EU Court Denies Class Action for Data Protection in Schrems vs. Facebook Ireland Ltd – A Short-Lived Respite Until GDPR?

In its judgment of January 26, the European Court interpreted EU rules on jurisdiction in a dispute referred from the Austrian Supreme Court between a ‘consumer’ – Maximilian Schrems – and Facebook Ireland Limited. The Court would not accept the consumer’s choice of forum for a class-action type proceeding and held that, when interpreting EU rules on jurisdiction (consumer forum), the consumer forum cannot assert ‘claims assigned by other consumers.’  A person bringing legal proceedings might do so on behalf of others provided they do it as a consumer, i.e., on a ‘predominately non-professional’ basis. According to the Court, a consumer is protected only in so far as he is, in his personal capacity, the applicant or defendant in proceedings. As expected, the Court confirms that the consumer must be able to challenge a social media provider in his country of domicile (Austria), rather than the provider’s (Ireland). Incidentally, this means he can also use his native language (German, not English). The Court does, however, interpret the consumer forum jurisdiction strictly, so as to prevent Mr. Schrems from using this forum where he is assignee of others’ claims. The Court appears to have been influenced by Mr. Schrems being assignee of enforcement rights of some 25,000 people worldwide, in addition to having become a well-known privacy campaigner. Although the Court has denied class action through assignment of rights by consumers, such actions are possible in the EU, e.g. under unfair contract terms legislation which enables action through consumer associations (for example, Test Achats in Belgium and UFC-Que Choisir? in France). Similarly, the General Data Protection Regulation, applicable from May 25, expressly creates a new class action available to consumers (data subjects), who will have the right to mandate a not-for-profit body organisation or association to act on their behalf: lodge a complaint, take legal action, and receive damages. The Court’s judgment in this case is therefore merely a respite. Meantime, Mr. Schrems’ highly-publicised proceedings against Facebook before the Irish Courts continue. Click here to find out more about our GDPR webinar series.