One of the main risks from the 1.0 version of the EDPB n. 8/2020 guidelines on the targeting of social media users, is represented from the incorrect use of entered data. Given that entered data are the result of the mix between data offered by the social media user and the data that this one acquires from third parties, always with the maximum reference to the data subject.
This mix leads to the creation of data that the data subject did not give, neither to the social network, nor to third parties. This new data, that result attributable to personal data categories, fall outside the will of the data subject of given them, because they are created from the combination put in place by the social media.
It can not be excluded that from “common” personal data is it possible, between the mix of this data and those offered by third parties, to reach the generation and the process of data.
Provided that we ask to ourselves, if the social network can use particular entered personal data for the targeting and doing that without adquire a new consent of the data subject, that is without have a new ad-hoc Directory?
This question is very important if we consider the access right principles of the data subject, ex article 15 of the GDPR, and the transparent principle by the article 12 of the GDPR, and as it is mentioned from the article 5, paragraph 1, letter a of the GDPR, as well as the article 9 of the GDPR.
From an analysis of the EDPB guidelines in question the answer should be negative. Indeed, the data subject, not having wanted to disclose such particular personal data to the social network, cannot be overridden in his or her right to choose which personal data to disclose or which data not to collect. All the more so if it is particular personal data.
Therefore, it is hoped that a more detailed intervention will be carried out with the issue, perhaps, of specific guidelines aimed at resolving the long-standing issue of the personal data provided, with the hope of direct intervention by both the Italian and European DPA. The regulatory and policy uncertainty regarding the personal data concerned imposes, as it will impose, a more specific regulation to safeguard the rights of the data subject. SOURCE: FEDERPRIVACY