白小姐论坛

XClose

Institute of Brand and Innovation Law

Menu

白小姐论坛 IBIL hosts 鈥楥lash of Jurisdictions' lecture before a record international audience

18 January 2022

In this 白小姐论坛 IBIL public lecture, 'Clash of Jurisdictions: the EU-US Data Transfer Saga', Max Schrems spoke to an audience of over 600 from 44 different countries about his actions before the CJEU, which has successfully held Facebook to account for its privacy violations.

Max Schrems

On 18 January 2022, the聽Institute of Brand and Innovation Law聽(IBIL) at 白小姐论坛 Laws hosted Max Schrems who gave an online public lecture chaired by Amanda Harcourt, Visting Professor at 白小姐论坛 Laws.聽The level of interest in the topic of data protection and privacy in the online environment was聽evident from the large and wide-ranging international audience, with over 600 people聽attending from 44聽different jurisdictions.

Europe is known as the originator of the world鈥檚 toughest data-protection laws, and few have done more than聽Max Schrems聽to give those laws real teeth. At this event, Max, an Austrian activist, writer and lawyer, spoke about his successful actions that held Facebook to account for its privacy violations, including the unlawful transfer of personal data,which聽have made him synonymous with privacy and the modern challenges of data transfer.聽His tenacity has led to the destruction of two EU/US data transfer agreements.聽

While studying in the USA, Max Schrems chose聽privacy law as the subject of a research paper and聽requested聽copies of all the data Facebook held on him. So shocked was he to be presented with 1200 pages of data, he complained to the Irish Data Protection Commissioner (where Facebook has its European Headquarters) in 2011.聽Facebook was audited under European law and had to delete some files and disable its facial recognition software.

In 2013, following the Snowden revelations about Facebook鈥檚 alleged involvement with the USA鈥檚 PRISM mass surveillance programme, Schrems filed a further complaint with the Irish Data Protection Commissioner against Facebook. This was聽based upon EU data protection law聽which prohibits data transfers to non-EU countries聽unless聽a company can guarantee "adequate protection" - the case was adjourned pending a referral to the Court of Justice of the EU (CJEU). 滨苍听聽('Schrems I') of 2015, the CJEU held聽the EU-US Safe Harbour agreement invalid, stating that聽individual data protection authorities could suspend data transfers to third countries if they violated EU rights.聽In December 2015, Schrems resubmitted his original complaint to the Irish Data Protection Commissioner (with equivalent complaints to the data authorities in Germany and Belgium).

In consequence, Facebook switched its transfer mechanism from Safe Harbour to standard contractual clauses.聽In October 2017, this led to a fresh referral to the CJEU implicating both standard contractual clauses and the EU-US聽Privacy Shield Framework.聽Schrems argued that these agreements also incorporated exceptions for cases of illegal mass surveillance.聽Shortly after its coming into effect in May 2018, Schrems filed suit under the newly promulgated General Data Protection Regulations (GDPR) in Ireland against Google and Facebook for coercing their users into accepting their data collection policies. Three complaints totalled over 鈧�3.9 billion were filed. In January 2019, Schrems filed further GDPR complaints against Amazon, Apple Music, DAZN, Filmmit, Netflix, SoundCloud, Spotify, and YouTube.

滨苍听聽('Schrems II'), the CJEU invalidated the Privacy Shield in July 2020, ruling that it 鈥渄oes not provide adequate protection鈥� and placed additional requirements for companies using standard contractual clauses to third countries outside the EU.聽In September 2020, the Irish DPC sent Facebook an order that they cease the transfer of data from EU citizens to the USA, indicating that a聽fine of 4% of turnover would apply for failure to comply.聽Facebook resisted this move, using both the court of public opinion and arguments based upon national security, the latter being taken up more recently by trans-Atlantic security services.聽Facebook appealed in May 2021, finding fault with the Irish regulatory process - but to聽avail.

In parallel to all this activity, in 2014 Max Schrems invited other Facebook users to join him in the Viennese courts for what has been labelled as the largest class action privacy suit likely to ever be brought in Europe. Initially, the case was dismissed on jurisdictional grounds,聽but this was overturned on appeal, and the matter is now with the Austrian Supreme Court.聽In addition, Max founded聽聽(standing for None of Your Business) in 2017. NOYB is a non-profit foundation which aims to provide citizens with targeted and strategic litigation in order to strengthen their right to privacy.

    Find out more