The fact that Mr Maximilian Schrems has made a statement about his sexual orientation on the occasion of a public panel discussion does not authorise the operator of an online social network platform to process other data relating to his sexual orientation, obtained, as the case may be, outside that platform, with a view to aggregating and analysing those data, in order to offer him personalised advertising

Mr Maximilian Schrems brought an action before the Austrian courts challenging the, in his submission unlawful, processing of his personal data by Meta Platforms Ireland in the context of the online social network Facebook. Those data include inter alia data concerning his sexual orientation.

Meta Platforms Ireland collects the personal data of Facebook users, including Mr Schrems, concerning those users’ activities both on and outside that social network, including in particular data relating to online platform visits and third-party websites and apps. To that end, Meta Platforms Ireland uses ‘cookies’,[1] ‘social plug-ins’[2] and ‘pixels’[3], embedded on the relevant websites.

With the data available to it, Meta Platforms Ireland is also able to identify Mr Schrems’ interest in sensitive topics, such as sexual orientation, which enables it to direct targeted advertising at him[4] in that regard, the question then arises as to whether Mr Schrems manifestly made public sensitive personal data about himself by having disclosed, on the occasion of a public panel discussion[5], the fact that he was homosexual, and thus authorised the processing of those data under the General Data Protection Regulation (GDPR).[6]

In that context[7], the Supreme Court, Austria, requested the Court of Justice to interpret the GDPR.[8]

First, the Court replies that the principle of data minimisation provided for by the GDPR precludes all of the personal data obtained by a controller, such as the operator of an online social network platform, from the data subject or third parties and collected either on or outside that platform, from being aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time and without distinction as to type of data.

Second, the Court finds that the possibility cannot be ruled out that, by his statement on the occasion of the panel discussion in question, Mr Schrems manifestly made his sexual orientation public. It is for the Supreme Court, Austria, to verify whether this is so.

The consequence of the fact that a data subject has manifestly made public data concerning his or her sexual orientation is that those data may be processed in compliance with the provisions of the GDPR. However, that fact alone does not authorise the processing of other personal data relating to that data subject’s sexual orientation.

Thus, the fact that a person has made a statement about his or her sexual orientation on the occasion of a public panel discussion does not authorise the operator of an online social network platform to process other data relating to that person’s sexual orientation, obtained, as the case may be, outside that platform using partner third-party websites and apps, with a view to aggregating and analysing those data, in order to offer that person personalised advertising.

[1] ‘Cookies’, installed on the device used, enable Meta to ascertain the source of visits.
[2] Facebook’s social plug-ins are ‘embedded’ by website operators into their pages. The most widely used is Facebook’s ‘like’ button. Each time such websites containing that button are visited, the cookies stored, the URL of the page visited and various log data (e.g. IP addresses, time data) are transmitted to Meta Platforms Ireland. In that respect, it is not necessary that the user has clicked on the ‘like’ button, since merely loading a page with such a social plug-in is sufficient for those data to be transmitted to Meta Platforms Ireland.
[3] Like social plug-ins, pixels can be embedded in websites and enable information to be collected about users who have visited those websites in order, inter alia, to measure and optimise advertising thereon. For example, when website operators integrate a Facebook pixel into their own websites, they can receive reports from Meta Platforms Ireland about how many people saw their advertising on Facebook and then subsequently went to the operators’ own website to visit it or make a purchase.
[4] As from 6 November 2023, Facebook’s services continued to be free only for users who had consented to their personal data being collected and used for the purpose of directing personalised advertising at them; users were able to sign up for a paying subscription in order to access a version of those services without receiving personalised advertising.
[5] On the occasion of a panel discussion, accessible to the public, in which he participated in Vienna on 12 February 2019, at the invitation of the Representation of the European Commission in Austria, Mr Schrems referred to his sexual orientation for the purpose of criticising Facebook’s processing of personal data, including the processing of his own data. That panel discussion was streamed and a recording of the round table was subsequently published as a podcast, as well as on the Commission’s YouTube channel. However, Mr Schrems has never mentioned that aspect of his personal life on his Facebook profile.
[6] Article 9(2)(e) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
[7] In the same proceedings, the Supreme Court, Austria, had previously questioned the Court of Justice about the jurisdiction of the Austrian courts, which gave rise to the judgment of 25 January 2018, Schrems, C-498/16 (see also Press Release No 7/18).
[8] In the light of the judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C-252/21 (see also Press Release No 113/23), the Supreme Court, Austria, withdrew some of its questions.

:: Judgment of the Court in Case C-446/21 | Schrems (Communication of data to the general public)