Austrian court refers Schrems’ Facebook complaint to EU Court

with the strengthening of consent requirements imposed by the GDPR, Facebook changed the legal basis for processing data. Instead of "consent", the basis of data processing is now a contract formed with Facebook services now being offered in return for the processing of users' personal data. EPA/NICOLAS BOUVY [NICOLAS BOUVY]

Austria’s Supreme Court has asked the European Court of Justice for clarification on the legality of Facebook’s processing of personal data after data protection activist Max Schrems brought a case before it. The Court in Luxembourg will now decide whether the US giant respected the EU’s data protection regime since it came into force in 2018. EURACTIV Germany reports.

Were the EU Court to rule in favour of Schrems, Facebook could face millions of lawsuits from users who could sue for damages.

“Almost every data use with which Facebook makes profits in the EU is based on this circumvention. If Facebook loses before the CJEU, they would not only have to stop misusing data and delete illegally collected data but also pay damages to millions of users. We are therefore very happy about the referral,” Schrems said in a statement on Tuesday (20 July).

This is the third case against Facebook that Schrems has brought before the EU Court. The other two were about the conformity of the EU-US data transfer agreement with European data protection rules. In 2015, the CJEU declared the Safe Harbour transfer agreement illegal, then in July 2020, it ruled that the Privacy Shield agreement was not compatible with the General Data Protection Regulation (GDPR).

EU-US data transfers at critical risk as ECJ invalidates Privacy Shield

The EU-US Privacy Shield agreement that attempts to guarantee the secure transmission of EU data to the United States, has been declared invalid by the European Court of Justice, in a ruling that will provoke major disruption to transatlantic data flows.

Processing personal data

Austria’s Supreme Court expressed doubts, particularly with regards to the legal basis Facebook used to process personal data.

Until the GDPR’s entry into force, Facebook had argued that users had given Facebook consent to process their data.

But with the strengthening of consent requirements imposed by the GDPR, Facebook changed the legal basis for processing data. Instead of “consent”, the basis of data processing is now a contract formed with Facebook services now offered in return for the processing of users’ personal data.

According to the Austrian court’s ruling, the “core question” is whether Facebook is trying to “undermine” the stricter legal basis of consent by reinterpreting its services as a contractual performance.

This is what Schrems’ lawyer, Katharina Raabe-Stupping, had argued in a statement. The CJEU will now “create clarity for all and provide uniform rules,” Raabe-Stupping added.

The EU Court will also examine whether the use of personal data from other sources – like advertising – is compatible with the principle of data minimisation enshrined in the GDPR. This could have the consequence that “Facebook may then no longer be allowed to use all data for advertising even if consent is valid,” said Schrems. Facebook could also be prohibited from filtering out sensitive data – such as the sexual orientation or political views of users.

Facebook to Irish data body: 533 million user breach took place before GDPR

Facebook has told the Irish Data Protection Commission that a breach involving the personal information of 533 million users worldwide took place prior to the entry into force of the EU’s General Data Protection Regulation in 2018, and the company …

Partial successes and Facebook’s reaction

Although the most sensitive issues have been passed on to the Court in Luxembourg, Schrems has already achieved partial success in Vienna as the Austrian Supreme Court concluded in a partial ruling that the US giant had not granted him full access to the data stored about him. The court awarded him a symbolic €500 in damages.

Facebook is currently considering the ruling’s implications, a spokesperson told EURACTIV, adding that the CJEU has not yet decided on the Austrian referral to the EU Court. “We will have to see where this goes first,” the spokesperson added.

“We are committed to the principles of GDPR and have made major changes to our business as part of our ongoing efforts to give users meaningful transparency and control over their data.” the spokesperson said.

[Edited by Benjamin Fox]

Subscribe to our newsletters