Facebook must pay an amount of 500 euros to Max Schrems for the emotional damage the social network has caused him. In addition, the company must stop processing the Austrian privacy activist's data and give him insight into all the data the platform has collected from him. Schrems finds it worst that Facebook is circumventing European privacy laws with its general terms and conditions. To put a stop to this, he is appealing the Vienna Supreme Court ruling. Schrems writes this on the website of his privacy association Noyb.
Max Schrems has been embroiled in a legal battle with Facebook for years. The privacy activist from Austria has repeatedly petitioned to gain insight into the data Facebook has collected from him over the years. Through the social network's website, it is possible to use a tool to download a copy of the user data Facebook holds. This includes general profile information, photos and videos a person has shared, the posts he has posted and liked, and so on.
According to Schrems, however, this is just the tip of the iceberg, and Facebook is withholding information. For example, it is unclear which companies Facebook shares user data with, and which companies Facebook receives data from. The privacy advocate claims that the lack of clarity and uncertainty about which companies have access to his information have caused emotional damage. He therefore demanded a token sum of 500 euros.
The Supreme Court finds proof that Schrems suffered emotional damage as a result of Facebook's conduct. The platform must therefore pay the privacy activist damages of 500 euros. The court also ruled that Facebook must stop processing the Austrian's data and still give him full insight into which companies the social network receives and shares data with.
Schrems is pleased with the ruling. "It is clear that Facebook does not actually provide the relevant information. I am glad to see that the court also allowed damages for such cases, where companies consistently deny users the right to know what data a company keeps about them."
But that is not the end of the matter. In his complaint, Schrems wrote that Facebook does not have permission to collect data from users. Since the General Data Protection Regulation (AVG) went into effect in May 2018, this has been mandatory. Facebook believes that if users agree to the terms and conditions of use, said sign a contract that they are okay with the company collecting and sharing data with third parties.
However, general terms and conditions, according to Schrems, do not meet the requirements of a civil law contract. Therefore, in his view, Facebook is unlawfully collecting and sharing user data. Even worse, in this way Facebook circumvents the AVG, which states that explicit consent is required to collect personal data. A Noyb survey of a thousand Facebook users found that only 1.6 percent understand that they have signed a "contract" with Facebook. The European Data Protection Board (EDPB) has been emphatic that there is no such thing as a "contract for data use": it requires consent.
The Vienna court does not share Schrems' opinion. According to him, the general terms and conditions were properly and clearly explained. Thus, Facebook's contract and data collection practices are not unlawful. The American tech company uses this data to make money and maintain the platform. It is therefore necessary for Facebook to process data, as intended within the context of the AVG.
"The Austrian court is allowing Facebook to circumvent the new AVG requirements," Schrems believes. "Facebook simply copied the 'consent' into another document the night the AVG went into effect, stating that this would be a contract, not consent. This would have the effect of depriving Europeans of their new protection. Facebook is clearly abusing the law and this cannot be tolerated."
The privacy activist feels that the Supreme Court did not adequately consider the potential problems that may arise as a result of this ruling. Although Schrems was partially vindicated, he is still appealing the ruling. On the website of the privacy association he founded, Noyb, he writes the following:
"It seems that the Court has not really looked into many of the issues raised by this case. We will obviously try to take this case all the way to the highest courts. In the spring of 2021, there could be a referral to the Court of Justice on the core issues. If the industry is just allowed to add a rule to its terms and conditions, to get around the consent requirements of the GDPR, we could shred large portions of the GDPR."
