EU Commission’s Ad Campaign Violates GDPR Rules on Sensitive Data
The European Union’s executive body is currently facing a significant privacy scandal. The European Data Protection Supervisor (EDPS) has confirmed that a Commission advertising campaign on X (formerly Twitter) violated the EU’s own data protection regulations. The campaign, which took place in fall 2023, involved micro-targeting ads based on sensitive data, specifically political views, to influence public opinion regarding a controversial legislative proposal aimed at combating child sexual abuse material (CSAM) online.
The EDPS’s findings stem from a complaint filed by the privacy rights nonprofit noyb, which accused the Commission’s Directorate General for Migration and Home Affairs of unlawful micro-targeting. The EDPS issued a reprimand, but no financial penalties, as the Commission ceased the practice following the complaint. The campaign targeted users in the Netherlands who expressed disinterest in certain political topics, effectively processing sensitive data without obtaining explicit consent, which is a requirement under EU data protection laws.
The Commission had previously argued that the ad campaign was implemented through a contractor and that it had included data protection safeguards. However, the EDPS’s ruling confirms that the Commission’s actions were unlawful. This finding may have broader implications for ongoing investigations into similar complaints against X and other political micro-targeting practices, as the potential for significant fines under the General Data Protection Regulation (GDPR) looms large.
With a new college of commissioners now in place, the previous home affairs commissioner responsible for the CSAM proposal is no longer in her position. The EDPS’s decision serves as a reminder of the importance of adhering to data protection laws, particularly regarding sensitive personal data, and may encourage national authorities to take action against similar practices by political parties across EU member states.
Source: Controversial EU ad campaign on X broke bloc’s own privacy rules | TechCrunch
