Max Schrems

Maximilian Schrems is an Austrian activist and author who became known for campaigns against Facebook for its privacy violations, including violations of European privacy laws and the alleged transfer of personal data to the US National Security Agency (NSA) as part of the NSA's PRISM program. Schrems is the founder of NOYB – European Center for Digital Rights.

Max Schrems
Max Schrems in 2016
Born
Maximillian Schrems

October, 1987
Salzburg, Austria
EducationLaw, University of Vienna
OccupationLawyer, author, privacy activist
OrganizationNOYB – European Center for Digital Rights
Known forPrivacy activism

Complaints with the Irish Data Protection Commissioner 2011

While studying law during a semester abroad at Santa Clara University in Silicon Valley, Schrems decided to write his term paper on Facebook's lack of awareness of European privacy law, after being surprised by what the company's privacy lawyer, Ed Palmieri, said to his class on the subject.[1] He later made a request under the European Right of access to personal data provision for the company's records on him and received a CD containing over 1,200 pages of data, which he published at europe-v-facebook.org with personal information redacted. He filed a first round of complaints against the company with the Irish Data Protection Commissioner (DPC) in 2011. In February 2012 Richard Allan and another company executive flew to Vienna to debate these complaints with him that lasted six hours.[1] Facebook was audited under European law and had to delete some files and disable its facial recognition software.[2] In 2014 Schrems took back the complaints, claiming that he never received a fair procedure before the Irish Data Protection Commissioner. He has never received a formal decision by the DPC and was denied access to all submissions by Facebook and the files of the case. On europe-v-facebook.org, he commented about taking back his complaints:

This decision was based on the fact that the Irish DPC has refused a formal decision for years and has not even granted the most basic procedural rights (access to files, evidence or the counterarguments). The DPC has factually stopped all forms of communication and ignored all submissions made. Many observers assumed that this may be based on political and economic considerations in Ireland."[3]

Schrems I
Max Schrems, 19 February 2012

In 2013 Schrems filed a complaint against Facebook Ireland Ltd with the Irish Data Protection Commissioner, Ireland being the country where Facebook has its European Headquarters.[4] The complaint was aimed at prohibiting Facebook to further transfer data from Ireland to the United States, given the alleged involvement of Facebook USA in the PRISM mass surveillance program. Schrems based his complaint on EU data protection law, which does not allow data transfers to non-EU countries unless a company can guarantee "adequate protection". The DPC rejected the complaint, saying that it was "frivolous and vexatious" and that there was no case to answer.[5] Schrems filed an application for judicial review in the Irish High Court over the inaction by the Irish DPC, which was granted.[4] On 18 June 2014, Mr. Justice Hogan adjourned the case pending a reference to the Court of Justice of the European Union (CJEU). He said that Irish law relating to privacy had effectively been pre-empted by European law and that the core issue was whether the relevant directives should be re-evaluated in the light of the subsequent entry into force of Article 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union.[6][7][8]

The European Commission found in the executive decision 2000/520/EC that the so-called EU–US Safe Harbor Principles would provide "adequate protection" under Article 25 of Directive 95/56/EC, when it comes to the transfer of personal information from the EU to the US. This executive decision by the European Commission was called into question by the 2013 Edward Snowden revelations. In essence Schrems therefore argued that the Safe Harbor system would violate his fundamental right to privacy, data protection and the right to a fair trial under the Charter of Fundamental Rights of the European Union.[9][10][11]

The oral hearing before the CJEU was held on 24 March 2015.[12][13] The court's Advocate General for the case is Yves Bot.[lower-alpha 1] During the hearing, Bot asked the European Commission lawyer Bernhard Schima what advice he could give him if he was worried about his data being at the disposal of US authorities. Schima replied that he might consider closing down his Facebook account, if he had one.[14] He said the European Commission was unable to guarantee that "adequate" safeguards for the protection of data are met, a remark that Schrems said was the most striking thing he heard at the hearing.[15][16]

Bot delivered his opinion on 23 September 2015. He declared the Safe Harbour agreement invalid and said that individual data protection authorities could suspend data transfers to third countries if they violated EU rights.[17][18][19][20]

On 6 October 2015, the Court of Justice of the European Union ruled that, (1) national supervisory authorities still have the power to examine EU–US data transfers in spite of an existing Commission decision (such as its Safe Harbour Decision in 2000 which determined that US companies complying with the principles were allowed to transfer data from the EU to the US), and (2) the Safe Harbour framework is invalid.[21] The Court found that the framework is invalid for several reasons: the scheme allows for government interference of the protections, it does not provide legal remedies for individuals who seek to access data related to them or have it erased or amended, and it prevents national supervisory authorities from exercising their powers. Under EU law, data-sharing with countries deemed to have lower privacy standards, including the US, are prohibited. Such activities will only be possible through more expensive and time-consuming methods.[22]

On 2 December 2015, Schrems resubmitted his original complaint against Facebook with the Irish Data Protection Commissioner. He also sent similar complaints to the Hamburg and Belgian Data Protection Authorities, which both claim jurisdiction over Facebook. The complaints are designed to enforce the CJEU judgement on Facebook, which presently does not rely on Safe Harbour for its data transfers. Instead Facebook relies on pre-approved contractual agreements called "model clauses". Schrems argues that these agreements also incorporate exceptions for cases of illegal mass surveillance, and thus that the CJEU ruling applies to these agreements as well.[23][24] The Irish Data Protection Commissioner took the view that Schrems had raised "well-founded" objections,[25] but that it needs further guidance from the CJEU to determine the complaint.

After the proceedings in February/March 2017,[26] Ms Justice Costello of the Irish High Court delivered the executive summary on Oct 3, 2017, referring the case to the CJEU.[27]

"Neither the introduction of the Privacy Shield Ombudsperson mechanism nor the provisions of Article 4 of the SCC decisions eliminate the well-founded concerns raised by the DPC in relation to the adequacy of the protection afforded to EU data subjects whose personal data is wrongfully interfered with by the intelligence services of the United States once their personal data has been transferred for processing to the United States."

— Ms Justice Costello

2014 Austrian class action

On 1 August 2014 Schrems filed a lawsuit against Facebook at the local Viennese courts. He enabled other Facebook users to join his case, generating a "class action" style suit, dubbed by the press as a David and Goliath suit, estimated as likely to be the largest class action privacy suit ever brought in Europe. Any Facebook user was able to assign his claim to Schrems via the fbclaim.com webpage. Within six days the participation in the suit was limited to 25,000 Facebook users, due to too many registrations, although other users could still register an interest.[28] Schrems sued the Irish subsidiary of Facebook in the Vienna courts for a "token amount" of €500 in damages per participant.[29] The case was financed by the German litigation funder ROLAND ProzessFinanz.[30] According to the terms of fbclaim.com all awarded money would be forwarded to the individual participants. Schrems does not receive any financial benefit from the class action, but acts on a pro bono basis.[31]

The first hearing took place on 9 April 2015.[32] On 1 July 2015, the Vienna District Court dismissed the class-action, saying it had no jurisdiction. The Court's decision hinged on whether Schrems was merely a consumer of Facebook, since it was on that basis that Schrems was able to pursue a case in an Austrian civil court in his place of residence. Facebook accused Schrems in having a commercial interest in his numerous legal actions against Facebook. Judge Margot Slunsky-Jost said that Schrems could benefit of the enormous media interest in his future career. The Court ruled on procedural grounds that Schrems would consequently not qualify as a consumer and could not file at his home court in Vienna.

In October 2015, the Higher Regional Court of Vienna reversed the regional court ruling, finding that Schrems is a consumer and that he does not act in any commercial interest. The Higher Regional Court ruled that Schrems can bring his own claims against Facebook Ireland in Vienna, which constituted 20 of the 22 claims in the lawsuit, but is unable to form a class action for procedural reasons. This would limit Schrems to bringing only a "model case".[33] The Oberlandesgericht allowed an appeal to the Austrian Supreme Court in the key matter of forming a class action under EU and Austrian law.[34] Schrems filed the appeal on 2 November 2015. The case is currently pending before the Austrian Supreme Court.

Complaints filed under GDPR in 2018-19

Shortly after its coming into effect on 25 May 2018, Schrems filed suit under the newly promulgated General Data Protection Regulation (GDPR) in Ireland against Google and Facebook for coercing their users into accepting their data collection policies. Three complaints totalling over €3.9 billion were filed.[35]

On 18 January 2019, Schrems filed further GDPR complaints against Amazon, Apple Music, DAZN, Filmmit, Netflix, SoundCloud, Spotify, and YouTube.[36][37] His non-profit, noyb.eu, alleged they failed to respond, did not include sufficient background information, or provided insufficient or unintelligible raw data.[38] noyb predicted a maximum total fine of €18.8 billion for the 8 companies.

Schrems II

At the conclusion of Schrems I, the Irish High Court officially referred the case (now called Data Protection Commissioner v Facebook Ireland and Maximillian Schrems) to the CJEU, along with eleven questions to address related to the validity of the SCC[39] (standard contractual clauses).[40] Judgement was presented July 16th, 2020.[41]

"The CJEU ruled that the Privacy Shield does not provide adequate protection, and invalidated the agreement. The court also ruled that European data protection authorities must stop transfers of personal data made under the standard contractual clauses by companies, like Facebook, subject to overbroad surveillance. This decision has significant implications for U.S. Companies and for the U.S. Congress because it calls into question the adequacy of privacy protection in the United States."

— epic.org Press Release[42]

“This is another landmark ruling for privacy rights by the Court of Justice, and a clear signal that the United States needs to reform its surveillance laws or risk losing its position as a global technology leader. Congress should act quickly to bring U.S. law in line with international human rights standards.”

— Alan Butler, EPIC Interim Executive Director and General Counsel, in response to the judgement[43]

In September 2020, Ireland's Data Protection Commission sent Facebook a preliminary order to stop transferring data from EU citizens to the US. A fine of 4% of annual revenue will be applied if the conditions are not met.[44] Facebook's blog published a response letter by Nick Clegg, VP of Global Affairs and Communications, on September 9th, 2020.[45] Clegg acknowledged that the laws regarding data transfer are changing, yet still more legal clarity is needed for everyone involved, and advocated a revision to the Privacy Shield. Additionally, the response noted the seeming contradiction between the Privacy Shield, which applies to EU-US data transfers and the court invalidated, and the SCC, which apply to EU-3rd party countries and the court held still valid.

"A lack of safe, secure and legal international data transfers would damage the economy and hamper the growth of data-driven businesses in the EU, just as we seek a recovery from COVID-19. The impact would be felt by businesses large and small, across multiple sectors. In the worst case scenario, this could mean that a small tech start up in Germany would no longer be able to use a US-based cloud provider. A Spanish product development company could no longer be able to run an operation across multiple time zones. A French retailer may find they can no longer maintain a call centre in Morocco."

[...]

"The EU has led the way in establishing a framework for data protection that protects and empowers users. Privacy rules will continue to evolve, and global rules can ensure the consistent treatment of data wherever it is stored. Facebook therefore welcomes the efforts already underway between EU and US lawmakers to evaluate the potential for an “enhanced” EU-US framework – a Privacy Shield Plus. These efforts will need to recognise that EU Member States and the US are both democracies that share common values and the rule of law, are deeply culturally, socially and commercially interconnected, and have very similar data surveillance powers and practices"

— Nick Clegg

Apple Tracking Case 2020

In mid November 2020, noyb.eu announced that complaints were filed to both the German and Spanish Data Protection Authorities,[46] [47][48] claiming "IDFA (Apple’s Identifier for Advertisers) allows Apple and all apps on the phone to track a user and combine information about online and mobile behaviour".[49] In a slight change from their previous legal strategy in other similar cases, noyb notes that, because the complaint is based on Article5(3) of the e-Privacy Directive and not GDPR, the Spanish and German authorities can directly fine Apple, without appealing to EU Data Protection Authorities under GDPR.

"EU law protects our devices from external tracking. Tracking is only allowed if users explicitly consent to it. This very simple rule applies regardless of the tracking technology used. While Apple introduced functions in their browser to block cookies, it places similar codes in its phones, without any consent by the user. This is a clear breach of EU privacy laws."

— Stefano Rossetti, privacy lawyer at noyb.eu

“The claims made against Apple in this complaint are factually inaccurate and we look forward to making that clear to privacy regulators should they examine the complaint. Apple does not access or use the IDFA on a user’s device for any purpose. Our aim is always to protect the privacy of our users and our latest software release, iOS 14, is giving users even greater control over whether or not they want to allow apps to track them by linking their information with data from third parties for the purpose of advertising, or sharing their information with data brokers. Our practices comply with European law and support and advance the aims of the GDPR and the e-Privacy Directive, which is to give people full control over their data.”

— Apple, in response via Financial Times[50]

Books

Max Schrems has authored the following books in German:

  • Kämpf um deine Daten (Fight for your Data), 2014
  • Private Videoüberwachung (Private Video Surveillance Law), 2011

Awards and honors

Notes
Notes
  1. In new matters of law, the Court appoints an Advocate General to advise it. The Advocate General's opinion is non-binding on the Court and is not always followed by the Court. Thus in Costeja for example, the "right to be forgotten" case, the Court differed on both the material scope of the directive under consideration and the Advocate General's opinion that freedom of expression and information took precedence over any right to erasure, arguing that in the latter case a balancing of rights was required and that a right to erasure derived from the data-subject's rights enshrined in Articles 7 (respect for private and family life) and 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union.
References
  1. Hill, Kashmir (7 February 2012). "Max Schrems: The Austrian Thorn In Facebook's Side". Forbes.
  2. Llana, Sara Miller; de Pommereau, Isabelle (18 January 2015). "Europe pivots between safety and privacy online". The Christian Science Monitor.
  3. "europe-v-facebook.org". www.europe-v-facebook.org. Retrieved 13 August 2016.
  4. Sanghani, Radhika (24 October 2013). "Facebook 'PRISM' decision to be reviewed by Irish High Court". The Daily Telegraph. London. Archived from the original on 22 March 2015.
  5. "Data Protection Commissioner says no action will be taken against Apple and Facebook". rte.ie. RTÉ News and Current Affairs. 26 July 2013. Archived from the original on 22 March 2015.
  6. Mac Cormaic, Ruadhán (19 June 2014). "High Court refers Facebook privacy case to Europe". The Irish Times. Archived from the original on 22 March 2015.
  7. "Schrems -v- Data Protection Commissioner ([2014] IEHC 310)". bailii.org. High Court of Ireland.
  8. "Reference for a preliminary ruling from High Court of Ireland (Ireland) made on 25 July 2014 – Maximillian Schrems v Data Protection Commissioner (Case C-362/14)". curia.europa.eu. Court of Justice of the European Union.
  9. "Case C-362/14, Schrems – does a 'safe harbour' shelter states that deprive EU citizens of their EU Charter rights?". EU Law Radar. Archived from the original on 14 March 2015.
  10. "Angry Austrian could turn Europe against the US – thanks to data". theregister.co.uk. The Register.
  11. "European Hearing on the Future of Safe Harbor". jdsupra.com. JD Supra.
  12. "Revelations on Safe Harbour violations go to hearing at EU court". Delano. 12 March 2015. Archived from the original on 23 March 2015.
  13. Sam Schechner and Valentina Pop (24 March 2015). "Personal Data Gets Day in Court". The Wall Street Journal.
  14. Bodoni, Stephanie (24 March 2015). "Want Privacy? Then Dump Facebook Account, EU Court Told". Bloomberg News. Archived from the original on 25 March 2015.
  15. Nielsen, Nikolaj. "EU-US data pact skewered in court hearing". euobserver.com. EUobserver. Archived from the original on 25 March 2015.
  16. Weinstein, Mark. "Europe's Remarkable New War on Facebook". Huffington Post. Archived from the original on 1 April 2015.
  17. "Press release No 106/15" (PDF). Court of Justice of the European Union.
  18. "EU-US data sharing deal not valid, ECJ rules in Irish Facebook/Max Schrems case". Irish Independent.
  19. Titcomb, James (23 September 2015). "EU's data sharing deal with US is invalid, European Court's Advocate-General says". The Daily Telegraph.
  20. Fioretti, Julia. "EU court adviser: data-share deal with U.S. is invalid". Reuters.
  21. "The Court of Justice declares that the Commission's US Safe Harbour Decision is invalid" (PDF). Politico. 6 October 2016. Retrieved 6 October 2015.
  22. "EU–US data transfers are invalid, rules ECJ". RTÉ. 6 October 2015.
  23. Price, Rob (4 December 2015). "After a landmark court ruling, an activist is trying to force Facebook to put an end to a key data transfer". Business Insider.
  24. "Data Protection Authorities in Ireland, Belgium and Germany requested to review and suspend Facebook's data transfers over US spy programs" (PDF). europe-v-facebook.org.
  25. "Data protection groups seek to join key High Court case". The Irish Times. Retrieved 13 August 2016.
  26. "Data Protection Commissioner v. Facebook & Max Schrems (Irish High Court)". EPIC.org. Retrieved 28 July 2020.
  27. "High Court refers Facebook data case to Europe". thejournal.ie. Retrieved 28 July 2020.
  28. https://thenextweb.com/facebook/2015/04/09/facebook-is-facing-25000-users-in-vienna-court-over-eu-privacy-violations/
  29. https://thenextweb.com/eu/2017/11/14/25000-eu-citizens-unlikely-get-compensation-facebooks-alleged-privacy-violations/
  30. "Lawyer suing Facebook overwhelmed with support". The Guardian.
  31. "Join the Facebook Class Action!". www.fbclaim.com. Retrieved 13 August 2016.
  32. Lunden, Ingrid. "Facebook's European Privacy Class Action Hearing Set For April 9". Techcrunch.
  33. Dr Judith Hradil-Miheljak (9 October 2015). "Judgement 11 R 146/15v" (PDF). Higher Regional Court of Vienna – via www.europe-v-facebook.org.
  34. "Austrian Court of Appeals: 20 of 22 points in Facebook Privacy Lawsuit upheld" (PDF). www.europe-v-facebook.org.
  35. Scally, Derek (25 May 2018). "Complaints filed against Facebook and Google under GDPR in 2018". The Irish Times. Retrieved 30 August 2018.
  36. "Netflix, Spotify & YouTube: Eight Strategic Complaints filed on "Right to Access" | noyb.eu". Retrieved 18 January 2019.
  37. Hill, Rebecca (18 January 2019). "Say GDP-aaaRrrgh, streamers: Max Schrems is coming for you, Netflix and Amazon". The Register. Retrieved 18 January 2019.
  38. "Austrian data privacy activist files complaint against Apple,..." Reuters. 18 January 2019. Retrieved 18 January 2019.
  39. "Data Protection Commissioner v. Facebook & Max Schrems (CJEU)". EPIC.org.
  40. "Standard Contractual Clauses". European Commission Website.
  41. "JUDGMENT OF THE COURT (Grand Chamber) in Case C-311/18" (PDF). noyb.eu.
  42. "BREAKING: Top Court in Europe Invalidates EU-U.S. Privacy Shield, Citing Lack of Privacy Safeguards and Overbroad U.S. Surveillance Laws" (PDF). Epic.org. 16 July 2020. Retrieved 29 July 2020.
  43. "BREAKING: Top Court in Europe Invalidates EU-U.S. Privacy Shield, Citing Lack of Privacy Safeguards and Overbroad U.S. Surveillance Laws" (PDF). Epic.org. 16 July 2020. Retrieved 29 July 2020.
  44. "Ireland to reportedly order Facebook to stop sending EU user data to the U.S." CNBC.com. 10 September 2020. Retrieved 13 September 2020.
  45. "Securing the Long Term Stability of Cross-Border Data Flows". fb.com.
  46. "SPANISH COMPLAINT UNDER ARTICLE 22(2) LEY 34/2002" (PDF). noyb.eu.
  47. "GERMAN COMPLAINT" (PDF). noyb.eu.
  48. "Apple tracks iPhone users without consent, claims activist Max Schrems". ft.com. 16 November 2020. Retrieved 16 November 2020.
  49. "noyb files complaints against Apple's tracking code "IDFA"". noyb.eu.
  50. "Apple tracks iPhone users without consent, claims activist Max Schrems". ft.com. 16 November 2020. Retrieved 16 November 2020.
  51. "Big Brother Awards: Die Gewinner stehen fest" (in German). Retrieved 19 October 2013.
  52. "EPIC.org" (in German). Retrieved 5 August 2013.
  53. "Privacy Activist Max Schrems Receives Internet and Society Award from the Oxford Internet Institute". OII Internet Awards. Archived from the original on 4 March 2016. Retrieved 13 August 2016.
  54. Pressemitteilung Jubiläumspreisverleihung Archived 15 August 2015 at the Wayback Machine, abgerufen am 17. Mai 2015
  55. EFF Announces 2016 Pioneer Award Winners
  56. "Maximilian Schrems". Forbes. Retrieved 18 January 2017.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.