Schrems: Que­sti­ons refer­red by the OGH to the ECJ

The Supre­me Court of Austria (OGH) has given the ECJ pre­sen­ted a seri­es of que­sti­ons, in con­nec­tion with pro­ce­e­dings brought by Max Schrems against Face­book. The sub­ject of the pro­ce­e­dings is, among other things, the que­sti­on of the legal basis on which Face­book pro­ces­ses cer­tain data about Schrems.

In par­ti­cu­lar, this invol­ves the que­sti­on of whe­ther Face­book has right­ly invo­ked Art. 6 (1) lit. b DSGVO, the Neces­si­ty of the pro­ces­sing for a con­tract. This que­sti­on ari­ses becau­se Face­book does not have con­sent for the pro­ces­sing of data about Schrems, but has sta­ted in the GTC sin­ce the GDPR came into force,

In lieu of pay­ing for […], by using the Face­book Pro­ducts to which the­se Terms of Use app­ly, you agree that we may show you ads … We use your per­so­nal infor­ma­ti­on […] to show you ads that are more rele­vant to you

By using this wor­d­ing, Face­book has attemp­ted to cla­ri­fy that the user pays with his or her data and that the pro­vi­si­on of the cor­re­spon­ding data in this sen­se is just as much a part of the con­tract as the pay­ment for a product.

Howe­ver, this is off­set by the very restric­ti­ve atti­tu­de of the EDSA who in his Gui­de­li­nes for the inter­pre­ta­ti­on of Art. 6 para. 1 b DSGVO argues that it is not the wor­d­ing of a con­tract that is decisi­ve, but its objec­ti­ve pur­po­se, which is also to be deter­mi­ned accord­ing to the expec­ta­ti­ons of the data sub­jects; necessa­ry wit­hin the mea­ning of Art. 6(1)(b) GDPR is only what is objec­tively necessa­ry for the con­tract as typi­fied by the EDSA. A mere eco­no­mic con­nec­tion bet­ween the con­tract and the data pro­ces­sing is not suf­fi­ci­ent, and adver­ti­sing is not necessa­ry for a contract.

Against this back­ground, the OGH sub­mits the que­sti­on to the ECJ whe­ther lit. b app­lies in such a case or whe­ther con­sent is rather required:

(1) Are the pro­vi­si­ons of Art. 6(1)(a) and (b) DSGVO to be inter­pre­ted as mea­ning that the Lega­li­ty of con­trac­tu­al pro­vi­si­ons in gene­ral terms of use on plat­form con­tracts […], which inclu­de the pro­ces­sing of per­so­nal data for aggre­ga­ti­on and ana­ly­sis of data for the pur­po­se of per­so­na­li­zed adver­ti­sing, are to be asses­sed accord­ing to the requi­re­ments of Art 6 (1) lit a in con­junc­tion with Art 7 DSGVOwhich can­not be repla­ced by invo­king Art 6(1)(b) DSGVO?

Other que­sti­ons refer­red rela­te to the admis­si­bi­li­ty of the Usa­ge data ana­ly­sis befo­re the princip­le of data mini­miz­a­ti­on and the que­sti­on of whe­ther data is worthy of spe­cial pro­tec­tion are if they pro­vi­de infor­ma­ti­on about cor­re­spon­ding cha­rac­te­ri­stics (e.g. homo­se­xua­li­ty), but the per­son respon­si­ble does not pro­cess the­se data accord­in­gly, i.e. does not dif­fe­ren­tia­te here in the adver­ti­sing accord­ing to such criteria.