In late 2015, the European Court of Justice (ECJ) issued its initial Schrems decision, invalidating the EU/US Safe Harbor and leading to important developments in the rules for transferring personal data from the EU to the US. Since that decision, Mr. Schrems has pursued two further legal proceedings in the EU.
The first involves Mr. Schrems’ challenge in the Irish courts to EU Standard Contractual Clauses, which permit data to be transferred internationally between contract parties. In the trial, Alston & Bird Special Counsel Peter Swire testified as an expert on US national security law, and the case is now being referred to the ECJ.
This post relates to Mr. Schrems’s second action, an attempt to consolidate an EU-wide consumer class action against Facebook before the Austrian courts. To support a class action, Mr. Schrems has been actively soliciting claim assignments from consumers throughout the EU, with the intent to assert them in a single proceeding before the Austrian courts. As part of his solicitation efforts, Mr. Schrems maintains a “submit-your-claim”-style website, accepts donations, gives paid speeches, and has written a book.
Mr. Schrems’s class action is structured differently than US class actions due to the fact that the Austrian courts – like most systems outside the US – do not have a certification mechanism akin to Federal Rule of Civil Procedure 23. Instead, individual claimants must personally assign their claims to Mr. Schrems, who appears as the single plaintiff in the action asserting both his own claims, as well as those that have been assigned to him.
This structure resulted in complex procedural questions under the Brussels I Regulation, which regulates jurisdiction among EU member states. Mr. Schrems’s class action is directed against Facebook Ireland Ltd., an EU company. As Brussels I’s baseline rule, EU defendants must be sued in the Member State where they are “domiciled,” which for a dispute between Mr. Schrems and Facebook Ireland would mean Irish jurisdiction. However, Art. 16 Brussels I contains special jurisdiction provisions for “consumer contracts” that permit consumers to sue in their home state – which for Mr. Schrems would mean Austria.
Mr. Schrems contended that he is a consumer who concluded a contract with Facebook and was entitled to sue in Austria. He further contended that since he received full assignments of other consumers’ claims against Facebook, he was entitled to assert those in Austria as well.
A. The ECJ Decision
The ECJ faced two questions. It resolved the first in Mr. Schrems’s favor, but found against him in regards to the second – and in doing so, established precedent that will likely make for further litigation once the General Data Protection Regulation (GDPR) enters into force:
1. Under the Brussels I Regulation, is Mr. Schrems still considered a “consumer” if he has operated a website, published books, delivered paid speeches, and collected donations in connection with soliciting and asserting third-party claims?
One of Facebook’s arguments was that Mr. Schrems’s systematic solicitation of claims had shaded into ‘professional’ territory, such that Mr. Schrems should no longer be considered a “consumer” needing the protection of the special jurisdiction provisions of Art. 16 Brussels I. The ECJ disagreed. On the one hand, it held that an individual who starts using Facebook as a “consumer” could lose consumer status if his use of Facebook “subsequently become[s] predominantly professional.” But the Court ultimately reasoned that the term “consumer” was defined by contrast to the term “economic operator” – and that a “consumer” does not lose his status due to (a) “the knowledge and information” he possesses, (b) “the expertise [he] may acquire in the field covered by [] services” provided by an economic operator, nor (c) “his assurances given for purposes of” representing other consumers’ claims. The ECJ expressed concern that stripping well-informed consumers of their consumer status would hinder consumers’ attempts to organize to assert their rights. As a result, the Court held that Mr. Schrems did not lose consumer status because he had “publish[ed] books, lectur[ed], operat[ed] websites, fundrais[ed] and be[en] assigned the claims of numerous consumers for the purpose of their enforcement.” Thus, Mr. Schrems’s own claims against Facebook can proceed.
2. Under the Brussels I Regulation, is Mr. Schrems entitled to assert claims assigned to him by consumers who reside in other EU member states or in non-EU states, if all claims are asserted against the same defendant?
For many observers, this second question was the more important question: Was Mr. Schrems permitted to consolidate EU jurisdiction over numerous individual consumer claims from around the EU in Austria by virtue of a straightforward civil-law assignment of rights? The ECJ ruled he was not. The Court relied on two main arguments:
– Only One Contract per Consumer Suit. By its express wording, Art. 16 Brussels I only creates special local jurisdiction over “matters relating to a contract concluded by a … consumer” and a business. As a result, the Court stated that “an applicant who is not himself a party to the consumer contract in question cannot enjoy the benefit of the jurisdiction relating to consumer contracts.” Thus, the Court held that only Mr. Schrems’s contract with Facebook was at issue, and that individuals who assigned claims to Mr. Schrems could not piggyback on the jurisdiction Mr. Schrems’s claim created. The Court held that this rule “makes it possible to make sure the attribution of jurisdiction is predictable” – e.g. by preventing consumer claims from being transferred to a plaintiff-friendly EU jurisdiction where the defendant has no assets or operations.
– Jurisdiction does not Follow Assignment. The Brussels I Regulation sets forth the exclusive list of EU fora having jurisdiction over litigation involving EU parties. In the lead-up to the ECJ’s decision, the Court’s Advocate General argued that permitting jurisdiction over consumer claims to follow their assignment into a new EU member state would create a “new specific forum” for consumer claims not foreseen in the Brussels I framework. The ECJ agreed: Brussels I’s framework for jurisdiction remains exclusive; jurisdiction of courts “other than those expressly referred to by [Brussels I] cannot be established [by] the concentration of several claims in the person of a single [plaintiff].” As a result, “the assignment of claims cannot, in itself, have an impact on the determination of the court having jurisdiction” over a claim.
As a result of the Court’s holding, Mr. Schrems’s individual claims will be able to proceed before the Austrian courts. However, his class action may be finished in its present form
B. Looking Forward under the GDPR
The ECJ’s reasoning in regards to Mr. Schrems’s attempted class action may make it more difficult to assert EU-wide class actions under the GDPR. The GDPR provides a new and different avenue for seeking collective relief against companies that hold personal data: Article 80 GDPR permits individuals to “mandate” a nonprofit consumer-rights organization to assert their privacy claims against companies in EU courts. As a result, nonprofit organizations could find themselves overseeing “opt-in” style class actions, where the organization acts analogously to “class counsel” asserting the claims of all individuals who have mandated its services.
These nonprofit-led suits will differ from Mr. Schrems’s current class-action because there will be no assignments of claims. Instead, the nonprofit will be asserting claims “on behalf of” individuals – so the individuals themselves will appear as parties, not the nonprofit.
Still, the ECJ’s holding in Mr. Schrems’s case may have effects on these nonprofit-led collective suits. The ECJ’s holding in Mr. Schrems’s case was based on Art. 16 Brussels I Regulation, which provides special jurisdiction provisions permitting consumers to sue in their home state. Similarly, Art. 79(2) GDPR contains special jurisdiction provisions permitting data subjects to file privacy claims in their home state.
This brings up a similar question as to what the ECJ answered in its most recent Schrems decision: Can EU consumers consolidate jurisdiction over a nonprofit-brought GDPR class action in a single member state? In its Schrems holding, the ECJ found that “consumer contract” jurisdiction cannot be consolidated in a single member state via assignment of claims. Could jurisdiction over GDPR claims be consolidated in a single member state via “mandating” those claims to a single nonprofit entity? For example, could Austrian, German, French, and Belgian consumers all retain a German nonprofit to assert their GDPR claims before German courts – even though the GDPR only permits Austrians to sue in Austria, Belgians to sue in Belgium, etc.?
In such a situation where an EU-wide consolidated GPDR class action is attempted in a single EU jurisdiction, the ECJ’s holding that “the assignment of claims cannot, in itself, have an impact on the determination of the court having jurisdiction” may reappear. If assigning a claim to an Austrian resident cannot create Austrian jurisdiction, an individual mandating his GDPR claim to an Austrian nonprofit may also be insufficient to permit the Austrian nonprofit to assert it in Austria. If so, it may be that if an EU-wide class action is to be brought, the nonprofit representing plaintiffs from multiple EU states would either have to (a) bring separate class actions within each member state, or (b) fall back to baseline Brussels I jurisdictional grounds, and consolidate jurisdiction over the class action in the defendant’s home state. As with a number of issues under the GDPR, this question may have to be separately answered by the ECJ.
[View source.]
