Court decision · 4 October 2024
Maximilian Schrems v Meta Platforms Ireland Ltd
Case C-446/21, ECLI:EU:C:2024:834 · Court of Justice of the European Union
What it means for your code
Advertising and profiling stores need a retention clock and a scope boundary, the same as any other personal data store. 'Keep everything forever because it might be useful' is the practice this decision rules out.
What happened
A social network aggregated personal data collected on and off its platform, held it without a time limit and used it for targeted advertising. It also processed data relating to the user's sexual orientation.
What was decided
Data minimisation prevents a controller from aggregating and keeping personal data for targeted advertising indefinitely and without distinction. The fact that a person publicly mentioned their sexual orientation does not authorise processing of other data about that orientation.
The legal test applied
- Data minimisation precludes aggregating and keeping personal data for advertising without limit of time or distinction of type
- Data manifestly made public by the subject does not open other data of the same special category to processing
What would have changed the outcome
- Bounded retention tied to a stated advertising purpose is not what was condemned
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.