The lawfulness of processing personal data for targeted behavioural advertising : a case study of facebook

Abstract

Targeted Behavioural Advertising is the targeting of users with advertisements created from data collected and processed about the user. The methods of collection of data used are problematic. The amount of surveillance and tracking required amount to an invasion of the right to privacy of the data subject. Targeted Behavioural Advertising practices impinge on the fundamental rights of privacy and data protection of the data subject. The Charter of Fundamental Rights of the European Union provides for the right to privacy as an inalienable right. To further protect EU citizens’ personal data, the GDPR requires businesses to process personal data lawfully, in line with the legal bases it provides. A balance needs to be struck between the fundamental rights of the data subject and the interests of businesses. In this research the available legal bases are analysed and applied in practice. Facebooks’ journey into trying to find an appropriate legal basis for its targeted behavioural advertising processing is used as an example. It is found that the current data protection regulation framework does not effectively regulate the processing of personal data for targeted behavioural advertising purposes. A need for collaboration between authorities from different legal fields to ensure a holistic approach to legislation is identified.