This article was published by Data Guidance.
The European Data Protection Board (‘EDPB’) launched, on 7 September 2020, a public consultation on its newly published Guidelines 8/2020 on the Targeting of Social Media Users1 (‘the Guidelines’). In particular, the Guidelines address the targeting services offered by social media providers to natural or legal persons aiming to communicate, among other things, commercial messages to social media users, and considering the rise of social media as a significant development in the online environment.
In relation to the respective roles and responsibilities of social media providers and targeters, the EDPB firstly notes the importance of the Court of Justice of the European Union’s (‘CJEU’) judgments in Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v. Wirtschaftsakademie Schleswig-Holstein GmbH and Fashion ID GmbH & Co. KG v. Verbraucherzentrale NRW eV. In addition, the Guidelines clarify the roles and responsibilities the social media ecosystem in relation to the concepts of data controller, data processor, and joint controllership by way of examples, giving particular emphasis to requirements in relation to lawfulness and purpose limitation.
In relation to targeting activities based on observed data, the Guidelines provide that observation is possible through the social media service itself, as well as on external websites by virtue of social plug-ins or pixels. In this case, the practical examples outlined by the EDPB underline that when both the targeter and the social media provider participate in the determination of the purposes and means of the processing, joint controllership exists in relation to the collection of personal data and its transmission by way of pixels, for example.
In this regard, Dmitry Alekseev, Senior Associate at ECIJA, told OneTrust DataGuidance, “The EDPB [denotes a certain sensibility in] considering an entity processing data as the data controller. In other words, in light of the EDPB’s comments, a [limited] decision on the processing means would [bring the processing subject to be considered] as data controller (or joint controller), where, in order to determine the controllership, the following should actually be considered:
- who the processing has been originated by;
- who determines all or the majority of means;
- who provides and retains ownership of the personal data;
- who is the brand behind the advertisements; and
- who is, in the reasonable expectation of data subjects, the point of contact for complaints and the exercise of rights.