Data Protection Commissioner v Facebook Ireland Ltd

JurisdictionIreland
CourtSupreme Court
JudgeMr. Justice Clarke
Judgment Date31 May 2019
Neutral Citation[2019] IESC 46
Docket Number[S.C. No. 68 of 2018],Appeal No: 2018/68
Date31 May 2019
Between/
The Data Protection Commissioner
Plaintiff/First Named Respondent
and
Facebook Ireland Limited
First Named Defendant/Appellant
and
Maximillian Schrems
Second Named Defendant/Second Named Respondent

[2019] IESC 46

Appeal No: 2018/68

THE SUPREME COURT

Constitutional law – European Union law – United States law – Appellant seeking leave to appeal to the Supreme Court – Whether any appeal lies to the Supreme Court

Facts: The second defendant/second respondent, Mr Schrems, brought a complaint to the plaintiff/first respondent, the Data Protection Commissioner (DPC), who formed the required view as to having concerns relating to the validity of certain relevant EU instruments, being Commission Decisions 2001/497/EC, 2004/915/EC, and 2010/87/EU, which concerned “Standard Contractual Clauses”. On that basis, the DPC brought proceedings before the High Court. As a result of a judgment of Costello J (The Data Protection Commissioner v Facebook Ireland Limited & anor [2017] IEHC 545) dated 3 October 2017, with a revised version circulated on 12 April 2018, the High Court referred certain questions to the Court of Justice (CJEU), which reference procedure remained pending before that Court. However, the first defendant/appellant, Facebook Ireland Ltd, sought leave to appeal to the Supreme Court. One of the issues which concerned the Court was as to whether any appeal lay in the context of a decision of the High Court to make a reference to the CJEU. Against that backdrop, the Court decided to hold a short oral procedure in relation to the application for leave to appeal. For the reasons set out in a judgment dated 31 July 2018 (Data Protection Commissioner & anor v Facebook Ireland Limited & anor [2018] IESC 38) (the earlier judgment), the Court decided to grant leave. Two broad sets of issues were the subject of leave to appeal. The first concerned the question of whether, as a matter of the combined effect of Irish constitutional law and the law of the European Union, any appeal at all lies to the Court in circumstances such as had arisen in this case and, if so, the permissible parameters of any such appeal. The second set of issues concerned certain findings of the High Court in relation to the law of the United States and the protections which that law confers on data subjects whose data is transferred to the United States from the European Union. Some of those findings were said by Facebook to be either in error or misleadingly incomplete. To the extent that an appeal may be held to lie, Facebook invited the Court to hold that the specific findings referred to were in error or incomplete and to make such order as the Court may have jurisdiction to grant to deal with such a situation.

Held by Clarke CJ that it was open to the Court to entertain an appeal against a decision of the High Court in circumstances where the High Court had made a reference to the CJEU under the Schrems v Data Protection Commission (Case C-362/14) EU:C:2015:650, [2016] 2 C.M.L.R. 2 (Schrems I) jurisprudence. Clarke CJ was satisfied that the Court could and should entertain any appeal against the facts found by the High Court and should overturn those facts, if it could be established that they were not sustainable in accordance with the relevant Irish jurisprudence. Clarke CJ suggested that the Court should not entertain some of the areas of appeal put forward on behalf of Facebook on the basis that they either involved a direct appeal against the text of the reference or were concerned with matters which essentially go towards the question of whether the High Court shared the concern of the DPC. Having analysed each of the remaining heads of appeal, Clarke CJ was satisfied that in each category it was more appropriate to characterise the criticisms which Facebook sought to make of the judgment of the High Court as being directed towards the proper characterisation of underlying facts rather than towards those facts themselves. In those circumstances, Clarke CJ did not propose making any order overturning any aspect of the High Court judgment.

Clarke CJ held that the appeal should be dismissed.

Appeal dismissed.

Judgment of Mr. Justice Clarke , Chief Justice, delivered the 31st May, 2019
1. Introduction
1.1

The transfer of data from the European Union to other jurisdictions, not least to the United States, has been the subject of both political and legal controversy in recent years. The underlying issues which give rise to the background to this appeal are a further episode in the legal aspect of that controversy.

1.2

However, it is important to start this judgment by emphasising what are, on any view, a number of unusual features of this case and to emphasise, in that context, what this judgment is not about.

1.3

It will be necessary to go into somewhat more detail about the form of proceedings which were before the High Court in this case and in respect of which an appeal has been brought to this Court. However, it is fair to say that the proceedings concerned derive as to their form from the judgment of the Court of Justice (‘CJEU’) in Schrems v. Data Protection Commission ( Case C-362/14) EU:C:2015:650, [2016] 2 C.M.L.R. 2 (‘ Schrems I’). That judgment required that the national law of member states provide a procedure whereby the person or body charged with data protection in the EU member state concerned (such as the plaintiff/first named respondent in this case, the Data Protection Commissioner (‘the DPC’)) should have a method of referring to the CJEU concerns relating to Union instruments in the data protection field, in circumstances where questions might arise as to the validity of the instruments in question.

1.4

The second named defendant/second named respondent, Mr. Schrems, brought a complaint to the DPC, who formed the required view as to having concerns relating to the validity of certain relevant EU instruments, being Commission Decisions 2001/497/EC, 2004/915/EC, and 2010/87/EU, which concerned ‘Standard Contractual Clauses’. On that basis, the DPC brought these proceedings before the High Court. The proceedings involved the DPC as plaintiff, the first named defendant/appellant, Facebook Ireland Limited (‘Facebook’), and Mr. Schrems as defendants with, for reasons which will be set out later, the Government of the United States (‘the US Government’) intervening. As a result of a judgment of Costello J. ( The Data Protection Commissioner v. Facebook Ireland Limited & anor. [2017] IEHC 545) dated 3 October 2017, with a revised version circulated on 12 April 2018, the High Court referred certain questions to the CJEU, which reference procedure remains pending before that Court.

1.5

However, Facebook sought leave to appeal to this Court. One of the issues which concerned this Court was as to whether any appeal lay in the context of a decision of the High Court to make a reference to the CJEU. Against that backdrop, this Court decided, unusually, to hold a short oral procedure in relation to the application for leave to appeal. For the reasons set out in a judgment dated 31 July 2018 ( Data Protection Commissioner & anor. v. Facebook Ireland Limited & anor. [2018] IESC 38) (‘the earlier judgment’), this Court decided to grant leave. While it will be necessary to refer to the grant of leave in more detail in due course, it is fair to say that two broad sets of issues were the subject of leave to appeal. The first concerned the question of whether, as a matter of the combined effect of Irish constitutional law and the law of the European Union, any appeal at all lies to this Court in circumstances such as have arisen in this case and, if so, the permissible parameters of any such appeal. The second set of issues concern certain findings of the High Court in relation to the law of the United States and the protections which that law confers on data subjects whose data is transferred to the United States from the European Union. Some of those findings are said by Facebook to be either in error or misleadingly incomplete. To the extent that an appeal may be held to lie, Facebook invites this Court to hold that the specific findings referred to are in error or incomplete and to make such order as this Court may have jurisdiction to grant to deal with such a situation.

1.6

Thus, the two broad sets of issues are those concerning the scope, if any, of appeal which may be available to Facebook and, to the extent that an appeal may lie, the issues of US law to which reference has been made. It should also be noted that the Government of the United States was granted leave to intervene in both the High Court and on this appeal.

1.7

However, in order to understand those issues more fully, it is necessary to deal in more detail with certain aspects of these proceedings and the process to date. I propose to start by setting out what I think can fairly be said to be the unusual features of these proceedings, for that background has the potential to influence both of the sets of issues which arise.

2. The Nature of these Proceedings
2.1

The issue which arose in Schrems I concerned the validity of the so-called ‘Safe Harbour’ arrangements entered into between the European Union and the United States of America. Briefly stated, in its decision dated the 26th July 2000 (2000/520/EC) (‘the Safe Harbour Decision’), the European Commission had determined, in accordance with Article 25(6) of Directive 95/46/EC, that an adequate level of protection would be attained in relation to data transferred from the EU to an organisation established in the United States, where such organisation complied with the principles set out in the Safe Harbour Decision and self-certified that it was in compliance with those principles.

2.2

Mr. Schrems made a complaint to the DPC concerning the transfer of his data from the EU to the United States under the Safe Harbour arrangements...

To continue reading

Request your trial
5 cases
  • Enniskerry Alliance v an Bord Pleanala and Protect East Meath Ltd v an Bord Pleanala
    • Ireland
    • High Court
    • 10 June 2022
    ...Supreme Court has itself recently clearly affirmed this fundamental principle in Data Protection Commissioner v Facebook, Supreme Court [2019] IESC 46, where Clarke CJ cited Case C-210/06 Cartesio [2008] ECR I-9641, where the CJEU stated at §§95–96: “Where rules of national law apply which ......
  • Facebook Ireland Ltd v Data Protection Commission
    • Ireland
    • High Court
    • 14 May 2021
    ...January, 2019 and on 31 st May, 2019 it dismissed the appeal: Data Protection Commissioner v. Facebook Ireland Ltd and Maximilian Schrems [2019] IESC 46. 24 . Shortly after the DPC commenced the DPC Proceedings, the European Commission adopted Commission Implementing Decision (EU) 2016/1250......
  • Friends of the Irish Environment CLG v Minister for Communications Climate Action and the Environment
    • Ireland
    • High Court
    • 14 September 2020
    ...this as a “bespoke” procedure, borrowing from the language of Clarke C.J. in Data Protection Commissioner v. Facebook Ireland Ltd [2019] IESC 46. 79 This case law is relied upon in support of the applicant's plea that the Irish State is under an obligation to provide a dedicated and suitabl......
  • Hayes v The Minister for the Environment, Community & Local Government
    • Ireland
    • Court of Appeal (Ireland)
    • 9 March 2020
    ...Union under article 267 of the Treaty on the Functioning of the European Union in Data Protection Commissioner v. Facebook Ireland Ltd [2019] IESC 46 was amenable to appeal and held that whilst such a decision was not itself appealable the findings of law and fact of the referring court tha......
  • Request a trial to view additional results
2 books & journal articles
  • Why do lower courts refer in the absence of a legal obligation? Irish eagerness and Dutch disinclination
    • United Kingdom
    • Maastricht Journal of European and Comparative Law Nbr. 26-6, December 2019
    • 1 December 2019
    ...Supreme Court’s judgmentpotentially restricting references from lower courts. Data Protection Commissioner -v- Facebook, [2018] IESC 38;[2019] IESC 46(Clarke C.J.). E. Fahey, ‘Facebook’s Efforts to Squash Scrutiny of the EU-US Privacy Shield’, 17August 2018, https://verfassungsblog.de/faceb......
  • Behind the Curve: Schrems II and the Need for Increased U.S. Data Protections in a Global Economy.
    • United States
    • The Journal of Corporation Law Vol. 47 Nbr. 1, September 2021
    • 22 September 2021
    ...Framework] (announcing the second EU-U.S. framework for data transfers to the U.S.). (4.) Id. (5.) Data Prot. Comm'r v. Facebook Ir. Ltd. [2019] IESC 46 (H. Ct.) (6.) Id. (7.) Id. (8.) Press Release, U.S. Dep't Com., Joint Press Statement from U.S. Secretary of Commerce Wilbur Ross and Euro......

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT