Yet another privacy case involving Facebook (FB) is heading to the EU’s top court.
And, yet again, the man behind the case is Max Schrems, the Austrian law student who has been pestering Facebook over its privacy policies for many years—with a high degree of success. It was Schrems whose Facebook-related complaint to Irish privacy authorities ultimately led to the scraping of the U.S.-EU Safe Harbor data-sharing agreement last year, throwing transatlantic data transfers into legal jeopardy.
This time around, the case is about Schrems’ two-year attempt to organize a class action lawsuit against Facebook in Austria. It’s going to the Court of Justice of the European Union, or CJEU, because class actions are a relatively novel concept in Europe, and Schrems and his “Europe v. Facebook” group are trying to break new ground.
After a very complicated couple of years, Austria’s supreme court is unsure who actually has jurisdiction over such a case, and it’s asked the CJEU to clear up the matter. Here’s what’s happened so far. (Take a deep breath…)
Get Data Sheet, Coins2Day’s technology newsletter.
In 2014, Schrems and his group decided to go after Facebook over complaints including its reported participation in the PRISM surveillance program, its tracking of users around the web, its alleged non-compliance with people’s requests for access to their own data, and various bits of its privacy policy.
Facebook’s headquarters for all its operations outside the U.S. And Canada are located in Ireland. Having already experienced frustration with the Irish privacy authorities, Schrems invited Facebook users from everywhere except the U.S. And Canada to join his putative class action in Austria.
The Austrian legal system does not allow for class actions as Americans typically understand them, but it does in principle allow people to assign their claims to one person who can then file a suit on their behalf. In this case, that person was Schrems, and 25,000 people globally assigned their claims to him.
The suit was backed by German litigation finance firm Roland ProzessFinanz, and the claimants are looking for €500 ($562) each in damages.
In 2014, the Viennese commercial court declined to hear the case on the basis that it was more about data protection than its usual domain of contract law. The case shifted to the Viennese regional court, which ordered Facebook to respond to the suit.
Then, in July 2015, the Viennese regional court decided Schrems was a “professional litigant” and could not be classed as a consumer, meaning he could not sue Facebook outside the country where it was headquartered. The court insisted Schrems ought to be suing Facebook in Ireland instead.
Schrems appealed to the next court up, which in October decided that he was a consumer after all, and could indeed sue in Austria. However, the appeal court did not grant Schrems the ability to sue on behalf of those 25,000 other people.
At this point, both Facebook and Schrems asked the Austrian supreme court to take on the case. Facebook doesn’t want the case to go ahead at all, and Schrems wants to be able to act as the avatar for thousands of others in court.
With the supreme court having now asked it for help, the CJEU will have to decide whether a consumer can also act on behalf of others. It will also have to decide whether Schrems, who is, after all, well-known for taking on Facebook, does indeed have the “consumer” status that allows him to sue in his home country.
“Filing thousands of individual lawsuits before thousands of courts would be an absurd exercise,” Schrems said in a statement. “If one takes a rational look at this matter there are little arguments against our position—but it will be an exciting case.”
Facebook did not respond to a request for comment to Coins2Day at the time of writing.
This is, of course, not Schrems’ only exciting case against Facebook. With the Safe Harbor victory already under his belt, he complained to the Irish data protection commissioner about another legal mechanism that Facebook is using to transfer EU citizens’ data to the U.S.—so-called “standard contractual clauses.” As before, he insists that the data is not sufficiently protected against surveillance by U.S. Authorities.
For more on Facebook, watch our video.
In May, the Irish privacy regulator referred the case to, you guessed it, the CJEU.
If Schrems wins there again, transatlantic data transfers will be in serious jeopardy, particularly as Safe Harbor’s replacement, “Privacy Shield,” is also looking legally shaky.
And if Schrems succeeds in his Austrian endeavor, he will be paving the way for class actions across the EU—while sticking it to Facebook, naturally. Bear in mind that even before the Safe Harbor ruling last year, Schrems’ complaints already ended up with Facebook having to give European users more of their data and being unable to deploy face-recognition features in the EU.
Whether or not he’s classified as a consumer as well as being a crusader, Max Schrems is certainly out to make life hell for Facebook, while changing Europe’s legal landscape along the way.
