Facebook hauled back to EU court, but on weaker legal grounds

Facebook on phone

By Magnus Franklin. Published 13 September 2016.

The Austrian law student whose battle with Facebook prompted EU judges to scrap a trans-Atlantic data-transfer deal is back in Europe's highest court for Round 2.

But privacy champion Maximilian Schrems is far less likely to triumph over the social network this time.

The new dispute centers on an Austrian "class action" claiming that Mark Zuckerberg's company has broken EU privacy rules.

Facebook "is accused of using invalid privacy policies, illegal processing and sharing of personal data or participation in the US mass-surveillance scandal," Schrems said in a statement yesterday announcing that Austrian judges have referred the case to the EU Court of Justice.

To bring the case, Schrems is making use of Austrian rules that allow a group of consumers to assign their legal claims to a lead consumer acting on their behalf.

Altogether, 25,000 individuals from a range of countries signed onto the claim via a website Schrems operates. When the list of claimants hit 20,000, only 3,712 had come from Austria, with a significant number of participants living in Germany, the Netherlands, Finland and Croatia.

The success of the court action ultimately hinges on whether a class action can be brought in Austria by people in so many countries against Facebook, whose European headquarters are in Ireland. The maneuver seems unlikely to gain traction, especially on a Continent that has staunchly opposed the introduction of US-style class actions.

The Austrian system itself restricts class actions to prevent the emergence of ambulance chasing. This helps explain why Schrems's suit cites legal precedents in other jurisdictions — including California and Canada.

'Users worldwide'

The case has been appealed all the way to the Austrian Supreme Court, which has now asked EU judges in Luxembourg for guidance on how pan-European law applies to the dispute.

Schrems says the case is vital for Facebook users beyond Austria and even the EU. "The 'class action' could be admissible for all users worldwide, European users or users in some countries," he says.

"Otherwise the plaintiffs would have to file hundreds of parallel lawsuits in multiple countries to remedy privacy violations by Facebook," he writes.

Facebook hardly seems rattled by the case.

"Mr. Schrems's claims have twice been rejected [by national judges] on the grounds that they cannot proceed as a 'class action' on behalf of other consumers in Austrian courts," the company said in an e-mailed statement to MLex. "We look forward to addressing the procedural questions presented to the [EU's Court of Justice] to resolve these claims."

Facebook may have underestimated Schrems's legal prowess in its previous fight before the Court of Justice, but there are many reasons why this case may prove more difficult for him to win.

A consumer?

For starters, EU judges will need to address the fundamental question of whether Schrems is really acting as a consumer in the case.

Schrems says that Facebook "is obviously trying to argue that I am some sort of 'commercial activist,' so that I can't sue them in my home court."

But the claim does relate to his own Facebook account, and Schrems says he isn't making any money by representing the other claimants. On this question, EU judges may well side with him.

The next hurdle Schrems must clear involves an EU law governing the jurisdiction of various courts around the bloc in civil and commercial matters.

The Austrian's suit relies on this "Brussels I" regulation, which spells out how courts should handle cross-border disputes ranging from divorce to bankruptcy. The rules stipulate that companies should be sued in their home countries — except in situations where claimants would face an unfair disadvantage. This is the case for consumers, who have the right to sue companies in their domestic courts anywhere in the EU.

The onus will be on Schrems to demonstrate that this provision applies to an Austrian "collective claim" — an unusual legal construct that allows named plaintiffs to sue a company jointly, if their claims are sufficiently similar and the case has legal value as a precedent.

It's one thing for Schrems to sue Facebook in an Austrian court or launch a collective claim on behalf of other Austrians under national law. But it's unclear whether this system can be used against defendants in other EU countries.

Legal hurdles

The Austrian Supreme Court has asked EU judges to explain who has standing to join the group claim — only Austrians, other EU residents, or people from outside the bloc, too. The answer to this seems straightforward. The Brussels I regulation makes it clear that consumers can file a claim only at home or in the country where the company is based. So the chances of non-Austrians joining the Austrian claim are slim.

Another challenge for Schrems and his lawyers will be to link their claims of privacy violations to consumer-protection law. A recent study suggested that Facebook's decision in 2014 to update its privacy policy — the event that triggered the litigation — did indeed violate a consumer law known as the Unfair Commercial Practices Directive. But this analysis has yet to be tested in court.

For now, everyone involved will have to wait — first for the EU court's hearing in Luxembourg and then its judgment, which could be expected sometime in the spring of 2018.

Even if the Schrems class action succeeds, an important question remains: What effect will it have on Facebook?

Schrems claims 500 euros ($560) in damages for each of the 25,000 claimants, or 12.5 million euros in all. The suit also seeks recompense for "undue enrichment" that Facebook is said to have gained through the alleged violation of consumer rights.

Contrast that with the latest quarterly profit Facebook posted in July: more than $2 billion.

Countdown to the GDPR