by Gerald Trieb and Antonia Kühberger//
In a long-standing civil case between Max Schrems and Facebook Ireland Inc., the Austrian Supreme Court (“Oberster Gerichtshof”, OGH) decided to refer a number of questions to the Court of Justice of the European Union (EUCJ). The four questions raise fundamental doubts about the legality of Facebook’s data processing of all EU customers. It is the third time in one year that the Austrian Supreme Court is submitting a Preliminary Proceeding on the GDPR to the EUCJ. In the proceeding of July 2021 the Austrian Supreme Court wants to know whether a data processing can be based on consent and how broadly a processing for the performance of a contract is to be interpreted. In addition, the EUCJ will have to clarify the extent of the principle of data minimisation and the use of special categories of personal data.
Facts of the main proceedings:
The defendant is Facebook Inc. Ireland which provides services to its users free of charge and generates revenue by processing user data in order to sell advertisers the opportunity to tailor and target advertising. The data collection is done through the use of cookies, social plugins and pixels. The controller processes both personal data and special categories of personal data. The parties disagree whether the processing is based on consent or on the fulfillment of a contract concluded with the user. A permanent deletion of user data from the servers is only initiated 30 day (“cooling-off period”) after the deletion of an account.
The one-stop-shop principle of GDPR does not apply since the proceeding is a civil proceeding. Therefore, the Austrian and not the Irish courts are competent.
Statement of the Parties:
- The plaintiff criticizes the legal basis of consent (Art 6(1)(a) GDPR) on which the processing is based. Therefore, he requests a declaration that there is no effective consent to the processing of personal data available and that no further data processing – unless technically necessary – takes place.
– In contrast, the defendant replies that the data processing is not based on consent (Art 6(1)(a) GDPR) but rather to fulfill a contractual obligation (Art 6(1)(b) GDPR).
Status of the proceedings:
The court of first instance dismissed the claim insofar as the plaintiff was not the “controller” due to his private use of the platform. The personalisation and also personalised advertising are to be considered an essential part of the service offered by the defendant, which is why Art 6(1)(b) of the GDPR can be used as a suitable legal basis. The Court of Appeal also stated similar reasons, according to which the controller provides the Facebook user with a “personalised” platform, i.e. individually tailored to his interests and settings, within the framework of the contractual relationship.
Questions referred to the EUCJ:
1) Core Question: Are the provisions of Art 6(1)(a) and (b) of the GDPR to be interpreted that the lawfulness of contractual provisions in general terms of use of platform contracts such as the one in the main proceedings (in particular contractual provisions such as: “Instead of paying for […], by using the Facebook Products to which these Terms of Use apply, you agree that we may show you advertisements … We will use your personal data […] to show you ads that are more relevant to you”, which involve the processing of personal data for aggregation and analysis of data for the purposes of personalised advertising, must be assessed in accordance with the requirements of Art 6(1)(a) in conjunction with Art 7 of the GDPR, which cannot be replaced by reliance on Art 6(1)(b) of the GDPR?
2) Is Art 5(1)(c) of the GDPR (data minimisation) to be interpreted that all personal data held by a platform such as issued in the main proceedings (in particular by the data subject or by third parties on and off the platform) may be aggregated, analysed and processed for the purposes of targeted advertising without any restriction as to the time or nature of the data?
3) Is Art 9 (1) of the GDPR to be interpreted as applying to the processing of data which permits the targeted filtering of special categories of personal data such as political opinion or sexual orientation (for example, for advertising), even if the controller does not differentiate between those data?
4) Is Art 5(1)(b) in conjunction with Art 9(2)(e) of the GDPR to be interpreted that a statement about one’s sexual orientation for the purposes of a panel discussion permits the processing of other data relating to sexual orientation for the purposes of aggregating and analysing data for the purposes of personalised advertising?
In support of the questions referred, the Supreme Court argues:
– In addition to the legal basis of consent, other permissions to process personal data can also coexist in parallel.
– Although the Supreme Court appreciates the statements of the Court of Appeal that the use of data is fundamental for the owed “personalised experience”, it is disputed whether the defendant’s declaration of intent can be shifted under the legal concept according to Art 6(1)(b) of the GDPR in order to circumvent the higher requirements for consent under data protection law.
– Data processing may only be based on Art 6(1)(b) of the GDPR if it is “necessary”. Accordingly, it must be examined whether there is a direct factual connection between the intended data processing and the specific purpose of the legal obligation.
– In addition, data processing of special category personal data is prohibited under Art 9 GDPR. The (voluntary) public accessibility of such data may constitute an exception, according to which the data processing is permissible after all. However, the compliant does not communicate such a voluntary publication via his Facebook-profile.
In summary, it can therefore be expected that the upcoming preliminary ruling will provide a clarification on the interpretation of the legal basis of consent (Art 6(1)(a) GDPR), the fulfillment of a contract (Art 6(1)(b) GDPR) and the requirements to process special categories of personal data (Art 9 GDPR). In particular, there is still hardly any relevant case law on processing on the basis of a contractual obligation, which is why comprehensive explanations on this question are desirable.
Links:
– Reference to EUCJ, including Questions (German Original)
– Reference to EUCJ, including Questions (English Translation)
Dr. Gerald Trieb is Partner at Knyrim Trieb Rechtsanwälte Vienna (Austria).
Antonia Kühberger is Legal Intern at Knyrim Trieb Rechtsanwälte Vienna (Austria) and Data Protection Support at Coca-Cola Hellenic Bottling Company.