Facebook Facing Lawsuit: Will Its Privacy Policy Ever Be Right?

Source: newsroom.fb.com

Source: newsroom.fb.com

In the latest protest against social networks’ collection and usage of consumer data, a European privacy group has filed a class action lawsuit against Facebook’s Irish subsidiary — and thousands of users have signed up to participate.

The Europe vs. Facebook group is targeting the social network with a class action lawsuit focused on the social network’s privacy and consent policies. The group’s leader, lawyer, and privacy activist Max Schrems is inviting users from anywhere in the world other than the U.S. and Canada to join the lawsuit against Facebook’s Irish subsidiary via the website fbclaim.com. Adult, non-commercial users living anywhere else are able to join the suit, since all users outside of the U.S. and Canada — about 80 percent of active users — have a “contract” with Facebook Ireland. To join, users need to sign in with and verify their Facebook account, plus provide other details, including a scan of an official identifying document, like a passport.

The group told TechCrunch that 11,000 participants had joined over the weekend since the lawsuit was launched on Friday. (Unlike with a U.S. class action suit, participants must actively come forward to join.) Fifty percent of participants are reportedly from German-speaking countries, with a “high number” of others hailing from the Netherlands, Finland, and the UK. “All European countries and South America” are reportedly represented by those who have joined the lawsuit.

The lawsuit is being brought against Facebook Ireland at the Commercial Court of Vienna. It targets the following “unlawful acts” by Facebook, to be assessed under California law, which governs Facebook’s terms of service.

Europe vs. Facebook outlines a variety of Facebook’s policies and actions, which form the basis of the lawsuit:

“Data use policy which is invalid under EU law
The absence of effective consent to many types of data use
Support of the NSA’s ‘PRISM’ surveillance programme
Tracking of Internet users on external websites (e.g. through ‘Like buttons’)
Monitoring and analysis of users through ‘big data’ systems
Unlawful introduction of ‘Graph Search’
Unauthorised passing on of user data to external applications”

The lawsuit sets the damage at what Europe vs. Facebook describes as a “token” amount of 500 euros, or about $671. But Schrems notes in a document on the case that the potential impact on Facebook could still be substantial. “We are only claiming a small amount, as our primary objective is to ensure correct data protection. However, if many thousands of people participate we would reach an amount that will have a serious impact on Facebook.”

There is no risk to participants, as Schrems will be the sole claimant, and under Austrian law a group of people may transfer their claims to a single person. The lawsuit then proceeds effectively as a class action suit. The suit is being financed by ROLAND ProzessFinanz AG, which says it considers the proceedings as part of a continual effort at “levelling the playing field in the fight between David and Goliath.”

Schrems has been battling Facebook since 2010, when he began the Europe vs. Facebook group to push regulators to force Facebook to bring its policies into compliance with the EU Data Protection Law. Efforts so far have led to Facebook’s deactivation of its facial recognition technology and deletion of some data, but Irish regulators have not enforced further changes.

Schrems told Wired that many people in Ireland say there is both political and economic pressureto not enforce the law against the U.S. tech giants there,” which is why the group is initiating the lawsuit in Austria. With the lawsuit, Schrems hope to get Facebook to provide what he described to Wired as “clear, straight-forward information and active, opt-in consent by users.” 

He also hopes that the lawsuit will serve as a warning for other companies who collect and use data in methods similar to Facebook’s. A recent poll available at onlineprivacydata.com and conducted by Rad Campaign, Lincoln Park Strategies, and Craig Newmark of craigconnects surveyed 1,007 Americans and found that 74 percent are either “very” or “somewhat” concerned about having too much personal information about them online.

Fifty-seven percent say they have either very little or no trust in social media sites, while only 22 percent report that they have some trust in social media sites. Seventy percent think that it’s either certain or very likely that Facebook, Twitter, Google, and Yahoo collect personal data (“such as interests, political affiliation, and purchase habits”) in order to target advertising or other content to them. Fifty-nine percent think that social networks likely sell their contact information, and 66 percent are concerned that social networks sell their information. A poll of over 1,000 adults by Ipsos Public Affairs found that only 37 percent of respondents said that social networks did a good job of protecting their users.

While those numbers come from a small sampling of U.S. consumers, Facebook users in Europe and around the world share a level of concern about how their data and personal information is being used. The Transatlantic Consumer Dialogue, a group of U.S. and EU NGOs, last week called on the FTC and the Irish Data Protection Commissioner to suspend Facebook’s policy change to widen its collection of web browsing data. Though more companies use data to track consumers’ behavior, data protection legislation is still vague enough to pose challenges to regulators — such as EU laws’ requirements that user consent needs to be “unambiguous and informed.”

The class action lawsuit by Europe vs. Facebook could further the dialogue on which practices by social networks are legal under current legislation and which should be amended. User dissatisfaction with Facebook and with the privacy concerns engendered by every social network’s data collection and usage are gaining momentum. A lawsuit in Europe, which generally has stricter data protection laws than the U.S., could create waves throughout the industry — and Schrems is hoping it will. Commenting on the EU’s past of spotty enforcement of data protection laws, he told Reuters that, “We have this habit of pointing the finger at the United States, but we’re not enforcing our rights anyway.If we can get a class action through like this, it will send out a huge signal to the industry overall.”

It’s not clear yet whether the current lawsuit will meet with more success than the limited victory brought by Schrems’ previous cases. But the lawsuit could become a vehicle for consumers to express their discontent with what they perceive as Facebook’s disregard for their privacy concerns, and that would demonstrate to Facebook and other companies just how many users are looking for change — and how much rethinking of policies and terms may be necessary.

More From Tech Cheat Sheet: