For several years, Facebook has illegally transferred data from European citizens to servers in the US and stored it there. This was the opinion of the Irish privacy watchdog DPC, which in this case acts as ‘chief supervisor’ on behalf of the entire EU, in a far-reaching statement on Monday. The offense has resulted in a fine of 1.2 billion euros for Facebook’s parent company Meta – the largest privacy fine imposed on the continent to date.
With this, the Austrian lawyer and activist Max (Maximilian) Schrems, who has been competing against Facebook for years, has also achieved one of his greatest victories to date. The ruling follows a legal battle that Schrems unleashed against the American company in 2013.
The Austrian studied for a semester at Santa Clara University in Silicon Valley in 2011, where the seeds were sown for his actions against Facebook. A professor there had invited the then privacy lawyer of the social media company for a guest lecture. Schrems says he was shocked by the total lack of knowledge of European privacy legislation that this Facebook lawyer allegedly showed.
Schrems, then 23 years old, then decided to write a thesis about Facebook’s misconceptions about European privacy rules, and during his research he was amazed. Invoking a special European rule that requires large tech companies to share all information they collect about their customers with those customers (if the customer specifically requests it), he discovered that in three years’ time – he had been on Facebook since 2008 – Facebook stored more than 1,200 pages of personal information about him.
This included information about everyone he’d ever befriended on Facebook, contacts he’d ‘unfriended’, all social and work-related gatherings he’d ever been invited to, private email addresses he’d never shared with the networking site. but which apparently had been distributed through other friends anyway, as well as old messages that he had once posted on the site (including messages that he had later deleted).
Read also: Nobel Prize winner Maria Ressa: ‘I consider Facebook a threat to democracies around the world’
According to Schrems, Facebook knowingly violated one European privacy rule after another. Upon returning to his home country, he founded an activist movement called Europe v. Facebook, which he sought to denounce the American company’s alleged total disregard for the privacy of European customers. A few years later, Schrems, now a graduate and lawyer, started a first lawsuit against the social media company, because complaints to the company itself would not yield anything.
Schrems said at the time that he was particularly concerned about Facebook sharing European user data with US intelligence and security services. At the time, NSA whistleblower Edward Snowden revealed that American services collected data on a large scale about citizens, including Europeans, in their fight against terrorism and that companies such as Facebook facilitated this by handing over that data without protest.
In the many and lengthy legal proceedings that followed, he was successful several times. In 2015, the European Court of Justice ruled that the American-European privacy treaty Safe Harbor, which was supposed to ensure proper protection of European user data in the US, was unlawful. Five years later, he achieved the same with the successor to that treaty, Privacy Shield. It was all against Facebook’s sore leg, and this is partly why Scherms got the nickname ‘fly in the chardonnay of the tech industry’.
Facebook itself says it will appeal. According to Schrems, the fine should have been even “higher”.