Austria’s Supreme Court has asked the European Court of Justice for clarification on the legality of Facebook’s processing of personal data after data protection activist Max Schrems brought a case before it. The Court in Luxembourg will now decide whether the US giant respected the EU’s data protection regime since it came into force in 2018. EURACTIV Germany reports.
Were the EU Court to rule in favour of Schrems, Facebook could face millions of lawsuits from users who could sue for damages.
“Almost every data use with which Facebook makes profits in the EU is based on this circumvention. If Facebook loses before the CJEU, they would not only have to stop misusing data and delete illegally collected data but also pay damages to millions of users. We are therefore very happy about the referral,” Schrems said in a statement on Tuesday (20 July).
This is the third case against Facebook that Schrems has brought before the EU Court. The other two were about the conformity of the EU-US data transfer agreement with European data protection rules. In 2015, the CJEU declared the Safe Harbour transfer agreement illegal, then in July 2020, it ruled that the Privacy Shield agreement was not compatible with the General Data Protection Regulation (GDPR).
Processing personal data
Austria’s Supreme Court expressed doubts, particularly with regards to the legal basis Facebook used to process personal data.
Until the GDPR’s entry into force, Facebook had argued that users had given Facebook consent to process their data.
But with the strengthening of consent requirements imposed by the GDPR, Facebook changed the legal basis for processing data. Instead of “consent”, the basis of data processing is now a contract formed with Facebook services now offered in return for the processing of users’ personal data.
According to the Austrian court’s ruling, the “core question” is whether Facebook is trying to “undermine” the stricter legal basis of consent by reinterpreting its services as a contractual performance.
This is what Schrems’ lawyer, Katharina Raabe-Stupping, had argued in a statement. The CJEU will now “create clarity for all and provide uniform rules,” Raabe-Stupping added.
The EU Court will also examine whether the use of personal data from other sources – like advertising – is compatible with the principle of data minimisation enshrined in the GDPR. This could have the consequence that “Facebook may then no longer be allowed to use all data for advertising even if consent is valid,” said Schrems. Facebook could also be prohibited from filtering out sensitive data – such as the sexual orientation or political views of users.
Partial successes and Facebook’s reaction
Although the most sensitive issues have been passed on to the Court in Luxembourg, Schrems has already achieved partial success in Vienna as the Austrian Supreme Court concluded in a partial ruling that the US giant had not granted him full access to the data stored about him. The court awarded him a symbolic €500 in damages.
Facebook is currently considering the ruling’s implications, a spokesperson told EURACTIV, adding that the CJEU has not yet decided on the Austrian referral to the EU Court. “We will have to see where this goes first,” the spokesperson added.
“We are committed to the principles of GDPR and have made major changes to our business as part of our ongoing efforts to give users meaningful transparency and control over their data.” the spokesperson said.
[Edited by Benjamin Fox]