On Thursday 16 November, the Austrian association Noyb, which specialises in data protection and privacy, lodged a complaint with the European Data Protection Supervisor against the European Commission. It is accusing it of breaching the rules of the General Data Protection Regulation (GDPR) during a targeted campaign carried out on social networks in September 2023 to promote its draft regulation to scan messaging services for child sexual abuse material (CSAM) (see EUROPE 13277/16).
“The European Commission has no legal basis for processing sensitive data for targeted advertising on X (formerly Twitter, editor's note). No one is above the law, and the European Commission is no exception”, commented Noyb’s data protection lawyer Felix Mikolasch.
The European Commission had based its targeting on the political and religious opinions of users, excluding certain sections of the population deemed to be close to conservative ideologies or the extreme right.
“I take this very, very seriously. This needs to be clarified”, commented the European Commissioner for Home Affairs, Ylva Johansson, shortly after the affair came to light.
The Noyb association appears to be one of the Commission’s pet peeves when it comes to data protection. Its founder, Max Schrems, has already lodged several complaints in the past. These had led to the invalidation of two EU/US data adequacy decisions by the Court of Justice of the EU.
These two legal frameworks, Safe Harbour (see EUROPE 11404/1) and Privacy Shield (see EUROPE 12529/2), which are supposed to guarantee an adequate level of protection for personal data circulating between the EU and the United States, were rejected in 2015 and 2020 respectively. (Original version in French by Thomas Mangin)