Behind The Headlines: DPC v Facebook And Its Potential Impact On International Trade

Author:Mr Richard Woulfe and Philip Nolan
Profession:Mason Hayes & Curran

Earlier this year, the Irish Data Protection Commissioner commenced proceedings in the High Court against Facebook Ireland Limited and Maxmillian Schrems. These proceedings have attracted unprecedented global interest. We provide an insight into the status of this litigation and its potential implications.

In May 2016, the Irish Data Protection Commissioner ("DPC") started proceedings in the High Court, seeking a reference to the Court of Justice of the European Union ("CJEU") for a preliminary ruling on the validity of the EU Commission decisions which permit data transfers from the EU to third countries on foot of standard contractual clauses ("SCCs").

This litigation, which stems from a complaint by Maxmillian Schrems ("Schrems") to the DPC in respect of Facebook Ireland Limited ("Facebook"), is a follow-on from related litigation (Schrems v Data Protection Commissioner) which resulted in the 2014 CJEU ruling that the EU Commission decision underpinning Safe Harbor was invalid.

The underlying issues

Article 25(1) of the Directive 95/46/EC (the "Directive") prohibits the transfer of personal data outside the EU unless the country to which the data is transferred "ensures an adequate level of protection" for the data protection rights of those individuals whose data is transferred.

However, the Directive provides an exception whereby a Member State may authorise transfers of personal data to a third country which does not ensure an adequate level of protection if "appropriate contractual clauses" are used. These "appropriate contract clauses" are the SCCs, which are heavily relied upon in international commerce to move data from Europe to other jurisdictions.

There are currently three sets of SCCs which have been approved by the Commission ("the SCC Decisions").

In October 2015, in its judgment in Schrems v DPC,  the CJEU laid down the process which national data protection authorities - like the DPC - are expected to take when they have doubts about the validity of a tool that is used to transfer personal data out of Europe: "It is incumbent upon the national legislature to provide for legal remedies enabling the national supervisory authority concerned to put forward the objections which it considers well founded before the national court in order for them, if they share its doubt as to the validity of the Commission decision, to make a reference for a preliminary ruling for the purpose of examination of the decision's validity."


To continue reading