Checking out Facebook's new terms & conditions (a small thread). Facebook seems to invoke necessity for performing a contract (art 6(1)(b) GDPR) as a legal basis for targeting ads to its users.
Facebooks new ‘Data Policy’ (19 April 2018) says:
‘We use the information we have [on you] to deliver our Products, including to personalize.. ads..’ facebook.com/about/privacy/… Hence, Facebook seems to see personalizing ads as a part of delivering its product.
‘We use the information we have [on you] to deliver our Products, including to personalize.. ads..’ facebook.com/about/privacy/… Hence, Facebook seems to see personalizing ads as a part of delivering its product.
Facebook also says: ‘.. we process data as necessary to perform our contracts with you.. The core data uses necessary to provide our contractual services are:.. To provide, personalize, and improve our Facebook Products’ facebook.com/about/privacy/…
Therefore, Facebook appears to rely on art 6(1)(b) GDPR – contract – as a legal basis for using personal data for ad targeting.
However, the Art 29 Working Party says that, generally, only consent can serve as a legal basis for targeted advertising: ‘consent should be required, for example, for tracking and profiling for purposes of direct marketing, behavioural advertisement....’ (WP203, p. 46).
ec.europa.eu/justice/articl… (WP203, purpose limitation, p. 46). See also ec.europa.eu/justice/articl… (legitimate interests opinion, WP217)
Would be interesting if this ended up before a judge: can online behavioural advertising (OBA) be be based on art 6(1)(b) GDPR? Is OBA 'necessary' to perform a contract?
In 2015 (under 95 Directive, not GDPR) I concluded: 'in most circumstances the only available legal basis for the processing of personal data for behavioural targeting is the data subject’s unambiguous consent'. GDPR would lead to same conclusion, I think papers.ssrn.com/sol3/papers.cf…
21(2) GDPR: "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object.. to processing of p. data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing."
Art 21(2) GDPR, the absolute right to object against direct marketing: does that right also apply when controller relies on 'contract' / art 6(1)(b)? Art 6(1)(b) is not mentioned in art 21(1), but I think that art 21(2) still applies.
Advocate General Bot of the @EUCourtPress says: 'The collection & use of personal data for the purposes of compiling user statistics & publishing targeted advertising must meet certain conditions in order to comply with the personal data protection rules.. from Directive 95/46.'
.. Advocate General Bot of the @EUCourtPress: 'In particular, such [OBA} operations may not be carried out without first informing and obtaining the *agreement* of the person concerned.' Case C‑210/16, curia.europa.eu/juris/document… Hence, he thinks consent is required for OBA
.. But, AG Bot's remark about OBA and consent was a kind of side remark (obiter dictum). And he's not a judge but an AG. curia.europa.eu/juris/document…
By the way: for certain ad targeting practices Facebook says that it relies on consent: facebook.com/about/privacy/…
Facebook: [We rely on] consent 'For using data that advertisers & other partners provide us about your activity off of Facebook Company Products, so we can personalise ads we show you on Facebook Company Products & on websites, apps, and devices that use our advertising services'
