Sunday 22 September 2019

Explainer: What's the Facebook privacy case all about? How does it affect me? And what happens now?

Facebook. Photo: Stock
Facebook. Photo: Stock
Adrian Weckler

Adrian Weckler

Today, the Irish High Court deferred the question of whether to cut off data flows from big companies such Facebook and Google. It kicked the can up to the European Court of Justice.

It’s a big international case with global attention. At issue are questions of US spying, European privacy and Ireland’s role in policing the major tech multinationals based here.

Here’s a beginner’s guide to the affair.

1. What’s this all about?

Europeans remain upset that American security agencies routinely spy on their Facebook accounts, email and other data. Some say that if US spies are allowed to keep trawling through our stuff -- through US laws such as the Foreign Intelligence Surveillance Act -- we shouldn’t let companies here transact any data to US friends or business contacts.

2. Any data? Hang on, is that like an email or a Facebook photo?


3. Surely that won’t happen?

We’ll have to see. The High Court has referred the issue to the European Court of Justice, which has the final say on all law within the EU.

4. In the meantime, is my Facebook affected?

No. Everything remains the same until the European Court hears the matter. That looks likely to happen at the end of next year or early 2019.

5. Is there any chance Facebook could be banned?

Not banned, no. But if the European Court takes a hard line and EU lawmakers don’t come up with some creative emergency treaty, it means that Facebook -- and other “communication service providers” like Google, Twitter, Microsoft, Slack and Yahoo which transfer lots of data -- might have to introduce some sort of ring-fenced data arrangement within the EU.

6. But isn’t the internet global? How would that work?

It’s hard to see how. We’ve asked big companies -- including Facebook -- about this before and they don’t have a clear idea about how to do this.

7. The company I work for does quite a bit of business with US organisations. Is that going to be affected?

Assuming they use global “communication service providers” such as Microsoft Outlook or Gmail, yes.

8. What a mess. How did all this come about?

An Austrian student called Max Schrems took the case in Ireland because that’s where Facebook has its European headquarters. He argued that what we all found out about US authorities’ spying activities - through revelations from the whistleblower Edward Snowden - means that the Americans aren’t respecting European privacy law. As such, he argues, certain aspects of previously accepted European law, which allow companies like Facebook to transfer data between continents, are now redundant. One of these is called a ‘standard contract clause’, also known as a ‘model clause’. Thousands of multinational companies sign up to this to pledge thta European citizens’ data is treated with proper respect and privacy when it’s outside the EU area of protection. But if US authorities routinely endorse security forces trawling through our personal information, it may not have much effect.

9. So this is ultimately about trying to get the Americans (or the British) to stop the CIA and MI5 from routinely sweeping through EU citizens’ data?

Partially, yes.

10. Is that realistic?

That’s the million-euro question. If US authorities don’t satisfy the standards of the European Court -- which they almost certainly won’t -- will the EU follow through in “suspending data flows” from the EU to the US? (Or between the EU and the UK, once it’s out?) That’s hard to envisage. What might happen is another hastily-formed treaty between the US and the EU to keep existing data transfers legal.

11. Wasn’t all this hashed out before with some new US-EU treaty supposed to solve it?

Yes. A treaty called ‘Privacy Shield’ was agreed last year to replace the ‘Safe Harbour’ agreement that was struck down by the European Court of Justice two years ago. But privacy campaigners -- and the Irish data protection commissioner -- don’t really think that the new treaty is effective enough. It looks more than possible that the European Court could strike down ‘Privacy Shield’ as well.

12. What happens now?

The Irish High Court is preparing the wording of the questions to be referred to the European Court of Justice. That court will take into account the facts established by the Irish court and rule on the substantive issue of European law involved.

Online Editors

Also in Business