Law student wins landmark privacy case against Facebook and is congratulated by Edward Snowden

By on

Vienna University’s Max Schrems has created a piece of EU law in his spare time


A law student has crowned what must be the best ever extra-curricular interests section of a CV after he won an epic legal battle against Facebook in his spare time.

Vienna University’s Max Schrems yesterday emerged victorious in the final round of his David v Goliath privacy action against Facebook in the European Court of Justice.

In doing so, law PhD student Schrems, 28, has changed EU law and sent shockwaves through the corporate world — while also no doubt impressing potential future employers.

Lawyers have already labelled yesterday’s result in the ECJ a “bombshell” ruling as it has invalidated the so-called “Safe Harbor” agreement, which gives US companies including Facebook access to the online information of millions of EU citizens.

Schrems’ win was such a big deal for global data privacy law that it even elicited a congratulatory tweet from Edward Snowden.

It all began four years ago when Schrems did a year abroad studying at Santa Clara University in Silicon Valley. There, he happened to attend a talk by a Facebook privacy lawyer that allegedly downplayed the importance of Europe’s privacy laws.

This riled the young law student, who decided to test the strength of EU legislation that granted him the right to receive the data Facebook held on him.

In response to his request, Facebook sent Schrems a CD with 1,200 pages of his own data on it, featuring everything he had ever done on Facebook, including every contact he had ever made via the site and even his contacts’ contacts.

Freaked out by the level of information held by the company on individuals — which he compared to the files kept on East German citizens by the Stasi — Schrems then launched a case against Facebook, whose European base is in Dublin, via Ireland’s data protection commissioner. At the same time, he founded a campaign website, Europe vs Facebook, to fund his battle — all in his spare time on top of his legal studies.

Having lost at first instance — and had his complaint described as “frivolous and vexatious” — Schrems then won at appeal in the Irish High Court. Eventually his case reached the ECJ in Luxembourg, which yesterday found in the student’s favour and struck down the framework underpinning the data transfers of thousands of companies.

In response to the decision, Schrems commented:

I very much welcome the judgment of the court, which will hopefully be a milestone when it comes to online privacy. This judgment draws a clear line. It clarifies that mass surveillance violates our fundamental rights. The decision also highlights that governments and businesses cannot simply ignore our fundamental right to privacy, but must abide by the law and enforce it.

In a follow-up quote given to the Financial Times, the law student added that “I just take a legal perspective, this is no crazy personal thing” and claimed that “I don’t feel this is the thing I want to do for the rest of my life.”

Legal Cheek imagines that Schrems won’t be short of offers if he decides he wants to practise law.



Good lad. Fight the power.



And I would have gotten away with it too, if it hadn’t been for you meddling kids!



I’m cracking up laughing, you silly, lmaooooo.



Fight the power…and every single innocent party who is fairly and lawfully processing data with the subject’s knowledge and consent (and with opt-out powers, same-use restrictions, security provisions, access requests and integrity regulations), but will have to kowtow even more than they already do to indecisive irresponsible tinfoil hats who are worried that ‘The Man’ is using the extensive collection of food pictures they uploaded to secretly pull the puppet strings of their lives because they couldn’t be arsed to read the T&Cs.



I’m pretty sure the whole point of the story was that the processing isn’t fair or lawful, and the parties neither single nor innocent…?



Then it would be a simple case of Facebook violating the regulation and facing the penalty. But they’re instead seeking to invalidate the regulation they are complying with, because apparently it’s super-creepy that Facebook knows who your Facebook friends are.



Is it such a bad thing that people do not want that amount of information stored?


Surely it’s a necessary and obvious function that Facebook would need to store the information you uploaded on the site so that you can access it whenever you log in?


“Yes young chap that is brilliant and valiant indeed, but did you attend either Oxford or Cambridge?”



I don’t know if you’re being sarcastic, but if you really mean what you have just said.. You deserve a knock on the head you Oxbridge swot.



Is it not made obvious by the speech marks and language such as “young chap”?



Stuffy law firms care more for background than ability; that is the point being made



Oxbridge is a completely different university…



Attention to detail not a strong point, eh?



Kinda funny, that coming from Oxbridge, the world center of obsolescence.


Heinous Heinz

No offence n’ all, but many continental European law grads from universities across France, Germany and Scandinavia would shit all over your supposedly superior Oxbridge graduates.

It is far more difficult to get into an elite law course at universities such as Copenhagen or Heidelberg or Humbolt with their stringent entry requirements than some public school pinhead who managed to flog 3 As at A-level which even a paralysed eel could achieve.

The only good thing UK universities are genuinely successful at is peddling their reputation to foreign cash cow students by offering an English-speaking education, which is spoon-fed to its students.



“If you’re a massive anal busybody you too can one day disrupt the benign practices of thousands of legitimate businesses”
Hooray, now people can continue to believe that offering up their personal information on somebody else’s website apropos of nothing means that Mark Zuckerberg gives a shit about their cat pictures and holiday selfies.
I do not understand the point of law here. The data protection principles under the safe harbour agreement are perfectly sufficient. There is no need to grant people further entitlements.






Enjoy it while it lasts.


Lord Harley of Council House

Just wait until I get my injunction against the Law Society.


Lord Harley of Bollocks

I have added this man’s accomplishment to my linkedin profile.

What a hero I am!


Mayor of the Internet

Dear Mr Blacker,
I am surprised and thoroughly impressed at the news I have seen on LinkedIn.
I hereby award you the ribbon of valour for your excellent feat, good sir. may you continue to be a Mozart of the Internet for many years!


Lord Harley of Bollocks

I accept it as coming from the Privy Council of Her Majesty the Queen, and will record it on my linkedin profile accordingly. I am overwhelmed with pride.



Saw your linkedin. Stunning profile picture. x


Deed U No

Pray tell, who has not transgressed Your civilised laws?
Pray tell, the purpose of a sinless, principled and patriotic life?
If with Evil You punish evil that, I have done,
Pray tell, what is the difference between You and me ?
– Rubaiyat by Omar Khayyam, Poet, Sage, Peacemaker, Astronomer.

“Quis custodiet ipsos custodes? – Roman Poet Juvenal in his satires.


Comments are closed.