Data privacy campaigner Max Schrems is been dealt a minor blow by the European Court of Justice but Facebook will have to fight to keep skeletons in the closet as individual court case is given thumbs up.

While the internet giant always had the upper ground, there was a small chance Schrems could pile misery sky-high with a class action lawsuit. Such occurrences are rare in European courts, and the European Court of Justice has now ruled he is unable to represent 25,000 people in an Austrian court to sue Facebook for data privacy violations, but he will be allowed to pursue an individual legal case.

This certainly takes the risk of a hefty financial blow out of the equation for Facebook, but the damage to credibility and consumer trust could be massive. Irrelevant as to whether Schrems is representing one person or 25,000, the privacy advocate will presumably use such an occasion to expose the data sharing practises and business model, which could leave Facebook in a relatively sensitive position.

Initially, Schrems was seeking permission to take Facebook to court on behalf of 25,000 individuals, seeking €500 compensation for each. Class actions lawsuits are rare in Europe, especially when the individuals are from a range of different nations and jurisdictions, therefore this idea was shot down. Perhaps this is a just a case of timing though. Under GDPR, which will be introduced later this year, collective action will be allowed in some cases. It is not known whether this is a case which would be accepted.

Although it is generally accepted that user information is used by Facebook to build its advertising solutions, some in the general public might be shocked at the breadth of information Facebook hordes, the granularity of the data, as well as the practise of data sharing with third-parties. Facebook has never denied it shares information with ‘selected’ third-parties, presumably ‘selected’ means anyone who is willing to pay, but it has been rather opaque about how the data mining, refining and distribution machine actually works.

Played correctly, Schrems could make a media circus of the situation, leaving Facebook to answer some awkward questions about practises which are common in the world of media, but rarely see the light of day or public scrutiny. Facebook has avoided a substantial financial penalty, having to fork out compensation to thousands, but the PR damage will be a crater the internet giant will want to avoid.

The actual case itself is based on how Facebook handled Schrems personal information, both with third-parties for advertising, as well as intelligence agencies in the states. Both areas Schrems believes violates his data privacy rights as a European citizen. The shady world of data and intelligence agencies is certainly an area which numerous parties would want to avoid getting into the public domain.

Again, it is generally accepted the internet giant collaborate with intelligence agencies when the appropriate occasion arises, but details on these relationships are very thin on the ground. Facebook and various others publish statistics on how much information is requested by the government, but the processes and discussions are secretive. Schrems could expose some uncomfortable truths should the game be played correctly.

While the smart money would be placed on the army of legal experts at the disposal of Facebook, it should be worth noting Schrems does have form when taking on the odds. Schrems was one of the leading activists and campaigners against Safe Harbour, the mechanism to facilitate and manage transatlantic data transmission, exposes its flaws and data privacy abuses from intelligence agencies in the US. The odds were against him there as well, but he was successful.

While there is a notable PR and financial risk for Facebook, precedent could also be set. Should Schrems be successful in his pursuit, the door could be opened for other privacy campaigners to have a poke not only at Facebook, but any other organization which facilitates the flow of information between third-parties. Google, Amazon, Twitter, app developers, media organizations and numerous other companies might be casting a wary eye over developments here.