On January 25, 2018, the Court of Justice of the European Union (“CJEU”) handed down a ruling permitting consumer privacy actions to be brought in the consumer’s home jurisdiction — as opposed to the jurisdiction in which the defendant data controller has its main establishment — but not permitting consumer privacy class actions to be brought in a consumer’s home jurisdiction.

Background

Maximilian Schrems (“Schrems”) — an Austrian resident, lawyer and privacy activist (best known for his involvement in litigation relating to the EU-U.S. Safe Harborand the EU Model Clauses) — brought a class action against Facebook’s Irish-registered office, before the Austrian courts.  Schrems’ action alleges various breaches of Austrian, Irish, and EU data privacy rules, and includes claims for damages arising from these alleged breaches.

Schrems, a Facebook user of ten years, initially registered with Facebook under a false name for personal purposes only, engaging in typical private uses of the site such as to share photos and posts with his 250 or so Facebook Friends.  Then, in 2011, Schrems created a Facebook page to report on his legal proceedings against Facebook Ireland, reference his lectures and media appearances, advertise his books and solicit public donations.

The Austrian Supreme Court sought a preliminary ruling from the CJEU on two points.

• Whether Schrems is a “consumer” as defined and interpreted under EU law (namely Article 15 of Regulation No. 44/2001 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters), in relation to his Facebook account, specifically the use of his Facebook page (“the Consumer Issue”).

• Whether Schrems could bring his action alongside and on behalf other consumers in contractual relationships with Facebook, those consumers numbering more than 25,000 and residing in Austria, other Member States, and outside the EU (“the Class Action Issue”).

Decision

• The Consumer Issue. The CJEU ruled that Schrems could be considered a “consumer” for the purpose of bringing a claim against Facebook’s Irish-registered office in Austria.  Schrems’ activity on Facebook — including activities associated with his commercial or professional endeavors — did not prevent him from maintaining his consumer user status, entitling him to launch claims in his domestic courts.  The CJEU held that a user may still be considered a “consumer” for the purpose of EU consumer law if the link between the user’s contract and any professional activities is “negligible”.  The CJEU found that expertise developed by Schrems and his agreeing to represent other consumers in their claims against Facebook did not deprive him of his consumer status under EU law.

• The Class Action Issue.  The CJEU found that Schrems, as a consumer, could not be assigned the claims of other consumers for the purpose of bringing a class action against Facebook in Austria.  In other words, Schrems can only act as a consumer with respect to his own relationship with Facebook, and cannot remain a consumer, and avail himself of the protections extended to consumers under EU law (namely Article 15 of Regulation No. 44/2001) to bring claims locally, where he acts on behalf of other consumers.  This position, the CJEU ruled, cannot be circumvented by assigning claims.

Significance and Next Steps

 The CJEU expanded the scope and meaning of “consumer” under EU law.  Notwithstanding the presence of non-traditional consumer activities (e.g., activities related to a person’s profession), an individual will not be deprived of their consumer status.  This decision potentially exposes defendants in “consumer” actions to being sued in the consumer’s — rather than the defendant’s — home court with those local rules applying.

It remains to be seen how significant the CJEU’s ruling on the class action issue will be.  The ruling specifically concerns the ability for a consumer, as defined by EU law, to initiate a class action on behalf of other consumers.  However, from May 25, 2018, Article 80 of the GDPR shall empower data subjects to instruct a not-for-profit body, organization or association to bring actions on their behalf.  It also permits Member States to adopt rules allowing such bodies, organizations or associations to bring claims on behalf of data subjects without a mandate from the relevant data subjects.

The proceedings now return to the Austrian courts, where Schrems can continue with his individual — rather than multi-party — lawsuit against Facebook.