ECJ to rule on Facebook class action claim

by Ingrida Milkaite

The Austrian Supreme Court (ASC) has asked the European Court of Justice (ECJ) to clarify two issues associated with the Facebook privacy class action claim. The case was initiated by Austrian lawyer Maximilian Schrems five years ago.

Facebook class action_900X600 Austrian lawyer Max Schrems invited Facebook users to join his class action against Facebook, and 25,000 people signed up, claiming 500 euros in damages each. He is seeking the right to represent all those people in the claim. Issues are to be clarified by the ECJ. (Image: public domain)

The ASC request came out on 12 September. In principle, Austrian law allows people to assign their claims to one individual who can then file a suit on their behalf. European regulation on class action is different from American law, and the situation is expected to be clarified by the ECJ.

Schrems wants to represent thousands of people in the claim against Facebook. According to his attorney, W. Proksch, the core question now is whether consumers have to file thousands of individual complaints before thousands of judges and courts in different countries, or if such issues can be dealt with in a joint procedure.

In 2014, Schrems accused Facebook of allegedly using invalid privacy policies, illegal processing, sharing of personal data and participation in the US mass surveillance scandal (the PRISM programme). Schrems invited Facebook users to join his class action in Austria and 25,000 people signed up, claiming 500 euros in damages each.

After long legal proceedings, the case reached the ASC - despite Facebook’s efforts to dismiss the case on jurisdictional grounds. Simply put, Schrems is seeking the right to represent the 25,000 people in the class action claim, while Facebook believes that such a claim should be brought into a different court.

Two questions for the ECJ

For the Schrems case, the ECJ will be focusing on two points related to the interpretation of EU law.

Firstly, Schrems engaged in a public fight, raised donations and participated in debates – can he still be considered a consumer in terms of EU law?

Secondly, if a consumer can file an assigned claim at his home court, can the class action be joined by all users worldwide, or should it be confined to European users or users in some countries?

Fact box

ECJ: National judges of the member states of the EU can (and in some cases must) invoke the preliminary ruling procedure at the ECJ. It enables national courts to consult the ECJ on the interpretation or validity of European law. All 28 member states of the EU are obliged to follow the rulings of the ECJ. Such co-operation between the ECJ and national judges creates legal certainty as EU law is applied consistently throughout Europe.

Possible impact of the judgement: According to Max Schrems, the relevant matter is that Facebook and other businesses could be limited in how they can use personal data. Notably, most issues arising with Facebook are not specific to Facebook.

Future prospects. Schrems has complained to the Irish Data Protection Commissioner about another legal mechanism that Facebook and other companies are using to transfer EU citizens’ data to the U.S. – the so-called "standard (or model) contractual clauses". It is a separate legal method of transferring data across the Atlantic that is also under question. The same can be said about the Privacy Shield, since both methods allegedly do not provide sufficient protection against surveillance. ­­

Facebook argues that Schrems is a professional litigant who is conducting the campaign as a business activity, since he has published books and receives fees for public appearances. This argument is important – if Schrem’s activity is considered commercial, he would lose protection under consumer law and would not be able to represent other consumers in the class action claim.

Via the class action’s website, Schrems argues that it is organized on a pro bono basis, and that his Facebook account has only been used in a private capacity. He claims to have never made any profit via the initiative.

The origins of the case

Schrems’s legal campaign against Facebook began in 2011, when he was a 24-year-old student at the Santa Clara University School of Law in California.

A couple of lawyers from Silicon Valley technology companies came to speak to his privacy class. Schrems was surprised to hear them say they did not take Europe’s strict privacy laws very seriously, since companies rarely faced significant penalties for breaking them, as The New York Times reported.

Schrems then sent Facebook a formal request to see all of the data the company had collected about him. He received a CD with more than 1,200 pages of information — every poke, friend request and invitation he had sent. He was shocked to see that Facebook had retained information he had deleted, including the complete text of a private chat with a friend who had been hospitalized for psychological problems, according to the same NYT article.

Schrems eventually filed 22 complaints about data retention with the Irish Data Protection Commissioner, as Facebook’s European headquarters are in Ireland. Two years later, after whistleblower Edward Snowden revealed possible data transfers of European citizens to the US authorities, Schrems filed another complaint.

Such complaint asserted that his personal information wasn’t adequately protected. His petition was rejected and developed into the ECJ case (C-362/14).

The outcome of this case – the Safe Harbour agreement, which allowed EU-US data flows – is no longer valid. In July 2016, it was replaced by EU-U.S. Privacy Shield, and is supposed to provide stronger protection for transatlantic data flows.

Read more

Click here for the Austrian Supreme Court decision regarding the referral to the ICJ.