Jurisdiction Uncertain in Collective Lawsuit Against Meta Over Facebook Data Breach

Legal uncertainties have emerged concerning the appropriate jurisdiction for a class action lawsuit filed against Meta, the parent company of Facebook, following a significant data breach. The proceedings, which commenced in Hamburg, encountered early delays as the court questioned whether it was the proper venue for the case.

The lawsuit stems from a major data breach that took place between 2018 and 2019, in which the personal information of over 530 million Facebook users from more than 100 countries was compromised and later appeared on the dark web in 2021. The Federal Association of Consumer Centers (Verbraucherzentrale Bundesverband) has accused Meta of violating European data protection laws and has initiated a model declaratory action. This legal mechanism allows consumer organizations to pursue claims on behalf of affected individuals, aiming to facilitate compensation for those impacted by the breach.

The initial court session was cut short after the presiding judge raised concerns about jurisdiction, suggesting that the Hanseatic Higher Regional Court in Hamburg might not be the competent authority to hear the case. The court indicated that another hearing would be scheduled to further address this procedural matter. The complexity arises from the fact that Meta's European headquarters are based in Ireland, raising questions about whether German courts can preside over a collective action against a company registered in another EU member state.

Legal representatives from the consumer association announced new motions shortly before the hearing, which differed from the original complaint. This last-minute change led the judge to postpone the proceedings, citing the inability of the court and Meta's legal team to properly prepare. The judge described the adjournment as regrettable for all parties involved, emphasizing the importance of proper preparation for such a significant case.

Henning Fischer, who oversees class action procedures at the consumer association, acknowledged the unprecedented nature of the lawsuit. He noted that this type of collective legal action against a defendant located in another EU country represents uncharted legal territory, and the question of which court holds jurisdiction remains unresolved. The association maintains that the Higher Regional Court in Hamburg is the appropriate venue, but this position will require judicial clarification.

The lawsuit seeks to establish Meta's accountability for data protection violations and enable affected individuals to claim compensation more efficiently. The outcome could set a significant precedent for future privacy litigation involving multinational technology companies operating within the European Union.

Meta has not issued a formal statement regarding the ongoing proceedings. The company is represented in court by the international law firm Freshfields. As the case develops, further hearings will be scheduled to resolve the jurisdictional dispute before substantive arguments regarding the alleged data protection breaches can proceed.

The case highlights the evolving landscape of data privacy enforcement within the EU, as well as the challenges involved in holding global technology firms accountable across national jurisdictions. The final decision on which court can hear the collective action will likely influence similar cases in the future, potentially shaping the legal framework for cross-border data protection litigation in Europe.