Facebook is about to be hit with a 'flood of lawsuits' in the EU - but there's a bigger threat on the horizon

• Facebook faces a "flood" of lawsuits in the EU after its strict new privacy legislation comes into effect, Deutsche Bank analysts predict.
• But there is a bigger threat on the horizon: If national regulators decide to take direct action against the company.
• Facebook has been a frequent target of pro-privacy lawyers and activists in the EU, and GDPR adds a new weapon to their arsenal.

---

It sounds like Max Schrems can't wait to sue Facebook again.

The 30-year-old Austrian lawyer has made a name for himself taking on the tech giants over privacy issues in Europe - and winning.

On May 25, Europe's tough new data privacy law, GDPR, will come into affect, and Schrems has a "pile of cases on his desk" waiting to go, Bloomberg reported in March 2018. The pro-privacy activist's expected legal action is just one of a deluge of cases observers are expecting to be brought against Facebook (and other tech firms) in the months ahead.

But there may be a bigger threat of the horizon: Direct government action.

In a research note published on Tuesday, Deutsche Bank analysts discussed how the impending legislation may affect Facebook, and predicted a "flood of lawsuits."

Their verdict: "While we do not opine on the likelihood of these lawsuits being successful we believe the sheer volume of lawsuits could be cause for concern, and if nothing else, a distraction for FB and other tech companies alike (e.g. Google)."

The analysts' larger concern is that national governments and regulators might attempt to take action against Facebook. "We would be far more alarmed by regulators directly litigating," they wrote - citing a report on how UK regulator the ICO is growing its staff by 40% over three years to enforce the new legislation.

A track record of taking on American tech giants

GDPR lays down strict new rules about how Europeans' data can be used by corporations, and has some serious teeth to aid enforcement. Non-compliant companies can be fined 4% of their global annual revenue (i.e. not just revenues generated in Europe) or €20 million ($24 million), whichever is higher.

For Facebook, which generated more than $40 million in revenue in 2017, that would amount to around $1.6 billion.

The EU doesn't shy away from going after the American tech giants, either: The European Commission, under the leadership of competition commissioner Margrethe Vestager, has previously forced Apple to pay €13 billion in back taxes after its arrangements in Ireland ran afoul of EU rules.

Schrems has had some success battling Facebook, but his resources are limited - his new legal initiative Noyb is crowdfunded by members of the public. National regulators, with all their resources, have the potential to be a far more significant threat.

Facebook, of course, has said it is working to ensure its products and services fully comply with GDPR. But some experts believe the company's methods of obtaining consent from users is not legally compliant, and campaigners seem certain to try and test this in a court of law.

And some analysts predict that GDPR could even make Facebook's position in Europe stronger, with GPDR adding barriers to entry that could make it more difficult for smaller players in the industry.

If Facebook raises the ire of national regulators, however, it might be a different story.