Austria's top court rules Meta's ad model illegal, orders overhaul of user data practices in EU

Court mandates Meta to disclose data sources, recipients and purposes to EU users Meta’s trade secret claims rejected by Austrian Supreme Court Decision is final and enforceable across the EU, creates precedent By Leo Marchandon Dec 18 (Reuters) - Austria’s Supreme Court has ruled that Meta’s (META.O) personalized advertising model is unlawful and ordered the company to provide users across the European Union with complete access to their personal data within 14 days of any request, in a final and directly enforceable decision that sets a binding legal precedent across the bloc. The ruling, made on Tuesday and publicised on Thursday, requires Meta to disclose not just raw data but comprehensive information about sources, recipients and purposes for each piece of information, rejecting all of Meta’s trade secret claims. The court ruled that Meta illegally collected data from third-party apps and websites, processed sensitive information revealing political views, sexual orientation and health data alongside other user data in violation of the EU’s General Data Protection Regulation (GDPR), and pushed personalized content and advertisements without obtaining a “specific, informed, unambiguous and freely given” consent. The case was brought to court by Austrian privacy activist Max Schrems in 2014. It took 11 years to resolve and involved three Austrian Supreme Court decisions and two rulings by the EU Court of Justice (CJEU), the bloc’s highest court, said Katharina Raabe-Stuppning, the lawyer representing Schrems. “It is enforceable throughout the EU by the plaintiff, meaning that, depending on the country of enforcement, non-compliance could result in daily fines or even a prison sentence for the relevant decision-makers at Meta,” privacy advocacy group None Of Your Business (noyb), which was founded by Schrems, told Reuters. The court ordered Meta to ensure sensitive data is not processed with other data, rejecting Meta’s arguments that it does not intentionally collect such information or cannot technically separate it, and upheld a previous CJEU ruling that Meta cannot process Europeans’ personal data for advertising. “Platforms like Facebook or Instagram have huge influence, for example via pushing political views on users,” Schrems said. “The decision makes clear that Meta must not use such user preferences without explicit consent by each user.” The court awarded Schrems 500 euros ($587) in damages for the GDPR violations, which noyb suggested almost any Meta user has experienced. “The 500 (euros) was a conservative figure chosen in 2014, long before the GDPR came into effect. The court was bound by this upper limit on claims. You would likely get more today, even if not US-style damages,” noyb said. Meta did not immediately respond to a request for comment. ($1 = 0.8519 euros)