Guidelines 08/2020 on the targeting of social media users – version for public consultation

Subparagraph  5.2.1. A  Roles

38 In Example 1 of paragraph 5.2.1, both the targeter and the social media provider participate in determining the purpose and means of the processing personal data. This results in the display of the advertisement to the target audience.

39 As far as the determination of purpose is concerned, Company X and the social media provider jointly determine the purpose of the processing, which is to display a specific advertisement to a set of individuals (in this case social media users) who make up the target audience.

40 As far as the determination of means is concerned, the targeter and the social media provider jointly determine the means, which results in the targeting. The targeter participates in the determination of the means by choosing to use the services offered by the social media provider, and by requesting it to target an audience based on certain criteria (i.e. age range, relationship status, timing of display). In doing so, the targeter defines the criteria in accordance with which the targeting takes place and designates the categories of persons whose personal data is to be made use of. The social media provider, on the other hand, has decided to process personal data of its users in such a manner to develop the targeting criteria, which it makes available to the targeter. In order to do so, the social media provider has made certain decisions regarding the essential means of the processing, such as which categories of data shall be processed, which targeting criteria shall be offered and who shall have access (to what types of) personal data that is processed in the context of a particular targeting campaign.

41 The joint control among the targeter and social media provider only extends to those processing operations for which they effectively co-determine the purposes and means. It extends to theprocessing of personal data resulting from the selection of the relevant targeting criteria and the display of the advertisement to thetarget audience. It also covers the processing of personal data undertaken by the social media provider to report to the targeter about the results of the targeting campaign. The joint control does not, however, extend to operations involving the processing of personal data at other stages occurring before the selection of the relevant targeting criteria or after the targeting and reporting has been completed, and in which the targeter has not participated in determining the purposes and means”

42 The above analysis remains the same even if the targeter only specifies the parameters of its intended audience and does not have access to the personal data of the users that are affected. Indeed, joint responsibility of several actors for the same processing does not require each of them to have access to the personal data concerned. The EDPB recalls that actual access to personal data is not a prerequisite for joint responsibility.