More than 17,000 Facebook members have joined a class action lawsuit accusing the social network of violating data protection law and supporting spying by America's National Security Agency.

The suit was launched on 1 August by a 26-year-old Austrian law student, Max Schrems, who filed his claim to be heard in his home country. He called for 1 billion Facebook users to join his case.

By Monday, 5,000 Facebook members had signed up for the action via a specially created app that can be accessed from desktop computers and mobile devices, handing over details of their Facebook memberships, their addresses and scans of identity documents. By Tuesday, more than three times that number were on board.

Schrems, who described the response to his appeal as "giant", told the Reuters: "The emails and feedback have been really positive and what is interesting is that many people say finally someone is doing something in this direction."

The case is being brought against Facebook Ireland, which is based in Dublin and runs the network's activities outside of America.

"Our aim is to make Facebook finally operate lawfully in the area of data protection," said Schrems. "We love to complain constantly about data protection problems in Europe, now it's also time for us to enforce our fundamental rights. Within the framework of this class action individuals can also make a contribution to this effort."

The world's biggest social network has 1.32 billion users, and its shares are trading at a record high, valuing the company at almost $200bn.

But Schrems claims Facebook Ireland has committed unlawful acts, including "support of the NSA's 'PRISM' surveillance programme", tracking Facebook users on external websites, for example through "like" buttons, passing user data to external applications without authorisation, and not securing effective consent for many types of data use.

The suit mentions in particular Graph Search, a Facebook feature which produces lists of named members in response to queries such as "Friends who live in San Francisco", or even "Facebook employees who live in London".

The claim for damages has been set at a "token" €500 member. The suit is being financed entirely by Roland Prozessfinanz, a specialist litigation funding company, which will take 20% of any damages awarded. The rest of the damages will be handed back to the claimants, unless the balance is under €5, in which case it will be donated to charity.

"Because of our long history as a litigation funding company we are used to levelling the playing field in the fight between David and Goliath. In this case it is particularly necessary," said Arndt Eversberg, chief executive of Roland.

Under Austrian law, a group of people may assign their claims to one litigant, in this case Schrems, thus creating a class action. But those who hand over their claim to Schrems will not be liable for any costs.

"We are only claiming a small amount, as our primary objective is to ensure correct data protection," said Schrems. "However, if many thousands of people participate we would reach an amount that will have a serious impact on Facebook."