Schrems: The Law Student Who Brought Down a Transatlantic Data Pact

From Vienna cafes to the European Union's highest court, an Austrian law student's two-year battle against Facebook and mass US surveillance culminated on Tuesday in a landmark ruling that has rippled across the business world.

Max Schrems, a 28-year-old Facebook user finishing his Ph.D in law at Vienna University, took an interest in the subject of privacy while studying for a semester abroad at Santa Clara University in California.

The legal battle against mass US surveillance that he subsequently pursued resulted in what lawyers called a "bombshell" ruling knocking down a data transfer framework between the European Union and the United States used by over 4,000 companies such as Google, Facebook and IBM.

"Max Schrems and Edward Snowden. What a combination. Two young men who have made indelible impacts on the world of data protection," wrote Stewart Room, a partner at PwC.

Like many Vienna residents, Schrems has a cafe - the traditional Cafe Ritter in the Austrian capital's fashionable Mariahilf shopping district - that is like a second home where he likes to spend much of his time and receive visitors.

In 2013, ex-National Security Agency (NSA) contractor Edward Snowden leaked details about the US government's Prism programme that allowed it to harvest private information directly from big tech companies such as Facebook.

Facebook has repeatedly denied being a "back door" for US spies.

Schrems took up the privacy battle and filed 22 complaints against Facebook in Ireland, where the company has its European headquarters. He set up a website, called europe-v-facebook.org, with the aim of ensuring that Europeans' privacy rights are enforced against "tech giants like Facebook."

He then lodged a complaint with the Irish Data Protection Commissioner, asking it to stop Facebook's transfers of European users' data to its US servers because of the risk of US government snooping.

That complaint was thrown out as "frivolous and vexatious."

But Schrems appealed. His case eventually wound its way to the Luxembourg-based European Court of Justice, which on Tuesday struck down the framework underpinning the data transfers of thousands of companies.

"Individuals now have far greater ability to exert a disruptive influence and shape law," said Paula Barrett, partner at law firm Eversheds.

Snowden, without whom Schrems said Tuesday's victory would have been impossible, congratulated the Austrian privacy activist via Twitter.

"Congratulations Max Schrems. You've changed the world for the better," Snowden tweeted.

© Thomson Reuters 2015