The use of social media content – particularly posts and comments – in advertising has become a prevalent practice in recent years. However, it is crucial for businesses and advertisers to be aware of the potential legal implications associated with such use. Besides copyright and advertising law considerations, it has also become essential to understand the relevant provisions of data protection law when contemplating the usage of social media content in advertising.
Social media content as personal data
Pursuant to Article 4(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or GDPR), personal data shall mean “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
Based on the above definition, it is apparent that usernames on social media platforms qualify as personal data. Posts and comments created by users on social media platforms are also considered to be personal data since they can be linked to a specific user (who is also an identifiable natural person).
Within social media, any information relating to an identified or identifiable natural person are considered to be personal data irrespective of the fact that the data subject has made it public of his or her own free will. This also entails a conclusion that personal data published on social media platforms shall enjoy the same legal protection as personal data that has not been made public at all.
Using social media content for advertising purposes
With regard to the fact that usernames, posts and comments in social media qualify as personal data, the provisions of the GDPR shall be taken into account in connection with the related processing activities.
Article 5(1) Point b) of the GDPR stipulates the principle of purpose limitation as follows: “Personal data shall be: (…) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes.”
Based on the above, the principle of purpose limitation requires that personal data is processed in accordance with the initial purpose or in a manner that is compatible with such initial purpose. Even in the exceptional case of processing purposes specifically mentioned by the GDPR as compatible with the initial purposes (i.e. archiving purposes in the public interest, scientific or historical research purposes, statistical purposes), data processing activities may only be pursued with appropriate safeguards as set forth by Article 89 of the GDPR (e.g. by way of anonymizing personal data that is used later for scientific research purposes).
With respect to the above, the data processing purpose of using social media content in any kind of advertisement can hardly be considered as compatible with the initial data processing purpose specified by the given social media platform. On the other hand, it is also evident that such commercial purpose does not fall under the exceptions listed in the GDPR (archiving purposes in the public interest, scientific or historical research purposes, statistical purposes).
Nevertheless, it is still possible to lawfully use social media content in an advertisement from a data protection perspective. If there is a lawful basis for the data processing activity, the advertiser shall be entitled to use the chosen personal data for advertising purposes. In the present case, the only reasonable and secure lawful basis is the consent of the data subject (i.e. the user of the given social media platform). It is to be noted that according to Article 4(11) of the GDPR, the consent of the data subject shall mean the freely given, specific, informed and unambiguous indication of the data subject's wishes e.g. a written, specific declaration of consent prior to which the advertiser provides the data subject with satisfactory information about the details of the processing activity.
In conclusion, the use of social media content in advertising can present a range of legal implications, the most important of which relate to data protection law. Businesses and advertisers must exercise caution and ensure that they obtain prior consent from the data subjects, otherwise they could easily face legal action entailing serious consequences.
By Zsuzsanna Lukacs, Senior Associate, Nagy & Trocsanyi