Many people who have data privacy at heart have no doubt heard about Austrian lawyer Maximilian Schrems, who began a string of high profile data privacy cases against Facebook Ireland Ltd (« Facebook ») back in 2011. These cases have inspired the EU to introduce regulation on data protection such as the upcoming General Data Protection Regulation (GDPR), directly applicable to all EU Member States as from 25 May 2018. These rules will permit (amongst other things) consumers to more readily access their private data held by companies, and may make it easier for class action suits to be filed against such companies – something Schrems recently attempted but failed to achieve.
In 2015, individual consumers around the EU assigned their claims to Shrems who (on their behalf) opened civil action proceedings in front of the Austrian courts against Facebook to force the company to improve its data protection policies. On 25 January 2018, the European Court of Justice (ECJ) issued a preliminary ruling in this regard which is important because it addresses the definition of a « consumer » under the Brussels I Regulation (« Brussels I »); and whether Mr Schrems was entitled to combine the assignment of claims of consumers from different EU (or non-EU) jurisdictions in Austria under Brussels I.
Schrems had originally opened his Facebook account in 2008 for personal use but around 2010, started using his account to promote his professional activities, which made Facebook argue that Schrems could no longer be considered a consumer as defined under Article 16 of Brussels I because his use of Facebook became « predominantly professional ». Furthermore, Facebook argued that they can only be sued in the Member State where they are domiciled i.e. Ireland.
In response, the ECJ decided that Schrems should not lose his consumer status due to being well-informed and representing other consumers’ claims and that he may sue Facebook in Austria due to an exemption for « consumer contracts » under Article 16 which allows consumers to sue in their home state. That said, the ECJ asserted that this special jurisdictional rule could only apply for personal claim and not on the assigned claims.
Therefore, Schrems can continue the case against Facebook in the Austrian courts as a consumer but only for personal claim, which means that Brussels I is currently insufficient for consumers to exercise a collective class-action suit in a single EU jurisdiction. Schrems may have been more successful if he waited to file the suit under the GDPR although the outcome of class action suits under the new rules is yet to be seen.
