The Pas­sau Regio­nal Court dis­mis­ses the action in its enti­re­ty with the fol­lo­wing con­side­ra­ti­ons, among others:
  • The pro­ce­s­sing of the data is neces­sa­ry for the per­for­mance of the con­tract bet­ween the par­ties (Art. 6 (1) (b) GDPR). Of cour­se, the user’s cont­act data is uploa­ded if the user cons­ents to the “cont­act import tool”.
  • A vio­la­ti­on of Pri­va­cy by Default does not exist. The con­trol­ler mere­ly has to ensu­re that only data that is neces­sa­ry for the respec­ti­ve pur­po­se is processed:

    The cri­ter­ion for the sel­ec­tion of mea­su­res is the neces­si­ty for the pro­ce­s­sing pur­po­se. The The pur­po­se of pro­ce­s­sing can be free­ly sel­ec­ted within the frame­work of the pro­vi­si­ons of Art. 5 para. 1 let­ter b GDPR. It is the­r­e­fo­re not neces­sa­ry to demand that the con­trol­ler always makes the most data pro­tec­tion-fri­end­ly default set­tings pos­si­ble. Rather, by deter­mi­ning a spe­ci­fic pro­ce­s­sing pur­po­se, the con­trol­ler also deci­des on the scope of the data requi­red for this pur­po­se […].

  • By default, Face­book sets it so that users can be found by ever­yo­ne else. This is also not a vio­la­ti­on becau­se it makes litt­le sen­se for new users to only be found by “fri­ends” they do not yet have. Face­book was the­r­e­fo­re allo­wed to clas­si­fy the cor­re­spon­ding default set­ting as neces­sa­ry for the pro­ce­s­sing pur­po­se, even if the user can chan­ge this manu­al­ly at a later date.
  • The­re is no unlawful trans­mis­si­on. Face­book is a US com­pa­ny and a glo­bal plat­form. Data must the­r­e­fo­re be exch­an­ged inter­na­tio­nal­ly; other­wi­se it would not be pos­si­ble to search for users in other are­as, and every Face­book user knows this. The user has no right to demand that Face­book only works in Europe.
  • The­re are No indi­ca­ti­onsthat Face­book is not data “free­ly available to the Ame­ri­can for­eign intel­li­gence ser­vice wit­hout any pre­con­di­ti­ons”.
  • Trans­mis­si­on to the USA is per­mit­ted. It is car­ri­ed out on the basis of the Data Pri­va­cy Frame­work. The cor­re­spon­ding ade­qua­cy decis­i­on is a sui­ta­ble basis; the­re is no need for a fur­ther review of adequacy.
  • Befo­re the DPF, the Stan­dard Con­trac­tu­al Clau­ses the basis on which a ade­qua­te basis represent:

    bb) For the pre­ce­ding peri­od, the stan­dard con­trac­tu­al clau­ses 2010 and 2021 adopted by the Com­mis­si­on in con­junc­tion with Art. 46 (1), (2) lit. c) GDPR con­sti­tu­te a suf­fi­ci­ent legal basis. Accor­ding to Art. 46 (1) GDPR, enforceable rights and effec­ti­ve legal reme­dies must be available to data sub­jects in order to ensu­re a level of pro­tec­tion equi­va­lent to EU law. In this respect, the plain­ti­ff com­plains that the US redress mecha­nism is based on a govern­ment regu­la­ti­on and not on for­mal law. Howe­ver, a regu­la­ti­on is also a law in the sub­stan­ti­ve sen­se. It is not clear why this can­not pro­vi­de equi­va­lent legal protection1 O 616/23 .

  • Moreo­ver, the Data trans­mis­si­on requi­red for con­tract ful­fill­ment and thus per­mis­si­ble in accordance with Art. 49 para. 1 sen­tence 1 b GDPR.

    Inso­far as data pro­tec­tion aut­ho­ri­ties hold dif­fe­ring opi­ni­ons, the­se are not bin­ding on the court.

  • Should US aut­ho­ri­ties can request infor­ma­ti­on from Face­book under US law, be this Con­se­quence of lawful trans­mis­si­on. This does not pre­vent an ade­qua­te level of protection,

    as it would also be per­mis­si­ble under the Euro­pean data pro­tec­tion regime pur­su­ant to Art. 6 para. 1 lit. c GDPR (ful­fill­ment of a legal obligation).