On 25 January 2018, the CJEU decided on the place of jurisdiction in a case of alleged privacy violations and the question of whether a class action is possible against social media companies (Case C-498/16).

The background of the case is a lawsuit involving Maximilian Schrems, an Austrian resident and well-known privacy activist, and Facebook Ireland, where the company has its European headquarters. Mr. Schrems, who has a private Facebook account, is alleging Facebook of violating numerous Austrian and European data protection rules. He brought several claims against Facebook Ireland Ltd. before the civil court in Vienna, Austria. In addition, Mr. Schrems was able to assign other consumer claims to his action and argues that the Austrian courts have international jurisdiction for a consumer class action against Facebook.

In contrast, Facebook held the action inadmissible, arguing that Mr. Schrems is not a “consumer,” since he also uses Facebook for professional purposes, as a result of which he is not entitled to bring actions before a court in his place of domicile (“consumer forum”). Furthermore, Facebook purported that the assigned claims are not applicable to the consumer forum.

After the first-instance court in Vienna (Landesgericht für Zivilrechtssachen Wien) basically followed the arguments of Facebook and dismissed Schrems’ action, the Supreme Court of Austria (Oberster Gerichtshof) referred the questions to the CJEU for a preliminary ruling. It seeks clarification on the conditions under which the consumer forum can be invoked based on Regulation (EC) No 44/2001 of 22 December 2000 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters.

The CJEU replied that class actions against Facebook in Austria are indeed inadmissible, but it backed Schrems in so far as he is entitled to file individual actions before courts in his place of residence (Austria), even though Facebook is located in Ireland.

The CJEU held, in particular, that Schrems’ activities − publishing books, lecturing, operating websites, fundraising, and being assigned the claims of numerous consumers for the purpose of their enforcement − do not entail the loss of a private Facebook account user’s status as a “consumer.” Therefore, he can invoke the “consumer forum” according to Art. 16 of said EC Regulation. In accordance with this provision, a consumer may bring proceedings against the other party to a contract in the courts for the place where the consumer is domiciled. The CJEU mainly argued that an interpretation of the notion of “consumer” that excluded the above-mentioned activities would have the effect of preventing an effective defence of the rights that consumers enjoy. They enjoy these rights in relation to their contractual partners who are traders or professionals, including those rights relating to the protection of their personal data. Such an interpretation would disregard the objective set out in Art. 169(1) TFEU of promoting the right of consumers to organise themselves in order to safeguard their interests.

As far as the assigned claims are concerned, the CJEU held that Regulation No 44/2001 established a special system in order to protect the consumer as the party deemed economically weaker and less experienced in legal matters than the other party to the contract. Therefore, a consumer is protected only as far as he, in his personal capacity, is the plaintiff or defendant in proceedings. Consequently, an applicant who is not himself a party to the consumer contract in question cannot enjoy the benefit of the jurisdiction relating to consumer contracts. This is also true for consumers to whom other claims have been assigned.

The decision of the CJEU is a partial victory for Schrems, who can pursue his individual claims against Facebook in his home country of Austria in which the lawsuit is much cheaper than in Ireland. Schrems is fighting against Facebook in a series of actions. Currently, complaints are pending before the Irish Data Protection Commissioner and the Irish High Court, where Schrems is arguing that Facebook has not correctly implemented the CJEU’s ruling of 6 October 2015 (Case C‑362/14). In this judgment, initiated by Schrems, the CJEU took down the EU-US Safe Harbour agreement and, in essence, prohibited the data transfer from Facebook EU to US surveillance bodies (see also eucrim 3/2015, p. 85).