Guidelines 08/2020 on the targeting of social media users – version for public consultation

Paragraph 8.1.1  Explicit special categories of data

112 At times, personal data being processed clearly falls within the definition of special categories of data, e.g. in case of a direct statement about a person being member of a certain political party or religious association.

• Example 10:

• Ms. Flora states explicitly in her social media profile that she is a member of the GreenestPlanetpolitical Party. The environmental organisation “Long live the Earth” wants to target social media users that are members of the GreenestPlanet political party in order to address targeted messages to them.

113 In Example 10, the social media provider and the environmental organisation are acting as joint controllers. Insofar as the environmental organisation requests the social media provider to target users based on their political opinion, both controllers contribute to the processing of special categories of data as defined by Article 9 GDPR. Processing of these data are in principle prohibited according to Article 9(1). Both the social media provider and the environmental organisation must therefore be able to rely on one of the exemptions in Article 9(2) for their processing. In addition to that, they must also both have a legal basis according to Article 6. Out of the exemptions in Article 9 (2), it appears that the only applicable exemptions in this situation would be to obtain the data subject’s explicit consent, under Article 9 (2) (a) GDPR, or the exemption that Ms. Flora manifestly made the personal data public, under Article 9 (2) GDPR.