Data Protection Commissioner v Facebook Ireland Ltd

• Jurisdiction: Ireland
• Court: High Court
• Judge: Ms. Justice Costello
• Judgment Date: 03 October 2017
• Neutral Citation: [2017] IEHC 545
• Docket Number: [2016 No. 4809 P.]
• Date: 03 October 2017

[2017] IEHC 545

THE HIGH COURT

COMMERCIAL

Costello J.

[2016 No. 4809 P.]

BETWEEN

THE DATA PROTECTION COMMISSIONER

PLAINTIFF

AND

FACEBOOK IRELAND LIMITED

AND

MAXIMILLIAN SCHREMS

DEFENDANTS

International law – Data Protection – Charter of Fundamental Rights of the European Union ('Charter') – The Treaty on the Functioning of the European Union ('TFEU') – Treaty on the European Union ('TEU') – Commission Decision 2001/497/EC – Commission Decision 2004/915/EC – Commission Decision 2010/87/EU – 5 U.S.C. Section 702 – Right to an effective remedy of EU citizens in third country for transfer of private data – Decision 2000/520/EC ('Safe Harbour Decision')

Facts: The key issue in the proceedings pertained to the right to an effective remedy to EU citizens whose private data had been transferred by the social media companies to third countries in contravention of the Commission Decisions 2001/497/EC; 2004/915/EC; and 2010/87/EU. The second defendant earlier had filed a complaint to the plaintiff in relation to his data sharing and transfer by the first defendant to a third country (United States). The plaintiff, who initially refused to entertain that complaint, nonetheless conducted an investigation into that complaint after the institution of judicial review proceedings by the second defendant and the determination of Court of Justice of European Union ('CJEU') upon reference that the plaintiff was not precluded from conducting an investigation into the EU-US data transfers under the Safe Harbour Decision. The plaintiff had now filed the present proceedings claiming that it needed to obtain a ruling from the CJEU on the validity of the said Commission Decisions before concluding the investigation.

Ms. Justice Costello referred the case to the CJEU for the determination of the validity of the Commission Decisions 2001/497/EC; 2004/915/EC; and 2010/87/EU. The Court held that it was not required to conduct the adequacy of data protection regime in the United States. The Court, however, opined that it had jurisdiction to entertain a question of the legitimacy of the remedial regime available to the EU citizens whose data were transferred to a third country on the pretext of national security as it contravened art. 57(1) of the Charter. The Court noted that the limitations imposed by the intelligence agencies of a third country to an effective remedy to the EU citizens whose right of privacy had been infringed was in contravention of art. 47 of the Charter.

JUDGMENT of Ms. Justice Costello delivered on the 3rd day of October, 2017

Introduction

1 This is an unusual case. The proceedings have been brought in this court for the purposes of obtaining a ruling from the Court of Justice of the European Union ('the CJEU') on the validity of three decisions of the Commission of the European Union ('the Commission') insofar as they apply to data transfers from the European Economic Area ('the EEA') to the United States of America. The decisions are: -

(1) Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC [2001] OJ L181/19;

(2) Commission Decision 2004/915/EC of 27 December 2004 amending decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries (notified under document number C(2004)5271) [2004] OJ L385/74; and

(3) Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (notified under document C (2010) 593) (Text with EEA relevance) [2010] OJ L39/5 (together the 'SCC decisions')

2 The plaintiff is the Data Protection Commissioner in Ireland ('the DPC'). She is the person charged with the enforcement and monitoring of compliance with the Data Protection Acts 1988 to 2003. She is also the person designated as the national supervisory authority for the purposes of monitoring the application in Ireland of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ('the Directive').

3 The DPC is investigating a complaint made by the second named defendant (Mr. Schrems), a student with an address at Schadegasse 2/13, 1060 Vienna, Austria who operates a Facebook account. She has formed the view that the complaint raises issues as to the validity of the SCC decisions having regard to the provisions of Article 7 and/or Article 8 and/or Article 47 of the Charter of Fundamental Rights of the European Union ('the Charter'). In light of the Ruling of the CJEU in Case C-362/14 Schrems v. Data Protection Commissioner, EU:C:2015:650 (' Schrems') 6th October, 2015, and in particular para. 65 of the Ruling she instituted these proceedings in order that the validity of the SCC decisions may be determined, either by this court declining to make a reference pursuant to Article 267 of the Treaty on the Functioning of the European Union ('TFEU') on the basis that no issue as to the validity of the SCC decisions arises, or on the basis that this court makes a reference to the CJEU and the CJEU makes a ruling on the validity of the SCC decisions.

The Parties

4 The DPC joined Mr. Schrems as a defendant to the proceedings as he is the complainant whose complaint she is investigating and which gives rise to these proceedings. Facebook Ireland Ltd. ('Facebook') is a limited liability company which operates an online social networking service, with a registered address at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2. It is part of the Facebook group of companies. Facebook Inc. is a US corporation, established under the laws of the State of Delaware and having its principal place of business at Menlo Park, California. It is the ultimate parent of the Facebook group of companies. Facebook is joined as a defendant to these proceedings as Mr. Schrems' complaint relates to the transfer of his data by Facebook to Facebook Inc. in the United States for processing. The DPC seeks no relief against either party. She joined them as defendants as they were the parties most concerned with the issues in order that they might engage fully in the proceedings. They have each done so.

5 The case raises issues of very major, indeed fundamental, concern to millions of people within the European Union and beyond. First, it is relevant to the data protection rights of millions of residents of the European Union. Secondly, it has implications for billions of euro worth of trade between the EU and the US and, potentially, the EU and other non-EU countries. It also has potentially extremely significant implications for the safety and security of residents within the European Union. There is considerable interest in the outcome of these proceedings by many parties having a very real interest in the issues at stake.

6 Applications were made by a number of parties to be joined or heard in the proceedings. In the event four parties were joined as amici curiae to the proceedings. These were the United States of America, the Business Software Alliance (BSA), Digital Europe and the Electronic Privacy Information Centre (EPIC). Each of these parties made submissions at the hearing but were not permitted to adduce evidence before the court.

The Charter of Fundamental Rights of the European Union ('the Charter')

Article 7

Respect for private and family life

Everyone has the right to respect for his or her private and family life, home and communications.

Article 8

Protection of personal data

1. Everyone has the right to the protection of personal data concerning him or her.

2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.

3. Compliance with these rules shall be subject to control by an independent authority.

Article 47

Right to an effective remedy and to a fair trial

Everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article.

Everyone is entitled to a fair and public hearing within a reasonable time by an independent and impartial tribunal previously established by law. Everyone shall have the possibility of being advised, defended and represented.

Legal aid shall be made available to those who lack sufficient resources in so far as such aid is necessary to ensure effective access to justice.

Article 51

Field of application

1. The provisions of this Charter are addressed to the institutions and bodies of the Union with due regard for the principle of subsidiarity and to the Member States only when they are implementing Union law. They shall therefore respect the rights, observe the principles and promote the application thereof in accordance with their respective powers and respecting the limits of the powers of the Union as conferred on it in the Treaties.

2. This Charter does not extend the field of application of Union law beyond the powers of the Union or establish any new power or task for the Union, or modify powers and tasks as defined in the Treaties

Article 52

Scope and interpretation of rights and principles

1. Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only...