Europeans Rush to Join Facebook Privacy Lawsuit

Facebook, Inc., beloved social media necessity/harbinger of doom, has faced its fair share of lawsuits and class actions over the years. In the last year alone, we’ve blogged about the company facing legal action for allowing minors to use credit cards, violating users’ privacy, and illegally sharing information with Hulu. Now, over in Europe – Austria, to be precise – a class action-style lawsuit has reached its maximum number of participants in less than a week after 25,000 Facebook users signed up over privacy concerns.

The lawsuit was filed in Vienna commercial court by Europe-v-Facebook, an Austrian group led by privacy campaigner Max Schrems. The suit claims that Facebook’s data use policy violates EU law, lacks effective consent for several key uses of users’ information, supports the U.S.’s NSA “PRISM” surveillance program in violation of European law, and violates EU law in several other key ways. Although the suit has been filed in Austria, Facebook Ireland – the company responsible for processing data outside the United States and Canada – is named as the defendant. The limit of 25,000 plaintiffs has been imposed by Europe-v-Facebook, which is wary of the administrative burden associated with a case that could affect millions. Schrems has already indicated that the number of Facebook users involved could well grow in the near future if the courts start to lean in their favor or if it becomes easier than expected to handle the potentially enormous size of the class.

Jurisdiction – Facebook’s European Problem

Schrems’ lawsuit has already transferred courts once, after the Vienna commercial court ruled that the matter didn’t fall under its jurisdiction. Instead, the regional court will be asked to rule on the merits of the case. While Facebook is expected to argue that the case needs to be heard in the United States, where the company is headquartered, Schrems seems confident that he can use his Austrian citizenship to argue that Vienna is the best place. On top of that, of the 25,000 members already signed up, the vast majority are European. The ten most represented countries, in fact, are all European (though more than 100 different countries now appear on the complaint). Leading the pack of current plaintiffs, if divided by country, is Germany with more than 5,200 plaintiffs, followed by Austria (more than 3,700), Netherlands (more than 2,400), Finland, Croatia, United Kingdom, Belgium, France, Serbia and Poland.

When it comes to privacy, EU law tends to be more consumer-friendly than its U.S. counterpart, and it’s no surprise that Schrems, et al. want to keep the case in a European court.

Proposed Damages – What’s the Price of Privacy?

The lawsuit’s accusations cover both specific violations – external website tracking, for example – and more general questions about online privacy. Speaking to the BBC, Schrems explained:

That said, the suit is asking for €500 ($669) per user for the first 25,000 plaintiffs. On the Europe Versus Facebook website, the group’s objectives are laid out more fully:

• Transparency (“Transparency is not only a question of fairness but it is also a principle of European data protection law. It is time that the biggest social network worldwide sticks to these legal principles.”)
• Opt-in instead of Opt-out (“Facebook often claims that all users have consented to the use of their personal data. But in reality Facebook users know that Facebook is more of an “opt-out”-system: If you do not change all the preset privacy settings most personal data will be visible without restrictions.”)
• Decide yourself (“There are people that do not want to share too much information online. But Facebook found a way to get their personal data too: Facebook is encouraging other users to deliver their data ... By allowing this, Facebook is ignoring another principle of European data protection law: Only the individual user can consent to the use of his or her data.”)
• Data minimization (“Facebook offers no sufficient way of deleting old junk data. Every inconsiderate comment, every invitation to an event (e.g., a demonstration) and every “like” is recorded for an indefinite amount of time ... This practice is contrary to the principle of data minimization. It is about time to think about the final disposal personal data that was shared on Facebook.”)
• Open Social Networks (“Today Facebook is a monopoly. Because Facebook drained the users from all other networks there is no realistic choice to choose another provider. The failed Google+ experiment shows that not even Google was able to provide for an alternative in the market. This is typical for a “closed system” ... We think that an open standard for social networks would be the key to change this situation. Like with your e-mail you should be able to choose your provider and still be able to communicate with your friends that made another choice.”)

A Class Action That Isn’t

Although Austrian law doesn’t actually recognize U.S.-style “class action” lawsuits, it does allow groups of people – even when numbering in the thousands – to elect an individual to represent their financial claims. So, for this lawsuit, Schrems will bear the weight of all registered plaintiffs’ claims, enabling him to wield far more power than if he were acting alone. Add to this the intense media interest on both sides of the Atlantic and one thing’s certain: Facebook won’t be able to ignore this suit, and questions about the company’s handling of private data won’t go away in a hurry.