An advisor to the Court of Justice of the European Union argues in a new opinion that lawyer and privacy activist Max Schrems cannot bring a class-action lawsuit against Facebook on behalf of 25,000 EU citizens for alleged privacy violations, but he can sue the social network as a single citizen in his home country of Austria.

Advocate General Michal Bobek released an opinion Tuesday regarding Schrems v. Facebook Ireland (a separate item from the so-called Schrems 2.0, which deals with model clauses) with two separate implications for legal actions in Europe.

On the one hand, the opinion states Schrems can sue Facebook as an EU citizen in an Austrian court. Facebook had argued that Schrems should have to bring his case to Ireland because he does not qualify as a consumer, but as a business. Bobek's opinion here is in line with an earlier decision from the Higher Regional Court in Vienna that found Schrems is not a commercial entity. Had Facebook won this part of the case, Schrems argues, he would have had to spend millions of euros to win the $500 euros he was claiming in the case.

On the other hand, however, Bobek dealt a blow to Schrems's attempt at getting an "Austrian-style class action" on behalf of several thousand EU citizens. The lawsuit claims Facebook violates European privacy law on several fronts, including by sharing user data with U.S. intelligence agencies, and asked for monetary compensation for all class members, which could cost Facebook more than 12 million euros.

Bobek refuted the grounds for the class action, arguing it could only be admissible against an Austrian business, and since Facebook's European operations are in Ireland, Schrems' Austrian-based case would not apply. Bobek argues that making such a class action admissible would lead to "forum shopping" in the EU and create legal uncertainty. The AG's opinion here differs from the legal views of the European Commission, Austria, Germany, and Portugal, each of whom had backed the views of Schrems in the case.

Schrems said, "The opinion by the advocate general on the admissability of a class action is unfortunately hard to understand. It seems that he did not want to engage in [a] policy decision, but quite honestly, this case got to the CJEU because the matter is a policy issue."

He also questioned Bobek's "legal uncertainty" argument, noting that Facebook conducted its own "forum shopping" by choosing the country in which it wanted to operate:

"A change of jurisdiction is happening thousands of times every day in Europe. ... It is hard to understand why a company should have trust in the jurisdiction of a certain court if a 'class action' is formed, but not in a daily business. Facebook itself has moved its operations from California to Ireland and thereby changed its jurisdiction, without anyone claiming that this would not be possible because users trusted in the jurisdiction of a California court when signing up for Facebook."

Schrems took to Twitter to provide a quick video reaction to the opinion:

First little video summary on the AG at the #CJEU on the Facebook "class action".. pic.twitter.com/7a8e5ssrTP

— Max Schrems (@maxschrems) November 14, 2017

In reaction to the opinion, a Facebook spokesperson told The Privacy Advisor: “Today’s opinion supports the decisions of two courts that Mr. Schrems’s claims cannot proceed as 'class action' on behalf of other consumers in Austrian courts.” 

A point by Bobek, the Advocate General, that's worth considering is his assertion that collective redress for EU citizens is appropriate, but that it should be addressed by new legislation and not the courts.

In comments provided to The Privacy Advisor, Eduardo Ustaran, CIPP/E, said the case is making an important distinction between legislation and the courts. "From an initial reading, the opinion draws a line between the power of the legislator and the power of the court, which is a reminder of the limits of the principle of separation of powers," he said. "Essentially, in Europe class actions need to be expressly contemplated under the law."

Calls for collective redress were echoed by others Tuesday. The opinion prompted Monique Goyens, the DG of the BEUC, to reiterate her organization's call for an EU framework for collective citizen redress.

If you are interested in why @beuc consistently calls for a EU wide system of collective redress, this is a must read ! it is all about making consumer rights an enforceable reality, not just a piece of paper, in a EU without borders. https://t.co/XSlzbakRM6

— monique goyens (@moniquegoyens) November 14, 2017

Though the Advocate General's opinion is not binding for the CJEU, the judges take opinions into consideration as they go about their deliberations.

Even if the CJEU goes against the AG's opinion, the environment for class actions in the EU could likely change this coming May when the General Data Protection Regulation goes into effect. In it, Article 80 states that data subjects will be granted to the right to "mandate a not-for-profit body" to "lodge the complaint on his or her behalf" to maintain citizens' data protection.

The final ruling of the CJEU's five-judge panel is expected early next year. The case will also continue to proceed in the Austrian Supreme Court.

photo credit: Gwenaël Piaser European Court of Justice via photopin (license)