Data Protection Commissioner v Facebook Ireland Limited & anor

PUBLISHED: 12th July 2019

The Supreme Court of Ireland has dismissed Facebook's appeal against the High Court's preliminary reference to the CJEU in respect of the validity of European Commission approved standard contractual clauses (SCCs). 

Under EU data protection law, a lawful transfer mechanism must be in place before personal data is transferred to a country outside the EEA.  SCCs are one such mechanism.

The Supreme Court’s judgment was delivered on 31 May 2019:  Data Protection Commissioner v Facebook Ireland Ltd [2019] IESC 46.

Background

Following a complaint made by Schrems relating to the validity of SCCs as a mechanism to legitimise the transfer of personal data from the EU to the United States, the Data Protection Commissioner (DPC) brought proceedings before the Irish High Court.  In October 2017, the High Court made a preliminary reference to the CJEU.  Facebook applied for leave to appeal the High Court’s decision to make that reference in the Supreme Court, which was granted in July 2018.  The appeal was heard before the Supreme Court in January 2019.

The Supreme Court had two sets of issues to consider:

1. Whether the Supreme Court has jurisdiction to entertain an appeal against a preliminary reference, and if so, what are the appropriate parameters for such an appeal.
2. Some of the High Court’s findings relating to U.S. law and the protections it affords to EU personal data, which Facebook alleged to be in error or incomplete.

Jurisdiction

The Supreme Court held that, while it could entertain the appeal at hand, there were "significant limitations" on the issues that it could properly consider.  In line with previous case law, Mr. Justice Clarke stated that the Supreme Court cannot entertain an appeal against the decision of a court to make a preliminary reference to the CJEU or against the terms of that reference.  He made it very clear that, while a decision of the Supreme Court to overturn facts of a referring court would be binding as a matter of Irish law, the making of a preliminary reference is a matter for the referring court alone as a matter of EU law; it is for the referring court alone to decide whether to make, amend or withdraw any reference. 

Nonetheless, the Supreme Court "can and should" entertain appeals against the facts found by the referring court and overturn those facts where necessary in accordance with Irish law.  Where the referring court has reached conclusions on contested facts or matters of national law, these decisions must be open to the appellate process provided for under the Irish Constitution.  In the interests of justice and the proper use of judicial resources however, the Court acknowledged that it is typically best to leave all issues that might arise on appeal to be dealt with in a single appeal following the conclusion of proceedings in the referring court.  But Mr. Justice Clarke highlighted that there were “exceptional factors at play" in the current proceedings. 

Typically, a national court makes a preliminary reference to the CJEU to rule on a specific question or questions of EU law and when the CJEU has issued its ruling, the matter reverts to the national court to make the appropriate order.  In the current proceedings however, the CJEU will have the final say on the validity or otherwise of SCCs, and there will be no further role of substance for the Irish courts following that determination.  This means that there cannot be any further appeal against any findings of fact after the CJEU's ruling.  On that basis, the Court deemed it necessary for the appeal to be held at this stage of proceedings:

"…to decline to exercise the jurisdiction of the Court to entertain an appeal against the facts at this stage would be for this Court to abdicate its constitutional role of reviewing, within the confines of the limitations imposed by Irish procedural law, findings of fact made in a court such as the High Court"

Facebook's Appeal

The Supreme Court found that it would not be appropriate for it to consider some of Facebook’s heads of appeal which relate directly to the text of the High Court's reference to the CJEU or to whether the High Court shared the concerns of the Data Protection Commissioner.  It would only be proper for the Supreme Court to consider actual decisions of fact.  As Mr. Justice Clarke explained:

"If the facts were wrongly found, then there is at least a possibility that this could have an effect on the ultimate decision of the CJEU". 

While questions of U.S. law are considered to be matters of fact under Irish law, Mr. Justice Clarke acknowledged that the CJEU may not characterise them as such.

On that basis, the Court addressed certain matters only in order to provide clarifications as to the underlying facts, which the High Court or the parties may rely on when making submissions in the CJEU if they so choose.

What Happens Now? 

The Supreme Court’s dismissal of Facebook’s appeal clears the way for the High Court’s preliminary reference, which is set to come before the CJEU on 9 July.

Interestingly, the CJEU has postponed scheduled hearings on Privacy Shield, another mechanism for transferring personal data from the EU to the U.S.  No new date has been set for these hearings, but they will inevitably now come before the CJEU after the Schrems’ proceedings.

Data Protection Litigation in Ireland

The Rules of the Superior Courts (Data Protection Actions) 2019 came into force on 19 June 2019.  These Rules have been introduced to facilitate the operation of the Data Protection Act 2018 and to deal with representative actions by not-for-profit bodies, organisations or associations under that Act. 

It remains to be seen whether representative actions will become popular in Ireland and how not-for-profit bodies, organisations or associations will go about confirming that they satisfy the necessary requirements to bring such actions.

If you would like to know more on any of the above issues, or advice on your data protection compliance obligations, please contact a member of our IP/IT team.