January 28, 2018,
EU General Data Protection Regulation, Thought Leadership 
No comments
On Thursday 25 January 2018, the Court of Justice of the European Union (CJEU) ruled that 30-year old Austrian privacy campaigner Max Schrems couldn’t bring a class action law suit against Facebook Ireland for what he claims was illegal use of personal data but granted him permission to challenge the social media giant’s business practices in his native Austria.
The second CJEU ruling in Schrems’ long-running legal battle with Facebook is significant for widening legal jurisdiction against Facebook Ireland by granting the right of Schrems to take legal action against Facebook Ireland in the Austrian courts.
Facebook Ireland, headquartered in Dublin, unsuccessfully argued that the matter could only be heard in Irish courts.
The case now returns to Austrian courts that had previously failed to recognise 25,000 co-plaintiffs that had joined the action in the hope of receiving €500 in compensation each.
The CJEU issued the following statement:
“Mr Schrems may bring an individual action in Austria against Facebook Ireland. By contrast, as the assignee of other consumers’ claims, he cannot benefit from the consumer forum for the purposes of a collective action.”
For seven years, Schrems has argued that Facebook Ireland violates the fundamental rights of EU citizens by collecting more personal data than permitted under EU law. A previous legal action he took saw the CJEU declare Safe Harbour invalid in regulating some European personal data transfers to the US.
The latest judgment has its roots in a complaint filed by Schrems in 2011 with the Irish Data Protection Commissioner (DPC).
Later, after Edward Snowden’s revelations, Schrems argued that personal data of European Facebook users transferred across the Atlantic was being made available to US intelligence and therefore a violation of EU citizens’ fundamental right to privacy.
Schrems eventually withdrew the complaint from the DPC, complaining of a lack of progress, and took a case in Vienna arguing that Facebook was violating his rights as a consumer.
As well as challenging the Austrian courts jurisdiction to hear the matter, Facebook’s lawyers also argued Schrems had relinquished his rights as a consumer because he headed a professional campaign against the company.
The CJEU were unpersuaded and allowed Schrems to pursue his legal action as a consumer through the court in Vienna – but only for himself and not on behalf of other claimants.
The ECJ ruling creates a new definition of consumer, allowing only the original contract partner to bring a case in their home country against a business.
Despite ending the hopes of a class action, Schrems declared that the CJEU ruling opened the door to the first broad review of whether Facebook’s operations in Europe adhere to EU privacy laws.
“This is a huge blow for them,” he said. “Facebook can no longer hide behind the Irish Data Protection Authority against claims brought in a court in Vienna by a Vienna resident.”
Schrems is busy planning a second-class action lawsuit against Facebook Ireland once the General Data Protection Regulation (GDPR) is fully enforceable from 25 May.
Art.80, GDPR provides:
“The data subject shall the right to mandate a not-for-profit body…which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest and is active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Arts.77, 78 and 79 on his or her behalf and to exercise the right to receive compensation referred to in Art.82 on his or her behalf where provided for by Member State law.”
Schrems’ hopes his new not-for-profit organisation None of Your Business nyob.eu will fall under Art.80, GDPR in order to continue the legal action on behalf of the other Facebook Ireland claimants.
Although it’s one nil to Facebook Ireland, this boxing match has many rounds left to go.
For information about the GDPR Transition Programme at Henley Business School, click here.
Recent Comments