Few readers of this blog will be unaware of the CJEU’s seminal judgment in the case of Schrems v Facebook Case C-362/14, where the Court struck down the EU Commission’s decision that the US’ safe harbour regime was adequate for data protection purposes. However, of course that was not the end of Mr Schrems’ mission to hold Facebook to account for transferring personal data obtained from within the EU into the US. Following the judgment, he went on to bring civil claims against Facebook in the Austrian courts for breaching his data protection obligations, including a claim for injunctive relief and a claim for damages (Mr Schrems is himself domiciled in Austria). More than this, he sought to act as a lightening-rod for claims brought by other individuals domiciled in foreign jurisdictions, including Germany and India. The claimants concerned assigned their claims against Facebook to Mr Schrems with a view to his leading the litigation charge against Facebook.Unsurprisingly, Facebook was not going to take the assignment process lying down. It argued before the Austrian courts that they had no jurisdiction over the assigned claims, which were brought by Mr Schrems qua “consumer”. It argued that EU law rules on territorial jurisdiction, as contained in Council Regulation (EC) 44/2001 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (“the Regulation”) could not be relied upon to afford the Austrian courts territorial jurisdiction over claims brought by individuals domiciled either in another Member State of the EU (e.g. Germany) or individuals domiciled in a country outside of the EU (e.g. India). In a judgment given on 25 January 2018, the CJEU confirmed that it agreed with Facebook’s interpretation of the Regulation. Thus, whilst Mr Schrems was entitled to pursue his own claim against Facebook qua consumer, based on his own personal contractual relationship with Facebook, he could not pursue the assigned claims as the Austrian courts had no jurisdiction to hear those claims – see the judgment here.
This is an important judgment on territorial jurisdiction and group litigation under the existing data protection regime. However, it seems that it is a judgment which would apply equally if claims were to be brought by consumers under the GDPR. The GDPR of course itself embodies provisions recognising the importance of allowing representative bodies (e.g. NGOs) to pursue claims on behalf of data subjects (see Article 80). However, those provisions do not create new more expansive rules on territorial jurisdiction. The same can be said of Article 79, which affords data subjects a right to sue the data controller either in the place where the data controller has an establishment or whether the data subject has his habitual residence. That Article identifies where the individual data subject can sue the data controller but does not speak to the issue of the assignment of claims. It appears in the circumstances that the Court’s judgment in Schrems will continue to resonate under the GDPR.
Pausing there, the judgment only deals with the position of individuals suing quae consumers. An interesting question as to the operation of the Regulation may arise where individuals are suing the data controller in some other capacity (e.g. as employees of the data controller or individuals who have no contractual relationship with the data controller at all).
The judgment is also interesting for what it says on the subject of when the user of a social networking site can properly claim to be occupying the position of ‘consumer’ vis-a-vis the site itself. In Mr Schrems’ case, ultimately he ended up using the site in order to promote his campaign against Facebook and his role as potential representative of other claimants. Facebook argued that this meant he was not using the site qua consumer but qua professional. The Court rejected this analysis and concluded that, in the context of his contractual relationship with Facebook, Mr Schrems was using the site qua consumer, as his use of the site was essentially non-professional. No doubt this is a bitter pill for Facebook to swallow. However, the judgment on this issue at least will be welcomed by online privacy campaigners.
Anya Proops QC