Feature

Max Schrems: The man who broke Safe Harbour

Schrems has persuaded a high court judge to confirm that Edward Snowden’s evidence is acceptable in court and that the US is engaged in mass surveillance of European citizens

Kevin Cahill
By
Published: 06 Oct 2015

The Irish, who figure critically in this case, have a phrase they use when fobbing off people they consider a nuisance: “Be off with you now, boy.”

The boy in question here was an understated Austrian law student called Max Schrems. And what the Irish wanted him to "be off" from was Facebook, the US internet giant based in their country.

Schrems challenged Facebook on its role in helping the US National Secruity Agency (NSA) harvest personal data. As a result, the European Court of Justice (ECJ) has declared Safe Harbour, the agreement that makes it possible for US firms to exchange data with Europe, invalid.

This will have far-reaching consequences for all US technology firms that provide online services in Europe, with them possibly having to re-engineer – potentially at great expense – the way they store data in Europe.

Taking on Facebook

Schrems is a 27-year-old PhD student of law in Vienna. As might be expected, he keeps his private affairs private. He has removed all background information on himself from all the websites he can reach, except the one he can’t – that at the NSA in Fort Meade, Maryland, his final target.

An avid internet user since 2008, Schrems decided to take privacy in Europe as his specialist subject at university. For one of his terms in 2011, he went to California and spent time at Facebook. He asked the company, whose lawyers he found almost totally ignorant of European privacy law, to let him have the data they held on him.

Schrems was entitled to do this under European law, a fact not known to many and not advertised by any of the internet giants. He was given a CD with 1,200 pages of his own data, which featured everything he’d ever done on Facebook, including every contact he had ever made via the site – and his contacts' contacts.

Appalled, Schrems started a campaign against Facebook via Ireland's data protection commissioner, but fell at the first hurdle. His plight was later rescued by the Irish high court.

Growing support

To support his campaign, Schrems persuaded 25,000 Europeans and German insurer of law suits Roland ProzessFinanz to cover the costs of the case. Backing the 25,000 are 65,000 signed-up supporters.

Schrems has now achieved something unique: he has got a high court judge to confirm that Edward Snowden’s evidence is acceptable in court, and has got a high court finding of fact that the US is engaged in indiscriminate mass surveillance of European citizens.

In his home territory, meanwhile, he is still at the stage of impasse he reached with Ireland's data protection commissioner. The local court in Vienna has ignored the Dublin finding of fact, claimed it had no jurisdiction, and refused to look at the facts in the case.

But Schrems is doing exactly as he did in Dublin, this time taking the case to the Austrian high court.

He now faces the combined public relations might of the nine largest internet companies on earth, backed up by the US government and its media. Schrems will need all of his rather English phlegm, and his massed troops, to see off the backlash, which has already begun.

Read more on Regulatory compliance and standard requirements