In a long-standing civil case between Max Schrems and Facebook, the Austrian Supreme Court (Oberster Gerichtshof, or "OGH") has accepted Mr Schrems' request to refer a number of questions to the Court of Justice of the European Union (CJEU, the highest Court in the EU). The four questions raise fundamental doubts over the legality of Facebook's data use of all EU customers.
In parallel, the Austrian Supreme Court also decided in a partial judgment that Mr Schrems gets € 500 in symbolic emotional damages because Facebook did not give full access to Mr Schrems' data, but staged an "egg hunt" for user data.
Core Question: "Consent" or "contract"? The Austrian Supreme Court has doubts about the legal basis Facebook uses for almost all processing of user data. The GDPR lists six options to legally process personal data, amongst them "consent" and "contract". You can only rely on "contract" if the processing is necessary for the performance of the contract.
Prior to the GDPR, Facebook claimed that users "consented" to their processing of personalized advertising. However, the GDPR raised the requirements for consent to be valid and also gave users the right to withdraw their consent at any time.