Max Schrems

Max Schrems, 19 February 2012

Maximilian Schrems (usually referred to as Max Schrems) is an Austrian privacy activist who campaigns against Facebook for privacy violation, including its alleged violations of European privacy laws and alleged transfer of personal data to the US National Security Agency (NSA) as part of the NSA's PRISM programme. He has founded a group called Europe v Facebook and as of February 2015 has initiated two lawsuits involving Facebook.

Background and past actions

While studying law during a semester abroad at Santa Clara University in Silicon Valley, Schrems decided to write his term paper on Facebook's lack of awareness of European privacy law, after being surprised by what the company's privacy lawyer, Ed Palmieri, said to his class on the subject.^[1] He later made a request under the European "right to access" provision for the company's records on him and received a CD containing over 1,200 pages of data, which he published at Europe v Facebook with personal information redacted. He filed numerous complaints about the company, and in February 2012 Richard Allan and another company executive flew to Vienna for a meeting with him that lasted six hours.^[1] According to Schrems, Facebook was audited under European law and had to delete some files and disable its facial recognition software.^[2]

In his 2015 book Data and Goliath, American security expert Bruce Schneier cited the experience Schrems had to make the point that in the digital age, consumers are increasingly being surveilled by corporations in exchange for free communications services.^[3]

'Europe v Facebook' lawsuit

On 18 June 2014 a case brought by the group in the Irish High Court was referred to the Court of Justice of the European Union (CJEU).^[4][5][6]

Schrems' Europe v Facebook (EvF) group had filed a complaint against Facebook Ireland Ltd with the Irish Data Protection Commissioner (DPC), Ireland being the country where Facebook has its European Headquarters.^[7] The DPC rejected the complaint, saying there was no case to answer.^[8] Schrems then filed an application for judicial review in the Irish High Court and this was granted.^[7] At the first hearing of the review, Mr. Justice Hogan adjourned the case pending a reference to the CJEU. He said that Irish law relating to privacy had effectively been pre-empted by European law and that the core issue was whether the relevant directives should be re-evaluated in the light of the subsequent entry into force of Article 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union.^[4]

The essence of the referral is that EU law regards the US as a so-called Safe Harbour when it comes to the transfer of personal information. That status was called into question by the 2013 Edward Snowden revelations, and the question referred is whether a member state, such as Ireland in this case, is in that event bound by EU law granting the US safe harbour status.^[9][10][11] Alternatively, may (or must) the relevant office holders of the member country pursue their own investigations in the light of factual developments in the Safe Harbour agreement.^[6]

The first hearing was held on 24 March 2015.^[12][13] The court's Advocate General for the case is Yves Bot and he will publish his opinion on 24 June 2015.^{[lower-alpha 1]} The court's judgement is expected before the following October. During the hearing, Bot asked the European Commission lawyer Bernhard Schima what advice he could give him if he was worried about his data being at the disposal of U.S. authorities. Schima replied that he might consider closing down his Facebook account, if he had one.^[14] He said the European Commission was unable to guarantee that "adequate" safeguards for the protection of data are met, a remark that Schrems said was the most striking thing he heard at the hearing.^[15][16]

Facebook class action

Schrems is also suing Facebook in a class action suit dubbed by the press as a David and Goliath suit, estimated as likely to be the largest class action privacy suit ever brought. Participation in the suit is presently limited to 25,000 Facebook users, although other users can still register an interest. Schrems is suing the Irish subsidiary of Facebook in the Vienna courts for €500 in damages per participant. Finance for the case is being supplied by the German litigation funder ROLAND ProzessFinanz.^[17]

On 20 November 2014, Schrems said at a conference convened in Brussels by the International Association of Privacy Professionals that his group would go on a head-on collision with Safe Harbour, an E.U.-U.S. agreement that allows over 3,000 U.S. companies, including Google, Facebook, and Apple, to repatriate European personal data. Schrems argues that in practice it does not give the consumer any protection.^[18]

The first hearing is set for 9 April 2015.^[19]

See also

Microsoft Corporation v. United States of America

Notes

Notes

References

Sources

• Schneier, Bruce (2015). Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World. New York: W.W. Norton & Company. ISBN 978-0393244816. 

External links

• Europe v Facebook site
• Facebook class action site
• Notes on 24 March 2015 CJEU hearing