VIENNA/LONDON (Reuters) - As Europe’s new privacy law took effect on Friday, one activist wasted no time in asserting the additional rights it gives people over the data that companies want to collect about them.
Austrian Max Schrems filed complaints against Google, Facebook, Instagram and WhatsApp, arguing they were acting illegally by forcing users to accept intrusive terms of service or lose access.
That take-it-or-leave-it approach, Schrems told Reuters Television, violates people’s right under the General Data Protection Regulation (GDPR) to choose freely whether to allow companies to use their data.
“You have to have a ‘yes or no’ option,” Schrems said in an interview recorded in Vienna before he filed the complaints in various European jurisdictions.
The GDPR overhauls data protection laws in the European Union that predate the rise of the internet and, most importantly, foresees fines of up to 4 percent of global revenues for companies that break the rules.
That puts potential sanctions in the ballpark of anti-trust fines levied by Brussels that, in Google’s case, have run into billions of dollars.
Andrea Jelinek, who heads both Austria’s Data Protection Authority and a new European Data Protection Board set up under GDPR, said she expected to see complaints come in as soon as the law enters force across the 28-member European Union.
Schrems was a 23-year-old law student when he first took on Facebook and he’s been fighting Mark Zuckerberg’s social network ever since - becoming the poster-boy for data privacy.
He won a landmark European court ruling in 2015 that invalidated a ‘safe harbor’ agreement that allowed firms to transfer personal data from the EU to the United States, where data protection is less strict.
With GDPR in mind, he recently set up a non-profit called None of Your Business noyb.eu (noyb) that plans legal action to blunt the ability of the tech titans to harvest data that they then use to sell targeted advertising.
His laptop perched on the table of a traditional Viennese coffee house, Schrems showed how a pop-up message on Facebook seeks consent to use his data - and how he is blocked when he refuses.
“The only way is to really accept it, otherwise you cannot use your Facebook any more,” Schrems explained.
“As you can see, I have my messages there and I cannot read them unless I agree.”
Erin Egan, Facebook’s chief privacy officer, said in a statement that the company has prepared for 18 months to ensure it meets the requirements of GDPR by making its policies clearer and its privacy settings easier to find.