Global menu

Our global pages

Close

Landmark EU-US Data Privacy Irish High Court Case

  • Ireland
  • General

20-04-2017

Data Protection Commissioner v Facebook Ireland Limited and Maximilian Schrems

In proceedings by the Data Protection Commissioner (“DPC”) that commenced on 7 February 2017 in the Irish High Court, the DPC has asked the High Court to make a Preliminary Reference to the Court of Justice of the European Union (“CJEU”) as to the validity of the “standard contractual clauses” (“SCC’s”) mechanism under which personal data is currently being transferred from the European Union (“EU”) to the United States (“US”).

The DPC did not seek orders against Facebook Ireland Limited (“Facebook”) or Maximilian Schrems (“Schrems”) under these proceedings. The purpose of the action is to obtain legal clarification from the CJEU on the validity of the SCC’s under which personal data is transferred from the EU to the US.

Background

This case arose from complaints made by Schrems to the DPC on 25 June 2013 concerning the transfer of data, by Facebook, from the EU to the US. The complaint followed the Snowden disclosures which revealed surveillance by the US National Security Agency of certain internet and telecommunications systems operated by companies including, Facebook, Microsoft and Google.

Schrems was concerned that his data may have been accessed by the US state security agencies because his personal data was being transferred from Facebook to its US parent company, Facebook Inc, under the Safe Harbour regime. The Safe Harbour regime was established by way of an EU Commission decision in 2000 which deemed the US to have an adequate level of data protection where the Safe Harbour regime was adhered to by parties involved in personal data transfers from the EU to the US.

The DPC declined to investigate Schrems’ complaint as the DPC was bound under existing national and EU law to apply Safe Harbour. Consequently, Schrems applied to the Irish High Court for a judicial review of the DPC’s decision. On 18 June 2014, Justice Hogan delivered his judgment holding that the essential question for determination was whether the DPC was bound by the EU Commission’s decision on the Safe Harbour regime regarding the adequacy of data protection law and practice in the US.

The Irish High Court referred the issue to the CJEU because it did not have authority to make such a ruling. On 6 October 2015, the CJEU in Maximillian Schrems v Data Protection Commissioner (Case C 362/14) ruled that the Safe Harbour scheme was invalid.

On 20 October 205, Schrems’ proceedings were returned before the Irish High Court and the decision of the CJEU was implemented by the making of a High Court Order which set aside the decision by the DPC not to investigate Schrems’ complaint of 25 June 2013. The High Court then remitted Schrems’ original complaint back to the DPC for investigation.

The DPC subsequently opened an investigation into Schrems’ original complaint but he subsequently reformulated his complaint to take account of the fact that the Safe Harbour scheme was deemed invalid. Schrems’ reformulated complaint was based on Facebook’s use of SCC’s to authorise EU to US data transfers. On 24 May 2016, the DPC issued a draft decision which found that Schrems raised “well-founded” objections. The DPC formed a preliminary view that using SCC’s did not provide the level of protection necessary and that there were “deficiencies” in the rights of EU citizens to access remedies under US law for any breach of their data protection rights.

The DPC was of the view that they could not complete the investigation without a ruling on the validity of the SCC’s. As a result, the DPC commenced legal proceedings in the Irish High Court seeking a declaration as to the validity of the EU Commission decisions concerning SCC’s and a Preliminary Reference to the CJEU on this issue.

Amicus Curiae

In light of the potential implications of this case, a number of international amicus curiae or friends of the court applied to be joined to the proceedings. On 19 July 2016, the High Court ruled that four of the ten parties be joined to the proceedings as friends of the Court.

As a result, the US government, Business Software Alliance, the Electronic Privacy Information Centre and Digital Europe were allowed to make representations to the Court in relation to the proceedings.

The US government were seeking to claim that “significantly enhanced” protections have been put in place in recent years to ensure the privacy rights of EU citizens and has warned of the “sweeping” commercial ramifications should the CJEU find that the SCC’s offer inadequate protection which could also undermine international co-operations to confront common threats.

Proceedings

The proceedings concluded on Wednesday 15 March after 20 days (approximately 5 and a half weeks) of hearing before Justice Costello.

We monitored the proceedings closely and have set out below more detailed information on the various stages of these proceedings:

Opening Statements

Amicus Curiae Application to Submit Affidavits to the Court

Expert Witnesses

Facebook Ireland Limited’s Expert Witness Reports sent to US Government

Amicus Curiae Submissions

Closing Statements

New Submission Request - 17 May 2017 Update

Court to Receive Update to Expert Option’s – 19 May 2017 Update

Judgment

https://www.eversheds-sutherland.com/global/en/what/publications/shownews.page?News=en/ireland/landmark-eu-us-data-privacy-case-referred-to-cjeu 

We will continue to monitor the progress of this matter.

For more information contact:

Marie McGinley
Partner, Head of IP, Technology and DP
mariemcginley@eversheds-sutherland.ie
+353 1 6441 457

Ciara McGrath
Solicitor
ciaramcgrath@eversheds-sutherland.ie
+353 1 6644 336

This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full terms and conditions on our website.

< Go back