The Court of Justice of the European Union (CJECU) has ruled that privacy campaigner, Max Schrems, does not have standing to bring a class action against Facebook Ireland before the Austrian courts. The Court did, however, allow Schrems to continue the litigation as an individual.
Schrems, who is domiciled in Austria, sought to bring a class action against Facebook for alleged data breaches to his own private account and on behalf of 25,000 other individuals from across Europe who had assigned their claims to him.
The Brussels 1 Regulation (44/2001) determines jurisdiction in cases with links to more than one country in the EU. Under the regulations, an action must be brought against a defendant in the Member State in which they are domiciled, except in the case of consumer contracts where consumers are allowed to bring an action in their State of residence.
The Supreme Court of Austria referred two questions on Schrems’ standing to the CJEU:
(1) Whether Schrems, who uses Facebook to fundraise and promote his books and events, had a professional interest in the case therefore could not be regarded as a ‘consumer’ under European consumer protection law; and
(2) Whether, under the Regulation, Schrems could bring a claim on behalf of other consumers domiciled in the same Member State, other Member States or non-member countries.
In relation to the first question, the Court agreed that an individual who starts using Facebook as a consumer could lose that status through predominantly professional use of the platform. However, the Court found that a consumer does not lose his status due to knowledge and expertise acquired in the field or assurances given for the purposes of representing the rights and interests of other users. The Court found that such an interpretation would disregard well established EU objectives promoting the right of consumers to organise themselves in order to safeguard their interests.
On the second point, however, the CJEU ruled that consumer privilege applies “only to an action brought by a consumer against the other party to the contract,” so Facebook users could not assign their claims to other citizens outside their State of residence. The Court held that this rule made “it possible to make sure the attribution of jurisdiction is predictable”, thereby preventing consumer claims being transferred to a plaintiff-friendly EU jurisdiction where the defendant has no assets or operations.
In 2013, the European Commission recommended that Member States introduce a collective redress mechanism, although nine countries have yet to do so – including Ireland. The landscape is changing, however, with the new General Data Protection Regulation (GDPR) which takes effect in May 2018. Article 80 of the GDPR states that data subjects “shall have the right to mandate a not-for-profit body, organisation or association….to lodge the complaint on his or her behalf.” Schrems has since set up an organisation that will bring privacy cases under GDPR.
In addition, EU Justice Commissioner Vera Jourova announced at a conference last September that the Commission will be proposing new legislation in March 2018 (now expected in April) to provide collective redress in consumer cases.
Click here for the judgment in Maximilian Schrems v Facebook Ireland Limited.
Click here to read Digital Rights Ireland’s submission on Ireland implementation of Article 80 of the GDPR.