Facebook Class Action Lawsuit by Privacy Activist Max Schrems Rejected by EU Court

An Austrian privacy activist cannot bring a class action lawsuit against Facebook for alleged privacy violations but can sue the company himself in his home country, the European Union's highest court ruled on Thursday.

The Court of Justice of the European Union (ECJ) said Max Schrems could bring a case against the US company under consumer law as an individual, but could not bring claims on behalf of the more than 25,000 signatories to his lawsuit.

Schrems alleges Facebook has illegally violated the privacy rights of European users, including by helping a US spy agency. Facebook rejects his assertions, which date back to 2014, and says it has always complied with European data protection laws.

"Mr Schrems may bring an individual action in Austria against Facebook Ireland," the court said in a statement, referring to Facebook's European headquarters.

"By contrast, as the assignee of other consumers' claims, he cannot benefit from the consumer forum (consumer law) for the purposes of a collective action."

Schrems had sought to claim EUR 500 ($620 or roughly Rs. 39,400) in damages for each of the signatories to his lawsuit, but Facebook argued the Austrian courts had no jurisdiction and that Schrems could not benefit from consumer protection laws.

Facebook said Schrems stopped being a consumer when he used a page for professional purposes. Under EU law, consumers are allowed to sue companies in their home country, as opposed to the one where the company is established.

"Today's decision by the European Court of Justice supports the previous decisions of two courts that Mr. Schrems's claims cannot proceed in Austrian courts as "class action" on behalf of other consumers," said a spokeswoman for Facebook.

Schrems said the ruling was a "huge blow" for Facebook as his individual lawsuit against the company could go ahead in a Vienna court and Facebook would have to explain whether "its business model is in line with stringent European privacy laws."

Facebook's Chief Operating Officer Sheryl Sandberg travelled to Europe this week to meet with policymakers and said the social network would make it easier for users to manage their privacy settings ahead of the entry into force of a tough new data privacy law.

Schrems recently set up a non-profit organisation, noyb, that will seek to enforce citizens' rights under the new law and said privacy class actions would be possible under it.

Missing piece of consumer protection
While Austria recognises some forms of class action lawsuits, Ireland does not.

The ECJ said only the person who concluded the original contract with the business could sue under consumer law in his or her home country. The same applies to a consumer to whom the claims of other consumers have been assigned, the court said.

"Since only the original consumer can sue, there is no possibility to bring a class action in Austria," Schrems said in a video on Twitter after the ruling.

The European Consumer Organisation (BEUC) said the ruling exposed "a missing and vital piece of the consumer protection jigsaw."

"It is another stark illustration that there are legal and procedural barriers which prevent people from seeking collective access to justice. Due to the high costs, it is often not realistic for consumers to go to court alone, especially when the harm they have suffered is rather small in monetary terms," said Monique Goyens, director general of BEUC.

© Thomson Reuters 2018