Austrian student challenges Facebook's use of personal data



To carry on his war against Facebook, Max Schrems figures he needs at least 200,000 euros — about £160,000 — no small sum for a law student scraping by on a government stipend.

But like those he is targeting, Schrems, 25, is a creature of the Internet age. He envisions a fundraising campaign that could go viral: If 10,000 people give 20 euros each, Schrems figures, he will have enough to take the world's most effective user revolt against Facebook to the next level — in a court of law.

Schrems contends that Facebook collects too much information on its users, keeps it too long and uses it for purposes that violate European privacy laws. As evidence, he points to the 1,222 pages of data the social media company catalogued on him before he formally requested his file from Facebook last year.

The account it offered of his life — every friendship declared, every photo uploaded, every "poke" or comment or invitation sent or received over three years of casual use — sparked an online sensation when he posted it on a website he christened "" Within a few months, 40,000 users had requested their own data, overwhelming Facebook's system for handling requests under what until then had been a little-known provision of European law.

A year later, regulators are engaged, and the social media site has made a series of changes to its privacy controls.

Yet Schrems and his small band of supporters are still bridling for a definitive legal showdown that could lead to sharp new limits on how Facebook and other Internet companies collect and use the personal information of their users, in Europe and beyond. At the core of the fight is one of the overarching questions of our time: Who has rights to the trillions of bits of data users create online every day?

"We're right now defining what our world is going to look like in 20 years," said Schrems, who has sandy brown hair and a faint resemblance to Facebook founder Mark Zuckerberg.

The issues raised by Schrems speak to the dilemma facing the company as it seeks to meet Wall Street's demands for greater profitability in the aftermath of a troubled initial stock offering in May. Advertisers want access to more data for better targeting of their messages, but users have rebelled when they think Facebook has gone too far in sharing their information.

The company has disputed the most sweeping of the allegations by Schrems and says it collects only the data it needs to keep the social media site working smoothly. It also has added controls and changed some features, announcing last month that it was blocking a tool in Europe that sought to identify the faces of users whose photos are uploaded to the site.

Facebook officials have met with Schrems personally and had extensive contact with European officials. Richard Allan, the company's top policy executive in Europe, said the reaction provoked by Schrems shows the responsiveness of the regulatory system.

Facebook has taken steps toward addressing concerns from regulators in Ireland, where Facebook headquarters its European operations, said Gary Davis, the deputy data protection commissioner in Ireland. "They're highly engaged, there's no question," he said. "Facebook wants to be in a position that is in compliance with European law."

Schrems, however, has not been impressed with Facebook's concessions or the toughness of the Irish regulators. (Washington Post Co. chairman and chief executive Donald E. Graham is a member of Facebook's board of directors.)

Not long ago, an aggrieved law student in Vienna would have had few tools for battling regulators in another country, or a big, rich company on another continent. But there are few borders in Schrems's world.

He can file lawsuits under the umbrella of European law, using money raised online from supporters anywhere in the world. Anyone looking to follow the action need only keep an eye on the group's website or, yes, on its Facebook page — an irony not lost on the company.

"We've created the perfect tools for any campaign to use, including against us," Allan said.

U.S. technology companies often struggle to adapt to the more expansive privacy expectations in Europe. Schrems said he first noticed the cultural differences during a year as a high school exchange student in Florida, where he was amazed to see that most Americans don't have the thick hedges favored by Austrians to limit views into their homes.

But it was his second stint in the United States, as an exchange student at Santa Clara University School of Law in Silicon Valley, that focused him on technology issues. When a Facebook official made a guest appearance at a class, he botched a description of European privacy law, Schrems said. That emboldened him to challenge the company — a move he called somewhat un-Austrian.

"Most people would never do that. They'd write a paper about it," Schrems said. "I totally picked that up in the U.S."

The first step was requesting data from Facebook, something he knew the company was legally obligated to produce.

He and two friends sent their requests to the corporate offices in Dublin. Schrems then pestered the company with a series of emails — 22 in all, he said — before finally receiving a CD in the mail with a document file. Two of his friends also got files (one was 882 pages, the other 1,142).

Schrems knew Facebook kept large amounts of information on its users, but the sheer volume of his file still amazed him, he said. Pictures uploaded from smartphones included precise global positioning system coordinates, the identities of anyone tagged in the photos and the moment — down to the second — when the shutter clicked. Information that users thought they had deleted survived in Facebook files.

Based on the documents, the German newspaper Taz made a diagram of Schrems's social life, with distinct clusters around different phases — his time as an exchange student in the United States, his stint as a volunteer with an ambulance corps, his current life as a law student living in an apartment in Vienna.

"That's basic FBI stuff," Schrems said. "Thirty years ago, you [would] put up a pin and look for the connections. Now you know in a click."

As attention grew, Schrems drafted complaints alleging 22 privacy violations by Facebook: keeping messages after senders deleted them, sharing personal data with outside app developers, allowing users to be "tagged" in photos without their permission, and more. Then he sent them to the Irish data protection commissioner. The Irish regulators opened a formal investigation resulting in a 149-page audit. Schrems, meanwhile, became a minor celebrity in Europe. Using little more than his laptop computer, he emailed news releases to hundreds of journalists and also updated his group's website and Facebook page.

"It's the only way to be successful in these times," said Andreas Kezer, 26, who graduated from law school and is part of Schrems's group. "It wouldn't make sense to communicate with pigeons."

One consequence of Schrems's activism is the ease with which Facebook users can now download data the company has collected about them. It could not easily send CDs to each of the 40,000 people who requested their information as part of his campaign, so it created online tools available to users worldwide.

Allan, the Facebook policy official in Europe, said the volume of data — although startling to some users — simply shows how the service works. Without a record, for example, that a user has "un-friended" another user, there's no way to keep the service from suggesting the same person as a friend in the future.

The company doesn't relish the possibility of an ongoing fight with Schrems but says it has worked hard with Irish regulators to address concerns he and others have raised. "There are some critics who we have who will never be happy, no matter what we do," Allan said.

Schrems doesn't see himself as a malcontent. European law, he says, requires that information be collected only for particular, explicit purposes approved by users, then deleted as soon as it's no longer needed. Keeping massive catalogues of personal data for years, he says, is a clear violation.

European law, however, gives Schrems no way to sue Facebook directly. To keep the campaign going, Schrems can appeal the ruling of regulators to a circuit court in Ireland. The case — against the regulators, not Facebook — eventually could reach the European Court of Justice in Luxembourg.

"Europe v. Facebook" as an organization can't file a suit against regulators; only an aggrieved citizen such as Schrems can. That means that, should Irish regulators prevail, he could be personally liable under European court procedures for all of the legal costs of both sides.

Hence the estimate of 200,000 euros, although Schrems increasingly wonders whether it could be more along the lines of 300,000 euros. It's a big bet for an aspiring lawyer with few financial resources of his own and, so far, no job at a firm. Last month, he added a yellow "Donate" button to the Web page.

"The problem now is they are enforcing only 20 percent of the law," he said. "That's something where you can't just let it sit there without a decision."

Start your day with The Independent, sign up for daily news emails
There will be a chance to bid for a rare example of the SAS Diary, collated by a former member of the regiment in the aftermath of World War II but only published – in a limited run of just 5,000 – in 2011
charity appealTime is running out to secure your favourite lot as our auction closes at 2pm tomorrow
Arts and Entertainment
Mark Wright has won The Apprentice 2014
tvThe Apprentice 2014 final
Arts and Entertainment
X Factor winner Ben Haenow has scored his first Christmas number one
ebooksA year of political gossip, levity and intrigue from the sharpest pen in Westminster
Elton John and David Furnish exchange marriage vows
peopleSinger posts pictures of nuptials throughout the day
Arts and Entertainment
James May, Jeremy Clarkson and Richard Hammond in the Top Gear Patagonia Special
File: James Woods attends the 52nd New York Film Festival at Walter Reade Theater on September 27, 2014
peopleActor was tweeting in wake of NYPD police shooting
Claudia Winkleman and co-host Tess Daly at the Strictly Come Dancing final
peopleLiam Williams posted photo of himself dressed as Wilfried Bony
Martin Skrtel heads in the dramatic equaliser
SPORTLiverpool vs Arsenal match report: Bandaged Martin Skrtel heads home in the 97th-minute
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating

By clicking 'Search' you
are agreeing to our
Terms of Use.

iJobs Job Widget
iJobs General

Recruitment Genius: Telesales & Customer Service Executives - Outbound & Inbound

£7 - £9 per hour: Recruitment Genius: Are you outgoing? Do you want to work in...

Recruitment Genius: National Account Manager / Key Account Sales

£30000 - £35000 per annum: Recruitment Genius: An opportunity has arisen for a...

Recruitment Genius: Operations Manager

£30000 - £35000 per annum: Recruitment Genius: An exciting opportunity to join...

Recruitment Genius: Recruitment Consultant

£30000 - £35000 per annum: Recruitment Genius: We have an excellent role for a...

Day In a Page

The week Hollywood got scared and had to grow up a bit

The week Hollywood got scared and had to grow up a bit

Sony suffered a chorus of disapproval after it withdrew 'The Interview', but it's not too late for it to take a stand, says Joan Smith
From Widow Twankey to Mother Goose, how do the men who play panto dames get themselves ready for the performance of a lifetime?

Panto dames: before and after

From Widow Twankey to Mother Goose, how do the men who play panto dames get themselves ready for the performance of a lifetime?
Thirties murder mystery novel is surprise runaway Christmas hit

Thirties murder mystery novel is surprise runaway Christmas hit

Booksellers say readers are turning away from dark modern thrillers and back to the golden age of crime writing
Anne-Marie Huby: 'Charities deserve the best,' says founder of JustGiving

Anne-Marie Huby: 'Charities deserve the best'

Ten million of us have used the JustGiving website to donate to good causes. Its co-founder says that being dynamic is as important as being kind
The botanist who hunts for giant trees at Kew Gardens

The man who hunts giants

A Kew Gardens botanist has found 25 new large tree species - and he's sure there are more out there
The 12 ways of Christmas: Spare a thought for those who will be working to keep others safe during the festive season

The 12 ways of Christmas

We speak to a dozen people who will be working to keep others safe, happy and healthy over the holidays
Birdwatching men have a lot in common with their feathered friends, new study shows

The male exhibits strange behaviour

A new study shows that birdwatching men have a lot in common with their feathered friends...
Diaries of Evelyn Waugh, Virginia Woolf and Noël Coward reveal how they coped with the December blues

Famous diaries: Christmas week in history

Noël Coward parties into the night, Alan Clark bemoans the cost of servants, Evelyn Waugh ponders his drinking…
From noble to narky, the fall of the open letter

From noble to narky, the fall of the open letter

The great tradition of St Paul and Zola reached its nadir with a hungry worker's rant to Russell Brand, says DJ Taylor
A Christmas ghost story by Alison Moore: A prodigal daughter has a breakthrough

A Christmas ghost story by Alison Moore

The story was published earlier this month in 'Poor Souls' Light: Seven Curious Tales'
Marian Keyes: The author on her pre-approved Christmas, true love's parking implications and living in the moment

Marian Keyes

The author on her pre-approved Christmas, true love's parking implications and living in the moment
Bill Granger recipes: Our chef creates an Italian-inspired fish feast for Christmas Eve

Bill Granger's Christmas Eve fish feast

Bill's Italian friends introduced him to the Roman Catholic custom of a lavish fish supper on Christmas Eve. Here, he gives the tradition his own spin…
Liverpool vs Arsenal: Brendan Rodgers is fighting for his reputation

Rodgers fights for his reputation

Liverpool manager tries to stay on his feet despite waves of criticism
Amir Khan: 'The Taliban can threaten me but I must speak out... innocent kids, killed over nothing. It’s sick in the mind'

Amir Khan attacks the Taliban

'They can threaten me but I must speak out... innocent kids, killed over nothing. It’s sick in the mind'
Michael Calvin: Sepp Blatter is my man of the year in sport. Bring on 2015, quick

Michael Calvin's Last Word

Sepp Blatter is my man of the year in sport. Bring on 2015, quick