Monday 16 July 2018

EU Court asked to rule on data transfer regime

Data privacy activist Max Schrems filed the original complaint
Data privacy activist Max Schrems filed the original complaint

Jeanne Kelly and Peter Bolger

The Irish High Court has asked the Court of Justice of the EU (CJEU) to decide on the validity of European Commission agreements on how data is transferred between the US and EU by Facebook and others.

The High Court made a reference for a preliminary ruling to the Court of Justice of the European Union (CJEU) in proceedings between the Data Protection Commissioner, Facebook Ireland Limited, and data privacy activist Max Schrems.

The case concerns the transfer of personal data by Facebook Ireland to its parent company in the US and raised issues as to whether a basis for doing so used by Facebook, namely the Standard Contractual Clauses (SCCs) were lawful under Irish and EU data protection law.

Mr Schrems had filed a complaint a number of years ago with the Data Protection Commissioner in which he claimed that the transfer of his personal data by Facebook Ireland to its US parent company was unlawful.

EU and Irish law prohibits the transfer of personal data to a country outside the European Economic Area (EEA) unless that country provides an adequate level of protection. In transfers of personal data outside of the EEA to the United States, there were two main mechanisms to legitimise these transfers.

One mechanism, the 'SafeHarbour' arrangement, had previously been held to be invalid by the CJEU in that it failed to afford EU citizens the right to an effective remedy before US courts for any breaches of the rights to respect for private life and the protection of personal data guaranteed by the EU Charter of Fundamental Rights. Following that decision, a replacement mechanism called 'Privacy Shield' was designed as an alternative transfer framework, under the EU-US Privacy Shield Decision.

After the first Schrems CJEU ruling was delivered in October 2015, the matter returned to the High Court, where an order was made returning Mr Schrems's complaint to the Data Protection Commissioner for investigation.

The Data Protection Commissioner reopened her investigation, but formed the view that she could not conclude it without obtaining a further ruling from the CJEU as to the status of the decisions of the European Commission upon which SCCs depend.

The Data Protection Commissioner then brought further proceedings before the High Court in which she sought a further reference to the CJEU for a preliminary ruling.

The High Court, recognised that the outcome of the proceedings had potentially significant economic and commercial consequences for a range of companies and individuals across the EU. It granted a number of governmental, business, and non-governmental organisations permission to participate in the proceedings as amici curiae (or "friends of the court"). These included the US and the Business Software Alliance (which represents the interests of global technology providers including Apple, IBM, Microsoft, and Intel).

Now, in a landmark judgment the High Court has decided to make a reference for a preliminary ruling to the CJEU.

In doing so, the High Court held that the Data Protection Commissioner had raised "well-founded concerns" as to the validity of the European Commission decisions on SCCs contractual clauses.

The High Court found that the adoption of the EU-US Privacy Shield Decision, following the striking down of the Safe Harbour arrangement, did not mean that a reference to the CJEU should not be made. In particular, the High Court was of the view that a decision from the CJEU was required in order to determine whether certain features of the Privacy Shield represented an adequate remedy for the protection of the rights to privacy and personal data which are protected under the EU Charter of Fundamental Rights.

The High Court noted that it was extremely important that there be uniformity in the application of the relevant EU directive throughout the European Union "on this vitally important issue". On that basis, the High Court found that it was both necessary and appropriate to refer the matter to the CJEU.

The High Court has given the parties to the proceedings an opportunity to consider the written judgment, which runs to 152 pages, and will hear further submissions from the parties on the specific questions to be referred to the CJEU.

Jeanne Kelly and Peter Bolger are Intellectual Property, Technology and Privacy solicitors at LK Shields

Irish Independent

Business Newsletter

Read the leading stories from the world of Business.

Also in Business