Austrian High Court Rules Meta's Personalized Ad Model Is Illegal; Victory for Schrems
Meta must give privacy advocate Max Schrems full access to all of his personal data within 14 days, the Austrian Supreme Court ruled and Noyb reported Thursday. Also, the social media giant must revamp its illegal personalized advertising model, the court said. Noyb said the decision sets an EU-wide precedent.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
"We acknowledge the Court's decision on this long-running matter and are reviewing the ruling," a Meta spokesperson emailed us.
Schrems, Noyb's founder, has tried to get full access to his personal data since 2011, but the company provided only some of it, according to his attorney Katharina Raabe-Stuppnig. Meta referred most users to a "download tool" containing what it called relevant information, and otherwise pointed users to its generic privacy policy, she said.
The Austrian high court, however, said Meta must disclose all of Schrems' personal data along with specific information on the data, such as its source, recipient and processing purpose, by Dec. 31. The court rejected Meta's claims that access should be limited by such factors as trade secrets, the attorney wrote.
The court also found that Meta was illegally collecting data from third-party apps and websites, ruling it's only permitted to serve personalized ads with a user's "specific, informed, unambiguous and freely given consent," Noyb said. The platform must also ensure that data revealing sensitive information such as health or sexual orientation must not be processed with other data without a valid legal basis under the GDPR, Noyb added.
“It took 11 years, but now there is a final ruling that Meta must provide unprecedented access to all data it has ever collected about Mr Schrems," Raabe-Stuppnig said. "This goes far beyond the download tool or information on the website." Noyb's attorney added that the "ruling is directly enforceable throughout the EU."
Schrems' case was heard in the Austrian Supreme Court three times and by the European Court of Justice twice, Noyb noted. Schrems was awarded 500 euros ($586) in damages, it said.
Schrems criticized the length of time data protection litigation takes, saying, "We must urgently work on making the GDPR enforceable in practice."