Irish High Court Will Refer Data Protection Case to the EU Court

PUBLISHED: 3rd October 2017

Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems

The High Court in Ireland has decided to make a reference for a preliminary ruling to the Court of Justice of the European Union (CJEU) in proceedings between the Data Protection Commissioner, Facebook Ireland Limited, and data privacy activist Maximillian Schrems.

The case concerned the transfer of personal data by Facebook Ireland Limited to its parent company in the US, Facebook Inc, and raised issues as to whether a basis for doing so used by Facebook, namely the Standard Contractual Clauses (SCCs) were lawful under Irish and EU data protection law.

Background

Mr. Schrems, at the time an Austrian graduate student, had filed a complaint a number of years ago, with the Data Protection Commissioner in which he claimed that the transfer of his personal data by Facebook Ireland Limited to its US parent company was unlawful. 

EU and Irish law prohibits the transfer of personal data to a country outside the European Economic Area (EEA) unless that country provides an adequate level of protection.  In transfers of personal data outside of the EEA to the United States, there were two main mechanisms to legitimise these transfers.

‘Safe Harbor’ struck down in 2015

One such mechanism, the ‘Safe Harbor’ arrangement, had previously been held to be invalid by the CJEU in that it failed to afford EU citizens the right to an effective remedy before US courts for any breaches of the rights to respect for private life and the protection of personal data guaranteed by the EU Charter of Fundamental Rights.  Following that decision, a replacement mechanism called “Privacy Shield” was designed as an alternative transfer framework, under the EU-US Privacy Shield Decision.

Investigation by Data Protection Commissioner

After the first Schrems CJEU ruling was delivered in October 2015, the matter returned to the High Court, where an order was made returning Schrems’ complaint to the Data Protection Commissioner for investigation.

The Data Protection Commissioner reopened her investigation, but formed the view that she could not conclude it without obtaining a further ruling from the CJEU as to the status of the decisions of the European Commission upon which SCCs depend.

Irish High Court proceedings

The Data Protection Commissioner then brought further proceedings before the (Irish) High Court in which she sought a further reference to the CJEU for a preliminary ruling. 

The High Court, recognised that the outcome of the proceedings had potentially significant economic and commercial consequences for a range of companies and individuals across the EU.  It granted a number governmental, business, and non-governmental organisations permission to participate in the proceedings as amici curiae (or “friends of the court”).  These included the United States of America and the Business Software Alliance (which represents the interests of global technology providers including Apple, IBM, Microsoft, and Intel).  

High Court judgment

In a landmark judgment delivered this morning, 3 October 2017, the High Court has decided to make a reference for a preliminary ruling to the CJEU.

In doing so, the High Court held that the Data Protection Commissioner had raised “well-founded concerns” as to the validity of the European Commission decisions on SCCs contractual clauses.

The High Court found that the adoption of the EU-US Privacy Shield Decision, following the striking down of the Safe Harbor arrangement, did not mean that a reference to the CJEU should not be made.  In particular, the High Court was of the view that a decision from the CJEU was required in order to determine whether certain features of the Privacy Shield represented an adequate remedy for the protection of the rights to privacy and personal data which are protected under the EU Charter of Fundamental Rights.

The High Court noted that it was extremely important that there be uniformity in the application of the relevant EU directive throughout the European Union “on this vitally important issue”.  On that basis, the High Court found that it was both necessary and appropriate to refer the matter to the CJEU.

The High Court has given the parties to the proceedings an opportunity to consider the written judgment, which runs to 152 pages, and will hear further submissions from the parties on the specific questions to be referred to the CJEU.

For further information contact Aideen Burke (aburke@lkshields.ie) in our Intellectual Property, Technology and Privacy team.

© LK Shields, 2017