Tech companies like Facebook not above the law, says Max Schrems

Julia Powles

The EU’s safe harbour ruling is a “puzzle piece in the fight against mass surveillance, and a huge blow to tech companies who think they can act in total ignorance of the law,” says Max Schrems, the man who brought the case.

“US companies are realising that European laws are getting more and more enforced. But still, people don’t believe that a court would order Google or Facebook to do something – they wouldn’t dare. Well, yes, they fucking would,” he said, speaking in Vienna.

The European ruling earlier this week sunk a 15-year-old data-transfer pact, the “safe harbour” regime, which offered a privileged route for over 4,000 transatlantic businesses to self-certify that they satisfied “adequate” data-protection standards under European law.

Schrems’s successful argument before the European court of justice was that the existence of a generalised programme of mass and indiscriminate surveillance, as disclosed in the Snowden revelations and confirmed by the referring Irish court, undermined this entire regime. The court agreed, with a hard-hitting ruling that has set companies – particularly those involved in the Prism programme, like Google, Apple, and Facebook – scrambling to find alternative legal bases for transatlantic data flows.

On the court’s unambiguous finding that mass surveillance is a breach of fundamental rights, Schrems is pragmatic about the consequences: “No, it won’t immediately stop spying. It has to be a political solution in the end. But the idea was to poke Facebook and other companies into the corner – because something might actually be done at the economic level.

“These private surveillance actors collect all the data that the governments then suck up. We don’t have jurisdiction over the US government of course, but companies have obligations to comply with the law.”

Salzburg-born Schrems, 28, is animated and straight-talking. He has an easy familiarity, chuckling frequently throughout conversation, and engaging in conspiratorial asides, whether on the casual disdain of Viennese waiters, or on the hopelessness of Irish regulation – “the biggest bunch of lies that I’ve ever seen”.

His critique of the Irish data protection office is unrelenting. Along with Luxembourg, it formally oversees European data protection for the majority of multinationals who headquarter their operations in tax-beneficial jurisdictions. “Ireland has no interest in doing its job, and will continue not to, forever. Clearly it’s an investment issue – but overall the policy is: we don’t regulate companies here. The cost of challenging any of this in the courts is prohibitive. And the people don’t seem to care.”

This reticence clearly goads Schrems, but it has also accelerated developments in the broader privacy landscape. Europe’s highest court, in both this ruling and in the immediately preceding decision of Weltimmo, have emphasised the independence of national data protection authorities across the EU-bloc, and their legitimacy in investigating and enforcing their own laws.

Between the lines, the court’s hand has been forced, with redundancy and potential replication being the inconvenient price of ensuring that data protection is actually respected. As Schrems puts it: “a genuine one-stop shop would be a smarter solution. But the problem is if half the shops are not open. One of the biggest issues in Europe is that countries are saying officially they’re on same page, but everyone knows they are very different in practice.”

Schrems is continuing his fight in Ireland, but his hopes rest elsewhere. “This judgment is valid for 28 countries. Now it goes down to the different data protection offices to enforce.” This gets at the core of Schrems’ mission. Much more than the privacy concerns, he’s motivated by the desire to prove that tech companies are not above the law. In Austria he’s running a class-action appeal against Facebook’s internal privacy policies, which builds on his four-year experience in trying to resolve these issues with the Irish regulator. The class-action, he confesses, will probably take five years and a return to the European Court of Justice.

Then he’ll be done, but not out of the game. His PhD at the University of Vienna focuses on the broader legal matrix that could support privacy claims. And his long-term ambition is to set up an enforcement-focused NGO in Europe, to support more local cases advocating for data protection.

“It’s a huge problem that in this privacy business, you can really only make money on one side of the game,” he says. “The biggest problem I’ve had is in finding good representatives who understand the law. I meet lots of privacy lawyers for coffee, and they say they like what I’m doing and personally agree with me, but then they say: ‘you can’t tell anyone we’ve ever met, because I’m losing all my clients otherwise’.”

The suite of actions Schrems is involved with works under the banner “Europe v Facebook”, in a deliberate effort to anonymise his own role. It has occupied years of his life, but not dominated it. “At the moment, it’s 24-7, but as with most legal procedures, you wait for half a year where nothing happens and then there’s two to three stressful weeks.”

Schrems is eager to dismiss the notion that he’s some sort of modern-day Robin Hood. “It’s strange the way people reduce you to this one thing – like, I’m this crazy activist person that sues everyone. No, I’m not. I’m not doing this for fame or money. When I find stories about myself, because I don’t always know when they’re coming out, I still find it very strange. I have this move which probably explains a lot, and typically put my coffee cup over my face because I just don’t like staring at myself. And now when people ask, how do I feel about taking on Facebook and NSA surveillance, and winning? It’s the logical result of what we submitted.”

The European decision, though dramatic, was not unexpected. In fact, at the hearing in late March, Schrems’s legal team was barely called upon. “We made our opening remarks, and the court then pretty much preached our submission to the commission. I even had the feeling that the European commission was not too interested in winning the case. Their representation was really bad. When the court asked, ‘So, does safe harbour provide adequate protection?’, the commission said ‘No, not currently’. At that point we thought; OK, now we can go.

“The guys at the commission, when you looked into their faces, I didn’t get the feeling that they have a big problem with it being abolished. I think they wanted to get rid of it anyway. And now they can say, ‘The court is taking a decision, we can’t be blamed for it anymore’.”

The commission now has the unenviable task of trying to negotiate safe harbour version 2. It is also on before the European Parliament and the Article 29 Working Party from next week. “I don’t know if it was the master plan, but now that the commission has a court decision at their back, Washington’s not going to be able to say, ‘Oh you have to come down from your big privacy stuff so that we can reach a decision.’”

Schrems confesses he can’t see the US government stepping down its surveillances practices. But the pressure from large companies for reform, and the strong ruling from the court, can only be a good thing, in his view. “A lot of the lobbying brought up that poor small businesses will be the worse affected by this. I don’t think so. At worst they might shift to European cloud services instead of US ones. It’s really a bigger problem for global communication networks like Facebook, that you just can’t split in any way.

“Big companies didn’t only rely on safe harbour: they also rely on binding corporate rules and standard contractual clauses. But it’s interesting that the court decided the case on fundamental rights grounds: so it doesn’t matter remotely what ground you transfer on, if that process is still illegal under 7 and 8 of charter, it can’t be done.”/Guardian