Privacy campaigner Max Schrems has launched a class-action lawsuit in Vienna against US social network Facebook's data retention practices.
Mr Schrems announced the latest round in his battle with the US company at a press conference in Vienna this morning. Central to his campaign is an app which allows users join the class action - via Facebook itself.
“Our goal is to finally get Facebook operating legally within data protection rules,” said Mr Schrems.
The civil suit in Vienna will run in parallel to another case brought by Mr Schrems against the Irish Data Protection Commission (DPC), challenging its decision not to investigate allegations that Facebook shared European user data with the NSA via its Prism programme. That case was heard before the High Court in Dublin before being passed on for legal clarification to the European Court of Justice (ECJ).
The new civil suit is open to all Facebook users outside of the US and Canada as they have a contract with Facebook International, based in Dublin. Under Austrian law, the users have to actively agree to sign up to the Schrems civil suit. To do this, he has set up an app via fbclaim.com which uses Facebook's own network to collate the claims.
The case claims Facebook International uses US data protection guidelines that are invalid under EU law. It claims the company collects data without securing adequate user consent and, in breach of EU law, passes on European user data to the NSA’s Prism surveillance programme. In addition the class action suit challenges Facebook’s practice of tracking users outside of its own network, through the “Like” button on websites. The case challenges what it calls Facebook’s “Big Data” practices, by which it says the company merges user data from various sources without explicit user consent. The case takes issue with Facebook’s “Graph Search” function which, Schrems claims, saw the company alter user terms of service to obtain user consent. Finally, the Austrian case claims Facebook illegally passes on user data to third parties.
The civil case has been filed in Vienna and will be heard under Austrian law. However, the Austrian campaigners have decided to use Californian law for compensation purposes, an option they say is available to them thanks to Facebook International’s hybrid legal status.
“This is very helpful for pushing through our rights,” said Mr Schrems. “But the compensation claim has been kept deliberately low - €500 per user - because, for us, it is about proper data protection. But if a few thousand people participate, we will reach an amount that Facebook will feel.”
This class-action civil suit follows Mr Schrems’s decision to withdraw his original Facebook complaint to the DPC, arguing the social network’s data collection policies breached EU law.
"The Irish case is now obsolete after nearly three years of a decision being promised 'shortly'," said Mr Schrems. "It's very difficult and expensive for a non-Irish person to take a case in Ireland. So we've shifted the focus of our action here to Vienna."
