After more than 9 hours, the Vienna Regional Court for Civil Matters (LGfZRS) closed the oral hearing in the data protection case against Facebook. The judgement will be issued in writing within the next months. The witness of Facebook (Cecilia Alvarez) emphasized repeatedly that data protection on Facebook would be easy to understand – just to say that she did not understand what the platform does with the data whenever a concrete question was posed. If there was any answer, it was usually not about the question that the witness was asked about. Schrems: “It was great to see how Facebook says that every user has knowingly agreed to the use of personal data – but their head data protection person is unable to answer even the simplest questions. In the end, it remains that Facebook cannot or will not explain what they do with user data.
Delete? Personal Data? Passwords?
What Facebook understands by “deletion” remained open. In many cases, the data on Facebook seems to remain stored and is only “hidden”, but Alvarez could not say when this is the case exactly. Unfortunately, the Facebook witness also does not know exactly what type of data is stored by Facebook – despite the duty to disclose this information under GDPR. Only when the evidence was overwhelming did the witness have to, for example, admit that Facebook continues to store users’ deleted passwords – at least for 8 years. Other issues of the lawsuit now seem undisputed, for example Facebook admitted on request to collect data from partners about every user – even without consent. Schrems’ lawyer Katharina Raabe-Stuppnig: “The witness was invited to testify on behalf of Facebook. In any case, we presented almost all our evidence in writing anyway. If the main witness of Facebook cannot give any information now, this can hardly be in their favor. So far we are very satisfied with the course of the procedure.”
Facebook lawyers: “Self-harm” and “economically impossible to follow the law”
At the same time the (now third) group of lawyers that represented Facebook provided more entertaining arguments: They argued, for example, that users had no right to compensation for data protection violations because they deliberately harmed themselves by using Facebook. The claim that Facebook’s tracking cookies are not covered by data protection law at all was also rather bizarre. However, the argument that it would be economically impossible for Facebook to comply with GDPR claims was maybe one of the strangest moments of the day – especially when Facebook has just announced new record profits.
Next steps: Judgement and appeals
The oral proceedings were closed yesterday. The judgment will be issued in writing within the next weeks or months. Already during the hearing all parties agreed that this case will be appealed at the Vienna Higher Regional Court (OLG) and the Austrian Supreme Court (OGH). Here, however, almost only legal issues will be decided on – a further oral hearing and new witnesses are no longer possible – which should allow for a rather swift procedure. It is very likely that one of the courts will also refer to the European Court of Justice (CJEU) to have disputed data protection issues clarified there. The procedure has been running for over 5 years so far.
