All started with joke Facebook could ‘do what it wants in Europe’

As eight television cameras jostled to get a shot of Max Schrems in Vienna, Facebook must have rued the day it signed him up in 2008.

In a veneer-panelled Viennese courtroom, the 27-year-old explained, in rapid-fire delivery, the day his interest in Facebook was piqued.

He was studying in the US in early 2011 and heard a Facebook employee joke during a speech that his company could "do what it wants in Europe because there is no implementation of data protection".

On his return to Austria, the law student decided to see about that.

A request for all data Facebook in Dublin held on him yielded 1,200 pages of data, including information he thought he had deleted. Further requests yielded even more data.

Armed with this, Schrems filed a complaint with the Irish Data Protection Commissioner (DPC) in Portarlington — regulator for companies based in Ireland — claiming that Facebook was collecting more information than it was entitled to under EU law.

And so began a tortuous and fractious three-way struggle between Schrems, Facebook and the DPC. In 2013, the Austrian added a further complaint based on the claims by Edward Snowden that companies like Facebook's Dublin operation share EU user data with US intelligence.

That complaint went to the Irish High Court and on to the European Court of Justice, where a ruling is pending.

Today, dozens of legal cases are now in play around Europe challenging how big data companies, many based in Ireland, collect, store and monetise private user information.

At the centre of the campaign: Max Schrems.

His Vienna case demands that Facebook divulge what user data it collects and why. That was also at the heart of his complaint in Ireland which he withdrew after three years last July, saying it was going nowhere.

The DPC disagrees: after two audits of Facebook operations it says it was ready to issue a preliminary judgment before Schrems pulled the plug in July 2014.

His decision to take on Facebook on his home turf attracted huge media attention, but some observers suggest that it may yet backfire.

Facebook says its Dublin operation has no case to answer in Austria. By suing in Vienna, its counsel has levelled at Facebook critics a charge they prefer to lob the other way: jurisdiction shopping. If the Vienna court agrees with Facebook that it is answerable to the Irish courts, the Schrems case hits a wall.

In its efforts to stop the case before it starts, Facebook counsel argued that Mr Schrems is pursuing the US company for career purposes and commercial gain.

Mr Schrems dismisses the idea, though says his one-man campaign could yet challenge one of the world’s biggest companies. It could challenge, too, whether the EU is ready to defend the privacy of its citizens, something it has defined as a fundamental right.

“The view in the US is that they can walk all over fundamental rights in the EU and that no one here will do anything about it,” said Mr Schrems. “This case isn’t just about US companies, but about why we in Europe don’t enforce the privacy laws we have.”