Austrian student challenges Facebook's use of personal data



To carry on his war against Facebook, Max Schrems figures he needs at least 200,000 euros — about £160,000 — no small sum for a law student scraping by on a government stipend.

But like those he is targeting, Schrems, 25, is a creature of the Internet age. He envisions a fundraising campaign that could go viral: If 10,000 people give 20 euros each, Schrems figures, he will have enough to take the world's most effective user revolt against Facebook to the next level — in a court of law.

Schrems contends that Facebook collects too much information on its users, keeps it too long and uses it for purposes that violate European privacy laws. As evidence, he points to the 1,222 pages of data the social media company catalogued on him before he formally requested his file from Facebook last year.

The account it offered of his life — every friendship declared, every photo uploaded, every "poke" or comment or invitation sent or received over three years of casual use — sparked an online sensation when he posted it on a website he christened "" Within a few months, 40,000 users had requested their own data, overwhelming Facebook's system for handling requests under what until then had been a little-known provision of European law.

A year later, regulators are engaged, and the social media site has made a series of changes to its privacy controls.

Yet Schrems and his small band of supporters are still bridling for a definitive legal showdown that could lead to sharp new limits on how Facebook and other Internet companies collect and use the personal information of their users, in Europe and beyond. At the core of the fight is one of the overarching questions of our time: Who has rights to the trillions of bits of data users create online every day?

"We're right now defining what our world is going to look like in 20 years," said Schrems, who has sandy brown hair and a faint resemblance to Facebook founder Mark Zuckerberg.

The issues raised by Schrems speak to the dilemma facing the company as it seeks to meet Wall Street's demands for greater profitability in the aftermath of a troubled initial stock offering in May. Advertisers want access to more data for better targeting of their messages, but users have rebelled when they think Facebook has gone too far in sharing their information.

The company has disputed the most sweeping of the allegations by Schrems and says it collects only the data it needs to keep the social media site working smoothly. It also has added controls and changed some features, announcing last month that it was blocking a tool in Europe that sought to identify the faces of users whose photos are uploaded to the site.

Facebook officials have met with Schrems personally and had extensive contact with European officials. Richard Allan, the company's top policy executive in Europe, said the reaction provoked by Schrems shows the responsiveness of the regulatory system.

Facebook has taken steps toward addressing concerns from regulators in Ireland, where Facebook headquarters its European operations, said Gary Davis, the deputy data protection commissioner in Ireland. "They're highly engaged, there's no question," he said. "Facebook wants to be in a position that is in compliance with European law."

Schrems, however, has not been impressed with Facebook's concessions or the toughness of the Irish regulators. (Washington Post Co. chairman and chief executive Donald E. Graham is a member of Facebook's board of directors.)

Not long ago, an aggrieved law student in Vienna would have had few tools for battling regulators in another country, or a big, rich company on another continent. But there are few borders in Schrems's world.

He can file lawsuits under the umbrella of European law, using money raised online from supporters anywhere in the world. Anyone looking to follow the action need only keep an eye on the group's website or, yes, on its Facebook page — an irony not lost on the company.

"We've created the perfect tools for any campaign to use, including against us," Allan said.

U.S. technology companies often struggle to adapt to the more expansive privacy expectations in Europe. Schrems said he first noticed the cultural differences during a year as a high school exchange student in Florida, where he was amazed to see that most Americans don't have the thick hedges favored by Austrians to limit views into their homes.

But it was his second stint in the United States, as an exchange student at Santa Clara University School of Law in Silicon Valley, that focused him on technology issues. When a Facebook official made a guest appearance at a class, he botched a description of European privacy law, Schrems said. That emboldened him to challenge the company — a move he called somewhat un-Austrian.

"Most people would never do that. They'd write a paper about it," Schrems said. "I totally picked that up in the U.S."

The first step was requesting data from Facebook, something he knew the company was legally obligated to produce.

He and two friends sent their requests to the corporate offices in Dublin. Schrems then pestered the company with a series of emails — 22 in all, he said — before finally receiving a CD in the mail with a document file. Two of his friends also got files (one was 882 pages, the other 1,142).

Schrems knew Facebook kept large amounts of information on its users, but the sheer volume of his file still amazed him, he said. Pictures uploaded from smartphones included precise global positioning system coordinates, the identities of anyone tagged in the photos and the moment — down to the second — when the shutter clicked. Information that users thought they had deleted survived in Facebook files.

Based on the documents, the German newspaper Taz made a diagram of Schrems's social life, with distinct clusters around different phases — his time as an exchange student in the United States, his stint as a volunteer with an ambulance corps, his current life as a law student living in an apartment in Vienna.

"That's basic FBI stuff," Schrems said. "Thirty years ago, you [would] put up a pin and look for the connections. Now you know in a click."

As attention grew, Schrems drafted complaints alleging 22 privacy violations by Facebook: keeping messages after senders deleted them, sharing personal data with outside app developers, allowing users to be "tagged" in photos without their permission, and more. Then he sent them to the Irish data protection commissioner. The Irish regulators opened a formal investigation resulting in a 149-page audit. Schrems, meanwhile, became a minor celebrity in Europe. Using little more than his laptop computer, he emailed news releases to hundreds of journalists and also updated his group's website and Facebook page.

"It's the only way to be successful in these times," said Andreas Kezer, 26, who graduated from law school and is part of Schrems's group. "It wouldn't make sense to communicate with pigeons."

One consequence of Schrems's activism is the ease with which Facebook users can now download data the company has collected about them. It could not easily send CDs to each of the 40,000 people who requested their information as part of his campaign, so it created online tools available to users worldwide.

Allan, the Facebook policy official in Europe, said the volume of data — although startling to some users — simply shows how the service works. Without a record, for example, that a user has "un-friended" another user, there's no way to keep the service from suggesting the same person as a friend in the future.

The company doesn't relish the possibility of an ongoing fight with Schrems but says it has worked hard with Irish regulators to address concerns he and others have raised. "There are some critics who we have who will never be happy, no matter what we do," Allan said.

Schrems doesn't see himself as a malcontent. European law, he says, requires that information be collected only for particular, explicit purposes approved by users, then deleted as soon as it's no longer needed. Keeping massive catalogues of personal data for years, he says, is a clear violation.

European law, however, gives Schrems no way to sue Facebook directly. To keep the campaign going, Schrems can appeal the ruling of regulators to a circuit court in Ireland. The case — against the regulators, not Facebook — eventually could reach the European Court of Justice in Luxembourg.

"Europe v. Facebook" as an organization can't file a suit against regulators; only an aggrieved citizen such as Schrems can. That means that, should Irish regulators prevail, he could be personally liable under European court procedures for all of the legal costs of both sides.

Hence the estimate of 200,000 euros, although Schrems increasingly wonders whether it could be more along the lines of 300,000 euros. It's a big bet for an aspiring lawyer with few financial resources of his own and, so far, no job at a firm. Last month, he added a yellow "Donate" button to the Web page.

"The problem now is they are enforcing only 20 percent of the law," he said. "That's something where you can't just let it sit there without a decision."

Start your day with The Independent, sign up for daily news emails
ebooksA special investigation by Andy McSmith
  • Get to the point
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating

By clicking 'Search' you
are agreeing to our
Terms of Use.

iJobs Job Widget
iJobs General

Recruitment Genius: Web Developer - PHP

£25000 - £35000 per annum: Recruitment Genius: You will be joining an ISO 9001...

Recruitment Genius: Experienced Bookkeeper - German Speaking - Part Time

£23000 - £25000 per annum: Recruitment Genius: This firm of accountants based ...

Recruitment Genius: Operations Manager

£30000 - £38000 per annum: Recruitment Genius: They are a financial services c...

Ashdown Group: Field Service Engineer

£30000 - £32000 per annum + car allowance and on call: Ashdown Group: A succes...

Day In a Page

Robert Fisk in Abu Dhabi: The acceptable face of the Emirates

The acceptable face of the Emirates

Has Abu Dhabi found a way to blend petrodollars with principles, asks Robert Fisk
Nepal earthquake: One man's desperate escape from Everest base camp after the disaster

Escape from Everest base camp

Nick Talbot was sitting in his tent when the tsunami of snow and rock hit. He was lucky to live, unlike his climbing partner just feet away...
Adopting high fibre diet could dramatically cut risk of bowel cancer, says study

What happened when 20 Americans swapped diets with 20 Africans?

Innovative study in the US produces remarkable results
Blake Lively and 'The Age of Adaline': Gossip Girl comes
of age

Gossip girl comes of age

Blake Lively is best known for playing an affluent teenager. Her role as a woman who is trapped forever at 29 is a greater challenge
Goat cuisine: Kid meat is coming to Ocado

Goat cuisine

It's loved by chefs, ethical, low in fat and delicious. So, will kid meat give lamb a run for its money?
14 best coat hooks

Hang on: 14 best coat hooks

Set the tone for the rest of your house with a stylish and functional coat rack in the hallway
Not even the 'putrid throat' could stop the Ross Poldark swoon-fest'

Not even the 'putrid throat' could stop the Ross Poldark swoon-fest'

How a costume drama became a Sunday night staple
Miliband promises no stamp duty for first-time buyers as he pushes Tories on housing

Miliband promises no stamp duty for first-time buyers

Labour leader pushes Tories on housing
Aviation history is littered with grand failures - from the the Bristol Brabazon to Concorde - but what went wrong with the SuperJumbo?

Aviation history is littered with grand failures

But what went wrong with the SuperJumbo?
Fear of Putin, Islamists and immigration is giving rise to a new generation of Soviet-style 'iron curtains' right across Europe

Fortress Europe?

Fear of Putin, Islamists and immigration is giving rise to a new generation of 'iron curtains'
Never mind what you're wearing, it's what you're reclining on

Never mind what you're wearing

It's what you're reclining on that matters
General Election 2015: Chuka Umunna on the benefits of immigration, humility – and his leader Ed Miliband

Chuka Umunna: A virus of racism runs through Ukip

The shadow business secretary on the benefits of immigration, humility – and his leader Ed Miliband
Yemen crisis: This exotic war will soon become Europe's problem

Yemen's exotic war will soon affect Europe

Terrorism and boatloads of desperate migrants will be the outcome of the Saudi air campaign, says Patrick Cockburn
Marginal Streets project aims to document voters in the run-up to the General Election

Marginal Streets project documents voters

Independent photographers Joseph Fox and Orlando Gili are uploading two portraits of constituents to their website for each day of the campaign
Game of Thrones: Visit the real-life kingdom of Westeros to see where violent history ends and telly tourism begins

The real-life kingdom of Westeros

Is there something a little uncomfortable about Game of Thrones shooting in Northern Ireland?