Austrian student challenges Facebook's use of personal data



To carry on his war against Facebook, Max Schrems figures he needs at least 200,000 euros — about £160,000 — no small sum for a law student scraping by on a government stipend.

But like those he is targeting, Schrems, 25, is a creature of the Internet age. He envisions a fundraising campaign that could go viral: If 10,000 people give 20 euros each, Schrems figures, he will have enough to take the world's most effective user revolt against Facebook to the next level — in a court of law.

Schrems contends that Facebook collects too much information on its users, keeps it too long and uses it for purposes that violate European privacy laws. As evidence, he points to the 1,222 pages of data the social media company catalogued on him before he formally requested his file from Facebook last year.

The account it offered of his life — every friendship declared, every photo uploaded, every "poke" or comment or invitation sent or received over three years of casual use — sparked an online sensation when he posted it on a website he christened "" Within a few months, 40,000 users had requested their own data, overwhelming Facebook's system for handling requests under what until then had been a little-known provision of European law.

A year later, regulators are engaged, and the social media site has made a series of changes to its privacy controls.

Yet Schrems and his small band of supporters are still bridling for a definitive legal showdown that could lead to sharp new limits on how Facebook and other Internet companies collect and use the personal information of their users, in Europe and beyond. At the core of the fight is one of the overarching questions of our time: Who has rights to the trillions of bits of data users create online every day?

"We're right now defining what our world is going to look like in 20 years," said Schrems, who has sandy brown hair and a faint resemblance to Facebook founder Mark Zuckerberg.

The issues raised by Schrems speak to the dilemma facing the company as it seeks to meet Wall Street's demands for greater profitability in the aftermath of a troubled initial stock offering in May. Advertisers want access to more data for better targeting of their messages, but users have rebelled when they think Facebook has gone too far in sharing their information.

The company has disputed the most sweeping of the allegations by Schrems and says it collects only the data it needs to keep the social media site working smoothly. It also has added controls and changed some features, announcing last month that it was blocking a tool in Europe that sought to identify the faces of users whose photos are uploaded to the site.

Facebook officials have met with Schrems personally and had extensive contact with European officials. Richard Allan, the company's top policy executive in Europe, said the reaction provoked by Schrems shows the responsiveness of the regulatory system.

Facebook has taken steps toward addressing concerns from regulators in Ireland, where Facebook headquarters its European operations, said Gary Davis, the deputy data protection commissioner in Ireland. "They're highly engaged, there's no question," he said. "Facebook wants to be in a position that is in compliance with European law."

Schrems, however, has not been impressed with Facebook's concessions or the toughness of the Irish regulators. (Washington Post Co. chairman and chief executive Donald E. Graham is a member of Facebook's board of directors.)

Not long ago, an aggrieved law student in Vienna would have had few tools for battling regulators in another country, or a big, rich company on another continent. But there are few borders in Schrems's world.

He can file lawsuits under the umbrella of European law, using money raised online from supporters anywhere in the world. Anyone looking to follow the action need only keep an eye on the group's website or, yes, on its Facebook page — an irony not lost on the company.

"We've created the perfect tools for any campaign to use, including against us," Allan said.

U.S. technology companies often struggle to adapt to the more expansive privacy expectations in Europe. Schrems said he first noticed the cultural differences during a year as a high school exchange student in Florida, where he was amazed to see that most Americans don't have the thick hedges favored by Austrians to limit views into their homes.

But it was his second stint in the United States, as an exchange student at Santa Clara University School of Law in Silicon Valley, that focused him on technology issues. When a Facebook official made a guest appearance at a class, he botched a description of European privacy law, Schrems said. That emboldened him to challenge the company — a move he called somewhat un-Austrian.

"Most people would never do that. They'd write a paper about it," Schrems said. "I totally picked that up in the U.S."

The first step was requesting data from Facebook, something he knew the company was legally obligated to produce.

He and two friends sent their requests to the corporate offices in Dublin. Schrems then pestered the company with a series of emails — 22 in all, he said — before finally receiving a CD in the mail with a document file. Two of his friends also got files (one was 882 pages, the other 1,142).

Schrems knew Facebook kept large amounts of information on its users, but the sheer volume of his file still amazed him, he said. Pictures uploaded from smartphones included precise global positioning system coordinates, the identities of anyone tagged in the photos and the moment — down to the second — when the shutter clicked. Information that users thought they had deleted survived in Facebook files.

Based on the documents, the German newspaper Taz made a diagram of Schrems's social life, with distinct clusters around different phases — his time as an exchange student in the United States, his stint as a volunteer with an ambulance corps, his current life as a law student living in an apartment in Vienna.

"That's basic FBI stuff," Schrems said. "Thirty years ago, you [would] put up a pin and look for the connections. Now you know in a click."

As attention grew, Schrems drafted complaints alleging 22 privacy violations by Facebook: keeping messages after senders deleted them, sharing personal data with outside app developers, allowing users to be "tagged" in photos without their permission, and more. Then he sent them to the Irish data protection commissioner. The Irish regulators opened a formal investigation resulting in a 149-page audit. Schrems, meanwhile, became a minor celebrity in Europe. Using little more than his laptop computer, he emailed news releases to hundreds of journalists and also updated his group's website and Facebook page.

"It's the only way to be successful in these times," said Andreas Kezer, 26, who graduated from law school and is part of Schrems's group. "It wouldn't make sense to communicate with pigeons."

One consequence of Schrems's activism is the ease with which Facebook users can now download data the company has collected about them. It could not easily send CDs to each of the 40,000 people who requested their information as part of his campaign, so it created online tools available to users worldwide.

Allan, the Facebook policy official in Europe, said the volume of data — although startling to some users — simply shows how the service works. Without a record, for example, that a user has "un-friended" another user, there's no way to keep the service from suggesting the same person as a friend in the future.

The company doesn't relish the possibility of an ongoing fight with Schrems but says it has worked hard with Irish regulators to address concerns he and others have raised. "There are some critics who we have who will never be happy, no matter what we do," Allan said.

Schrems doesn't see himself as a malcontent. European law, he says, requires that information be collected only for particular, explicit purposes approved by users, then deleted as soon as it's no longer needed. Keeping massive catalogues of personal data for years, he says, is a clear violation.

European law, however, gives Schrems no way to sue Facebook directly. To keep the campaign going, Schrems can appeal the ruling of regulators to a circuit court in Ireland. The case — against the regulators, not Facebook — eventually could reach the European Court of Justice in Luxembourg.

"Europe v. Facebook" as an organization can't file a suit against regulators; only an aggrieved citizen such as Schrems can. That means that, should Irish regulators prevail, he could be personally liable under European court procedures for all of the legal costs of both sides.

Hence the estimate of 200,000 euros, although Schrems increasingly wonders whether it could be more along the lines of 300,000 euros. It's a big bet for an aspiring lawyer with few financial resources of his own and, so far, no job at a firm. Last month, he added a yellow "Donate" button to the Web page.

"The problem now is they are enforcing only 20 percent of the law," he said. "That's something where you can't just let it sit there without a decision."

Start your day with The Independent, sign up for daily news emails
ebooksAn introduction to the ground rules of British democracy
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating

By clicking 'Search' you
are agreeing to our
Terms of Use.

iJobs Job Widget
iJobs General

Recruitment Genius: Sales Executive or Senior Sales Executive - B2B Exhibitions

£18000 - £30000 per annum: Recruitment Genius: A Sales Executive or Senior Sal...

Recruitment Genius: Head of Support Services

£40000 - £55000 per annum: Recruitment Genius: This is an exciting opportunity...

Recruitment Genius: Warehouse Team Leader

£22000 per annum: Recruitment Genius: This industry leading company produces h...

Recruitment Genius: Business Development Manager / Sales - OTE £40,000

£20000 - £40000 per annum: Recruitment Genius: This IT provider for the educat...

Day In a Page

A nap a day could save your life - and here's why

A nap a day could save your life

A midday nap is 'associated with reduced blood pressure'
If men are so obsessed by sex, why do they clam up when confronted with the grisly realities?

If men are so obsessed by sex...

...why do they clam up when confronted with the grisly realities?
The comedy titans of Avalon on their attempt to save BBC3

Jon Thoday and Richard Allen-Turner

The comedy titans of Avalon on their attempt to save BBC3
The bathing machine is back... but with a difference

Rolling in the deep

The bathing machine is back but with a difference
Part-privatised tests, new age limits, driverless cars: Tories plot motoring revolution

Conservatives plot a motoring revolution

Draft report reveals biggest reform to regulations since driving test introduced in 1935
The Silk Roads that trace civilisation: Long before the West rose to power, Asian pathways were connecting peoples and places

The Silk Roads that trace civilisation

Long before the West rose to power, Asian pathways were connecting peoples and places
House of Lords: Outcry as donors, fixers and MPs caught up in expenses scandal are ennobled

The honours that shame Britain

Outcry as donors, fixers and MPs caught up in expenses scandal are ennobled
When it comes to street harassment, we need to talk about race

'When it comes to street harassment, we need to talk about race'

Why are black men living the stereotypes and why are we letting them get away with it?
International Tap Festival: Forget Fred Astaire and Ginger Rogers - this dancing is improvised, spontaneous and rhythmic

International Tap Festival comes to the UK

Forget Fred Astaire and Ginger Rogers - this dancing is improvised, spontaneous and rhythmic
War with Isis: Is Turkey's buffer zone in Syria a matter of self-defence – or just anti-Kurd?

Turkey's buffer zone in Syria: self-defence – or just anti-Kurd?

Ankara accused of exacerbating racial division by allowing Turkmen minority to cross the border
Doris Lessing: Acclaimed novelist was kept under MI5 observation for 18 years, newly released papers show

'A subversive brothel keeper and Communist'

Acclaimed novelist Doris Lessing was kept under MI5 observation for 18 years, newly released papers show
Big Blue Live: BBC's Springwatch offshoot swaps back gardens for California's Monterey Bay

BBC heads to the Californian coast

The Big Blue Live crew is preparing for the first of three episodes on Sunday night, filming from boats, planes and an aquarium studio
Austin Bidwell: The Victorian fraudster who shook the Bank of England with the most daring forgery the world had known

Victorian fraudster who shook the Bank of England

Conman Austin Bidwell. was a heartless cad who carried out the most daring forgery the world had known
Car hacking scandal: Security designed to stop thieves hot-wiring almost every modern motor has been cracked

Car hacking scandal

Security designed to stop thieves hot-wiring almost every modern motor has been cracked
10 best placemats

Take your seat: 10 best placemats

Protect your table and dine in style with a bold new accessory