Facebook set for NSA privacy grilling as EU court greenlights Max Schrems lawsuit

The European Court of Justice (ECJ) has ruled Austrian activist Max Schrems can bring a case against Facebook over privacy violations, but that he can’t bring a class action suit against the social media giant.

“@EUCourtPress decides: I can finally sue Facebook in Vienna over Privacy violations!” Schrems wrote on Twitter. “However, it limits consumer rights to "contract partner" only, so no class action. Huge problem for Facebook anyways.”

“Good news is we can finally get Facebook into a court. After seven years in Ireland, where the DPC [Data Protection Authority] didn’t do anything, three and a half years in Austria where … Facebook tried to resist that lawsuit, this lawsuit is now in the courts,” Schrems said following the ruling.

“We’ll be able to debate with Facebook that their privacy policy is something that no one in the world has ever understood and could not possibly agree to. That, for example, they hand over all the data to the NSA [National Security Agency], that they track you online, even when on pages that …... you visit, so there’s a lot of stuff that Facebook will have to deal with now.”

Facebook had argued that because Schrems has a Facebook page, he is no longer a consumer. The court found Schrems’ page does not “entail the loss of a private Facebook account user’s status as a ‘consumer.’”

No class action

Although Schrems can pursue his legal challenge against Facebook, the court ruled he will not be able to bring his more than 25,000-strong class action suit against the company.

“Mr Schrems may bring an individual action in Austria against Facebook Ireland,” the court said in a statement. “By contrast, as the assignee of other consumers’ claims, he cannot benefit from the consumer forum for the purposes of a collective action.”

“The second part that's interesting is that the ECJ says that only the original contracting partner of a company is a consumer, so anybody that didn't sign a contract with the company themselves is not within the consumer protection realm. That's hugely problematic.” Schrems said, citing a consumer buying a second-hand Volkswagen car as an example of the ruling’s limitations. In this case, as they did not sign the original contract with Volkswagen, they would not be able to sue.

“Today’s decision by the European Court of Justice supports the previous decisions of two courts that Mr. Schrems’s claims cannot proceed in Austrian courts as ‘class action’ on behalf of other consumers,” Facebook spokesperson Sally Aldous said. “We were pleased to have been able to present our case to the European Court of Justice and now look forward to resolving this matter.”

Schrems’ case will now act as a model for future actions. Facebook will face the court again for another case involving Schrems, linked to an Irish lawsuit about whether European data can be legally transferred to the US.

Schrems first filed the lawsuit against Facebook Ireland in 2014, following revelations released by NSA whistleblower Edward Snowden. Schrems argued Facebook was violating Europeans’ privacy rights and requiring it to stop using the data for its own purposes and those of third parties.

Think your friends would be interested? Share this story!