David v Goliath: Austrian activist to take on Facebook in court

An Austrian law graduate spearheading a class action suit against Facebook for alleged privacy breaches said ahead of the first hearing Thursday he hopes the case will eventually lead to an overhaul of a "Wild West" approach to data protection.

Max Schrems and 25,000 other Facebook users are suing the social network for various rights violations, ranging from the "illegal" tracking of their data under EU law to Facebook's involvement in the PRISM surveillance programme of the US National Security Agency (NSA).

"Basically we are asking Facebook to stop mass surveillance, to (have) a proper privacy policy that people can understand, but also to stop collecting data of people that are not even Facebook users," 27-year-old Schrems told AFP in an interview.

"There is a wide number of issues in the lawsuit and we hope to kind of win all of them and to get a landmark case against US data-gathering companies."

The case has been brought against Facebook's European headquarters in Dublin, which registers all accounts outside the United States and Canada -- making up some 80 percent of Facebook's 1.35 billion users.

Schrems was able to file his action against the Irish subsidiary at a civil court in Vienna because under EU law, all member states have to enforce court rulings from any other member state.

Among other issues, judges will have to rule on Facebook's objection that the class action is inadmissible under Austrian law -- an objection dismissed by Schrems' lawyer as lacking "any substance".

So far, the social media company has not been available for comment on the matter.

- 'Token amount' -

Interest in the case has been overwhelming. Within days of launching the suit in August last year, thousands of people -- mostly based in Europe but also in Asia, Latin America and Australia -- had signed up.

In the end, Schrems limited the number of participants to 25,000 but a further 55,000 have already registered to join the proceedings at a later stage.

Each of the plaintiffs is claiming a "token amount" of 500 euros ($540) in damages.

Schrems said the case is not about getting rich, but "about the principle that fundamental rights have to be applied".

"We have privacy laws here in Europe but we are not enforcing (them)," he said.

"The core issue is: do online companies have to stick to the rules or do they live somewhere in the Wild West where they can do whatever they want to do?"

The battle began nearly four years ago, after Schrems had spent a semester at Santa Clara University in Silicon Valley.

The Austrian said he was startled by the general lackadaisical attitude towards European privacy laws.

"The general approach in Silicone Valley is that you can do anything you want in Europe" without facing any major consequences, Schrems said.

As a result, he set up the Europe-v-Facebook (EvF) advocacy group, which in particular campaigns for the overhaul of the so-called Safe Harbour agreement, a data exchange pact signed in 2000 between the United States and the European Union.

In parallel with the class action, Schrems and the EvF have also filed several complaints against Facebook in Ireland.

That case was referred to the European Court of Justice (ECJ) after Irish authorities refused to open an investigation into the alleged breaches of privacy.

The ECJ's decision, expected in 2016, could have wide-ranging implications for US tech companies operating in Europe.

But what if Schrems loses the Facebook fight?

"That would also be interesting", mused the activist, because it would beg the question "why you can't win if there are privacy laws" and they have been broken.