Data Protection Commissioner

• Jurisdiction: Ireland
• Judge: Mr. Justice Brian J. McGovern
• Judgment Date: 19 July 2016
• Neutral Citation: [2016] IEHC 414
• Docket Number: [2016 No. 4809 P.]
• Court: High Court
• Date: 19 July 2016

BETWEEN

DATA PROTECTION COMMISSIONER

PLAINTIFF

AND

FACEBOOK IRELAND LIMITED

AND

MAXIMILLIAN SCHREMS

DEFENDANTS

[2016] IEHC 414

McGovern J.

[2016 No. 4809 P.]

THE HIGH COURT

Data Protection – Transfer of data – Commission Decision 2000/520/EC – The Charter of Fundamental Rights of the European Union (Charter) – Art. 267 of the Treaty on the Functioning of the European Union (TEFU) – Availability of the effective remedy to EU citizens in US – Appointment of amicus curiae

Facts: Following the filing of the complaint by the second named defendant against the first named defendant with the plaintiff alleging that transfer of data by the first named defendant to the US Parent company was unlawful, the plaintiff after delivering its draft decision in relation to that issue now sought a declaration as to the validity of the SCC decisions to the extent they apply to data transfers from EU to US having regard to the Charter. The plaintiff also sought a reference to the CJEU pursuant to art. 267 of TEFU. The key issue arose on joining several other parties as amicus curiae in the present proceedings as the issue was of utter public importance.

Mr. Justice Brian J. McGovern held that a reference to CJEU could not be made unless the matter was heard before the Court of first instance. The Court granted an order for joining the United States, Electronic Privacy Information Centre, Business Software Alliance, Digital Europe while refusing the other to be joined as an amicus curiae. The Court observed that a party could be joined as an amicus curiae if that party was able to bring the exclusive expertise which was otherwise unavailable and had adopted a neutral position for the common good and benefit. The Court held that an amicus curiae should not be permitted to join the litigation at a trial stage but at an appellate stage wherein the legal rather than factual issues were in debate.

JUDGMENT of Mr. Justice Brian J. McGovern delivered on the 19th day of July, 2016

1 These proceedings concern the transfer of data by Facebook Ireland Limited (' FIL') to its US parent company Facebook Inc. and whether this transfer is lawful under both national and EU data protection law.

2 The second named defendant, Maximillian Schrems, filed a complaint with the plaintiff on 25th June, 2013, in which he argued that the transfer of his personal data by FIL to its US parent company was unlawful. Following the hearing of judicial review proceedings in the High Court on 29th April, 2014, a reference was made to the Court of Justice of the European Union (' the CJEU') in which it held, inter alia, that, by failing to afford EU citizens any possibility of pursuing effective legal remedies in the US in connection with any alleged contravention of their rights under Article 7 and/or 8 of the Charter, Commission Decision 2000/520/EC of 26th July, 2000, (' the Safe Harbour Decision') was in breach of Article 47 of the Charter and therefore invalid. After the CJEU ruling, the judicial review proceedings returned before the High Court and, on 20th October, 2015, an order was made quashing the Commissioner's refusal to investigate the complaint brought by Mr. Schrems. The complaint was submitted back to the Commissioner for investigation. Accordingly, the Commissioner opened an investigation into the complaint and, following the hearing of a reformulated complaint, the Commissioner, on 24th May, 2016, issued a draft decision. The decision was issued in draft form so as to preserve the right of Mr. Schrems and/or FIL to make further submissions in relation to its terms and the Commissioner will give consideration to such submissions in due course.

3 The investigation of the reformulated complaint by the Commissioner was conducted on the basis of two strands which proceeded in parallel. Strand one comprised a factual investigation which focused on establishing whether FIL had continued to transfer subscribers' personal data to the US subsequent to the CJEU ruling and, if FIL had continued to do so, strand one of the investigation also sought to examine the legal bases on which such transfers are effected. Strand two sought to examine whether, in view of the adequacy criteria identified in Article 25(2) of Directive 95/46/EC of 24th October, 1995, (' the Directive'), the US ensures adequate protection for the data protection rights of EU citizens.

4 The Commissioner has formed the view that she cannot conclude her investigation without obtaining a ruling from the CJEU on the validity of the three Commission Decisions on standard contractual clauses that have been approved by the Commissioner as fulfilling the requirements of Article 26(4) of the Directive (' the SCC Decisions'). These are:-

(1) Commission Decision 2001/497/EC of 15th June, 2001, on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC (Text with EEA relevance) (notified under document number C(2001) 1539) [2001] OJ L181, 4.7. 2001, pp. 19-31;

(2) Commission Decision 2004/915/EC of 27th December, 2004, amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries (notified under document number C(2004) 5271) (Text with EEA relevance) [2004] OJ L385, 29.12. 2004, pp.74-84; and,

(3) Commission Decision 2010/87/EU of 5th February, 2010, on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (notified under document C(2010) 593) (Text with EEA relevance) [2010] OJ L39, 12. 2.2010, p. 5-18.

5 In these proceedings the plaintiff claims:-

(1) a declaration as to the validity of the SCC Decisions insofar as they apply to data transfers from the European Economic Area to the United States having regard to the Charter of Fundamental Rights of the European Union (' the Charter') and in particular Article 7 and/or Article 8 and/or Article 47 thereof.

(2) A reference to the CJEU pursuant to Article 267 of the Treaty on the Functioning of the European Union and para. 65 of the ruling of the CJEU in Maximillian Schrems v. Data Protection Commissioner ( Case C-362/14), 6th October, 2015, in order to obtain a preliminary ruling on the validity of the SCC Decisions insofar as applies to data transfers from the EU to the US, having regard to the Charter and in particular to Article 7 and/or Article 8 and/or Article 47 thereof.

Applications by Parties to be joined as Amici Curiæ

6 Within the State and across the EU, there are a significant number of entities that rely on the SCC Decisions for the purpose of making data transfers between the EU and the US. The outcome of these proceedings has the potential to have significant economic and commercial consequences for a range of companies and individuals across the European Union. In view of this, a number of parties have brought applications to be admitted as amici curiæ in these proceedings. The parties seeking audience in that capacity are:-

(i) The United States of America;

(ii) BSA Business Software Alliance;

(iii) IBEC Limited;

(iv) Electronic Frontier Foundation (EFF);

(v) Digital Europe;

(vi) Irish Council of Civil Liberties and American Civil Liberties Union;

(vii) Electronic Privacy Information Centre (EPIC);

(viii) Irish Human Rights and Equality Commission; and,

(ix) Mr. Kevin Cahill.

7 The parties were largely in agreement as to the legal principles which apply. In H.I. v. Minister for Justice, Equality and Law Reform [2004] 3 I.R. 197, the Supreme Court held that the court may appoint an amicus curiæ pursuant to its inherent jurisdiction. In O'Brien v. Personal Injuries Assessment Board (No. 1) [2005] 3 I.R. 328, Finnegan P. identified a number of matters which the court ought to consider when deciding whether to exercise its discretion in favour of appointing an amicus curiæ. The first is whether the applicant has 'a bona fide interest and is not just acting as a meddlesome busybody'; secondly, whether the case has a ' public law dimension' and that the applicant ' has not just a sectional interest, that is the interest of its members, but a general interest which should be respected and to which regard should be had'; and, thirdly, whether ' the decision may affect a great number of persons'.

8 In Doherty v. South Dublin County Council [2007] 1 I.R. 246, the Supreme Court upheld the order of the Quirke J. in the High Court whereby the learned trial judge found that the equality authority had statutory authority to act as an amicus curiæ.

9 In Fitzpatrick v. F.K. [2007] 2 I.R. 406, Clarke J. said at 415-416:-

'...it seems clear that amongst the important factors to be taken into account are:-

(a) whether the proposed amicus curiæ might be reasonably said to be partisan or, on the other hand, to be largely neutral and in a position to bring to bear expertise in respect of an area which might not otherwise be available to the court; and,

(b) the stage which had been reached in the proceedings with particular reference to a distinction between trial courts and appellate...