Data Protection Commissioner v Facebook Ireland Ltd

• Jurisdiction: Ireland
• Judge: Mr. Justice Clarke
• Judgment Date: 31 May 2019
• Neutral Citation: [2019] IESC 46
• Docket Number: Appeal No: 2018/68,[S.C. No. 68 of 2018]
• Court: Supreme Court
• Date: 31 May 2019

Between/

The Data Protection Commissioner

Plaintiff/First Named Respondent

and

Facebook Ireland Limited

First Named Defendant/Appellant

and

Maximillian Schrems

Second Named Defendant/Second Named Respondent

[2019] IESC 46

Appeal No: 2018/68

THE SUPREME COURT

Constitutional law – European Union law – United States law – Appellant seeking leave to appeal to the Supreme Court – Whether any appeal lies to the Supreme Court

Facts: The second defendant/second respondent, Mr Schrems, brought a complaint to the plaintiff/first respondent, the Data Protection Commissioner (DPC), who formed the required view as to having concerns relating to the validity of certain relevant EU instruments, being Commission Decisions 2001/497/EC, 2004/915/EC, and 2010/87/EU, which concerned “Standard Contractual Clauses”. On that basis, the DPC brought proceedings before the High Court. As a result of a judgment of Costello J (The Data Protection Commissioner v Facebook Ireland Limited & anor [2017] IEHC 545) dated 3 October 2017, with a revised version circulated on 12 April 2018, the High Court referred certain questions to the Court of Justice (CJEU), which reference procedure remained pending before that Court. However, the first defendant/appellant, Facebook Ireland Ltd, sought leave to appeal to the Supreme Court. One of the issues which concerned the Court was as to whether any appeal lay in the context of a decision of the High Court to make a reference to the CJEU. Against that backdrop, the Court decided to hold a short oral procedure in relation to the application for leave to appeal. For the reasons set out in a judgment dated 31 July 2018 (Data Protection Commissioner & anor v Facebook Ireland Limited & anor [2018] IESC 38) (the earlier judgment), the Court decided to grant leave. Two broad sets of issues were the subject of leave to appeal. The first concerned the question of whether, as a matter of the combined effect of Irish constitutional law and the law of the European Union, any appeal at all lies to the Court in circumstances such as had arisen in this case and, if so, the permissible parameters of any such appeal. The second set of issues concerned certain findings of the High Court in relation to the law of the United States and the protections which that law confers on data subjects whose data is transferred to the United States from the European Union. Some of those findings were said by Facebook to be either in error or misleadingly incomplete. To the extent that an appeal may be held to lie, Facebook invited the Court to hold that the specific findings referred to were in error or incomplete and to make such order as the Court may have jurisdiction to grant to deal with such a situation.

Held by Clarke CJ that it was open to the Court to entertain an appeal against a decision of the High Court in circumstances where the High Court had made a reference to the CJEU under the Schrems v Data Protection Commission (Case C-362/14) EU:C:2015:650, [2016] 2 C.M.L.R. 2 (Schrems I) jurisprudence. Clarke CJ was satisfied that the Court could and should entertain any appeal against the facts found by the High Court and should overturn those facts, if it could be established that they were not sustainable in accordance with the relevant Irish jurisprudence. Clarke CJ suggested that the Court should not entertain some of the areas of appeal put forward on behalf of Facebook on the basis that they either involved a direct appeal against the text of the reference or were concerned with matters which essentially go towards the question of whether the High Court shared the concern of the DPC. Having analysed each of the remaining heads of appeal, Clarke CJ was satisfied that in each category it was more appropriate to characterise the criticisms which Facebook sought to make of the judgment of the High Court as being directed towards the proper characterisation of underlying facts rather than towards those facts themselves. In those circumstances, Clarke CJ did not propose making any order overturning any aspect of the High Court judgment.

Clarke CJ held that the appeal should be dismissed.

Appeal dismissed.

Judgment of Mr. Justice Clarke , Chief Justice, delivered the 31st May, 2019

1. Introduction

1.1 The transfer of data from the European Union to other jurisdictions, not least to the United States, has been the subject of both political and legal controversy in recent years. The underlying issues which give rise to the background to this appeal are a further episode in the legal aspect of that controversy.

1.2 However, it is important to start this judgment by emphasising what are, on any view, a number of unusual features of this case and to emphasise, in that context, what this judgment is not about.

1.3 It will be necessary to go into somewhat more detail about the form of proceedings which were before the High Court in this case and in respect of which an appeal has been brought to this Court. However, it is fair to say that the proceedings concerned derive as to their form from the judgment of the Court of Justice (‘CJEU’) in Schrems v. Data Protection Commission ( Case C-362/14) EU:C:2015:650, [2016] 2 C.M.L.R. 2 (‘ Schrems I’). That judgment required that the national law of member states provide a procedure whereby the person or body charged with data protection in the EU member state concerned (such as the plaintiff/first named respondent in this case, the Data Protection Commissioner (‘the DPC’)) should have a method of referring to the CJEU concerns relating to Union instruments in the data protection field, in circumstances where questions might arise as to the validity of the instruments in question.

1.4 The second named defendant/second named respondent, Mr. Schrems, brought a complaint to the DPC, who formed the required view as to having concerns relating to the validity of certain relevant EU instruments, being Commission Decisions 2001/497/EC, 2004/915/EC, and 2010/87/EU, which concerned ‘Standard Contractual Clauses’. On that basis, the DPC brought these proceedings before the High Court. The proceedings involved the DPC as plaintiff, the first named defendant/appellant, Facebook Ireland Limited (‘Facebook’), and Mr. Schrems as defendants with, for reasons which will be set out later, the Government of the United States (‘the US Government’) intervening. As a result of a judgment of Costello J. ( The Data Protection Commissioner v. Facebook Ireland Limited & anor. [2017] IEHC 545) dated 3 October 2017, with a revised version circulated on 12 April 2018, the High Court referred certain questions to the CJEU, which reference procedure remains pending before that Court.

1.5 However, Facebook sought leave to appeal to this Court. One of the issues which concerned this Court was as to whether any appeal lay in the context of a decision of the High Court to make a reference to the CJEU. Against that backdrop, this Court decided, unusually, to hold a short oral procedure in relation to the application for leave to appeal. For the reasons set out in a judgment dated 31 July 2018 ( Data Protection Commissioner & anor. v. Facebook Ireland Limited & anor. [2018] IESC 38) (‘the earlier judgment’), this Court decided to grant leave. While it will be necessary to refer to the grant of leave in more detail in due course, it is fair to say that two broad sets of issues were the subject of leave to appeal. The first concerned the question of whether, as a matter of the combined effect of Irish constitutional law and the law of the European Union, any appeal at all lies to this Court in circumstances such as have arisen in this case and, if so, the permissible parameters of any such appeal. The second set of issues concern certain findings of the High Court in relation to the law of the United States and the protections which that law confers on data subjects whose data is transferred to the United States from the European Union. Some of those findings are said by Facebook to be either in error or misleadingly incomplete. To the extent that an appeal may be held to lie, Facebook invites this Court to hold that the specific findings referred to are in error or incomplete and to make such order as this Court may have jurisdiction to grant to deal with such a situation.

1.6 Thus, the two broad sets of issues are those concerning the scope, if any, of appeal which may be available to Facebook and, to the extent that an appeal may lie, the issues of US law to which reference has been made. It should also be noted that the Government of the United States was granted leave to intervene in both the High Court and on this appeal.

1.7 However, in order to understand those issues more fully, it is necessary to deal in more detail with certain aspects of these proceedings and the process to date. I propose to start by setting out what I think can fairly be said to be the unusual features of these proceedings, for that background has the potential to influence both of the sets of issues which arise.

2. The Nature of these Proceedings

2.1 The issue which arose in Schrems I concerned the validity of the so-called ‘Safe Harbour’ arrangements entered into between the European Union and the United States of America. Briefly stated, in its decision dated the 26th July 2000 (2000/520/EC) (‘the Safe Harbour Decision’), the European Commission had determined, in accordance with Article 25(6) of Directive 95/46/EC, that an adequate level of protection would be attained in relation to data transferred from the EU to an organisation established in the United States, where such organisation complied with the principles set out in the Safe Harbour Decision and self-certified that it was in compliance with those principles.

2.2 Mr. Schrems made a complaint to the DPC concerning the transfer of his data from the EU to the United States under the Safe Harbour arrangements...