Register Log in

Law & Disorder / Civilization & Discontents

How one law student is making Facebook get serious about privacy

Max Schrems requested his personal data from Facebook, got a 1,000-page PDF.

Aurich Lawson

The world’s largest legal battle against Facebook began with a class assignment. Student Max Schrems still hasn’t turned in his university paper on the topic, due well over a year ago, but he has already accomplished something bigger: forcing Facebook to alter its approach to user privacy. Now, Schrems wants cash—hundreds of thousands of euros—to launch the next phase of his campaign, a multi-year legal battle that might significantly redefine how Facebook controls the personal data on over one billion people worldwide.

"If we get €300,000 ($384,000), we can shoot from all cannons," the 25-year-old told Ars from his parents’ home in Salzburg, Austria.

What began as an academic assignment in spring 2011 quickly morphed into an advocacy organization called "Europe vs. Facebook." Over the last year, Schrems has encouraged tens of thousands of Facebook users worldwide to request copies of whatever data Facebook holds on each of them, as he has done. Under European Union law, Facebook is required to comply with these requests within 40 days, since its international (e.g., non-American) headquarters are in Ireland (largely for tax reasons). This means that all Facebook users outside the United States and Canada (which have their own, less-stringent privacy rules) are effectively governed by Irish and EU data protection authorities.

"I’m certain that we have really turned the screws heavy on them."

As a way to compel Facebook Ireland to comply with existing EU law, Schrems filed 22 formal complaints with the Irish Office of the Data Protection Commissioner (ODPC) on August 18, 2011. Those complaints included charges that Facebook Ireland violated EU law by keeping records of "pokes" even after a user has deleted them, collecting data on non-Facebook users as a way to create "shadow profiles," performing automatic tagging, gathering personal data via "Friend Find," retaining records of deleted posts, retaining copies of deleted chat messages, retaining copies of deleted friends, and many others.

Schrems argues that Irish data protection authorities aren’t properly enforcing the law when it comes to Facebook, and he hopes that a judicial review will vindicate his position. If necessary, he plans to take his case all the way to the European Court of Justice in Luxembourg.

Enlarge / Max Schrems, 25, is leading a group called Europe vs. Facebook to force the social network to comply with EU data protection law.

In the meantime, Irish authorities have begun asking for changes, and Facebook has altered some of its policies. Just this month, Ars reported that Facebook changed the way it presents privacy information to new users, largely at the suggestion of the ODPC. Back in September, Facebook said it would disable facial recognition for European users, also under pressure from Irish authorities.

And those authorities say that they are now sticking it to Facebook on questions of privacy. "There have been points where we’ve had serious disagreements," Gary Davis, the ODPC’s deputy data protection commissioner, told Ars. "We’ve threatened serious enforcement action. But my sense is that Facebook is a company that gets it. What they get is that non-compliance with EU law is not good for their business."

"When we’ve come to that point where we’ve leaned across the table and said you need to do this, they’ve gone away and have done it," he added. "I’m certain that we have really turned the screws heavy on them."

As for Facebook, the company says that it takes discussions with critics seriously and that it is in "direct contact" with Schrems and Europe vs. Facebook. "Over the past year we have been working on an ongoing, continuous basis with our regulator in Europe, the Irish ODPC," said Tina Kulow, a Facebook spokesperson, in an e-mail to Ars. "The latest ODPC’s report demonstrates again how Facebook adheres to European data protection principles and is going beyond with commitment for best practices in data protection compliance."

Working separately, an Austrian law student and an under-staffed Irish data protection watchdog have helped bring worldwide improvements to Facebook's privacy policies. Here's how they did it.

Facebook maintains that it complies with all EU laws.

Right of access

This battle began nearly 18 months ago in California. Schrems, a spiky-haired, feisty Austrian from the University of Vienna, was spending the semester as a visiting law student at Santa Clara University (SCU) in the heart of Silicon Valley. As part of a privacy seminar taught by Dorothy Glancy, one of America’s top privacy scholars, Schrems learned that one of the major principles of European privacy law was called the "right of access."

It’s a simple idea: anyone interacting with an EU company or government agency can, for any reason, request all the data that entity has about oneself, and the company or government agency must comply. (American law has no equivalent principle, largely leaving privacy and data protection issues to be sorted out in contract law between individuals and corporations.) The idea is summed up in Section V, Article 12 of the 1995 EU directive "On the protection of individuals with regard to the processing of personal data and on the free movement of such data":

Member States shall guarantee every data subject the right to obtain from the controller:

(a) without constraint at reasonable intervals and without excessive delay or expense:

- confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed,

- communication to him in an intelligible form of the data undergoing processing and of any available information as to their source,

- knowledge of the logic involved in any automatic processing of data

While in Glancy’s 25-person privacy seminar, Schrems had the opportunity to learn about privacy and data protection while also meeting with experts from various tech companies, including Facebook. When a company official came to speak with the class (neither Glancy nor Schrems will say who it was), it quickly became clear to Schrems that the man didn’t have a full grasp of this basic European privacy principle.

"He said that [Facebook sticks] to EU privacy law," Schrems said. "And I asked him about consent, and he said ‘We interpret consent in a way that as long as they don’t say no [then it’s OK].’ I had the feeling that he had never been to Europe and didn’t understand the cultural difference."

At an interview in San Francisco, Glancy gushed with praise for Schrems. "He is 10 times smarter than anybody that has done these kinds of practical projects," she told Ars. "He’s just very, very smart, in the cunning sense of smart. He also didn’t start asking questions until he knew he was right."

After the Facebook experience, Schrems decided to examine Facebook’s compliance with European Union data protection law as part of an academic paper. "I didn’t turn it in, but don’t tell anybody!" he joked.

As part of his project, Schrems decided not to rely on unsubstantiated rumor or speculation as to precisely what information Facebook holds on individuals. Instead, he would get a copy of all the data that Facebook had on him.

Expand full story

89 Reader Comments

Post a reply
  1. headfoot wrote:
    It's really, really simple. If you dont want Facebook storing your data, and storing data about your actions on the site, then don't join Facebook. How hard is that?

    Uh huh.

    Thanks for demonstrating your lack of understanding.

    I didn't join Facebook. Facebook has still collected plenty of data on me.
    13578 posts | registered
  2. Brass2TheMax wrote:
    Or you could, you know, not give Facebook your data in the first place if you're not okay with them having it.

    You mean like, not give my phone number to anyone who might have a smartphone where Facebook can hoover up the data?

    You are oversimplifying to the point of being blatantly wrong.
    13578 posts | registered
  3. So many more important causes in the world to use your perseverance at...
    A person opts to create a Facebook account and then complains about privacy, this blows my mind! Just don't create an account to start with, nobody is obligating you to do so!
    Nope, instead I'm gonna fight for my right to upload all my data, connections and pictures of my dog in someone's servers, for free, and demand that it's all safe and private and that I can print a 1000-pages document whenever I need.
    1 post | registered
  4. The real question is: Why would anyone with half a brain want to have anything to do with a business that routinely engages in illegal and/or unethical practices in relation to its customers?! If your next-door neighbor stole something from your home every time you invited him in, would you keep inviting him?! Facebook is a den of thieves intent on using every dirty trick in the book to maximize their profits at their users' expense. As far as I'm concerned, anyone who trusts Facebook should have their head examined.
    748 posts | registered
  5. EDIT: Nevermind. I was talking to an obivous troll.
    300 posts | registered
  6. Google and yahoo are the same. My sister created an account on google once and agreed to have the data transferred from yahoo. The thing is my sister deleted her friends addresses from her yahoo account before that but google showed it anyway. The addresses were there even if the info was already deleted. Where does all this info go? Who's using it? Who said they could because my sister never agreed to that.
    84 posts | registered
  7. In every FB discussion on the internet someone will come up and say: "If you don't want FB having your data, just don't make an account, simple".

    If it just were so.

    First: Most people are aware that they are handing over information and are fine with that. What they are not fine with is that the control over their data once it has been handed over is not working as advertised. There are a bunch of privacy settings that should let you exactly control what will happen to each piece of data you are handing over to FB. People are not complaining that FB is getting their phone number if they themselves put them in, but they are rightfully complaining if their phone number ends up in the FB database even if they explicitly expressed their wish of keeping that information hidden from FB with a setting in their account. That is the kind of things that is upsetting a lot of users.
    FB tries to keep up the illusion that you are still in control of the information handed over when in reality you are not. And this is exactly the point people concerned with privacy are objecting at. FB is trying to obfuscate what they are doing with the data and how the collect and connect the data. And it is this obfuscation the privacy fight is against.

    Second: As also pointed out in this thread several times your private data ends up with FB even is you are not subscribed to their service. Again most of it has been handed over willingly by posting pictures, sharing address books and so on. But then again behind the curtain FB is connecting all this nitbits of data and creating shadow profiles and trying to make as much use of data - your data - that was never explicitly handed over to them.

    This discussion is not about: "Whaaa I posted a pic of me showing me completely wasted and half naked and now everybody in the office is making fun of me, how can Facebook let this happen." It is about not knowing what exactly FB has on account of us, how our data is cross referenced, if and in what way FB is using this information beyond the purpose of social networking and who else is granted access to the data. All these questions need to be asked and at least in Europe there are laws that should force FB to answer them.
    282 posts | registered
  8. "Irish legal scholars have been fairly impressed with Schrems’ tenacity so far, and they say that the Facebook case could solve a fundamental question that will have significant impact across the continent: who actually owns personal data?"

    no it wont, its already fundamentally clear who legally owns it' "my data is my property", just as my text here is legally my personnel (C)/IP all right's reserved automatically , end of story.

    "The philosophical difference, as I see it, is that Facebook believes that once they get the data, and if they are compliant, it is their data," Eoin O’Dell, an Irish law professor at Trinity College Dublin, told Ars. "The argument on the part of the advocates is a stronger claim that privacy rights require the data protection regime to accept that the data continues to be the data of the user, and not Facebook’s data. There’s the big philosophical, constitutional argument."

    as a legal scholar Eoin O’Dell is also fully aware that its not just that "privacy rights require the data protection regime to accept that the data continues to be the data of the user"

    regardless of how legal scholar Eoin O’Dell 'personally sees it' there is No philosophical view or "constitutional argument" here, its still THE LAW (even in the US, and Trinity College Dublin, Ireland : ) that "all data" personal or not that is created with or made by the "data subject"/person is the express and exclusive intellectual property and copyright of that private person and remains so , no other party be it face book or any others can make a "derivative work" for commercial profit and thats before you even consider these fundamental EU "Data Protection Act" Laws..

    "O’Dell acknowledges that it’s a tall order for all of Schrems’ appeals to make it to the European Court of Justice"
    he's also a little let's say "WRONG" on that too, see below... (phorm) and getting the UK Information Commissioner's Office to get legal reviews etc...

    did ars and the readers here already forget the massive so called "phorm storm" that ran for ever (some might even make the case its still ongoing) back in 2008 that covered all this EU personal data law and many other legal points besides, and showed how the many companies are wrong in their "Data Protection Act" compliance thinking and stealing your personal data for commercial piracy profit

    put simply: the worlds commercial companies cant pile cash in to the QUANGO's , build legally binding commercial IP/copyright databases, setup IP/copyright and "derivative" financial trading markets for profit, then steal the "private person's" data IP/copyright and its "derivatives" to fill that artificial database to commercially trade with..

    that's a fundamentally clear commercial Piracy for profit practice , and comes with a potential real jail term for the commercial BOD/person in charge that sighed off on that practice, not just a fine, the Board Of Directors and upper management would do well to consider...before some "private person's" perhaps "Europe vs. Facebook." decide to test that in the court's and wont accept horse trading, only a legal ruling

    regarding the EU "Data Protection Act" Schrems and the "Europe vs. Facebook." private individual's should probably Google "phorm storm" ,it could take a while as theres masses of legal data full of the end users case against the companies for profit in with the dross, but potentially well worth doing.

    Ohh and ARS given this is covering Ireland .Great Briton/United Kingdom, and the wider EU
    ( for the US world map challenged reader, over there on the right > ), you might want to come up with a better listing than CIVILIZATION & DISCONTENTS if this "discontent"ed non civilization (although i find most EU Austrian's quite civilized : ) as you put it, continues to fight FB and others like they did Phorm, Phorm storm did set the standard after all ;).
    348 posts | registered
  9. Errum wrote:
    "I love social networking," he [Schrems] told me. "I’m just not sure that Facebook should be the one running it."

    Perfectly stated.

    I thoroughly disagree.

    I'm Irish and I find that I echo the sentiment of the Irish Authority in that Facebook may not be doing it right, but if we help them to do it right, then it's all good. It's really not relevant who is doing it, lets just get them compliant. Besides, I'm not convinced that anyone else would be any different - human nature being what it is.

    To Cyrus: Eoin O'Dell is certainly a very good local source, but you missed out by not picking up on TJ McIntyre, Solicitor and Lecturer at University College Dublin (Check out the group he heads Digital Rights Ireland, which took the successful case Digital Rights Ireland v Ireland & Ors [2010] IEHC 221 regarding Data Retention) - He is very active in this area.
    3 posts | registered
  10. What about the rest of the american companies that operate outside their country ?

    The US companies are allowed to do what ever they want in america but if they sell products in EU shouldn't their products follow those counties laws ?

    It is not only facebook that have an american arrogant asshole behavior to the laws of other countries.

    Even the american government itself is doing it. For crying out loud!

    When will the rest of the world say enough ?

    Americans have never been nice to deal with and they are getting worse by the year.

    While an all out war would be over the top. Although i must admit it, it brings a smile to my face when thinking of america in a nuked state. Due to years of personal frustration and the load of crap US have done over the years without being punished.

    Economical punishment would be saner. Would be extra effective now when america is in another economic disaster their more arrogant and greedier fellow americans caused.

    Putting america in the naught corner i think would do them some real good. Especially after some real hard and deserved spanking.
    127 posts | registered
Post a reply

You must to comment.

Need to register for a new account?

If you don't have an account yet it's free and easy.