The Austrian Supreme Court (OGH) referred four questions to the European Court of Justice in the dispute between Max Schrems and Facebook. It is about nothing less than the fundamental question of whether Facebook is violating the GDPR by handling user data – and has been doing so since 2018.
Schrems has also been awarded symbolic damages in the amount of 500 euros. He gets this because the social network does not adequately fulfill his obligation to provide information. The data protection activist had requested all information about himself, as stipulated by the GDPR, but only received PDF files that Facebook considered relevant. In addition, the company announced which information and download options were available through which the searcher could find everything himself. The Supreme Court does not consider this to be sufficient. The daily newspaper The standard writesthat this would have required Schrems to search “at least 60 data categories with hundreds, if not thousands of data points” using these tools. The Supreme Court is said to have called this an “Easter egg hunt”.
The court also ruled that Facebook had to prove that the data was complete. Facebook claimed that this or the counter-evidence was the job of the searcher.
Consent or contract for data usage
The questions referred to the ECJ mainly concern consent. Before the GDPR came into force in 2018, Facebook is said to have simply said that users had consented to the processing. Afterwards, according to the Noyb (None of your Business) association, Facebook reinterpreted the consent into a contract through which people would virtually order personalized advertising. Consent is necessary as soon as it is not only about processing that is necessary for the functionality of the service. “The requirements of ‘free’, ‘specific’ or ‘informed’ consent would no longer apply once consent is viewed as a ‘contract’,” Noyb writes.
It should also be discussed whether Facebook violates the principle of data minimization, for example by merging data from like buttons and pixels on other pages, as well as whether there are categories that may not be used for advertising purposes – that is the political opinion and sexual orientation.
Noyb refers to the forwarding to the ECJ on its website as “Breaking”. Schrems himself comments: “If Facebook loses before the ECJ, they would not only have to stop misusing data and delete illegally collected data, but also pay compensation to millions of users. We are therefore very happy about the submission.”