Guidelines 08/2020 on the targeting of social media users – version for public consultation

Subparagraph 5.2.2 B  Legal basis

59 In Example 2, in praragraph 5.2.2, Article 6 (1) f GDPR does not provide an appropriate legal basis to justify the processing in this case, taking into account the context in which the personal data was provided. Indeed, Ms. Jones contacted the bank for the sole purpose of setting up an appointment, following which she communicated her intention not to make use of the services offered by the bank. Hence, one can consider that there is no reasonable expectation by Ms. Jones that her personal data shall be used for targeting purposes (‘re-targeting’). Moreover, a compatibility test under Article 6 (4) GDPR will lead to the outcome that this processing is not compatible with the purpose for which the personal data are initially collected.

60 In Example 3 , in paragraph 5.2.2, the targeter might be able to rely on legitimate interest to justify the processing, taking into account inter alia that Mr. Lopez was: (a) informed of the fact that his e-mail address may be used for purposes of advertising via social media for services linked to the one used by the data subject; (b) the advertisement relates to services similar to those for Mr. Lopez is already a customer, and (c) Mr.Lopez was given the ability to object prior to the processing, at the moment where the personal data were collected by the bank. However, the mere fulfilment of information duties according to Article13, 14 GDPR is not a transparency measure to be taken into consideration for the weighing of interests according to Article 6 (1) (f) of GDPR.