CURIA - Documents

Home > Search form > List of results > Documents

Start printing

Language of document : ECLI:EU:C:2024:366

Provisional text

OPINION OF ADVOCATE GENERAL

RANTOS

delivered on 25 April 2024 (1)

Case C‑446/21

Maximilian Schrems

Meta Platforms Ireland Limited, formerly Facebook Ireland Limited

(Request for a preliminary ruling from the Oberster Gerichtshof (Supreme Court, Austria))

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Social networks – Article 5(1)(b) – Principle of ‘purpose limitation’ – Article 5(1)(e) – Principle of ‘data minimisation’ – Article 9(1) and (2)(e) – Processing of special categories of personal data – Personal data which are manifestly made public by the data subject – Personalised advertising – Data concerning sexual orientation)

Introduction

1. This request for a preliminary ruling from the Oberster Gerichtshof (Supreme Court, Austria) has been made in proceedings between Mr Maximilian Schrems (‘the applicant’), a user of the social network Facebook, and Meta Platforms Ireland Limited, formerly Facebook Ireland Limited (‘Meta Platforms Ireland’ or ‘the defendant’), concerning the allegedly unlawful processing by that company of his personal data.

2. The questions referred for a preliminary ruling in the present case concern, on the one hand, the application of the principle of ‘data minimisation’ laid down in Article 5(1)(c) of Regulation (EU) 2016/679 (2) and, on the other hand, the interpretation of the concept of ‘personal data which are manifestly made public by the data subject’ referred to in Article 9(2)(e) of that regulation, read in conjunction with Article 5(1)(b) of that regulation, which establishes the principle of ‘purpose limitation’. The referring court asks, in essence, first, whether the principle of data minimisation permits the processing of personal data without restriction as to time or type of data and, second, whether a person’s statements concerning his or her own sexual orientation, made during a panel discussion, allow the processing of other data relating to that person’s sexual orientation for the purposes of personalised advertising.

Legal context

3. Article 4 of the GDPR, entitled ‘Definitions’, provides in paragraph 11 thereof:

‘For the purposes of this Regulation:

…

(11) “consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

4. Article 5 of that regulation, entitled ‘Principles relating to processing of personal data’, provides, in paragraphs 1 and 2 thereof:

‘1. Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; …

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);

…

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’

5. Article 6 of that regulation, entitled ‘Lawfulness of processing’, provides in paragraphs 1 and 3 thereof:

‘1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

…

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

…

3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

(a) Union law; or

(b) Member State law to which the controller is subject.

…

… The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.’

6. Article 7 of that regulation, entitled ‘Conditions for consent’, is worded as follows:

‘1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.

…

3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.’

7. Article 9(1) and (2) of the GDPR, entitled ‘Processing of special categories of personal data’, provides:

‘1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

2. Paragraph 1 shall not apply if one of the following applies:

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

…

(e) processing relates to personal data which are manifestly made public by the data subject;

…’

8. Article 13 of that regulation, concerning ‘information to be provided where personal data are collected from the data subject’, provides, in paragraph 1 thereof:

‘Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

…

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

…’

The dispute in the main proceedings, the questions referred for a preliminary ruling and the procedure before the Court

9. Meta Platforms Ireland, a company incorporated under the law of Ireland, operates the closed communications network ‘Facebook’, which is, in essence, an online social network for sharing content. (3) Its business model is essentially to offer free social networking services to its private users and to sell online advertising, including advertising tailored to its users. (4) That advertising is primarily based on the automated creation of relatively detailed profiles of the users of that social network. (5)

10. In 2018, following the entry into force of the GDPR, Meta Platforms Ireland presented new Facebook terms of service to its users in the European Union with a view to obtaining their consent, which is, moreover, required in order to sign up for or access the accounts and services provided by Facebook. (6) Those new terms of service also enable users to have an overview of and control over the data stored. (7)

11. The applicant is a Facebook user who accepted the new terms of service presented by Facebook. As is apparent from the order for reference, he has publicly referred to his homosexuality but, on his Facebook profile, he has never mentioned his sexual orientation and has not published any sensitive data. (8) Nor has the applicant authorised the defendant to use, for the purposes of targeted advertising, the fields in his profile relating to his relationship status, employer, job title or education.

12. However, the applicant allegedly received an advertisement for a female politician, and that advertisement was sent to him on the basis of the analysis that he was similar to other ‘customers’ who had ‘liked’ her; he regularly received advertising aimed at homosexuals and invitations to corresponding events, even though he had never previously shown an interest in such events and was not even familiar with the venues in which they were held. Those advertisements and invitations were based not directly on the applicant’s sexual orientation or that of his ‘friends’ on the social network, but on an analysis of their particular interests. (9) Moreover, he claims that Meta Platforms Ireland recorded all data relating to the applicant, including those obtained through third parties or plug-ins, and stored them for an indefinite period.

13. In those circumstances, the applicant brought, before the Landesgericht für Zivilsachen Wien (Regional Court for Civil Matters, Vienna, Austria), an action seeking enforcement, a declaration and an injunction concerning the allegedly unlawful processing of his personal data by Meta Platforms Ireland. (10)

14. Subsequently, on the occasion of a panel discussion organised by the Representation of the European Commission in Vienna (Austria) and held on 12 February 2019, (11) the applicant referred to his sexual orientation during a speech aimed at criticising the allegedly unlawful processing, by Meta Platforms Ireland, of data relating to his sexual orientation. (12)

15. His action having been dismissed, at first instance, by judgment of 30 June 2020 and, on appeal, by the Oberlandesgericht Wien (Higher Regional Court, Vienna, Austria), by judgment of 7 December 2020, (13) the applicant lodged an appeal on a point of law before the Oberster Gerichtshof (Supreme Court), the referring court.

16. In that context, the Oberster Gerichtshof (Supreme Court) decided to stay the proceedings and to refer four questions to the Court of Justice for a preliminary ruling. (14) Since the first and third questions were withdrawn following the judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), (15) the present case concerns the second and fourth questions, which are worded as follows:

‘(2) Is Article 5(1)(c) of the GDPR (data minimisation) to be interpreted as meaning that all personal data held by a platform such as that in the main proceedings (by way of, in particular, the data subject or third parties on and outside the platform) may be aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time or type of data?

(4) Is Article 5(1)(b) of the GDPR, read in conjunction with Article 9(2)(e) thereof, to be interpreted as meaning that a statement made by a person about his or her own sexual orientation for the purposes of a panel discussion permits the processing of other data concerning sexual orientation with a view to aggregating and analysing the data for the purposes of personalised advertising?’

17. Written observations were lodged by the applicant, Meta Platforms Ireland, the Austrian, French, Italian and Portuguese Governments and the Commission. Oral argument was presented by the applicant, Meta Platforms Ireland, the Austrian Government and the Commission at the hearing held on 8 February 2024.

Analysis

The second question referred

18. By its second question, the referring court asks, in essence, whether Article 5(1)(c) of the GDPR, which lays down the principle of data minimisation, must be interpreted as meaning that all the personal data available to a network such as Facebook, in particular through the data subject or third parties on and outside that platform, may be aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time or type of data.

19. As a preliminary point, all processing of personal data must comply, first, with the principles relating to processing of data set out in Article 5 of the GDPR and, second, with one of the conditions relating to lawfulness of processing listed in Article 6 of that regulation. (16)

20. As regards, more specifically, the principles relating to processing of personal data, the Court has stated, inter alia, that the principle of data minimisation set out in Article 5(1)(c) of the GDPR provides that personal data are to be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, which reflects, in essence, the principle of proportionality. (17) Accordingly, the principle of data minimisation aims to minimise the restrictions on the right to the protection of personal data caused by the processing in question.

21. In the present case, it seems clear to me that the possible absence of any limitation, as assumed by the referring court, is, by definition, contrary to the application of the principle of data minimisation. However, it is not apparent from the documents before the Court that there is anything to confirm or exclude such an assumption, which, in any event, it is for the referring court to assess. I shall nevertheless endeavour to provide that court with some useful guidance on the interpretation of the provision under consideration, which may enable that court to rule on the case pending before it.

22. As regards, first, the restriction of processing of personal data as to time, I consider that, in the absence in the GDPR of a specific provision in that connection, the EU judicature cannot set a mandatory time limit for the retention of such data. Moreover, the Court has held that even initially lawful processing of accurate data may over time become incompatible, in particular, with Article 5(1)(c) to (e) of the GDPR, where those data are no longer necessary in the light of the purposes for which they were collected or processed. (18) It is therefore for the referring court to assess, in the light of the circumstances of the case and by applying the principle of proportionality, (19) the extent to which the period of retention of personal data by Meta Platforms Ireland is justified having regard to the legitimate aim of processing those data for the purposes of personalised advertising.

23. As regards, second, the restriction of processing of personal data as to type of data, it is also for the referring court to determine, in the circumstances of the present case, the personal data the processing of which may be considered to be lawful, in accordance with the principle of proportionality.

24. Moreover, the references, in the wording of Article 5(1)(c) of the GDPR, to very general conditions, such as ‘adequacy’, ‘relevance’ and ‘necessity’, demonstrate, in my view, that the EU legislature intended to leave a wide discretion to the competent authorities in the application of that provision, since those conditions can be interpreted only on a case-by-case basis, in the light of the circumstances of the case.

25. That said, I consider that, as the Commission notes in its written observations, certain distinctions may be drawn depending on the degree to which the various forms of processing interfere with the rights of the data subject. The referring court could, therefore, where it considers it appropriate, on the one hand, draw a distinction between the use of ‘static’ data concerning the data subject (such as age (20) or sex) and the use of ‘behavioural’ data (such as the monitoring of users’ browsing habits), the latter use being, as a general rule, more intrusive as regards the data subject’s rights. With regard, in particular, to ‘behavioural’ data, a further distinction could be drawn between the collection of data relating to ‘active’ behaviour (such as clicking on the ‘Like’ button) and the collection of data relating to ‘passive’ behaviour (such as simply visiting a website), the latter normally being more intrusive for the user. On the other hand, a distinction could also be drawn between the processing of personal data collected on the Facebook platform and outside that platform, that is to say on web pages, on applications other than Facebook or on users’ devices, the latter processing being more intrusive than the former. (21)

26. In the context of that analysis, it is also important, in my view, to take account of the reasonable expectations of data subjects. (22)

27. Moreover, in a situation such as that prevailing before the entry into force of the GDPR, in which the processing of data collected outside the Facebook platform was based not on consent but rather on the necessary nature of the processing for the performance of the contract in accordance with Article 6(1)(b) of that regulation, (23) account must be taken of the Court’s strict interpretation of that provision. (24) It is therefore important, as emphasised by the Italian Government in its written observations, to ensure that a broad interpretation of the principle of data minimisation under Article 5 of that regulation does not allow controllers to extend the categories of personal data considered to be necessary for the performance of the contract under Article 6(1)(b) of that regulation.

28. In the light of the foregoing, I propose that the answer to the second question referred for a preliminary ruling should be that Article 5(1)(c) of the GDPR must be interpreted as precluding the processing of personal data for the purposes of targeted advertising without restriction as to time or type of data and that it is for the referring court to assess, in the light of the circumstances of the case and by applying the principle of proportionality, the extent to which the data retention period and the amount of data processed are justified having regard to the legitimate aim of processing those data for the purposes of personalised advertising.

The fourth question referred

29. By its fourth question, the referring court asks, in essence, whether Article 5(1)(b) of the GDPR, read in conjunction with Article 9(2)(e) thereof, must be interpreted as meaning that a statement made by a person about his or her sexual orientation as part of a panel discussion permits Meta Platforms Ireland to process other data concerning his or her sexual orientation for the purposes of offering him or her personalised advertising. More generally, the referring court asks about the scope of the latter provision and raises, more specifically, the question as to how that person’s sensitive data would have had to be made public in order for Article 9(2) of the GDPR to apply.

The relevance of the question referred

30. Meta Platforms Ireland stated in its written and oral observations, without this being disputed by the other parties at the hearing, that at no time during the proceedings before the national courts did it rely on the exemption provided for in Article 9(2)(e) of the GDPR as the legal basis for processing the data at issue. (25)

31. In such circumstances, the fourth question clearly appears to be irrelevant, since that exemption is not applicable in the present case. (26)

32. That said, it should be recalled that, according to the settled case-law of the Court, in the context of the procedure provided for in Article 267 TFEU, which is based on a clear separation of functions between the national courts and the Court of Justice, questions on the interpretation of EU law referred by a national court, in the factual and legislative context which that court is itself responsible for defining, (27) and the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevance. (28)

33. In the following points, therefore, I shall propose an answer to the fourth question raised by the referring court, without prejudice to the Court’s decision as to the relevance of that question.

The substance of the question referred

34. As a preliminary point, it should be recalled that, in accordance with Article 5(1)(b) of the GDPR, which lays down the principle of purpose limitation, personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Under Article 9(1) of that regulation, the processing of personal data concerning, inter alia, a natural person’s sex life or sexual orientation is to be prohibited, unless such processing falls within the scope of one of the exemptions provided for in Article 9(2) of that regulation. (29)

35. In particular, pursuant to Article 9(2)(e) of the GDPR, the prohibition on processing sensitive personal data does not apply if the processing relates to personal data which are manifestly made public by the data subject. As I pointed out in my Opinion in Meta Platforms and Others (General terms of use of a social network), (30) the use in the wording of that provision of the adverb ‘manifestly’ and the fact that that provision constitutes an exemption to the general prohibition on processing sensitive personal data require a particularly stringent application of that exemption, on account of the significant risks to the fundamental rights and freedoms of data subjects. (31) In order for that exemption to apply, the user must, in my opinion, be fully aware that, by an explicit act, he or she is making his or her personal data accessible to anyone. (32)

36. In the case in the main proceedings, the sensitive data relating to the applicant’s sexual orientation were disclosed, outside the Facebook platform (‘off site’) and outside any other platform or computer application, as part of a panel discussion organised by the Commission (33) and with the aim of criticising the allegedly unlawful processing by Meta Platforms Ireland of data relating to that sexual orientation. (34)

37. In that regard, the Court has already had occasion to rule on the use of ‘off-site’ data, in the context of other platforms, in the judgment in Meta Platforms and Others (General terms of use of a social network). (35) On that occasion, the Court ruled that Article 9(2)(e) of the GDPR must be interpreted as meaning that, where the user of an online social network visits websites or apps to which one or more of the categories set out in Article 9(1) of the GDPR relate, the user does not manifestly make public, within the meaning of the first of those provisions, the data relating to those visits collected by the operator of that online social network via ‘cookies’ or similar storage technologies and that, where he or she enters information into such websites or apps or where he or she clicks or taps on buttons integrated into those sites and apps, such as the ‘Like’ or ‘Share’ buttons or buttons enabling the user to identify himself or herself on those sites or apps using login credentials linked to his or her social network user account, his or her telephone number or email address, that user does not manifestly make public, within the meaning of Article 9(2)(e) of the GDPR, the data thus entered or resulting from the clicking or tapping on those buttons unless he or she has explicitly made the choice beforehand, as the case may be on the basis of individual settings selected with full knowledge of the facts, to make the data relating to him or her publicly accessible to an unlimited number of persons. (36)

38. That said, the referring court considered it necessary to maintain the fourth question which it had referred for a preliminary ruling on the ground that the acts examined by the Court in that last case related to visits to websites or apps and clicking or tapping on buttons integrated into them, whereas the present case concerns a statement made by the data subject about his sexual orientation during a panel discussion. In that connection, the referring court considers that consent for the purposes of Article 9(2)(e) of the GDPR cannot be inferred from such a statement.

39. In that regard, it seems to me appropriate to draw a distinction between, on the one hand, the preliminary question of whether the applicant’s statement concerning his sexual orientation constitutes an act by which he manifestly makes public that sexual orientation within the meaning of Article 9(2)(e) of the GDPR and, on the other hand, if the answer to that question is in the affirmative, the question of whether the fact of having made his sexual orientation manifestly public permits the processing of data related to that orientation for personalised advertising purposes, in accordance, inter alia, with Articles 5 and 6 of that regulation.

40. As regards, in the first place, the classification which must be given to the applicant’s statement for the purposes of Article 9(2)(a) of the GDPR, in the absence of any useful guidance deriving from the origin of that provision and its application by the Court, (37) I note that the exemption set out in Article 9(2)(e) of that regulation requires, in essence, two conditions to be met cumulatively, namely, first, an ‘objective’ condition that the personal data in question must be ‘manifestly made public’ and, second, a ‘subjective’ condition that it is the ‘data subject’ who must make those data manifestly public.

41. In the case in the main proceedings, subject to the checks to be carried out by the referring court, it seems to me that those two conditions are fulfilled. Although disclosed incidentally as part of a wider discussion critical of Meta Platforms Ireland’s processing of sensitive data, I consider that the statement made by the applicant constitutes an act by which, with full knowledge of the facts, he manifestly made public his sexual orientation.

42. As regards the first condition, it seems to me highly likely that, in the light of the open nature of the panel discussion, which was broadcast live and then as a stream, (38) and in view of the public’s interest in the subject addressed by that panel, the applicant’s statement may reach an indefinite public, much wider than that in attendance. (39)

43. As regards the second condition, it is, in my view, entirely possible to presume that, by openly referring to his sexual orientation in the circumstances of the present case (in particular in the context of an event which was open and accessible to the press), the applicant had, if not the intention, at least full awareness of making that orientation ‘manifestly public’ for the purposes of the case-law cited in point 35 of this Opinion. (40)

44. Moreover, the objective of the protection conferred by Article 9(1) of the GDPR is, in my view, to prevent the data subject from being exposed to harmful consequences (such as public opprobrium or discriminatory acts) deriving, in particular, from a negative perception, from a social or economic point of view, of the situations set out therein. (41) That provision therefore provides for special protection of such personal data by means of a fundamental prohibition, which is not absolute, and the application of which in the present case is subject to the assessment of the data subject, who is in the best position to assess the harmful consequences which could result from disclosure of the data in question and who may, where appropriate, waive that protection or not avail himself of it, with full knowledge of the facts, by manifestly making public, within the meaning of Article 9(2)(e) of that regulation, his situation, and in particular his sexual orientation.

45. With regard, in the second place, to the examination of the consequences, which manifestly making public one’s sexual orientation has, as regards the processing of those sensitive data by Meta Platforms Ireland for the purposes of Articles 5 and 6 of the GDPR, I consider that the fact that data are manifestly made public within the meaning of Article 9(2)(e) of that regulation does not, in itself, allow processing of those data to be carried out for the purposes of that regulation.

46. The application of that provision simply has the effect of lifting the ‘special protection’ afforded to certain particularly sensitive personal data. Once that protection has been knowingly waived by the data subject (who has manifestly made public those data), those initially ‘protected’ personal data become ‘ordinary’ (that is to say non-sensitive) data which, like all other personal data, may be processed lawfully only under the conditions laid down in particular in Articles 6 and 7 of the GDPR and in compliance with the principles laid down in particular in Article 5 of that regulation, (42) including the principle of purpose limitation set out in Article 5(1)(b) of that regulation, which requires that personal data be collected for specified, explicit and legitimate purposes, a matter which it is for the controller to demonstrate, in accordance with paragraph 2 of the provision in question. (43)

47. Accordingly, the fact that the applicant made a statement about his sexual orientation as part of a panel discussion, though it may lead to the conclusion that, in the circumstances of the present case, that person ‘manifestly made public’ those data within the meaning of Article 9(2)(e) of the GDPR, cannot, in itself, justify the processing of personal data revealing that person’s sexual orientation. (44)

48. In the light of the foregoing, I propose that the answer to the fourth question referred should be that Article 5(1)(b) of the GDPR, in conjunction with Article 9(2)(e) thereof, must be interpreted as meaning that a statement made by a person about his or her own sexual orientation for the purposes of a panel discussion open to the public, while capable of constituting an act by which the data subject has ‘manifestly made public’ those data for the purposes of Article 9(2)(e) of that regulation, does not in itself permit the processing of those or other data concerning the sexual orientation of that person with a view to aggregating and analysing the data for the purposes of personalised advertising.

Conclusion

49. In the light of the foregoing considerations, I propose that the Court answer the second and fourth questions referred by the Oberster Gerichtshof (Supreme Court, Austria) as follows:

1. Article 5(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as:

– precluding the processing of personal data for the purposes of targeted advertising without restriction as to time or type of data, and

– meaning that it is for the referring court to assess, in the light of the circumstances of the case and by applying the principle of proportionality, the extent to which the data retention period and the amount of data processed are justified having regard to the legitimate aim of processing those data for the purposes of personalised advertising.

2. Article 5(1)(b) of Regulation 2016/679, in conjunction with Article 9(2)(e) thereof,

must be interpreted as meaning that:

– a statement made by a person about his or her own sexual orientation for the purposes of a panel discussion open to the public, while capable of constituting an act by which the data subject has ‘manifestly made public’ those data for the purposes of Article 9(2)(e) of that regulation, does not in itself permit the processing of those or other data concerning the sexual orientation of that person with a view to aggregating and analysing the data for the purposes of personalised advertising.

1 Original language: French.

2 Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2, ‘the GDPR’).

3 That social network allows its users to upload and share content in a personalised way, based on their pre-selected settings, and to communicate directly or exchange data with other users.

4 More specifically, that advertising aims to present users with goods and services of possible interest to them, in particular based on their personal consumer attitudes, interests, purchasing power and personal situation (location, age, sex, etc.). At the same time, ‘Facebook Business Tools’ enable advertisers to create targeted advertisements and to verify the effectiveness of their advertising using systems of analysis based on correlation algorithms and models in order to infer the corresponding consequences.

5 For those purposes, the defendant uses technologies such as ‘cookies’, which enable the use of ‘social plug-ins’ (such as the ‘Like’ button) or ‘pixels’, which are IT tools incorporated into the Facebook site, websites and third-party applications. Those tools allow, in essence, the collection and aggregation of certain data from a user visiting such websites or using such applications in which they are contained, thus creating a user profile on the basis of which it is possible to offer personalised advertising.

6 In its written and oral observations, Meta Platforms Ireland has stated that, in the period prior to the entry into force of the GDPR, first, the processing for personalised advertising purposes of personal data collected on its platform was based not on the consent of the applicant but primarily on the justification that the processing of those data was necessary for the performance of the contract, and, second, the processing of personal data collected on sites or applications outside its network was based on the user’s consent, so that the user could exclude the latter data from processing without giving up Facebook’s services. In the present case, the company argues that it did not process the applicant’s personal data collected outside its platform because, when he registered with the Facebook social network in 2008, he had not given his consent in that connection. By contrast, from the entry into force of the GDPR, Facebook obtained consent to the processing for personalised advertising purposes of personal data collected either on its network or on external sites or applications and, in the absence of such consent, allowed users not to permit the processing of all their data for personalised advertising purposes in return for payment of a fee. It would appear that the lawfulness of the new terms of service under the GDPR is currently being examined by the data protection authorities of some Member States.

7 As is clear from the order for reference, Meta Platforms Ireland does not grant access to all the data processed, but grants access only to the data which it considers to be of interest and relevance to users. In addition, Meta Platforms Ireland allows certain content (such as messages, photos or posts) to be deleted from a Facebook account.

8 Moreover, only his ‘friends’, the list of whom is not made public, could see the posts on his timeline.

9 The applicant claims that he commissioned an analysis concerning the inferences which could be drawn from his friends list, which showed that he had done civilian service with the Red Cross in Salzburg (Austria) and that he is homosexual. The list of the sites which are of interest to him outside Facebook allegedly included, inter alia, dating apps and dating websites for homosexuals, as well as the website of an Austrian political party. The applicant’s stored data seemingly included a non-existent email address and another which was not provided on his Facebook profile, but which he had used to send requests to the defendant.

10 In essence, the applicant sought from the court of first instance, first, an order that the defendant be required to enter into a written contract concerning the use of his personal data on the Facebook network and, in the alternative, a finding that no such contract had been entered into and that he had not consented to the terms of service; second, an order requiring the defendant to refrain from processing his personal data for personalised advertising purposes or for aggregation and analysis of data for advertising purposes; third, a finding that there was no effective consent to the processing for the purposes described in the former version of the data use policies, with respect to his personal data which the defendant obtained from third parties; and, fourth, an order requiring the defendant to refrain from using or processing his data concerning visits to and use of third party pages in the absence of effective consent to processing. In essence, the applicant argued that acceptance of the terms of service and associated data use policies does not constitute effective consent given to the controller to process personal data. He also stated that Meta Platforms Ireland processes sensitive data relating to him, such as data concerning his political beliefs and sexual orientation, even though those data are not referred to on his Facebook profile.

11 As is apparent from the parties’ written and oral observations, that panel discussion was accessible to the public, which could obtain a ticket free of charge, subject to availability, from the Eventbrite platform (189 people were eventually registered), and was broadcast live. Moreover, a recording of the round table was subsequently published as a podcast, as well as on the Commission’s YouTube channel.

12 As is apparent from the order for reference and from the written pleadings submitted by the applicant, the applicant made the following statement: ‘I shall now give you a very banal example: you can infer my sexual orientation from my friends list. I have never mentioned that I am gay on Facebook. I’ve been “out” since I was 14 years old and it doesn’t stress me out or anything. But it’s not something that I speak about everywhere and all the time in public, because I tell myself, well, talk about data protection instead, otherwise you’re going to end up in that box again. And that distracts attention from data protection’.

13 Those two national courts held, in essence, that the processing of personal data carried out by Meta Platforms Ireland was necessary for the performance of the contract for the purposes of Article 6(1)(b) of the GDPR.

14 I would point out that, in the main proceedings, the referring court has already made a request to the Court for a preliminary ruling, which gave rise to the judgment of 25 January 2018, Schrems (C‑498/16, EU:C:2018:37).

15 C‑252/21, ‘the judgment in Meta Platforms and Others (General terms of use of a social network)’, EU:C:2023:537. The present proceedings for a preliminary ruling were stayed pending that judgment. When questioned by the Court, the referring court responded that that judgment answered the first and third questions referred and that it maintained its request for a preliminary ruling with respect to the second and fourth questions referred.

16 See judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C‑439/19, EU:C:2021:504, paragraph 96 and the case-law cited).

17 See, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C‑439/19, EU:C:2021:504, paragraph 98 and the case-law cited).

18 That is so in particular where they appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed (see judgment of 24 September 2019, GC and Others (De-referencing of sensitive data) (C‑136/17, EU:C:2019:773, paragraph 74 and the case-law cited)).

19 See the case-law cited in footnote 17 of this Opinion.

20 Without prejudice to the fact that, in accordance with Article 8 of the GDPR, children below the age of 16 may not themselves give consent under Article 6(1)(a) of that regulation in relation to the offer of information society services.

21 In that regard, I would point out that, in the context of the concept of ‘consent’ within the meaning of point (a) of the first subparagraph of Article 6(1) and Article 9(2)(a) of the GDPR, the Court stated, inter alia, that a user cannot reasonably expect data other than those relating to his or her conduct within the social network (in that case, Facebook) to be processed by the operator of that network, and held that separate consent could be given for the processing of the latter data, on the one hand, and data other than those data, on the other (judgment in Meta Platforms and Others (General terms of use of a social network), paragraph 151). Similarly, in my Opinion in the same case, I expressed doubts as to whether the collection and use of personal data outside the social network Facebook are necessary for the provision of the services offered as part of that network, such that the consent initially given for access to that network (in other words, setting up a Facebook profile) may legitimately cover the processing of the user’s personal data outside that network (Opinion in Meta Platforms and Others (General terms of use of a social network) (C‑252/21, EU:C:2022:704, point 56, footnote 81)).

22 For example, with regard to the legitimate interests of the controller as a legal basis for processing, recital 47 of the GDPR states that the existence of such a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.

23 See footnote 6 of this Opinion.

24 The Court has held, in essence, that, irrespective of whether the processing of personal data provided for by such a provision is referred to in the contract, the decisive factor for the purposes of applying the justification set out in that provision is rather that the processing at issue must be essential for the proper performance of the contract concluded between the controller and the data subject and, therefore, that there are no workable, less intrusive alternatives (see, to that effect, judgment in Meta Platforms and Others (General terms of use of a social network), paragraph 99).

25 See footnote 6 of this Opinion. As is apparent from the hearing, it seems that, in the main proceedings, Meta Platforms Ireland referred to the panel discussion in order to refute the applicant’s argument concerning the alleged harm caused by the alleged psychological distress he suffered as a result of the personalised advertisement, in order to show that he had no difficulty in publicly declaring his homosexuality. The referring court therefore raised the question on the interpretation of Article 9(2) of the GDPR, not for the purpose of applying the exemption provided for by that provision but in the entirely different context of the examination of the harm relied on by the applicant in the light of Meta Platforms Ireland’s defence.

26 In accordance with Article 5(2) of the GDPR, the burden of proof for demonstrating that personal data are processed in accordance with that regulation is borne by the controller.

27 See, by analogy, judgment of 4 May 2023, Glavna direktsia ‘Pozharna bezopasnost i zashtita na naselenieto’ (Night work) (C‑529/21 to C‑536/21 and C‑732/21 to C‑738/21, EU:C:2023:374, paragraph 57).

28 See, to that effect, judgment of 13 July 2023, Ferrovienord (C‑363/21 and C‑364/21, EU:C:2023:563, paragraphs 52 to 55 and the case-law cited).

29 As stated in recital 51 of that regulation, personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms.

30 C‑252/21, EU:C:2022:704, point 42.

31 See also, to that effect, judgment in Meta Platforms and Others (General terms of use of a social network), paragraph 76 and the case-law cited).

32 In that regard, I would point out that the use of the verb ‘make’ in the concept of ‘manifestly made public’, implies active and conscious behaviour on the part of the data subject. According to the European Data Protection Board (EDPB), ‘the word “manifestly” implies that there must be a high threshold for relying on this exemption. The EDPB notes that the presence of a single element may not always be sufficient to establish that the data have been “manifestly” made public by the data subject. In practice, a combination of [elements] may need to be considered for controllers to demonstrate that the data subject has clearly manifested the intention to make the data public, and a case-by-case assessment is needed’ (EDPB, Guidelines 8/2020, point 127). The EDPB refers, by way of example, to elements such as the default settings of the social media platform, the nature of the social media platform, the accessibility of the page where the sensitive data are published, the visibility of the warning alerting the data subject to the public nature of the information that he or she is publishing, the fact that the data subject has published the sensitive data himself or herself, or whether instead the data have been published by a third party or inferred. See also Georgieva, L. and Kuner, C., ‘Article 9. Processing of special categories of personal data’, The EU General Data Protection Regulation (GDPR), Oxford, 2020, p. 378, according to which: ‘In this context, “making public” should be construed to include publishing the data in the mass media, putting them on online social network platforms or similar actions. However, the data must have been “manifestly” made public, which requires an affirmative act by the data subject, and that he or she realised that this would be the result’.

33 See footnote 11 of this Opinion.

34 See footnote 13 of this Opinion.

35 Paragraphs 84 and 85 of that judgment.

36 See also my Opinion in Meta Platforms and Others (General terms of use of a social network) (C‑252/21, EU:C:2022:704, point 46).

37 I would point out that the provision in question reproduces verbatim Article 8(2)(e) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) and that, moreover, no explanation was provided when that provision was introduced in Common Position (EC) No 1/95 adopted by the Council on 20 February 1995 with a view to adopting Directive 95/…/EC of the European Parliament and of the Council of … on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 C 93, p. 1).

38 See footnote 11 of this Opinion.

39 For example, as the applicant himself acknowledges in his written observations, his statement was likely to be repeated, quite legitimately, in a press article covering the event in question.

40 In that regard, I would point out that the applicant was the key player in a long and important dispute against Meta Platforms Ireland (formerly Facebook) concerning the application of the GDPR and that, therefore, it is reasonable to assume that he was fully aware of the consequences of his statements in the light of that regulation. That said, I note the difference between, on the one hand, the willingness to authorise the processing of ‘sensitive’ data, which constitutes consent to the processing of such data within the meaning of Article 9(2)(a) of the GDPR, and, on the other hand, the intention to make, or full awareness of making, such data manifestly public, which entails as a consequence the prohibition on the processing of such data for the purposes of Article 9(1) of that regulation is not applicable but is not sufficient, in itself, to authorise the processing of such data, as I shall explain in points 45 to 47 of this Opinion.

41 For example, a person could be discriminated against because of his or her political or sexual orientation, or face unfair economic consequences because of his or her medical situation (particularly with regard to health insurance or other similar situations).

42 As recalled in recital 51 of the GDPR, in addition to the specific requirements for the processing of particularly sensitive personal data, the general principles and other rules of that regulation should apply, in particular as regards the conditions for lawful processing. Moreover, under Article 22(4) of that regulation, decisions based solely on automated processing are not to be based on special categories of personal data referred to in Article 9(1) of that regulation, unless point (a) or (g) of Article 9(2) thereof applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.

43 The Court recently ruled to the same effect concerning the interpretation of Article 9(2)(h) of the GDPR, read in conjunction with Article 5(1)(a) and Article 6(1) of that regulation, and stated that the processing of data concerning health based on the first provision must comply, in order to be lawful, both with the requirements arising from that provision and with the obligations arising from the latter two provisions and, in particular, must satisfy at least one of the conditions of lawfulness set out in Article 6(1) of that regulation (judgment of 21 December 2023, Krankenversicherung Nordrhein (C‑667/21, EU:C:2023:1022, paragraph 78)).

44 All the more so since, in the case in the main proceedings, the referring court asks whether the statement made during the panel discussion in question permits the processing of other personal data, in particular those collected from third-party applications.