our next keynote will take the form of
an interview with Jennifer Baker
interviewing max schrems okay well
there's a breakout session later this
afternoon which max will be in and he is
described as one in a billion and we're
all invited to get to know the man
behind the headlines so presumably when
you start with this you had no idea you
were going to end up making new rules
for Europe no not at all like pretty
much the whole Facebook thing started
because I was were studying in the u.s.
half a year and there was a guy from
Facebook telling us that basically the
story was you can break European law
because nothing ever it's ever gonna
happen which was really true currently
and that led into a little experiment of
is our law actually enforceable and I
never thought it's gotta be a big thing
at the beginning we're just putting
facts up on the website what we got from
Facebook a little complaints in our land
were drafted over two nights and
suddenly you're like in this whole
privacy debate in the end I mean do you
ever wish that it wasn't Facebook that
maybe there would have been a different
target that might have been easier -
yeah like we never expected it to be
public thing so Facebook is not really a
good target for a public thing because
everyone is telling you you you know
you're free to join it not to join it so
it's really not from a PR standpoint it
was not a wise decision but it was not a
decision it was just the first one that
came up but it was interesting to see
how things are enforceable and where the
practical problems are because we have a
nice law in Europe on paper but we're
actually not doing anything about it and
I think that's the big problem in the
Penn the transatlantic debate is that
we're usually pointing at the u.s.
saying that's the evil prism empire the
googles and whatever but the factual
problem is that we're not enforcing all
law right now and I wouldn't stick to
the law either if it's actually not
enforced like an island where you get an
enforcement notice as like the worst
thing that can happen to you which is a
little letter saying dear Facebook don't
do that kisses your data protection
commissioner that's actually what you
get there
okay you brought up the iris Data
Protection Commissioner we spoke a
little bit before we came on stage about
that you have some sort of quite
interesting views on their efficacy
shall we put it that way your
independence I think on independence is
one issue I think we have a huge problem
in practice if it's not after the DP
sees are independent mainly because they
also overlooked the government there
makes a lot of sense to be independent
and what we saw in practice was that the
governments are saying it's an
independent body we're not able to
intervene and then they independently
put someone there that doesn't do
anything and that's something we see now
more and more in different countries and
we have the same problem for example in
Sweden where a complaint that we filed
was just not ever touched for the
reasons that they feel they don't want
to touch it and you have to prom that
you don't have any political no and no
political responsibility because there
is just no government body that's
responsible for it it's an independent
office they can do whatever they want to
do and especially in Ireland you had two
problem that the legal oversight is so
expensive that even companies are not
going after the DPC even if companies
get insane rulings the thing I got from
most lawyers in Ireland was that even
companies are not going after them at a
high court on the whole procedure that
there is because it's just so insanely
expensive it's even more expensive for a
consumer like me we were able because
there was a lot of a lot of media on
that that we had a clam crowdfunding
platform we got about 60,000 euro but
that's an exception I can do that but
most average users are unable to do that
and that's prob why for example right
now at the TPC in Ireland the last
numbers from Billy Hawks time was that
only two to four percent of all the
complaints that were filed with the TPC
were actually getting decided all the
others were informally resolved and I
know ours were informally resolved by
sending an email back saying we don't do
anything you go to the courts if you're
unhappy with it so we have a very
serious enforcement problem and I think
that's that's the thing that hopefully
the new regulation is gonna about as
well well of course if the new
regulation goes through in its current
form we've got this one-stop-shop issue
and Ireland then becomes the center
point and you know we all laugh about
the pictures
that little office in Portland but I
mean what's I mean are you alarmed by
that I mean and in principle the
one-stop shop I think that work in
principle there dr4 one-stop shop makes
a lot of sense because as a company I
don't want to have twenty eight data
production commissioners that have
different opinions that is something
that makes a lot of sense the problem
from a consumer perspective is I'm able
to speak English but a lot of the people
in other countries have especially in
Europe have low understanding of English
especially if it comes to legal text so
if that is really the only place where
you can file a complaint only in the
national language you have a serious
problem and usually in consumer
contracts we have the fact that you can
always go to your local court so the
idea of having a cooperation between
your local DPC and whoever is the
one-stop shop makes a lot of sense I
don't know what the exact position right
now is in the in the council and I don't
know what the final version is going to
be but I think somewhere along that
lines that is kind of what makes sense a
lot we also had the problem that we have
actually in Europe for the big companies
in a private sector
trudi pcs that are responsible that's
Island and Luxembourg for text reasons
all these companies are having
headquartered in these two countries
pretty much and they have a huge burden
and they also have a lot of pressure
from the public to not scare away the
companies you've just attracted by the
tax regime so there is a certain thing
that it makes sense that other countries
also involved in in the decision process
I guess okay well I mean we sort of
talked about you know you're a versus
Facebook but can you break it down I
mean there's sort of three strands to
what you're doing is the Irish procedure
the ECJ and then you should talk a
little bit more about that and the class
action so just give us an outline of
what direction in one of the next steps
with each of those like we have to first
what was the 22 complaints at the DPC
which always sounds like a big number we
just split up every little button on
Facebook as an individual complaint to
makes it easier to process these 22
complaints were taken back this summer
because after three years were at the
Irish TPC we have the problem that we're
not allowed to see the evidence we're
not allowed to see the fouls of the case
we're not even allowed to see the
counter-arguments by facebook so was a
two-party procedure but one of the two
parties was when I sent an email I got
the answer back that they do not respond
to the email if you call them to tell
you that you should send them an email
because you're not allowed to talk to
you
and they were just totally shutting down
the only option we had was filing loads
of jr's traditional reviews against the
Irish TPC which just didn't pay off so
in the end we had to from that for
example I was talking back then to Gary
Davis device data protection
commissioner in Ireland who is now
working for Apple interestingly but the
the fun thing was that I said you know I
don't know what the artists procedure is
but under European law you have access
to the files of your case that's one of
the most basic principles ever since
even in case law system and like ever
they are ever since and the answer I was
in at least article 6 of the European
Convention of Human Rights for failed
trial and the answer from from him was
article 6 doesn't apply to us
and I was like article 6 European
Convention of Human Rights doesn't apply
to port or Lincoln or you know what why
and the answer was we don't tell you why
and that was really the point where a
friend of mine who was a lawyer as well
he was freaked out like the train ride
back to Dublin he was like are we
somewhere in bloody Boston what's going
on here so we really had serious doubts
about the independence or whatever it is
in Ireland we don't have any evidence
I'll usually leave it up to the
journalists to make up their mind why
that is but really saw that they're just
not willing to enforce anything then the
second string was the prison complaint
which we filed later because I got
journalists journalists asking me if the
whole prison thing can be legal from a
European perspective that Facebook
Ireland sends data then to the US which
is then used for the prison program and
I was researching it for half a day and
I was like no like if actually no
because it runs after safe harbor and
safe harbor at least on the legal basis
falls under the higher ranking law of
article seven and eight of the Charter
and article 25 of the directive says
that it has to be an adequate protection
in the US and I was like mass
surveillance of all my content is surely
not an adequate protection
the fun thing was that the Irish tpc
first said that they do not have to
investigate complaints so they just
don't feel like investigating it then
I'm not a native English speaker but I
was like according to the Oxford
English dictionary Shaul in the law
means that you must that's like as an
Austrian speaking here so they finally
decided that they must but that my
complaint was frivolous and vexatious
because my legal view that this is not
an adequate protection was frivolous and
vexatious which allowed them to get rid
of the complaint without ever
investigating it and the fun thing was
that my frivolous and vexatious legal
viewpoint was the same that the
Commission has taken the European
Parliament has taken that the article 29
working group has taken so apparently
all of these institutions were frivolous
and vexatious according to the Irish TPC
that went then to the High Court and was
now referred to the ECJ which i think is
going to be a very interesting case we
now now roughly know what the different
parties are saying we will go on a
head-on collision with safe harbor and
say safe harbor was ever since invalid
400 reasons all these reasons we know
that are out there because we're the
only ones they could ever bring them up
to the ECJ others will not bring it up
another stream of arguments is that
article 3 of the safe harbor applies
which allows in specific situations to
suspend data flows to individual
companies that's pretty much what a lot
of the member states are arguing the
European Parliament argues that this
cannot be the case but not specifying
why we know that Austria has argued as
well and Slovenia and they're pretty
much on our side the Commission seems to
try to kind of wind its way out of it um
we'll see how that turns out but it's
very interesting because after the digit
right silent case we have a very good
case we can save data retention in
Europe which is only metadata for six
months it's disproportionate and content
data forever it's like off the scale
it's not anywhere close to being
proportionate so to overcome that
problem will be interesting I really
have to trouble that I wanted to come up
to the ECJ with a solution to the whole
problem as well that was the reason
where I was also in DC and was like do
you have any clue how we can possibly
solve the problem and right now I don't
see it I think for the ECJ case they're
kind of three options either they see CJ
finds his way out to kind of find some
formal reason not to decide about the
thing which they tend to do if they feel
like it
and then there is the article three
argument which i think is the most
likely outcome but has a huge problem
for safe harbor in practice because then
every little DPC which there are 31
countries plus germany has like i think
16 d pcs or something every individual
GPC can tell you you're not allowed to
bring it to the google cloud and then
you have each TPC suspending data flows
in all Member States so I think safe
harbor in that case would be Swiss
cheese that would need to be fixed right
away anyways and then you have the
possibility of a suspension of safe
harbor in itself which possibly you can
only do by saying there's gonna be a
transition period of a year or two or
something like that which would give the
chance to renegotiate it in some way I
think that's the most reasonable things
that could possibly come out but it's
the Supreme Court of Europe so you never
really know where the end results are
gonna lay but that's kind of these
dreams you see right there the third
thing that we did right now is the class
action in Austria which is kind of
coming from the Irish procedure because
we decided DPC in Ireland we're not
gonna go anywhere with that and I have
the option as a consumer to sue at my
home court classical European consumer
law so we filed a individual consumer
complaint in Vienna I always wanted to
do that right away and we later decided
that in Austria it's possible to form a
class action by assignment so we have a
monetary request of damages of 500 bucks
in our case against Facebook we try to
stay as low as possible to make the
point that we're not after money but
about the principle and what you can do
is that you assign your monetary claim
to the actual claimant that's already
there and thereby former class action so
it's actually a two-party procedure but
you can actually legally represent or
actually represent twenty five thousand
people in our case that's that was done
through an assignment app that was kind
of cool I wasn't a web app that you
could pull on your on your smartphone
and you had to login with Facebook
because we had to verify that you have a
Facebook account take a picture of your
ID so we verify it's a real person and
then fill out a couple of forms it was
interesting cuz it took people on
average 10 to 15 minutes to fill it out
and taking a picture of your ID and
uploading it to a webpage is really a
lot to ask for
and we still have 25,000 people signing
up your claim within six days then we
shut it down because we were like it's
out of proportion I have to administer
it myself because I'm doing that as a
individual consumer I also don't get any
money for it because I got the same 500
boxes everybody else is getting so we
stopped with the 25,000 but we got
another 50,000 people that just
registered to be later joined possibly
so you see how there's a huge kind of
interested in in it and it was
interesting because a lot of people even
emailed us that they don't want to have
their 500 bucks they want to donate it
to someone else to just want to kind of
have the rights enforced we also got the
response from Facebook last week which
was very interesting they brought up
actually I mean that's what you
technically do they brought up a hundred
reasons why this class action is not to
be certified so to say there's a
different German German but kind of the
whole thing was this is impossible and
you can never sue Facebook that was kind
of the general argument you can't even
go to courts against them that is kind
of clear no the fun thing is one of two
things is the competence they've even
argued that their own users are not
competent to assign your claim because
they're legally incompetent which you
can only be in Austria if you going
insane which is interesting cuz to claim
25,000 of their own users have
apparently gone insane because obviously
a couple of years earlier they were able
to sign their privacy policy so I was
arguing if possibly Facebook makes you
go insane but yeah it's it's a bunch of
really interesting arguments it's really
wonderful if you want to have a PR thing
after that you just take their own
arguments put it out to the media and
you have the best laugh ever and that's
gonna be very interesting cuz there we
have the whole prison thing and NSA and
Big Data in it as well
so that has a high chance to go up to
the ECJ at some point as well and what's
interesting is what we did in that case
and that was legally really an
interesting thing and if any I mean a
lot of company people are in here if you
have a look at the terms you have
because what made the biggest fun for us
was that they claimed that California
law applies
if you want to have towards California
law is the smartest thing you can
possibly give your consumer and that's
pretty much our argument we made in that
case is that we say we have damages
under Irish law concerning Irish
controller we have a contract with an
Irish company so European data
protection law applies there's a cause
of action and article 23 22 after a
directive and then in Irish law and this
cause of action I can then use under
California law to make a color fornear
tort claim so we have a hybrid we have a
hybrid between European privacy law and
California tort law and it's only
because of the terms of Facebook that
were able to do that I was like they
have never had any I mean they pretty
much took a California terms and
translated into German and thought that
that's workable in Europe which is
wonderful if you do that cuz you as a
consumer in Europe you can kind of pick
the jurisdiction you that are is more
favorable to you I can choose Austrian
jurisdiction or California and whatever
the case is I take the jurisdiction
makes more fun yeah in that case you
even have that hybrid situation and you
can file the whole thing in Austria so
you aren't so I was like that's
wonderful and that was the only reason
why we actually did the class action I
I'm through at Facebook I personally
don't care about Facebook as a company
or anything I was some kind of through
with the privacy debate but that class
action and how the law worked together
that well was like I have to follow
there's no worry we're not doing that if
you want to know more about the class
action all our files also the class
action is on our web page to download
it's kind of interesting how we argued
it legally the other thing we also
argued was unjust enrichment which i
think is gonna be a new path you can
take saying that they like illegally use
our data and make a certain amount of
money off of it which is quite kind of
the typical thing of unjust enrichment
in most jurisdictions and that's kind of
an interesting path to go down this well
to get a monetary claim of course in the
case of facebook it's gonna be a couple
of cents per users or not read the big
books but the interesting thing is under
austrian procedural law is they have to
come up with the number of how much
money they're making on each user which
has got to be very interesting to ask
and i was already talking to privacy
peoples that are gonna have a Firefox
sticker it tells you how much money
making right now when you're on Facebook
with that information and that was kind
of the class action which is kind of
interesting I think as well because its
sake and really kind of consumer rights
to get a reprieve --i see and kind of
mixes in a way you really have something
that's enforceable for an individual
consumer but also for consumer groups
and that's I think something that we'll
see very likely in the future that we
have more consumer action like really
consumer groups to take that take the
lead we do have to add a little bit in
Germany right now that falafel band has
gone after Facebook and we do have that
a little more I think what we need in
the long run from an enforcement
perspective is to have a European
enforcement NGO like something on a
European level that really does what we
did on a structural level because we're
right now I mean we did a lot on
Facebook and that was just from my home
laptop like that's really nothing that's
not a structure and nothing like that
well you see how vulnerable they are in
the end and I think that is the last
thing I still wanna do is kind of set up
this European enforcement agency to kind
of dump the knowledge we acquired so far
into like I call it the shoe box that
should then happily flow whenever ever
after well I mean you've you've
obviously garnered a lot of support I
mean you were saying how pleased were
that they actually the European
Parliament I mean down on your side I
mean this comes back to sort of cultural
differences between the US and the EU
and we're told that we must protect data
flows at all costs what do you see is
the fundamental differences it's
interesting because I was an exchange
student when I was 17 in the US and
really the most redneck rule places in
Central Florida my host dad had a
pumpkin on his bed it was wonderful
but you really understand what it helps
me a lot to understand the US side and I
think a lot that a lot of the troubles
we have is that they're just two
different cultures that are so deep deep
down in our souls that we can hardly
express it that are just clashing
oftentimes I see that also like on on
the European US debate in politics a lot
and and I think that is kind of the key
for me is that I'm happily understanding
the US side and I just asked
to understand the European side as well
if you do business here and I think
that's kind of the crucial thing we have
to come to because we're right now more
in oftentimes in the debate of trying to
kind of convince the other side of our
point of view instead of trying to
cooperate in a way and that was I think
probably on the long run something
that's gonna be interesting and and that
I oftentimes see even with US officials
that just have a hard time to understand
the concept of fundamental rights in
Europe because and a lot of it is really
not legal but cultural in the background
so which is reach arcing from different
sides we even have that win in Europe
like to Scandinavia also like UK Ireland
that sometimes has very different views
on that and I think that is oftentimes
not really expressed too much and and
could overcome a lot of these issues but
for example maybe we have more of a
tolerance if governments or if in the US
the NSA is getting access to your data
but we're suddenly concerned if it's if
it's a corporate money-making entity I
mean do you think do you see differences
between government and corporates in
that sense I don't see that difference
anymore because what we see in reality
and that's typically prism is that we
have corporations going after our data
for monetary reasons but then the
government coming in and say oh you have
all these nice data let's get it I mean
that's the Microsoft case with which we
have in the u.s. right now where they
have the warrants and that's a real big
issue because you don't really have the
separation anymore you don't have the
government spying on you you have kind
of Google on your phone that spies on
you well enough and then the government
is taking it up and that's something why
I don't really care about government and
private that much anymore
because in the end if the government
wants to access something that's on a
private server they gotta get it one way
or the other either to hack into the
system if that's the NSA or they do
Pfizer and prism and whatever and get it
that way and therefore there is a
certain argument not to have your data I
mean it's it's typical things like I was
at a conference in Washington and you
have two 4s on your boarding pass where
it's a secondary security scan in scheme
to pulled out because you're on the list
and if you ask for austrian airlines
that are you to get that from the
Department of Homeland Security and they
have to pull you out and that whole
stuff
and that's usually something where you
never really know where the data comes
from I think in that case it was 2p in
our data but it's kind of interesting to
see how this kind of melts together even
from the CCTV that is usually run
privately but then the police is
accessing it we have the same thing on
big scale as well okay to come back to
Facebook again then you know this is
where it all started I mean in 2012
Facebook changed the privacy policy do
you think that was in reaction to what
you were doing we had a couple of
changes on Facebook they have to have
shorter retention periods which is
interesting custom again we are not we
don't have access to the file so we know
there was pretty much no retention
period or very long retention periods
and now they have a shorter one which no
one is allowed to know how long it is
and we had the facial recognition that
they have to turn off interestingly
Irish procedure again the urge Facebook
to do that on the consent basis even
though the article 29 working group has
found in the paper previously that
facial recognition on social networks is
disproportionate which was Facebook
don't do it just like in a abstract term
but it was totally targeting Facebook
and again in Ireland it was not enforced
but happily asked if they would be so
nice to comply with that and not do it
anymore
so in the end the result was that they
finally turned off the facial
recognition thing our main argument was
that it's totally disproportionate
because you saved two clicks if you mark
someone on a picture and therefore you
have facial recognition and be a
biometric data of 1 billion people
that's kind of slightly disproportionate
possibly and there were new privacy
policies twice but factually from a
legal perspective they were a little
easier to read from a consumer
perspective from a form but from a legal
perspective to just the same policy I
mean what we have with most of US
companies is that they have their
policies written up on the California
law because that's the u.s. privacy
policy law and then you just translate
it to German the promise mainly that you
have such abstract purposes that you can
pretty much do anything like to write
the old privacy policy that they just
changed last week or something once we
use your information to try to provide
this the services and functions
to you and others which is the purpose
of Facebook which means you can do
anything with the data because anything
you could possibly do as a company is a
service and function you provide to you
and others event and that is the that is
just where you see that they never
remake a I mean it was one of our main
arguments that the consent is invalid
because if that's the purpose it's very
likely not specific informed and
unambiguous and they you just have this
different approach where you still have
to feeling that things are drafted in
the Silicon Valley and then it's kind of
the Europeans are just gonna get it and
that's it don't worry for the European
law and that's really it's something
where I was wondering how little the how
little companies are investing into
being being complicit being compliant
with European Union law it's still
something that's off the scale I think
the the the the new penalties on the new
regulation will bring it up because
honestly in my university in California
next door we had European with European
competition law after the Microsoft case
so suddenly was important Custer was
money in it right now we have two
problem that you've actually it doesn't
pay off to be compliant right now
and that is something that a lot of
Europeans don't understand cuz this idea
of just looking at a law as a risk
factor which is just very much there in
the u.s. it's just not that much there
in Europe and that's something where it
is kind of this why are they all
sticking to all along it was like yes
because there's no fine so I think that
would help a lot in in the new
regulation and I hope that that's gonna
get us somewhere closer to compliance
okay
well I'm looking we're out of time
already and I we haven't even touched on
the new regulation and the risk raised
approach and the stuff that I had
written down but there is another a
chance to hear max this afternoon so
hopefully you'll be able to cover some
of the things we didn't get around to
and I think that's it for this session I
think what's lunch next