Max Schrems, the privacy activist who brought down the EU-US Privacy Shield data transfer agreement, spoke to EURACTIV Germany about his new case against Facebook, which he hopes could turn the tech giant’s entire data processing model upside down.
Following the Austrian Supreme Court’s referral in July of Schrems’ case to Luxembourg, the EU Court of Justice will now decide whether Facebook’s processing of personal data is compatible with European law.
If the EU Court were to rule in his favour, this would mean that “a large part of the data processing carried out by Facebook in Europe was illegal,” said Schrems, adding that “each individual user could then claim damages from Facebook.”
With the current 307 million daily users Facebook claims to have in Europe, the ruling could lead to a flood of lawsuits claiming compensation.
However, how much such claims for damages could go for still remains unclear. “According to current tables, we are talking about a few thousand euros per head, which is of course an incredible amount in the masses,” Schrems said.
A separate case currently pending before the EU Court could shed more light on the matter. “We could thereby get an explanation from the CJEU fairly soon as to how this is to be understood with regard to damages – especially with regard to Facebook,” he said.
Contract vs consent
At the core of the hearing is the issue of whether the legal basis Facebook uses for processing personal data for advertising purposes is in line with GDPR, the EU’s privacy framework.
“Until the entry into force of the GDPR, Facebook always based the processing of user data on the ‘consent’ of its users,” Schrems said.
“With the entry into force of the GDPR, the group then decided from one day to the next that not user consent, but a contract, would form the basis for data processing,” he added.
Since the requirements for consent to data processing in the GDPR are much higher than for contractual consent, the data protection activist suspects a deliberate attempt to undermine and water down the strict rules of the GDPR.
Facebook’s conversion of consent into a contract is unique. “No one but Facebook dares to circumvent data protection rules through any kind of contractual construct,” said Schrems. “That’s too wild, even for Google,” he added.
Data processing of sensitive data and advertising
In addition to the question of the legal basis for data processing, the Court in Luxembourg will also deal with questions of data minimisation and the handling of sensitive data, which according to Schrems are extremely relevant for the entire industry.
Here, the focus is particularly on the evaluation of personal data for advertising purposes. Facebook currently collects all data in a large “data pool,” regardless of whether it concerns sensitive information like sexual orientation or political preferences, and follows an “anything goes approach,” Schrems continued.
Although Facebook does not itself assign the collected data to specific categories, by passing it on to third parties – as in the case of British political consulting firm Cambridge Analytica – the sensitive data can still be analysed.
According to Schrems, if the EU Court were to uphold his claim, this would mean digital corporations would have to “introduce a filter when processing sensitive and political data in the future.”
This is particularly explosive when it comes to the question of political persuasion. “Things like Cambridge Analytica are only possible because political information data is not properly protected and not filtered out of the whole pool of data,” Schrems emphasised.
“If digital companies had to filter out this data in the future, much of the micro-targeting that there is so much fuss about for political reasons would no longer be technically possible,” Schrems added.
Facebook is also facing a probe from the Irish data protection authority that might lead to the stoppage of data transfers with the United States, which would cause a very significant disruption to the way the social network currently operates.
[Edited by Luca Bertuzzi/Josie Le Blond]