Europe's highest court has granted privacy campaigner Max Schrems permission to challenge Facebook's business practices in his native Austria, but not in a class action lawsuit.
The second European Court (ECJ) ruling in Mr Schrems’s long-running legal battle with the US social media giant is significant for broadening legal jurisdiction.
In its ruling on Thursday, the Luxembourg court dismissed Facebook’s claim that it is only answerable to courts in Ireland, home to its international headquarters.
The case, separate to another legal action in the High Court in Dublin, now returns to Austrian courts, which had previously challenged the lawyer's attempts to recruit other Facebook users to his case.
In its ruling, the ECJ agreed with the Austrian courts and Facebook, and dismissed the campaigner’s attempt to build a collective action case against the company.
“Mr Schrems may bring an individual action in Austria against Facebook Ireland,” the court said in a statement. “By contrast, as the assignee of other consumers’ claims, he cannot benefit from the consumer forum for the purposes of a collective action.”
For seven years Mr Schrems has argued that Facebook violates the fundamental rights of EU citizens by collecting more data than permitted under EU law. A previous legal action he took saw the ECJ strike out the Safe Harbour provisions, regulating some European data transfers to the US.
The case ruled on by the ECJ on Thursday had its roots in a 2011 complaint filed by Mr Schrems to the Data Protection Commissioner (DPC) in Dublin.
Later, after Edward Snowden’s revelations, Mr Schrems argued that European Facebook user data, transferred across the Atlantic, was being made available to US intelligence, a violation of EU citizens’ fundamental right to privacy.
Lack of progress
The Austrian campaigner eventually withdrew the case from the DPC, complaining of a lack of progress, and took a case in Vienna arguing that Facebook was violating his rights as a consumer.
As well as challenging jurisdiction, Facebook argued that Mr Schrems had relinquished his rights as a consumer because he headed a professional campaign against the company.
Mr Schrems insisted his campaign was not for profit. The ECJ confirmed on Thursday that he is free to litigate against Facebook as a consumer - but only for himself and not for others.
The ECJ ruling creates a new definition of consumer, allowing only the original contract partner to bring a case in their home country against a business.
Despite the end of his class action, which had signed up 25,000 participants each claiming €500 damages each, Mr Schrems said the ruling opened the door to the first broad review of whether Facebook’s operations in Europe adhere to EU privacy laws.
“This is a huge blow for them,” he said. “Facebook can no longer hide behind the Irish Data Protection Authority against claims brought in a court in Vienna by a Vienna resident.”
As well as his ongoing Irish case, soon to be referred to the ECJ, Mr Schrems is planning a second class action lawsuit against Facebook under new data protection regulations, operational in the EU from May. For this end he is collecting funds for a new privacy organisation, nyob.eu.
Facebook welcomed the ECJ’s ruling and said it looked forward to resolving the matter.
