A class-action-style lawsuit accusing Facebook of targeting advertising based on allegedly illegally processed personal data is heading for the European Union’s highest court.
However, the Court of Justice of the EU is not being asked to rule on the substance of the case.
Instead, the Austrian Supreme Court has asked the CJEU to clarify whether someone who has become famous for their litigation of privacy rights can sue a company as an ordinary consumer under Austrian law.
The someone in question is Max Schrems, the man whose insistence that the Irish Data Protection Commissioner pay attention to his complaint against Facebook ultimately led to the biggest change in European privacy regulation in recent history. Unhappy with the DPC’s initial dismissal of his complaint, Schrems took his appeal all the way to the High Court of Ireland, which referred questions of law to the CJEU. In its response, the CJEU unexpectedly invalidated the Safe Harbor Framework governing transatlantic transfers of personal information, forcing its replacement by Privacy Shield.
Now another case initiated by Schrems is on its way to the CJEU, he said Monday.
This one, filed in August 2014 his native Austria, accuses Facebook of “unjust enrichment” by targeting advertising at its users based on what Schrems says is illegal handling of their personal data.
Schrems’ complaint concerns Facebook’s treatment of his personal data — but he also invited other Facebook users to assign him the right to pursue Facebook for its treatment of their personal data. Over 25,000 people responded, according to the site fbclaim.com, turning the case into an Austrian-style class-action.
Over the last two years the case bounced from Commercial Court to Regional Court in Vienna, through the Higher Regional Court and then all the way to the Supreme Court, as Facebook sought to have the case dismissed on technical and jurisdictional grounds.
Facebook’s most recent argument has been that Schrems is not eligible to sue it as a consumer in the Austrian courts because he has become a professional litigant. It says he has been paid to write books and give lectures as a result of his lawsuits against the company.
The Supreme Court thinks that Articles 15 and 16 of a December 2000 ruling from the Council of the EU, “on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters,” applies in this case.
Article 15 says, among other things, that a person is considered to be a consumer if he has entered into a contract “for a purpose which can be regarded as being outside his trade or profession.”
The Supreme Court has asked the CJEU to determine whether Schrems can still be considered a consumer in the light of the activities highlighted by Facebook.
Pending the CJEU’s ruling, the Supreme Court’s decision on jurisdiction is stayed. If it says that the case can go ahead, then it’s back to the lower courts to hear arguments about the substance of the case.
By the time that happens, the EU’s new General Data Protection Regulation could well have entered force, changing once again the rules on who has jurisdiction in European privacy cases.