European Commission – Complaint Upheld (European Union, 2024)

The campaign From the 15 to the 28 September 2023, the Commission ran a targeted advertising campaign on X focussing on users in eight Member States. The campaign aimed at communicating the proposal for a Regulation laying down rules to fight and prevent child sexual abuse, the so-called “Chat Control Regulation”. The Commission, here the controller, carried out the campaign through an external contractor. For its targeting strategy, the Commission defined certain inclusion and exclusion keywords and accounts affiliated with political interests. The exclusion words selected by the Commission showed to exclude terms that correlate with a "Eurosceptic" political opinion such as “Viktor Orban”. The inclusion words then correlated to “pro-EU” sentiments and included particular parties and politicians. This input was then used through X’s keyword targeting and look-alike strategy allowing the targeting of people with interests similar to the keywords and accounts (proxy data). Specifically, the campaign targeted X users speaking Dutch, who were from the Netherlands and were older than 18. The complaint On the 16 November 2023, noyb on behalf of a data subject filed a complaint with the European Data Protection Supervisor against the Commission alleging unlawful data processing for targeted advertising. The data subject based its complaint on the provisions of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Regulation 2018/1725] (EU-GDPR) which is data protection legislation applicable to data processing operations conducted by EU-institution. The data subject alleged that under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Regulation 2018/1725] the Commission had processed special categories of his data under Article 10(2) in breach of the principle of lawfulness under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Article 4(1)(a)]. The data subject laid out that this practice encompasses profiling based on special category data; here the political views of the users. Therefore, the data subject alleged that the Commission had breached [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Article 10(1)] prohibiting the processing of special category data as none of the exceptions under Article 10(2) applied. Moreover, even if the Commission had not intended to process special categories of data, [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Article 10(1) and Article 4(1)(a)] do not require intent on the part of the controller to be established. The Commission’s arguments The Commission argued that the selection of the inclusion and exclusion keywords did not draw on personal data of specific X users. The Commission explained that it targeted groups based on their age, location and spoken language but stated that it never intended to process special categories of data. The Commission explained that X’s algorithm determines people with similar interests based on what they post and re-post. The Commission concluded that it merely used X’s services for the publication of the campaign. Further, the Commission justified the data processing as it was necessary for the performance of a task in the public interest under Article 5(1)(a), referring to the communication of legislative proposals. As a legal basis for this, the Commission referred to Article 17(2) of the Treaty of the European Union which grants the Commission a general right of initiative for legislative proposals. Controllership The EDPS held that the Commission determines the means and purposes of the targeted advertising for political purposes. The EDPS highlighted that pursuing an interest through a processing operation is an indication of determining the purposes of processing. The Commission chose the services provided by X and selected the keywords that in turn determined the target audience. Therefore, the EDPS stated that the European Commission acted as a controller. Performance of a task in the public interest The EDPS puts forward that Article 17(2) TEU is very general in nature, not referring to promotional activities of the Commission and therefore does not meet the requirement of a clear and precise legal basis under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Article 5(2)]. The EDPS therefore rejected the Commission’s argument that the data processing was necessary for the performance of a task in the public interest. Other legal basis such as consent were found not to be applicable, as they were not disputed. The EDPS found that the Commission had infringed [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Articles 4(1)(a), 4(2), 5 and 26 of the Regulation] as promoting legislation is not in the public interest. Special category data The EDPS set out that if a social media provider categorises users into having certain religious, philosophical or political beliefs, this must be seen a processing special categories of data. The EDPS clarified that X had targeted users with interests similar to the key accounts and words which were directly linked to a political affiliation. The EDPS stated that X acted under the instructions of the Commission and therefore was liable. It further reiterated that the intent of the Commission to process special category data is irrelevant as has been shown in CJEU case law (e.g. C-131/12). Exceptions to processing special category data The EDPS considered the exceptions to processing special categories of data under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Article 10(2) of the Regulation] but found that they did not apply. In particular, the EDPS considered: * [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Article 10(2)(e)] – Data manifestly made public The EDPS reiterated that in C-252/21, the CJEU showed that sharing or liking certain posts cannot be considered as manifestly making data public. The EDPS declared that even if the data had manifestly been made public, this does not in itself allow for the further processing of this data for political advertising. In particular the EDPS highlighted, with reference to the fact that the data subject had set their account to private, that this was crucial when the data subject could not reasonably have foreseen this kind of processing. Conclusion In conclusion, the EDPS found that the Commission had infringed [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32018R1725 Articles 4(1)(a), 4(2), 5, 10(1) and 26 of the Regulation] by unlawfully processing personal data, including special category data without consent. The EDPS issued a reprimand against the Commission and explained that a fine was not necessary as the practice had already ended.