In the latest round of the ongoing battle between Austrian privacy activist Max Schrems and Facebook, the European Court of Justice (CJEU) ruled that Schrems did not have standing to bring claims on behalf of Austrian consumers over Facebook’s alleged violations of users’ privacy rights. The court did, however, allow for Schrems to continue with the lawsuit as an individual.

In 2014, Schrems sued Facebook in local court in Vienna over alleged consumer privacy violations. He brought the complaint both as an individual and as a collective action on behalf of 25,000 Facebook users worldwide. Facebook’s global headquarters are based in Ireland, and the company argued against Schrems’ standing to sue on two grounds: (1) Schrems, who uses Facebook to promote his books and events, has a professional interest in the case therefore cannot be regarded as a “consumer” under European consumer protection law; and (2) Facebook is not located in Schrems’ home country. These questions were referred to the European Court of Justice by the Supreme Court of Austria.

The CJEU’s decision on the first issue follows the Advocate General’s opinion in November 2017. On the second point, however, the CJEU ruled that consumer privilege applies “only to an action brought by a consumer against the other party to the contract,” so Facebook users cannot assign their claims to other citizens outside their home countries.

Although the European Commission recommended in 2013 that member states introduce a collective redress mechanism, nine countries have yet to do so. However, this will change in May, when the new General Data Protection Regulation (GDPR) takes effect. Article 80 of the GDPR states that data subjects “shall have the right to mandate a not-for-profit body, organisation or association …. to lodge the complaint on his or her behalf.” It is no surprise that Max Schrems has already founded his own NGO specifically for this purpose. In addition, EU Justice Commissioner Vera Jourova announced at a conference last September that the Commission will be proposing new legislation in March 2018 (now expected in April) to provide collective redress.

While the Schrems challenge now returns to the Supreme Court of Austria, the EU data privacy landscape may soon become more litigious.