Sunday 22 October 2017

High Court asks European Court of Justice to examine Facebook data transfer case

Facebook. Photo: Stock
Facebook. Photo: Stock

Aodhan O'Faolain

A High Court judge has decided to ask the Court of Justice of the EU to determine the validity or otherwise of EU-US data transfer channels used by Facebook and others.

The outcome of the referral has potentially huge implications for EU-US trade and data privacy rights of millions of EU citizens.

Ms Justice Caroline Costello said she was referring the issues because she concurred with the Irish Data Protection Commissioner’s view there are “well founded" grounds for believing the European Commission decisions approving data transfer channels known as Standard Contractual Clauses are invalid.

It is "extremely important" there be uniformity in the application of the relevant European Directive throughout the EU "on this very important issue", she said in her 152 page judgment. This required that there be "consistency and clarity."

For those reasons, she considered a reference was necessary and appropriate, she added.

She added she did not consider she had to refuse to refer as a result of the recent Privacy Shield agreement between the EU and US.

She will hear submissions as to the precise wording of the questions to be referred to the CJEU later.

Data Protection Commissioner Helen Dixon sought referral after reaching a draft view Austrian lawyer Max Schrems had "well-founded" objections over transfer of his data to the US.

The case arose after Mr Schrems complained in 2013 about the transfer of his personal data by Facebook Ireland to its US parent, Facebook Inc.

That lead to the Irish High Court referring issues to the CJEU which resulted in the European court striking down the Safe Harbour arrangement for data transfers.

Mr Schrems’ complaint was then investigated by the Commissioner who, in a draft finding of May 2016, found he had well-founded objections to his data being transferred. That was based on her views about the adequacy of remedies available in the US for EU citizens who allege breach of their data privacy rights.

The Commissioner then applied for a referral, saying she wanted the CJEU view before she finalised her decision on Mr Schrems complaint. The key issue was whether the European Commission decisions approving the data transfer channels known as SCCs are valid or not.

The Commissioner's case was against Facebook Ireland – because Facebook’s European headquarters are here - and Mr Schrems but no orders were sought against them. The US government, Business Software Alliance and civil liberties groups were among several parties joined as assistants to the court on legal issues.

Mr Schrems opposed a referral, arguing the Commissioner had enough information to finalise his complaint without it.

Facebook also opposed referral but on very different grounds. Both it and the US government argued US law and other measures afford adequate protections for data privacy rights of EU citizens.

That was disputed by Mr Schrems and civil liberties groups including the Washington-based Electronic Privacy Information Center (EPIC).

The judge had last March reserved judgment on the 21 day case but later agreed to a request from the US government to receive information about what were described as “significant” new developments in the matter.

Those included a decision of the US Foreign Intelligence Surveillance Court (FISC) of April 26th last which addressed the failure of US agencies to comply with surveillance restrictions imposed by the FISC and restraining collection of "about" data.

Another development was a decision by the US Court of Appeals for the Fourth Circuit that Wikimedia, but not several other plaintiffs, had the necessary legal standing to challenge the Upstream surveillance programme.

Both the Commissioner and Mr Schrems argued the developments had no significance for the issues the court had to decide.

Online Editors

Editor's Choice

Also in Irish News