Yet Another Legal Action By Dogged Privacy Activist Brings Good News And Bad News For Facebook In EU's Highest Court

from the Max-Schrems-strikes-again dept

The Austrian privacy activist Max Schrems has appeared a few times on Techdirt, as he conducts his long-running campaign to find out what Facebook is doing with his personal data, and to take back control of it. In 2011, he obtained a CD-ROM (remember those?) containing all the information that Facebook held about him at that time. More dramatically, in 2015 Schrems persuaded the Court of Justice of the European Union (CJEU) that the Safe Harbor framework for transferring personal data from the EU to the US was illegal under EU laws because of the NSA's spying, as revealed by Edward Snowden. As Schrem's detailed commentary (pdf) on that CJEU judgment explains, the case was specifically about Facebook, although it applied much more generally. Last month, we wrote about another case, currently being referred to the CJEU, concerning Facebook's use of standard contractual clauses (SCCs) (pdf), also known as "model clauses". It's an alternative legal approach for transferring data across the Atlantic, and if the CJEU rules against Facebook again, it could make things rather difficult for the big US Internet companies (but ordinary businesses won't be affected much.)

You might think that all these Facebook cases would be more than enough for any privacy activist, but not for Schrems, apparently. He is engaged in yet another legal action that involves Facebook (pdf). As Schrems explains:

[he] has sued Facebook over his private Facebook account at his home court in Vienna, Austria. Schrems accuses Facebook to massively violate strict European privacy laws. The lawsuit includes claims from invalid privacy policies all the way to data sharing with US intelligence services. In addition to bringing his personal claims, he also invited other users to sign over their rights to him, to form a so-called "Austrian style class action" against Facebook, in which he represents other users on a pro bono basis.

This legal action is rather different from the others discussed above, and involves Schrems personally suing Facebook in Austria using civil law. Unusually, he also gathered 25,000 people to join him in a class action against Facebook, each asking for €500 damages. Because of the importance of the legal questions under discussion, Austria's supreme court referred them to the CJEU for a definitive ruling. As is usual, before the CJEU judges themselves rule, one of the court's Advocates General offered a legal opinion, which has just been published. Two questions were considered: whether Schrems could bring a case at all, and whether a class action was possible. Here's Schrems' explanation of what the Advocate General (AG) said for the first issue:

Facebook tried to argue that Mr Schrems cannot bring a lawsuit at his home court, as he would not qualify as a consumer, but as a business. This is despite the fact that the courts have found, that the lawsuit is organized on a pro bono basis and he never used his Facebook account in any commercial way. The strategy of Facebook was to force Schrems to bring his lawsuit at Facebook's home court in Dublin -- where a single case of €500 could cost Millions in legal fees. This was clearly rejected by the AG, just like previously by the Higher Regional Court in Vienna: Individuals that fight for their rights as volunteers are not 'businesses' and can enjoy their consumer rights. The AG confirmed: Mr Schrems can bring a 'model case' in Vienna.

On the second question:

the advocate general accepted Facebook's point of view: An "Austrian style class action" is only admissible against an Austrian company -- but not if an Austrian consumer sues a company in another EU member state [Facebook's EU operations have their headquarters in Ireland].

Schrems spends some time explaining why he thinks the Advocate General is wrong, and it's worth reading his thoughts here, since Schrems is naturally something of an expert in this domain after all these years. But as he also points out, what counts is what the five judges who will consider the case at the CJEU decide. Although they usually accept the reasoning of the Advocate General, they don't have to and sometimes disagree. Schrems thinks their judgment will be handed down in January 2018, after which the case will go back to the Austrian courts to make a final ruling based on the CJEU's findings.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community. Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis. While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: cjeu, data protection, eu, max schrems, privacy, social media

Companies: facebook