Schrems can't throw collective sueball at Facebook but individual action OK

It's not a knock-out: Fbook's privacy status will be tested in Austrian court

By Rebecca Hill

Posted in Policy, 25th January 2018 10:33 GMT

Max Schrems can sue Facebook in Vienna as an individual, but can’t bring a class action suit, in a ruling from the Court of Justice of the European Union without a knock-out blow for either side.

The decision, handed down this morning, relates to a case the Austrian activist and lawyer brought as a consumer in the Austrian city, which claims the firm infringed data-protection provisions on his personal account.

This case is separate to the more famous, ongoing and hugely costly battle with Facebook that he launched in Ireland, where the biz has its European headquarters.

Schrems also attempted to make the consumer suit a collective action, bringing in seven others who live in Austria, Germany and India, whom he has offered to represent pro bono.

The Irish arm of the Zuckerborg, though, countered that because Schrems has a page listing his lectures and activities on the social network, his use should be considered professional, not personal.

It also said that the consumer privilege that allows someone to sue a company in a different jurisdiction from its HQ can't apply for joint claims.

The Supreme Court of Justice in Austria sent these two questions - whether Schrems could be considered a consumer, and whether he can bring collective action - up to the CJEU.

In its ruling (PDF), the CJEU said that publishing books, carrying out fundraising and being assigned the claims of other consumers “do not entail the loss of a private Facebook account user’s status as a ‘consumer’”.

But, it said, consumer privilege only applies to the parties in the contract (Facebook and Schrems, in this case) - consumers from other nations cannot bring action in another’s jurisdiction.

The decision, which runs in line with the opinion of advocate general Michal Bobek in November, means it’s one-all in the latest case.

Schrems celebrated the fact he was now able to sue Facebook in Vienna, rather than having to go through the courts in the nation the business is based.

This has been something of a bugbear for Schrems, who has repeatedly argued that the costs of fighting the battle in Ireland would make it impossible for others to bring similar cases.

“Facebook can no longer hide behind the Irish Data Protection Authority against claims brought in a Court in Vienna by a Vienna resident,” he said.

"The fact that the case is now clearly admissible is a huge problem for Facebook."

He said that - regardless of whether it is a personal claim or one with 25,000 other people – "if the business model of Facebook is tested in a court that’s a huge risk for a company that ignored the law".

Facebook, meanwhile, claimed victory for the part of the ruling that said Schrems had to go it alone.

“Today’s decision by the European Court of Justice supports the previous decisions of two courts that Mr. Schrems’s claims cannot proceed in Austrian courts as “class action” on behalf of other consumers,” a spokesborg said.

“We were pleased to have been able to present our case to the European Court of Justice and now look forward to resolving this matter.” ®

Sign up to our NewsletterGet IT in your inbox daily


More from The Register

Uber hack: EU data protection bods launch taskforce

Justice commissioner slams biz for 'irresponsible' behaviour

Big tech wants the ICO on EU data protection board in Brexit fallout

Watchdog keeping voting rights 'huge gain' for marketing sector, say Facebook, Google et al

Austrian privacy chief handed leash to EU's data protection beast

Group warms up for greater powers once GDPR hits

Don't sweat Brexit, big biz told: Your shiny data protection sticker will remain intact

Survey reveals GDPR training and investment is on the rise Snoop laws not 'significant' obstacle to EU data protection talks

Digi minister confident of adequacy decision post-Brexit

Dell EMC patches 3 zero-days in Data Protection Suite

Could combine to 'fully compromise' virtual appliance, researchers warn

Facebook smartmobe app's pre-ticked privacy settings violate German data protection law

Court favours consumer group in long-running dispute

EU's data protection bods join the party to investigate Uber breach told to sever ties with 'grubby, unethical' company

UK Data Protection Bill tweaked to protect security researchers

Re-identification of data will not be a crime, as long as you warn the authorities

Coming soon to a Parliament near you – UK's Data Protection Bill

First reading to be squeezed into short September term