Guidelines 08/2020 on the targeting of social media users – version for public consultation

SECTION 3  RISKS TO THE RIGHTS AND FREEDOMS OF USERS POSED BY THE PROCESSING OF PERSONAL DATA

8 The GDPR underlines the importance of properly evaluating and mitigating any risks to the rights and freedoms of individuals resulting from the processing of personal data. The mechanisms that can be used to target social media users, as well as the underlying processing activities that enable targeting, may pose significant risks. These guidelines do not seek to provide an exhaustive account of the possible risks to the rights and freedoms of individuals. Nonetheless, the EDPB considers it important to point out certain types of risks and to provide a number of examples how they may manifest themselves.

9 Targeting of social media users may involve uses of personal data that go against or beyond individuals’ reasonable expectations and thereby infringes applicable data protection principles and rules. For example, where a social media platform combines personal data from third-party sources with data disclosed by the users of its platform, this may result in personal data being used beyond their initial purpose and in ways the individual could not reasonably anticipate. The profiling activities that are connected to targeting might involve an inference of interests or other characteristics, which the individual had not actively disclosed, thereby undermining the individual’s ability to exercise controlover his or her personal data. Moreover, a lack of transparency regarding the role of the different actors and the processing operations involved may undermine, complicate or hinder the exercise of data subject rights.

10 A second type of risk concerns the possibility of discrimination and exclusion. Targeting of social mediausers may involve criteria that, directly or indirectly, have discriminatory effects relating to an individual’s racial or ethnic origin, health status or sexual orientation, or other protected qualities of the individual concerned. For example, the use of such criteria in the context of advertising related to job offers, housing or credit (loans, mortgages) may reduce the visibility of opportunities to persons within certain groups of individuals. The potential for discrimination in targeting arises from the ability for advertisers to leverage the extensive quantity and variety of personal data (e.g. demographics, behavioral data and interests) that social media platforms gather about their users. Recent research suggests that the potential for discriminatory effects exists also without using criteria that are directly linked to special categories of personal data in the sense of Article 9 of the GDPR.

11 A second category of risk relatesto potential possible manipulation of users. Targeting mechanismsare, by definition, used in order to influence the behavior and choices of individuals, whether it be in terms of their purchasing decisions as consumers or in terms of their political decisions as citizens engaged in civic life. Certain targeting approaches may however go so far as to undermine individual autonomy and freedom, e.g. by delivering individualized messages designed to exploit or even accentuate certain vulnerabilities, personal values or concerns. For example, an analysis of content shared through social media can reveal information about the emotional state (e.g. through an analys is of the use of certain key words). Such information could be used to target the individual with specific messages and at specific moments to which he or she is expected to be more receptive, thereby surreptitiously influencing his or her thought process, emotions and behaviour.

12 Mechanisms to target social media users can also be used to unduly influence individuals when it comes to political discourse and democratic electoral processes. While ‘traditional’ offline political campaigning intends to influence voters’ behaviour via messages that are generally available and retrievable (verifiable), the available online targeting mechanisms enable political parties and campaigns to target individual voters with tailored messages, specific to the particular needs, interests and values of the target audience. Such targeting might even involve disinformation or messages that individuals find particularly distressing, and are therefore (more) likely to stimulate a certain emotion or reaction by them. When polarising or untruthful (disinformation) messages are targeted at specific individuals, with no or limited contextualisation or exposure to other viewpoints, the use of targeting mechanisms can have the effect of undermining the democratic electoral process.

13 In the same vein, the use of algorithms to determine which information is displayed to which individuals may adversely affect the likelihood of access to diversified sources of information in relationto a particular subject matter. This may in turn have negative consequences for the pluralism of public debate and access to information. Targeting mechanisms can be used to augment the visibility of certain messages, while giving less prominence to others. The potential adverse impact may be felt at two levels. On the one hand, there are risks related to so-called ‘filter-bubbles’ where people are exposed to ‘more-of-the-same’ information and encounter fewer opinions, resulting in increased political and ideological polarisation. On the other hand, targeting mechanisms may also create risks of “information overload”, whereby individuals cannot make an informed decision because they have too much information and cannot tell if it is reliable.

14 The collection of personal data by social media providers may not be limited to the activities performedby individuals on the social media platform itself. The targeting of social media users on the basis of information concerning their browsing behaviour or other activities outside the social media platformcan give individuals the feeling that their behaviour is systematically being monitored. This may have a chilling effect on freedom of expression, including access to information. Such effects may be exacerbated if targeting is also based on the analysis of content shared by social media users. If private messages, posts and comments are subject to analysis for commercial or political use, this may alsogive rise to self-censorship.

15 The potential adverse impact of targeting may be considerably greater where vulnerable categories of individuals are concerned, such as children. Targeting can influence the shaping of children’s personal preferences and interests, ultimately affecting their autonomy and their right to development. Recital 38 of the GDPR indicates that specific protection should apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child.

16 The EDPB recognizes that the increase in concentration in the markets of social media and targeting may also increase risks to the rights and freedoms of individuals. For example, certain social media providers may be able to combine, either alone or in connection with other companies, a higher quantity and diversity of personal data. This ability, in turn, may increase the ability to offer more advanced targeting campaigns. This aspect is relevant from both a data protection (more in-depth profiling of the persons concerned) and competition law viewpoint (the unrivalled insight capabilities provided by the platform may make it an ‘unavoidable trading partner‘ for online marketers). The degree of market and informational power, in turn, as the EDPB has recognised, “has the potential tothreaten the level of data protection and freedom enjoyed by consumers of digital services”.

17 The likelihood and severity of the aforementioned risks will depend, inter alia, on the nature of the targeting mechanism and how and for which exact purpose(s) it is used. Elements which may affect the likelihood and severity of risks in the context of the targeting of social media users will be discussed in greater detail in section 7.