BlnBDI (Berlin) - 521.17130.38

Berlin Commissioner for Data Protection and Freedom of Information Final Notice Reference No. 521.17130.38 Your complaint dated March 21, 2023. Your reference C061-03 Dear Sir or Madam, We hereby inform you that the review procedure initiated in response to your above-mentioned complaint has been concluded. Based on the information provided to us, we have determined that there was no violation of the General Data Protection Regulation (GDPR) in the processing of your personal data by the Christian Democratic Party of Germany for the following reasons. Reasoning I. We have established the following facts: The enterprise Meta Platforms Ireland Ltd. offers its online advertising clients various services (online tools) on Facebook for displaying advertisements. As part of the “Core Audiences” service, advertisers are to be given the opportunity to display their ads based on target audiences. To this end, advertisers can use numerous characteristics specified by the platform to select the target audience of Users to whom the ads are to be shown—based on numerous characteristics specified by the platform—such as location (e.g., countries, cities, or even more precise GPS locations), behavior (e.g., previous purchases, clicks on content, and device usage), demographic information (e.g., age, gender, education, occupation), connections (e.g., with Facebook pages or other users who share certain characteristics), or specific interests (e.g., organic food or action movies). The use of this service makes it possible to offer targeted advertising based on specific individual characteristics, known as microtargeting. The complainant in the present proceedings, Mr. [redacted], was shown the advertisement of the respondent, the Christian Democratic Union party, with the ad ID [redacted], during a visit to the Facebook online platform. The advertisement can be found at the following link in the Meta Ad Library: According to the Ad Library, it was displayed exclusively on September 9, 2021, on the online platform. The ad contained the following text: “CDU; Funded by the CDU; Start-ups and the digital economy. Digitalization and sustainability, digital learning and teaching, modernization of the state and digital administration: Digitalization encompasses all areas of our lives and is therefore one of the central tasks for the future of our country. Because everything is interconnected, we need policies that hold everything together. We have concrete ideas about the digital policy initiatives we want to use to move Germany forward. Curious? Monday, 6 p.m., live on cdu.de #CDigitallyUnited." In addition, a promotional video highlighting various positions of the Christian Democratic Union and a link to the party’s Facebook page were embedded in the ad below this text. At the time the above-mentioned ad was displayed, the complainant was a user of the free browser extension “Who targets me” (for information on how the “Who targets me” tool works: http://web.archive.org/web/20211203033445/https://whotargets.me/en/instal/instal- ling-the-browser-extension/), which stores information about political ads that were specifically targeted at Users via the Facebook online platform. The extension uses the “Why am I seeing this ad?” feature, through which Facebook itself disclosed—at the same time the ad was displayed—which Users were selected for this ad and by means of which personalized targeting criteria, and automatically stores the data transmitted in this manner. According to Individual Log 7 describing the process, the data regarding the advertisement in question was stored on September 9, 2021, at [redacted] o’clock. According to the ad information recorded by the complainant, the ad was served to him based on the following criteria: WAIST Gender ANY: WAIST INTERESTS Social Democratic Party of Germany; The technical documentation of the recorded data backup was attached by the complainant as a printout with the complaint dated March 21, 2023, and subsequently submitted as a spreadsheet. Advertisers on Facebook are generally unable to independently verify whether a specific ad was viewed by a specific User. After the ad campaign ends, advertisers receive a report as part of the billing process indicating showing how many users were shown the ad, enriched with specific statistical analyses (so-called “Insights”). In the present case, the respondent confirmed in a letter dated July 5, 2023, that it had commissioned an ad group—whose content corresponded to the aforementioned ad—in connection with the 2021 Bundestag election from (then) Facebook Ireland Inc. According to the letter dated July 5, 2023, the basis for the agreement with Facebook included, among other things, the generally applicable Terms of Service dated October 22, October 2020 (see http://web.ar- chive.org/web/20211022225207/https://de-de.facebook.com/legal/terms) and the Terms of Service for Self-Serve Ads dated June 28, 2021 (see https://web.ar- chive.org/web/20250928115721/https://www.facebook.com/legal/self_service_ads_terms) As criteria for selecting advertising recipients, the respondent, as stated in its letter dated July 5, 2023, the respondent used the target audience offered by the enterprise to select male and female individuals from Germany aged [redacted] who, among other things, were interested in the “Social Democratic Party of Germany.” In the letter dated July 5, 2023, the respondent states that it used the “Core Audiences” service to display the advertisements. It follows from this that “Custom Audiences” or “Lookalike Audience” services were not used in connection with the aforementioned ad. According to the analysis (“Insights”) submitted by the respondent in the letter dated July 5, 2023, the aforementioned ad or ad group had a reach of 497,386 and 517,018. The reach of the advertisement corresponds to the number of people who saw the advertisement, although this metric is based on estimates; impressions indicate how often the content of the advertisement was displayed on the screens of the data subjects (val. https://de-de.facebook.com/help/274400362581037). Further detailed information—such as how often the ad was shared, commented on, or reacted to, as well as the number of interactions with the respondent’s profile on the online platform—was not disclosed, but is generally part of the Insights feature. During the 2025 Bundestag election campaign, did the respondent sign an agreement on December 22, 2024, with other parties with representation in the Bundestag—such as the CSU, SPD, FDP, the Left Party, and the Greens—regarding a fair Bundestag election campaign? (https://www.tagesschau.de/inland/bundestagswahl/fairness-abkommen-wahlkampf- 100.html; https://www.spd.de/fileadmin/Dokumente/Beschluesse/20241222 Fairnessab- kommen.pdf), which stipulated, among other things, that microtargeting based on sensitive data such as religious affiliation or sexual identity be discontinued and be limited to the use of broader socio-demographic characteristics for “target-group-specific outreach” to voters . II. From a legal perspective, we assess the established facts as follows: The respondent has violated the GDPR. A. Violation of Art. 26 GDPR The respondent has violated para 2, first and second sentences, of para 1, second sentence, of the GDPR. Under this provision, joint controllers are required to set forth their obligations to safeguard the data subject rights in a transparent agreement that reflects their respective actual roles and relationships with respect to the data subject, and to make the essential elements of the agreement available to the data subject. This did not occur in the present case. L. Joint controllership pursuant to Article 26 of the GDPR Meta and the respondent are joint controllers pursuant to Article 26(1) , first sentence, of the GDPR. Accordingly, joint controllership exists when two controllers have jointly made the decision on the purposes and means of data processing. Pursuant to Art. 4(7) GDPR, a controller is any person who, alone or jointly with others, makes the decision on the purposes and means of personal data processing. To be classified as a controller, the entity must therefore be involved in the decision regarding the direct or indirect purposes or grounds of the data processing. At the same time, it must have a say in the framework conditions of the processing operation, such as the software or hardware used for that purpose (EDPB, Guidelines on the Terms “ Controller” and “Processor,” July 7, 2021, p. 3). For joint controllership pursuant to Art. 26(1) of the GDPR, all controllers must be involved in determining the purposes and means of data processing to such an extent that the specific processing would not be possible in the intended manner without the participation of one of the parties (EDPB, Guidelines on the Terms “Controller” and “Processor,” July 7, 2021, p. 3 et seq.). It follows from Recital 79 and Art. 26(3) of the GDPR that data processing based on joint determinations should not place data subjects at a disadvantage (see Kühling/Buchner/Hartung, Art. 26 GDPR, para. 10). Accordingly, the concept of the controller is interpreted broadly to protect data subjects [CJEU, Judgment of June 5, 2018, C-210/6, Wirtschaftsakademie, para. 28). Actual access to the specific data being processed is not required for the status of controller (CJEU, Judgment of June 5, 2018, Wirtschaftsakademie, C 210/6, para. 38; EDPB, Guidelines on the Terms “Controller” and “Processor,” July 7, 2021, p. 3; see, in particular, regarding targeting: EDPB, Guideline 8/2020 on the Targeted Addressing of Social Media Users, April 13, 2021, para. 47 with further references). In this regard, the CJEU states the following regarding the identical predecessor provision: By contrast, a natural or legal person who, out of self-interest, influences the processing of personal data and thereby participates in the decision regarding the purposes and means of such processing, may be regarded as a controller within the meaning of Art. 2(d) of Directive 95/46. Furthermore, joint responsibility of several parties for the same processing under this provision does not require that each of them have access to the relevant personal data"" (CJEU, Judgment of July 10, 2018, C-25/17, Jehovah’s Witnesses, para. 69). Nor is an equal distribution of responsibility necessary (CJEU, Judgment of June 5, 2018, C-210/16, Wirtschaftsakademie, para. 43; CJEU, Judgment of July 10, 2018—C-25/17, Jehovah’s Witnesses, para. 66: CJEU, Judgment of July 29, 2019, C-40/17, Fashion ID, para. 70: Kühling/Buchner/Hartung, Art. 26 GDPR, para. 16 et seq.), nor does it require complete alignment of the respective specified purposes and means (see Gierschmann, ZD 2020, 69, 70.) When using an online social network such as Facebook, a mere actuality regarding joint controllers between advertisers and controllers is sufficient. advertisers’ actual ability to influence the purposes and means of data processing is sufficient to establish joint controllership, since advertisers can configure settings to tailor their offerings to specific target groups and thereby (co-)determine the purposes of the processing (see CJEU, Judgment of June 5, 2018, C-210/16, Wirtschaftsakademie, para. 39; Ehmann/Selmayr/Bertermann, Art. 26 GDPR, para. 9). Even mere participation in determining the purposes and means of processing out of self-interest in the data processing can give rise to joint controllers (see CJEU, Judgment of July 10, 2018, C-25/17, Jehovah’s Witnesses, para. 68), insofar as it is relevant that the processing takes place at all. The advertisements viewed and any reactions to them are used by Meta not only for statistical purposes related to billing for the advertisement, but also to improve its own products. The advertiser: thereby also contributes to the processing of personal data by Meta (CJEU, Judgment of June 5, 2018, C-210/16, Wirtschaftsakademie, paras. 36, 39). By way of limitation, a data subject is not considered a controller for upstream or downstream data processing operations for which the involved party has not determined the purpose or means (CJEU, Judgment of July 29, 2019, C-40/17, Fashion ID, para. 74). 9. Relevant Data Processing Operation In the present case, the matter concerns a data processing operation in which Meta and the respondent share joint responsibility pursuant to Art. 26(1), first sentence, of the GDPR. This This involves the processing of personal data already collected by Meta to specify the selection of recipients for the advertisements that the respondent commissioned from Meta (the so-called advertising phase). In this context, in addition to users’ general profile data (name, place of residence, gender, date of birth), interest-based data—such as in the case of the complainant, “Social Democratic Party of Germany”—is also used to display targeted advertisements. This data is collected by Meta in advance, on the one hand through Users’ own active profile entries, and on the other hand through the tracking of page interactions—that is, viewing, commenting on, and sharing pages and posts, as well as “likes.” Although the respondent is not the controller responsible for the collection of this data, However, since the respondent has made the decision on the criteria for selecting the recipients, it is responsible to the extent that this data is used to display the specific advertisements (see below). b. Joint Determination of Purpose and Means During the advertising phase, the operator of the online social network Facebook and the respondent, which advertised on Facebook, were jointly involved in determining the purpose and means of data processing, even if their contributions differed in part with regard to the degree of responsibility and the specific objectives. The purposes are the “whether” and “why”—that is, the objective of the data processing. For a joint determination, it is sufficient to pursue closely interlinked or complementary purposes with mutual benefit, whereby the benefit must not be limited to the purely monetary compensation for the processing. “Means” refers to the Art and methods of data processing. In this context, the joint controllers may be involved to varying degrees in determining the means, particularly if one entity decides to use standardized tools and infrastructure provided by another entity (see EDPB, Guidelines on the Terms “Controller” and “Processor” in the GDPR, July 7, 2021, paras. 35, 59 et seq., 63 et seq.; Kühling/Buchner/Hartung, Art. 26 GDPR, para. 13; Monreal, ZD 2014, 611, 612; Schreiber, ZD 2019, 55, 56). (1) Joint Determination of Purpose The purpose of the processing of Facebook users’ personal data by the online social network is to display advertisements that are as targeted as possible to a specific audience, such as the respondent’s advertisement. From Meta’s perspective, this purpose serves two specific objectives: first, the generation of advertising revenue through satisfied advertisers, and second, the expansion of the data set to make the advertising system more efficient. The delivery of advertisements that are as targeted as possible thus constitutes at least an intermediate objective of Meta. This is evident from the general terms of use for the online social network (see https://www.facebook.com/terms.php; https://web.ar: chive.org/web/20210930162556/https://de-de.facebook.com/legal/terms/), where Section 2 (“How Our Services Are Funded”) states that Meta uses personal data—such as location, demographic information, activities, and interests—of users to serve targeted advertisements to specific audiences. The Terms of Service applicable to advertisements (seehttps://www.facebook.com/legal/selfser- vice-ads_terms; https://web.archive.org/web/20210930160001/https://www.face- book.com/legal/self service ads terms) further stipulate in Section 1 that, to the best of Meta’s ability, the advertisement will be delivered to the target audience specified by the advertisers or the result selected by them is targeted, but no guarantee is given for precise targeting. According to Section 5, Meta may also conduct tests on advertisements at any time to evaluate formatting, relevance, pricing, reporting, targeting, and delivery. Meta therefore retains a degree of discretion in addition to the purpose specified by the advertisers. From the respondent’s perspective, the purpose of data processing was the placement of an advertisement to reach a group of Users selected on the basis of specific criteria By using the advertising application offered by Meta for this purpose, the respondent also exerts significant influence over the associated data processing, because it is the respondent who initiates the data processing—which occurs through the display of the advertisement it designed—in the first place. (2) Joint Determination of Means Meta Platforms Ireland Ltd. (at that time still Facebook Ireland Ltd.) also jointly determined the means of data processing during the advertising phase for the purpose of the targeted display of advertisements together with the respondent as the advertiser. For the phase of data processing preceding the display of the advertisement, the operator of the network is, in particular, solely responsible for determining the means when collecting User data. However, to the extent that the online social network offers advertisers—as in the present case—the opportunity to publish their advertisements via the network and to serve them to specific (interest-based) groups of Users, the advertisers are also involved in the decision regarding the means of data processing. The respondent selected the standardized tools and infrastructure of the online social network to place its advertisements for the Bundestag election campaign. For the placement of advertisements, the Terms of Use for Self-Serve Ads from (see https://www.facebook.com/legal/self_serviceads_terms; https://web.ar- chive.org/web/20210930160001/https://www.facebook.com/legal/self_service_adsterms). Sections T and 6 of those terms stipulate that Facebook delivers the advertisement as soon as ad space becomes available and determines the size, placement, and positioning of the advertisements. The display of the advertisement is based on the processing of personal data pursuant to Art. 4(2) of the GDPR, because when displaying advertisements, reference may be made to the name, age, location, and specific, previously determined interests of the data subject, i.e., i.e., a comparison of the interests assigned to a user profile with those defined by the respondent as selection criteria. This applies even if users employ an identifier other than their real name on Facebook, since the collected data, including online identifiers, regularly enables the identification, identifiability, and profiling based on the identifier, and the data processing must therefore be considered to involve personal data (see Recital (Articles 26 and 30 of the GDPR). To enable advertisers to define target audiences for their ads, Meta offers, among other things, the “Core Audiences” service, which, according to its letter dated July 5, 2023, the respondent also used in the present case to serve targeted advertisements . When determining the desired target audiences for an advertisement, Meta provides advertisers with specific categories of targeting criteria, which the advertisers can then select. Consequently, Meta has provided the means in this regard and, through its legal, substantive, and technical design, has significantly influenced the effect of these means. By virtue of the respondent’s decision to use the social online network Facebook as an advertising platform for the Bundestag election campaign, and thus to use a specific advertising infrastructure and the specific service (Core Audience), it, too, made a decision on the specific means of data processing. In doing so, it sets these means in motion for its specific advertising campaign . Furthermore, it must be taken into account that the respondent could also have advertised on other social platforms that do not engage in audience targeting. It also refrained from entering into agreements that deviated from Meta’s offering or from using the preselected profiles. Rather, in the present case, the respondent selected a specific tool for delivering targeted advertising by using a predefined utility program and, within the framework of the program, played a decisive role in selecting the criteria for determining the target audience. Even if the selectors—that is, the more or less specific criteria for the further selection of user profiles from the platform’s database, were proposed solely by the platform, they were nonetheless individually selected, adopted, and agreed upon by the respondent, and thus decided upon in a joint process. Furthermore, the present situation differs fundamentally from the facts that formed the basis of the Cologne Administrative Court’s decision regarding the scope of joint liability in connection with the operation of a Facebook page by the Federal Press Office (see Cologne Administrative Court, judgment of July 17, 2025, 13 K 1419/23). Insofar as the Court in that case distinguished, for the purpose of distinguishing between essential and non-essential means—regardless of whether this distinction is followed—in the present case, the respondent has, by selecting the specific advertising criteria, also established, even by this standard, a complaint essential means for data processing. The selection of categories of recipients and the categories of data subjects is, in this respect, explicitly classified by the Cologne Administrative Court as a means essential to data processing (Cologne Administrative Court, Judgment of July 17, 2025—13 K 1419/23, para. 189). The fact that the respondent never had access to the personal data of the Users of the online network is therefore—as already explained above— irrelevant. Essentially, it played a decisive role in making a decision on which target groups to select and thereby determined—for the individual data subjects belonging to these target groups among Meta’s users—that their personal data would be processed. The concept of joint controllers and the associated detailed documentation are intended, in the interest of the data subjects, to prevent, among other things, a party from making a (co-)decision and later claiming that it did not have the content and scope of the decision (see Piltz/Gola/Heckmann, Art. 26 GDPR, para. 2; Martini/Paal/Pauly, Art. 26 GDPR, para. 8). In this regard, the CJEU holds (Judgment of June 5, 2018—C-210/16, Wirtschaftsakademie, para. 40), that the fact that an enterprise “uses Facebook [.. to make use of the associated services” does not exempt the enterprise from complying with its obligations regarding the protection of personal data. Furthermore, an examination of the respective contributions reveals that both controllers share a common interest in selecting profiles that are as effective as possible for advertising purposes. Such success would be demonstrable for both the respondent and the platform and could be leveraged for their respective interests. This is precisely the aim of the agreed-upon selection of selectors; it is therefore inconsequential that the contracting parties mutually benefit from one another for their respective own purposes. It is also harmless that the two parties do not attach equal importance to the same aspects of the processing operation. For example, the platform may be somewhat less concerned about the specific content it promotes, and customers are naturally less interested in how the platform maintains Users’ profiles. Furthermore, if the advertising party were able to completely evade its responsibility in such cases, there would be a risk that it could thereby circumvent the provisions of the GDPR by utilizing corresponding services outside the European Union. 2. Lack of a Transparent Agreement An agreement pursuant to Art. 26(1), second sentence, of the GDPR between Meta and the respondent does not exist in the present case. Meta’s various terms of use and privacy policy do not meet the requirements for such an agreement, as they lack a specific reference to the advertiser as well as to Article 26 of the GDPR. Nor does the so-called “"Addendum for Controllers" dated August 31, 2020 (https://web.ar- chive.org/web/20210326130301; https://de-de.facebook.com:443/legal/controller ad dendum) does not constitute an agreement governing the data processing at issue here. According to the first bullet point, this Addendum for Controllers dated August 31, 2020, applies exclusively to the collection of data as specified in the “Terms of Use for Covered Products” (e.g., https://web.archive.org/web/20210325015247; https://www.facebook.com/legal/terms/businesstools) as well as the transfers of such data to Meta. It is expressly stated that the “subsequent processing of data by Facebook Ireland (...) is not part of the joint processing.” In the present case, however, the relevant data processing operations do not concern the collection and transfers of data by the respondent to Meta, but rather Meta’s use of data already collected by Meta. Data processing during the advertising phase therefore cannot, as a matter of fact, fall within the scope of the “Addendum for Controllers.” Furthermore, the so-called “Addendum for Controllers” does not meet the requirements of Article 26 of the GDPR. Pursuant to Art. 26(1), second sentence, of the GDPR, joint controllers must set forth in a transparent agreement which of them fulfills which obligations under the GDPR, in particular the data subject rights and the information obligations. The agreement must therefore include, with respect to the area of joint responsibility, a division of all obligations under the GDPR associated with that responsibility. Article 26(2) of the GDPR further provides that the agreement must duly reflect the respective actual functions and relationships of the joint controllers vis-à-vis data subjects and that the essential elements of the agreement must be made available to the data subject . “Essential” information—and thus information that must be made available to data subjects—includes at least a clear description of the joint arrangement and the roles of the parties involved and their respective relationships with the data subjects, as well as specification of which of the joint controllers is responsible for which data subjects and which information rights (DSK, Brief Paper No. 16: Joint Controllers, Art. 26 GDPR, March 19, 2018, p. 4). The “Addendum for Controllers” to which the respondent refers fails to meet the aforementioned requirements for a transparent agreement in several respects. For example, it lacks any reference to the purpose and means of the specific data processing. The provision is very general in nature and refers to the many different business tools. To that extent, the addendum cannot, from the outset, be sufficient for any single data processing operation . The same applies to the description of the roles and interaction of the parties involved, which is practically nonexistent. The only content included in this regard is the aforementioned limitation of the scope of application to the collection and transmission of personal data by business users who are joint controllers alongside Meta. Furthermore, due to the general nature of the provisions, the agreement does not specify the specific identity of the advertiser. In addition to the shortcomings regarding content and transparency, this aspect also affects the provision of essential information to the data subject: While making this information available on the website is generally sufficient for this purpose, the essential details naturally also include who is a party to the agreement. The addendum provided on the website of Meta (formerly Facebook Ireland, Inc.) therefore never fully cover the essentials on its own and without specific supplementation. To enable data subjects to establish at least a rough connection, there would have to be at least a reference to the addendum within the advertisement itself, for which there is no evidence in the present case. B. Violation of Art. 9 GDPR By initiating data processing during the advertising phase, the respondent violated Art. 9(1) and (2) of the GDPR. According to this provision, the processing of personal data revealing political opinions is generally prohibited, unless the processing is covered by an exception under Article 9(2) GDPR. In the present case, the complainant’s personal data, from which political opinions can be inferred, was processed under the respondent’s responsibility without the existence of an exception. 1. Political Opinions Political opinions are inferred from personal data if they can be derived from it with sufficient probability (see Petri/Simitis/Hornung/Spiecker cited by D?hmann, Art. 9 GDPR, para. 12; Schiff/Ehmann/Selmayr, Art. 9 GDPR, para. 22). This category must be interpreted broadly and encompasses both support for and opposition to certain political orientations, parties, and issues (see OVG Hamburg Nord, R 2020, 285, 290; K?hling/Buchner/Weichert. Art. 9 GDPR, para. 27). Even non-political data considered in isolation may, in light of all the circumstances of the individual case—particularly taking into account the capabilities of modern algorithms—be deemed political opinion data (see Paal/Pauly/Frenzel, Art. 9 GDPR, para. 12). In particular, “liking” a political party on Facebook constitutes political opinion data, even if it does not express an inner conviction or an objective affiliation of the data subject with the respective party (see Ehmann/Selmayr/Schiff, Art. 9 GDPR, para. 22). The data processed in this manner need not necessarily reflect the actual political opinion of the person concerned; rather, it is sufficient that the data fall within this specific category (see CJEU, Judgment of July 4, 2023, Meta Platforms—C-252/21, para. 69 et seq.; EDPB, Guidelines 8/2020 on the Targeted Targeting of Social Media Users, Version 2.0, April 13, 2021, para. 123). This is because predictions about political views are also to be regarded as sensitive information (see the report by the Information Commissioner’s Office, “Investigation into the use of data analytics in political campaigns. A report to Parliament,” 2018, p. 36: Paal/Pauly/Ernst, 3rd ed. 2021, Art. 4 GDPR, para. 14). In this respect, such predictions pose the same risks to the data subject as in cases where the prediction corresponds to the person’s actual opinion (see GA Athanasios Rantos, Opinion in Case C-252/21, para. 40; Schiff/Ehmann/Selmayr, Art. 9 GDPR, para. 20, footnote 56). It follows from this broad interpretation that political opinion data do not merely cover specific voting decisions or even party affiliation. It is sufficient that the data subject holds a sufficiently identifiable or predicted opinion regarding a specific political party or a specific political issue, whereby the opinion may also consist of a certain degree of approval or disapproval. According to the above-mentioned CJEU case law, this opinion need not be accurate, but only needs to be deemed by the controller to be the data subject’s opinion or sufficiently informative for the purpose of categorizing the person. The data protection risk in this regard lies in the fact that a person is associated with a specific political stance and this circumstance takes on particular significance in the selection of that person. Such data was processed; in the present case, the processed data concerned the complainant’s alleged affinity with the Social Democratic Party of Germany (SPD). Meta assigned specific characteristics to the complainant for this purpose, which largely fall within the scope of the targeting criteria established by the respondent: “male and female,” “Social Democratic Party of Germany.” The table submitted by the complainant showed that, for the display of the advertisement to him, his age, his place of residence, and a—at least presumed— interest in the SPD were decisive factors, and to that extent, his personal data relating to these criteria were processed. In this case, political data is not (merely) every single interaction the complainant had with pages, posts, and comments directly or indirectly related to the SPD. Rather, it is the algorithmically supported overall view of these interactions, which led Meta to assume that the complainant belonged to the SPD’s voter base. This data was used to select the complainant as a suitable recipient of the advertisement. 2. No Exception Under Art. 9(2) of the GDPR The data processing described was also prohibited because there was no exception to the prohibition on processing under Art. 9(2) of the GDPR. The exceptions to the prohibition on processing must be interpreted narrowly due to the particular sensitivity of the data in question (see CJEU, Judgment of July 4, 2023, C-252/21, Meta Platforms, para. 76, with further references). d. Political opinion data not manifestly public The political opinion data used during the advertising phase was not manifestly public pursuant to Art. 9 (2)(e) of the GDPR. The data subject has manifestly made data public if the data is accessible to an indefinite number of persons without any significant restrictions on access. The purpose of permitting data processing in such cases is that a person who publishes their own data is no longer in need of protection in this respect (Gola/Heckmann/Schulz, Art. 9 GDPR, para. 32 et seq.). According to the CJEU, it must be examined whether the data subject intended to make the personal data in question accessible to the general public explicitly and through a clear affirmative act to make the personal data in question accessible to the general public” (Judgment of July 4, 2023, C-252/21, Meta Platforms, para. 77). Particularly with regard to interactions with websites, apps, and also with content on these websites or apps that allow inferences to be drawn from Article 9 data, it must be assumed that users generally do not expect their interactions to be disclosed. At the moment of interaction, it will often not occur to them that information about the interaction, beyond its technical provision, will be used by the website operator. To that extent, there will also be no intention whatsoever that the data be disclosed to third parties. without prior consent being obtained (see judgment of July 4, 2023—C- 252/21, Meta Platforms, para. 78 et seq.). In the case of the online network Facebook, not everyone can see all user interactions from the outset. Only a few personally identifiable interactions can be viewed without a Facebook account (e.g., comments). Furthermore, this is only possible if the data subject has configured this in their privacy settings. There, the data subject can also configure settings so that posts, likes, etc., can only be viewed by friends, friends of friends, or everyone (see https://de- de.facebook.com/help/325807937506242). Although it is not known which setting the complainant had selected, this is irrelevant. As demonstrated, the assessment of whether Users should be assigned to a specific interest category is based not only on “Likes” or other public interactions. Meta also evaluates how long each video was viewed, which pages were visited, and, furthermore, which interactions with social plug-ins on other websites were not visible to the general public. The complainant did not make such information public. In any case, not every single one of these interactions is the subject of the data processing at issue here, but rather the processing of the interest classification that emerges from them as a whole—which was not obviously made public, but rather determined in the background by an algorithm. Consequently, this involves derived data generated by Meta. b. Lack of Consent Where two parties are joint controllers for data processing, a consent to data processing—which both parties intend to rely on as a basis— must unambiguously cover the processing by the joint controllers; in particular, both parties must be named (see EDPB Guidelines on Consent 05/2020, para. 65). Furthermore, when processing sensitive data within the meaning of Article 9 of the GDPR, it is required that consent pursuant to Article 9(2) of the GDPR explicitly refer to the sensitive data. The data used must be specifically identified in this regard, as must the purpose of use (Schulz/Gola/Heckmann, 3rd ed. 2022, Art. 9 GDPR, para. 23). With regard to the specific identification of advertising recipients based on the targeting criteria selected by the complainant, which concerned sensitive information such as political opinion, no consent was granted by the data subjects. Such is also not implied by the general use of Facebook and acceptance of Meta’s Terms of Service, since, pursuant to Art. 4(11) of the GDPR, consent must always be given in an informed manner and thus must also include the identity of all controllers , which is not the case here. The CJEU points out that Users must have the freedom to individually refuse consent to certain data processing that are not necessary for the performance of a contract, without being forced to completely forgo the use of Facebook (Judgment of July 4, 2023, C-252/21, Meta Platforms, para. 155). While such voluntary consent is not apparent in the present case, but would in any event have to be proven by the controller (see Judgment of July 4, 2023, C-252/21, Meta Platforms, para. 153). Furthermore, when consent is given to the processing of political opinion data, the category of data and the purpose must be precisely specified (see Kühling/Buchner/Weichert, Art. 7 GDPR, para. 60b). However, the aforementioned information was not included either in the general terms of use or in the aforementioned addendum for controllers. Consent within the meaning of Art. 9(2)(a) GDPR is therefore ruled out as a legal basis for data processing. C. No Legal Basis Under Art. 9(2)(g) GDPR in National Law Nor is there a substantial public interest in the targeted display of election campaign advertising using political opinion data pursuant to Art. 9(2)(g) GDPR, because the art of election advertising described conflicts with the public interest in fair and unbiased elections. In this regard, Recital 56 of the GDPR already provides that such data processing may be permitted only to the extent that appropriate safeguards are in place, which do not exist in the present case. In the absence of clear and precise regulations governing data processing, it does not arise from Article 21(1), first sentence, of the Basic Law (GG) or Para 8(1) of the Political Parties Act (PartG). Nor is para 50 of the Federal Registration Act (BMG), which only authorizes the registration authority to provide political parties with information from the registration register, relevant in the present case. No other grounds for authorization under Article 9(2) of the GDPR are applicable. Insofar as the respondent invokes Article 6 regarding the lawfulness of data processing (1)(f) of the GDPR, it should be noted that this basis for lawfulness is, in principle, already excluded due to the absence of a comparable basis for lawfulness in Art 9 (see Gola/Heckmann/Schulz, GDPR, Art. 9, para. 6). C. Violation of Art. 13 GDPR With regard to data processing during the advertising phase, the respondent has violated Article 13(3) of the GDPR. During the advertising phase, the data processing does not involve the collection of data; thus, the controller is not subject to the obligations under Article 13(1) and (2) of the GDPR, but rather to those under Article 13 (3) of the GDPR. Accordingly, a controller who intends to further process data already collected for a different purpose must provide the data subject with this different purpose and all relevant information pursuant to Article 13(2) of the GDPR prior to further processing. In the present case, this was not done adequately. The purpose of collecting data on the data subject’s interactions with website content, as well as collecting data entered by the data subject themselves, was, as determined by Meta, the creation of a personality profile. The data was processed by being used for this purpose in the present case. It was used for a new purpose, Namely, to display a specific advertisement to the complainant as the recipient based on the pre-set targeting criteria selected by the respondent, which correspond to the data in the personality profile. As joint controllers, Meta and the respondent were able to fulfill the data subject’s rights jointly, individually, and on behalf of each other, and the data subject could assert their rights against either controller. In this regard, it is also necessary to consider what information Meta may have provided to the data subject prior to the further processing . In the present case, the necessary information that must be provided pursuant to Art. 13(3) of the GDPR, the changed purpose as well as the relevant information pursuant to Article 13(2) of the GDPR, which includes the existence of the rights to access, rectification, erasure, restriction, and objection to processing pursuant to Article 13(2) (b) of the GDPR, as well as the existence of a right to lodge a complaint with a supervisory authority pursuant to Article 13(2)(d) of the GDPR. Insofar as the respondent, in its letter received by the authority on October 25, 2023, refers to Meta’s privacy policy and terms of use with regard to its information obligations, this information does not satisfy the requirements of Article 13 of the GDPR. It is true that some information regarding the display of advertisements is contained in Meta’s Privacy Policy and various other notices. Regardless of whether this information meets the requirements of Article 12(1) of the GDPR—that is, whether it was provided in a precise, transparent, understandable, and easily accessible form in clear and simple language (see BeckOK Data Protection Law/Schmidt-Wudy, Art. 13 GDPR para. 85), this information does not, however, contain any specific information concerning the respondent. Although the changed purpose could be inferred from the notice provided with each advertisement "Why are you seeing this ad?"—which indicates that the ad is displayed based on the data subject’s activities in “meta-technologies,” such as “likes” on posts and Facebook pages, clicked ads, self- content, and location data (val. https://de-de.face book.com/help/794535777607370). However, at least the information required under Article 13(2)(b) and (d) of the GDPR has not been adequately provided. This is because Meta’s Terms of Service and Privacy Policy do not contain any specific information regarding the actual controllers. General information regarding the rights of access and erasure is not sufficient. This is because para 13(2)(b) of the GDPR stipulates that information regarding the right of access, etc., must be provided “by the controller.” However, the advertisement only indicates that the respondent is an advertiser, not that it is also a controller within the meaning of Articles 13 and 26 of the GDPR. The data subject is thus not informed in a clear, precise, and transparent manner as to whom they can turn to in order to exercise their data subject rights. Furthermore, as part of the information regarding the right to lodge a complaint, the supervisory authority responsible for the controller must be specified (Paal/Pauly/Paal, Art. 15 GDPR, para. 29). This was also not done in the present case. II. Consequently, we have made the decision to issue a warning in light of the violation. The warning is based on Art. 58(2)(b) GDPR. If, as in this case, the factual requirements of Article 58(2)(b) of the GDPR are met, the issuance of a warning is within the discretionary authority of our agency. In exercising this discretion, we carefully weighed whether and which supervisory measures should be taken. A warning was not an option, as the violation is of considerable severity: The respondent, among other things, processed special categories of personal data for the targeted display of advertisements without a legal basis. We are currently refraining from further measures, in particular a fine pursuant to Article 83 of the GDPR. In reaching this decision, we have taken into account, in particular, the criteria set forth in Article 83(2) of the GDPR: The specific violation has already been discontinued and lasted only for a limited period of time. This is the first identified violation of this kind by the respondent. The warning is necessary for the supervisory authority to sanction the conduct that violates data protection laws. A less severe measure (such as a mere reminder) would not be equally effective, especially since the respondent has not yet shown any willingness to comply: It continues to represent the view that targeting based on an interest in the “Social Democratic Party of Germany” does not constitute a special category of personal data under Art. 9 (1) of the GDPR. In doing so, the respondent fails to acknowledge that it used particularly sensitive data belonging to the complainant for its advertising purpose and that, due to its failure to acknowledge its responsibility, it has failed to provide the necessary transparency to the data subject , which in such cases is precisely intended to serve as the basis for the data subject’s consent. In light of this lack of understanding and the fact that the respondent relied on the assessment of its advertising partner in its legal evaluation without independently reviewing the data protection requirements, it cannot be ruled out that it will continue to employ such practices as long as an operator continues to offer them. The voluntary commitment made in this regard on the occasion of the 2024 federal election is neither binding nor permanent and has also not led to the respondent demonstrating any understanding in the present proceedings. The warning also serves as a sanction imposed by the supervisory authority for the company’s previous conduct in violation of data protection laws. Insofar as your complaint is concerned, we therefore consider the matter closed. Information on Legal Remedies A lawsuit may be filed against this decision within one month of its notification with the Administrative Court of Berlin, Kirchstraße 7, 10557 Berlin.