A GDPR case against Facebook, launched by Austrian privacy activist Max Schrems, has been deemed legal under EU law after the Austrian Supreme Court’s ruling, ComputerWeekly reports.
Why is this a big deal? Because Facebook has been trying to block this case for five years, and winning a ruling against one of the richest companies in the world is huge news.
The case dates back to 2015, when Schrems famously filed a class action lawsuit on behalf of 25,000 Facebook users. He was seeking a ‘token level’ reward of €500 per plaintiff for violations of privacy — for a total of €12.5 million.
The lawsuit’s main concern is that the data Facebook has on EU citizens is subject to the US government’s questionable mass digital surveillance.
Facebook‘s key argument for why Schrems shouldn’t be allowed to file the suit was that GDPR cases against the company would need to be filed in Ireland. The social media giant’s EU headquarters are in Dublin, so Facebook is under the jurisdiction of the Irish Data Protection Commissioner. Forcing Schrems to move the suit over to Ireland would complicate the process and make it harder for him to represent the 25,000 participants in the class action.
The Austrian Supreme Court, however, has now rejected all attempts by Facebook to block the case and has made it clear GDPR cases can be filed from other EU countries.
Schrems stated in a press release that he was pleased this fundamental issue had been cleared up and that he hoped for a speedy procedure after waiting five years to get the case going.
“If we win even part of the case, Facebook would have to adapt its business model considerably. We are very confident that we will succeed on the substance too now. Of course, they wanted to prevent such a case by all means and blocked it for five years,“ said Schrems.
Zuckerberg and friends will probably keep fighting the suit as hard as they can, but Schrems recently managed to get the upper hand in another privacy-related suit in Ireland. So it’s starting to look that Facebook‘s handling of personal data will finally hit European courts in the near future.