A big blow for Facebook today after Europe’s top court delivered a verdict in a long-running legal challenge that opens the door for plaintiff and privacy campaigner, Max Schrems, to sue Facebook in his home city of Vienna.

The company had sought to argue that Schrems’ does not have consumers rights on account of his privacy campaigning activities. But in its judgement today the CJEU rejects that argument, saying Schrems’ campaigning activities do not cancel out his status as a consumer with a private Facebook account.

“After throwing dirt at me for three years and circulating that I would try to make a profit from my political activities, it’s maybe the time now for Facebook to apologize,” said Schrems in a statement on the judgement.

Facebook has previously tried to argue that Austrian courts do not have international jurisdiction over its business, which has its European HQ in Ireland. But in 2015 a local appeals court ruled Schrems can file personal claims in his local court in Vienna.

The company’s tactics have stalled the substance of the lawsuit from being heard for more than three years.

Now, with the CJEU ruling, Schrems can bring a model case against Facebook on his home turf — challenging the company over a suite of awkward privacy issues.

Such as US government surveillance program access to Facebook user data; how the company pervasively tracks its users around the rest of the web; and the complexity and opacity of its privacy policies — and whether Facebook is therefore obtaining legal consent from users to process their personal data.

Truly this will be a * get popcorn * lawsuit.

“There’s a lot of stuff that Facebook will have to deal with,” said a jubilant Schrems in a video response to the judgement posted to Twitter.

Facebook does have one reason to be cheerful, though.

Being as, back in 2014 when Schrems filed the original suit, he had tried to structure it as a privacy class action — gathering thousands of other Facebook users to join the cause and assign their claims to him. (As an attempt to workaround Austria’s lack of class action law for consumers.)

However today’s CJEU ruling closes off that possibility — with the judges concluding:

Article 16(1) of Regulation No 44/2001 must be interpreted as meaning that it does not apply to the proceedings brought by a consumer for the purpose of asserting, in the courts of the place where he is domiciled, not only his own claims, but also claims assigned by other consumers domiciled in the same Member State, in other Member States or in non-member countries.

 

In its response statement to the ruling, Facebook’s spokesperson only flagged up the court’s second opinion, writing: “Today’s decision by the European Court of Justice supports the previous decisions of two courts that Mr. Schrems’s claims cannot proceed in Austrian courts as ‘class action’ on behalf of other consumers. We were pleased to have been able to present our case to the European Court of Justice and now look forward to resolving this matter.”

Under the EU’s incoming data protection framework GDPR, which will apply from May 25, there is a provision for consumer organizations to pursue collective redress on behalf of individual consumers.

And Schrems is currently crowdfunding to get an not-for-profit off the ground for exactly that purpose — saying the aim of the organization will include bringing “privacy class actions” under a different legal regime (i.e. Article 80 of the GDPR).

So he’s clearly not going to abandon his fight for consumer class actions in the EU.

Though he also calls out the CJEU’s judgement as problematic, saying it implies a consumer only has rights against a company if they themselves entered into the original contract — so, for example, someone buying a secondhand Volkswagen wouldn’t have consumer rights against the company.

“Unfortunately the CJEU has massively limited consumer rights in this case and missed a golden opportunity to finally allow collective redress in Europe,” he said in a statement on that. “This will hit consumers in many cases where they have not signed the original contract with a company.”

“We now have the absurd situation that 71 companies that were harmed by a cartel could bring their claims jointly, only consumers cannot join forces. Equally you can sue ‘into’ a country that has a class action but not ‘out’ of such a country. As the Advocate General has already said in its option: There is now an urgent need to get a European solution for collective redress,“ he added.

Featured Image: Bryce Durbin/TechCrunch