If the European Court of Justice has a loyalty card, Max Schrems should apply. On Tuesday the EU's highest court will hear legal opinion on the third referral to Luxembourg arising from the Austrian man's legal campaign against Facebook.
Since 2011, Schrems has fought a David and Goliath battle against the US social media giant, accusing it of collecting more information on users than allowed under EU law – and allowing US intelligence access the data hoard.
Such practises would breach European citizens’ fundamental right to privacy, he has argued – a point on which the ECJ has already found once in his favour. In 2015, the court spiked the EU’s main data transfer agreement with the US, called Safe Harbor, calling it unfit for purpose.
As well as Facebook, Mr Schrems has been locked in combat with Ireland's Data Protection Commissioner (DPC), Helen Dixon, claiming Irish regulation of big tech is so light-touch as to be almost non-existent.
Ms Dixon disagrees vigorously with that view, pointing to her commercial court case – referred to the ECJ – over Facebook’s business practises, including data transmissions to the US.
Tuesday’s ECJ court date is not about that case but a class-action Schrems filed in Vienna against the US company.
According to Schrems, Facebook operates in Europe with contracts that are invalid under EU consumer law. Facebook has disputed this through several legal instances, questioning the jurisdiction of Austrian courts and challenging the legality of 25,000 EU citizens who have assigned their claims to Schrems in this case.
In addition, Facebook has accused Mr Schrems of forfeiting his consumer rights because he has written books, delivered lectures and has a commercial interest in his long-running campaign.
Mr Schrems denies he is challenging Facebook in order to earn money or build a profile. The reason it has dragged on so long, he claims, is because of Facebook’s legal obfuscation and a go-slow from the Irish DPC.
The Austrian lawyer argues he withdrew his Irish Facebook complaint and shifted it to Vienna because he got tired of waiting for a final, definitive DPC ruling on whether Facebook’s Dublin operation adheres to EU privacy law. Six years on, we’re still waiting.
