Guidelines 08/2020 on the targeting of social media users – version for public consultation

SECTION 6  TRANSPARENCY AND RIGHT OF ACCESS

82 Article 5 (1)(a) GDPR states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 5 (1)(b) GDPR also states that personal data shall be collected for specified, explicit and legitimate purposes. Articles 12, 13 and 14 GDPR contain specific provisions on the transparency obligations of the data controller. Finally, recital 39 states that “it should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed”.

83 Information presented to data subjects in respect of the way in which their personal data are processed, should be, in all cases, concise, transparent, in an intelligible and easily accessible form, using clear and plain language.

84 The EDPB recalls that the mere use of the word “advertising” would not be enough to inform the users that their activity is being monitored for the purpose of targeted advertising. It should be made transparent to individuals what types of processing activities are carried out and what this means for the data subject in practice. Data subjects should be informed in an easily understandable language if a profile will be built based on their online behaviour on the platform or on the targeter’s website, respectively, by the social platform and by the targeter, providing information to the users on the types of personal data collected to build such profiles and ultimately allow targeting and behavioural advertising by targeters. Users should be provided with the relevant information directly on the screen, interactively and, where appropriate or necessary, through layered notices.