Schrems' pursuit of Facebook gets only limited breath of life from EU data-privacy rules

26 January 2018 10:23am

25 January 2018. By Magnus Franklin.

Privacy activist Max Schrems is already planning his next move against Facebook, after suffering a setback at the EU’s top court today. A new EU data law coming into force this year could open up a new front for the Austrian lawyer, but won’t open the door to the unlimited class action lawsuits he’s seeking.

The EU Court of Justice ruled today that Schrems can sue Facebook in his home country under consumer law, even though the company’s European operation is based in Ireland. But he can’t pursue claims on behalf of other consumers, because they each have an individual contract and relationship with social media company.

Filing a class action against Facebook would have to be done in Ireland, the court said. The only problem? Ireland doesn't have a collective redress system.

That will change on May 25, 2018 when the EU's new privacy law, the General Data Protection Regulation, comes into force. The regulation provides for the right for consumers to bring collective claims, breathing fresh life into Schrems' ambitions. He’s already laid the ground for the next fight, setting up a platform — noyb.eu — to coordinate collective actions.

But even if today’s ruling gives Facebook and other technology companies short-lived respite, there will be some degree of protection, even under the GDPR.

The biggest hitch is that the GDPR sets out that claims against companies, including collective lawsuits, must normally be brought in the country where the company is established — business-friendly Ireland, in the case of Facebook and several other big tech companies, such as Apple and Google.

There is an exception for citizens bringing claims in their own country, “where the data subject has his or her habitual residence." This suggests that Schrems’ original ambition of representing 25,000 Facebook users from across the EU, and even some in India, in a case brought in consumer-friendly Austria has little legal standing.

The most he can hope for is probably a series of collective lawsuits with claimants sorting themselves by nationality.

As the rules change under the GDPR, there are certainly going to be more cases before EU judges in Luxembourg, chiseling out the precise rules that should apply to cross-border disputes. It's not the last the courts will see of Schrems, or indeed of Facebook.

Countdown to the GDPR