The Higher Regional Court in Vienna has ruled that Facebook does not need to obtain the explicit consent of its users to use their data according to the EU data protection law (GDPR). The court confirmed a previous ruling by the higher civil court against the plaintiff, Austrian data activist Maximilian Schrems. The higher court said that Facebook can successfully invoke Article 6 of the GDPR, allowing Facebook to process user data based on the contract between the user and the platform. The data are used for advertising, which represents Facebook's business model, the court explained in the ruling.
Facebook has however to pay Schrems EUR 500 and provide him with access to the personal data Facebook holds on him. The payment is for emotional damage caused by the uncertainty about what Facebook is doing with his personal data. The court held that users have a right to be told which other parties have provided data to Facebook or if and to whom Facebook has provided data to, Schrems said. According to Article 82 of the GDPR, every person is entitled to compensation for violation of this regulation and the consequent material or immaterial damage caused.
The Court in Vienna also allowed an appeal to the Austrian Supreme Court (OGH) over the issue of whether the Facebook terms and conditions can be considered a contract and sufficient consent for data processing. Schrems said that he will file such an appeal and it is likely that the Austrian Supreme Court will refer the issue to the European Court of Justice (CJEU).
