CJEU stresses data minimisation in Schrems III case

Written By

hertta hytinantti Module
Hertta Hytinantti

Associate
Finland

I am an associate in our Privacy & Data Protection group and Commercial group in Helsinki, where I advise our domestic and international clients with data protection, other data regulation, and cyber security regulation.

Legal questions

The Court of Justice of the European Union (CJEU) issued a judgment on 4 October 2024 in the case of Schrems v Meta Platforms Ireland Ltd (Meta) where it stressed the importance of the data minimisation and purpose limitation principles under the GDPR when it comes to targeted online advertising.

In its judgment, the CJEU analysed two matters:

  1. the processing of all personal data for an unlimited time for advertising purposes, and
  2. the processing of information that has been made “manifestly public”.

Regarding the second question, the CJEU stated that the use of personal data made manifestly public should be limited only to the originally intended purposes for publication.

For more information, please contact Hertta Hytinantti.

The full article was published in the Connected newsletter.

To sign-up to receive future newsletters for the latest Regulatory & Public Affairs news and updates, see below:

TO SUBSCRIBE TO OUR CONNECTED NEWSLETTER CLICK HERE

Latest insights

More Insights
Curiosity line blue background

A prelude to more liberalisation? Latest round of relaxation in the telecom sector in China

4 minutes Mar 31 2025

Read More
Curiosity line pink background

A new frontier of connectivity: Regulating direct–to–device services in Australia

8 minutes Mar 31 2025

Read More
Curiosity line yellow background

Understanding key EU cybersecurity legislative acts: NIS2, CER, and CRA

4 minutes Mar 31 2025

Read More