ICO Statment on Meta v O'Carroll

The UK Information Commissioner’s Office have released a statement on the O'Carroll vs Meta in which Tanya O’Carroll wanted Facebook to stop targeting her with direct marketing content. Facebook has now agreed to her objection. The case centred around Article 21 of the UK GDPR which gives individuals the right to object to direct marketing.

An ICO spokesperson said:

"People have the right to object to their personal information being used for direct marketing, and we have been clear that online targeted advertising should be considered as direct marketing.  “Organisations must respect people's choices about how their data is used. This means giving users a clear way to opt out of their data being used in this way.  “If people believe that an organisation is not complying with their request to stop processing their data, they can file a complaint to us. We will continue to engage with Meta on this issue."

The ICO went on to add:

The Information Commissioner is the regulator for the application of the UK General Data Protection Regulation (‘UK GDPR’), Data Protection Act 2018 (‘DPA’) and the Privacy and Electronic Communications Regulations 2003 (‘PECR’).

The Information Commissioner was intervening in these proceedings to assist the Court with the application of Article 21 UK GDPR (right to object to processing of personal data for direct marketing purposes). The Commissioner had made submissions to assist the Court on the following issues:

Issue 1 - What law governs the processing of personal data for the purposes of online targeted advertising? 

Issue 2 – If Article 21 UKGDPR  applies to online targeted advertising, what is the meaning of “direct marketing” within Articles 21(2) and (3)? 

Issue 3 – Is Meta processing Ms O’Carroll’s personal data for direct marketing purposes and/or profiling related to those purposes with the consequence that Ms O’Carroll has the absolute right to object to such processing and profiling under Articles 21 (2) and (3) UK GDPR?  The Commissioner’s position in relation to each of those issues can be summarised as follows: 

Issue 1:  (a) The processing of personal data for the purposes of online targeted advertising and profiling for such purposes falls within the scope of the UK GDPR. The UK GDPR applies in a technologically neutral manner, including to online activity.  (b) Although online advertising could have been specifically regulated by way of amendment to the direct marketing provisions contained within PECR (and the underlying ePrivacy Directive) (which do not currently extend to online advertising1), this fact does not prevent the UK GDPR from applying to online targeted advertising. The ePrivacy regime and the UK GDPR are intended to complement each other and be read together.  (c) Accordingly, pursuant to Articles 21(2) and (3) UK GDPR, Ms O’Carroll has an absolute right to object to the processing of her personal data and related profiling for the purposes of online targeted advertising where that processing and profiling are for direct marketing purposes.   

 Issue 2: The definition of ‘direct marketing’ for the purposes of Articles 21(2) and (3) UK GDPR is “the communication (by whatever means) of advertising or marketing material which is directed to particular individuals” as is currently set out in section 122(5) of the DPA.

Issue 3: The Commissioner’s published guidance – see link below -  provides that online advertising targeted at particular individuals constitutes direct marketing. Accordingly, having regard to Meta’s online targeted advertising and based on the written evidence filed by the parties, the Commissioner’s position is that Meta is processing Ms O’Carroll’s personal data for direct marketing purposes and profiling related to those purposes with the consequence that Ms O’Carroll has the absolute right to object to such processing and profiling under Articles 21 (2) and (3) UK GDPR.