consent, but on the fact that the data processing is an essential part of the contractual purpose of "personalisation" and necessary for the performance of the contract, Article 6(1)(b) GDPR. According to the findings of the court of first instance, the plaintiff had concluded this contract with knowledge of this content.
Based on the economic model described under "Facts", the Court of Appeal assumed that the provision of personal user data was a main pillar of the contract concluded between the parties. Facebook owed the personalised advertising experience. It considered the processing to be lawful within the meaning of Article 6(1)(b) GDPR.
The referring court has considerable doubts about this. In essence, it is a question of whether the declaration of consent to processing by Facebook can be moved under the legal concept of Article 6(1)(b) GDPR in order to undermine the significantly higher protection offered to the plaintiff by the legal basis of "consent".
In order to substantiate these doubts, the court first refers to WP29 Guidelines, according to which the mere mentioning of processing activities “in the small print" is not sufficient (WP217, p. 17). The literature also points out that providers such as Facebook typically use data about their users for advertising purposes, which is not necessary for the performance of the contract in the strict sense. The court then states that the objective purpose of the contract is required for Article 6(1)(b) GDPR. Artificial or unilaterally imposed services cannot be subsumed under this.
The court further states that Article 9(1) GDPR is affected and that an exception to the general processing ban can only be made under the conditions of Article 9(2) GDPR. In doing so, the court pointed out that Article 9(2)(e) GDPR, i.e. the public nature of the data, was not already based on a statement made by the plaintiff at the representation of the European Commission. This statement had been made precisely with the intention of questioning and publicly criticising the data processing already carried out by Facebook.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the German original. Please refer to the German original for more details.