DPC v. Facebook Ireland Limited & Schrems - 16 July 2020

• Judgment Date: 16 July 2020
• Case Outcome: The Court of Justice of the European Union delivered judgment on 16 July 2020, in which it addressed 11 questions posed by the Irish High Court in the context of a preliminary reference made on 4 May 2018.
• Issuer: Court of Justice of the European Union
• Date: 16 July 2020
• Judgement Number: C-311/18
• Year: 2020
• Status: Proceedings complete.

JUDGMENT OF THE COURT (Grand Chamber)

16 July 2020 *

(Reference for a preliminary ruling — Protection of individuals with regard to the

processing of personal data — Charter of Fundamental Rights of the European

Union — Articles 7, 8 and 47 — Regulation (EU) 2016/679 — Article 2(2) —

Scope — Transfers of personal data to third countries for commercial purposes —

Article 45 — Commission adequacy decision — Article 46 — Transfers subject to

appropriate safeguards — Article 58 — Powers of the supervisory authorities —

Processing of the data transferred by the public authorities of a third country for

national security purposes — Assessment of the adequacy of the level of

protection in the third country — Decision 2010/87/EU — Protective standard

clauses on the transfer of personal data to third countries — Suitable safeguards

provided by the data controller — Validity — Implementing Decision (EU)

2016/1250 — Adequacy of the protection provided by the EU-US Privacy

Shield — Validity — Complaint by a natural person whose data was transferred

from the European Union to the United States)

In Case C-311/18,

REQUEST for a preliminary ruling under Article 267 TFEU from the High Court

(Ireland), made by decision of 4 May 2018, received at the Court on 9 May 2018,

in the proceedings

Data Protection Commissioner

v

Facebook Ireland Ltd,

Maximillian Schrems,

intervening parties:

* Language of the case: English.

EN

JUDGMENT OF 16. 7. 2020 — CASE C-311/18

2

The United States of America,

Electronic Privacy Information Centre,

BSA Business Software Alliance Inc.,

Digitaleurope,

THE COURT (Grand Chamber),

composed of K. Lenaerts, President, R. Silva de Lapuerta, Vice-President,

A. Arabadjiev, A. Prechal, M. Vilaras, M. Safjan, S. Rodin, P.G. Xuereb,

L.S. Rossi and I. Jarukaitis, Presidents of Chambers, M. Ilešič, T. von Danwitz

(Rapporteur), and D. Šváby, Judges,

Advocate General: H. Saugmandsgaard Øe,

Registrar: C. Strömholm, Administrator,

having regard to the written procedure and further to the hearing on 9 July 2019,

after considering the observations submitted on behalf of:

– the Data Protection Commissioner, by D. Young, Solicitor, B. Murray and

M. Collins, Senior Counsel, and C. Donnelly, Barrister-at-Law,

– Facebook Ireland Ltd, by P. Gallagher and N. Hyland, Senior Counsel,

A. Mulligan and F. Kieran, Barristers-at-Law, and P. Nolan, C. Monaghan,

C. O’Neill and R. Woulfe, Solicitors,

– Mr Schrems, by H. Hofmann, Rechtsanwalt, E. McCullough, J. Doherty and

S. O’Sullivan, Senior Counsel, and G. Rudden, Solicitor,

– the United States of America, by E. Barrington, Senior Counsel, S. Kingston,

Barrister-at-Law, S. Barton and B. Walsh, Solicitors,

– the Electronic Privacy Information Centre, by S. Lucey, Solicitor, G. Gilmore

and A. Butler, Barristers-at-Law, and C. O’Dwyer, Senior Counsel,

– BSA Business Software Alliance Inc., by B. Van Vooren and K. Van Quathem,

advocaten,

– Digitaleurope, by N. Cahill, Barrister, J. Cahir, Solicitor, and M. Cush, Senior

Counsel,

– Ireland, by A. Joyce and M. Browne, acting as Agents, and D. Fennelly,

Barrister-at-Law,

– the Belgian Government, by J.-C. Halleux and P. Cottin, acting as Agents,

FACEBOOK IRELAND AND SCHREMS

3

– the Czech Government, by M. Smolek, J. Vláčil, O. Serdula and A. Kasalická,

acting as Agents,

– the German Government, by J. Möller, D. Klebs and T. Henze, acting as

Agents,

– the French Government, by A.-L. Desjonquères, acting as Agent,

– the Netherlands Government, by C.S. Schillemans, M.K. Bulterman and

M. Noort, acting as Agents,

– the Austrian Government, by J. Schmoll and G. Kunnert, acting as Agents,

– the Polish Government, by B. Majczyna, acting as Agent,

– the Portuguese Government, by L. Inez Fernandes, A. Pimenta and C. Vieira

Guerra, acting as Agents,

– the United Kingdom Government, by S. Brandon, acting as Agent, and

J. Holmes QC, and C. Knight, Barrister,

– the European Parliament, by M.J. Martínez Iglesias and A. Caiola, acting as

Agents,

– the European Commission, by D. Nardi, H. Krämer and H. Kranenborg, acting

as Agents,

– the European Data Protection Board (EDPB), by A. Jelinek and K. Behn,

acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 19 December

2019,

gives the following

Judgment

1 This reference for a preliminary ruling, in essence, concerns:

– the interpretation of the first indent of Article 3(2), Articles 25 and 26 and

Article 28(3) of Directive 95/46/EC of the European Parliament and of the

Council of 24 October 1995 on the protection of individuals with regard to the

processing of personal data and on the free movement of such data (OJ 1995

L 281, p. 31), read in the light of Article 4(2) TEU and of Articles 7, 8 and 47

of the Charter of Fundamental Rights of the European Union (‘the Charter’);