Facebook Ireland Ltd v Data Protection Commission

• Jurisdiction: Ireland
• Judge: Mr. Justice David Barniville
• Judgment Date: 14 May 2021
• Neutral Citation: [2021] IEHC 336
• Date: 14 May 2021
• Court: High Court
• Docket Number: [2020 No. 617 JR.]

Between

Facebook Ireland Limited

Applicant

and

Data Protection Commission

Respondent

and

Maximilian Schrems

Notice Party

[2021] IEHC 336

[2020 No. 617 JR.]

[2020 No. 126 COM.]

THE HIGH COURT

JUDICIAL REVIEW

Judicial review – Preliminary draft decision – Own volition inquiry – Applicant seeking judicial review – Whether the respondent’s decision and the procedures adopted by it were amenable to judicial review

Facts: The respondent, the Data Protection Commission (DPC), decided to commence an “own volition” inquiry under s. 110 of the Data Protection Act 2018 to consider whether the actions of the applicant, Facebook Ireland Ltd (FBI), in making transfers of personal data relating to individuals in the European Union/European Economic Area were lawful and whether any corrective power should be exercised by the DPC in that regard. The DPC decided to commence the inquiry by issuing a “Preliminary Draft Decision” (PDD) to FBI on 28th August, 2020. FBI brought judicial review proceedings in respect of the PDD and the procedures adopted by the DPC. FBI contended that the DPC’s decision to issue the PDD and to adopt the procedure which it had adopted should be quashed, and declarations should be made by the High Court. FBI asserted that the DPC’s decision and the procedures adopted by it were amenable to judicial review. It said that the DPC’s decision and the procedures were unlawful on several grounds, including being in breach of the provisions of the 2018 Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April, 2016 by virtue of the DPC’s failure to conduct any investigation before issuing the PDD; a breach of FBI’s legitimate expectation that procedures published by the DPC in its 2018 Annual Report and on its website, and followed by the DPC in other inquiries, would be followed in respect of the DPC’s inquiry; breaches of FBI’s right to fair procedures, including premature judgment of the issues by the DPC and a failure to afford sufficient time to FBI to make submissions to the DPC; a failure by the DPC to take into account relevant considerations and, in particular, to await publication by the European Data Protection Board of guidance/recommendations to assist controllers and processors as regards the use of “supplementary measures” to ensure adequate protection for data subjects when transferring data to third countries; a breach of FBI’s right to equal treatment and non-discrimination; and a breach of the DPC’s obligation to act proportionately by subjecting FBI to simultaneous inquiries. FBI also alleged a breach by the DPC of its duty of candour in the manner in which it had defended the proceedings.

Held by Barniville J that the decisions of the DPC on 28th August, 2020 to commence the own volition inquiry under s. 110 of the 2018 Act in respect of FBI’s EU-US data transfers, to issue the PDD and to adopt the procedures set out in that document and in the surrounding correspondence were all amenable to judicial review. He concluded that the grounds of challenge advanced by FBI in respect of the DPC’s decision and in respect of the procedures adopted by it must be rejected and that FBI had not established any basis for impugning the DPC’s decision or the PDD or the procedures for the inquiry adopted by the DPC. He considered and rejected FBI’s allegation that the DPC was in breach of its duty of candour in the manner in which it defended the proceedings. He concluded that the DPC ought to have answered a number of the questions raised on behalf of FBI in correspondence sent on 29th October, 2020 which was responded to on behalf of the DPC on 5th November, 2020. He concluded that there was no basis for the allegation of abuse of process and improper purpose made by the DPC but withdrawn in the course of the hearing, that it ought not to have been made and that, having been made, it ought to have been withdrawn much sooner than it was.

Barniville J refused all of the reliefs sought by FBI and dismissed the claims made by it in the proceedings.

Reliefs refused.

JUDGMENT of Mr. Justice David Barniville delivered on the 14 ^th day of May, 2021

Index

1. Introduction	3
2. Overview of Decision	6
3. Structure of Judgment	7
4. Relevant Factual Background	8
5. CJEU Judgment in Schrems II	13
6. Developments Post Judgment in Schrems II	17
7. DPC's 28 August 2020 Letter and PDD	22
8. Correspondence Post the DPC's 28 August 2020 Letter and PDD	35
9. Procedural Background	46
10. Resolution of Mr. Schrems Proceedings	49
11. Structure for Consideration of the Issues Raised	51
12. Whether PDD/DPC's Procedure is Amenable to Judicial Review	53
13. Alleged Failure by DPC to Conduct an Investigation/Inquiry Before Reaching a Decision	69
14. Alleged Departure by DPC from Published Procedures/Breach of Legitimate Expectation	80
15. Alleged Breach of Fair Procedures: 21-Day Period for Submissions	114
16. Alleged Breach of Fair Procedures: Premature Judgment	132
17. Alleged Breach of Fair Procedures: Involvement of Commissioner at Investigation and Decision-Making Stages	151
18. Single Decision to Cover Infringement and Corrective Measures: Ultra Vires Section 111 of 2018 Act	157
19. Failure to Await Guidance from EDPB and/or Failure to Take Timing of EDPB Guidance into Account	157
20. Alleged Discrimination/Breach of FBI's Right to Equality: Inquiry into FBI Only	167
21. Alleged Disproportionality of Simultaneous Inquiries	180
22. Adequacy of DPC's Reasons	181
23. Duty of Candour	184
24. Abuse of Process/Improper Purpose	192
25. Summary of Conclusions	196

1. Introduction

1 . On 16 ^th July, 2020, the Court of Justice of the European Union (“CJEU”) delivered its landmark judgment in Case C-311/18 Data Protection Commissioner v. Facebook Ireland Ltd and Maximilian Schrems (commonly now referred to as “ Schrems II”) on a reference from the High Court (Costello J.). This case is about what happened after that judgment.

2 . Following the judgment in Schrems II, the Data Protection Commission (“DPC”) decided to commence an “own volition” inquiry under s. 110 of the Data Protection Act, 2018 (the “2018 Act”) to consider whether the actions of Facebook Ireland Ltd (“FBI”) in making transfers of personal data relating to individuals in the European Union/European Economic Area are lawful and whether any corrective power should be exercised by the DPC in that regard. The DPC decided to commence the inquiry by issuing a “Preliminary Draft Decision” (“PDD”) to FBI on 28 ^th August, 2020.

3 . FBI took issue, on several grounds, with the decision by the DPC to commence the inquiry by means of the PDD and with the procedures adopted by the DPC. Mr. Schrems, who had made a complaint and a reformulated complaint to the statutory predecessor of the DPC, the Data Protection Commissioner, under the Data Protection Act, 1988 (the “1988 Act”), which had ultimately led to the reference by the High Court to the CJEU leading to the judgment in Schrems II, also took issue with the DPC's decision and procedures on a number of grounds, some of which overlapped to an extent with the grounds advanced by FBI.

4 . Both FBI and Mr. Schrems brought judicial review proceedings in respect of the PDD and the procedures adopted by the DPC. Each applied successfully to be joined as a notice party to the other's judicial review proceedings. Both proceedings were entered in the Commercial List. FBI's proceedings were heard by me over five days between 15 ^th December and 21 ^st December, 2020, following which they were adjourned to allow further affidavit evidence to be provided by the DPC. Mr. Schrems' proceedings were due to commence on 13 ^th January, 2021. However, they were resolved between Mr. Schrems and the DPC shortly prior to hearing, on terms to which it will be necessary briefly to refer later in this judgment.

5 . FBI contends that the DPC's decision to issue the PDD and to adopt the procedure which it has adopted should be quashed, and declarations should be made by the court, on several grounds. At the outset, FBI asserts that the DPC's decision and the procedures adopted by it are amenable to judicial review. It then says that the DPC's decision and the procedures are unlawful on several grounds, including being in breach of the provisions of the 2018 Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 ^th April, 2016 (the “GDPR”) by virtue of the DPC's failure to conduct any investigation before issuing the PDD; a breach of FBI's legitimate expectation that procedures published by the DPC in its 2018 Annual Report and on its website, and followed by the DPC in other inquiries, would be followed in respect of the DPC's inquiry; breaches of FBI's right to fair procedures, including premature judgment of the issues by the DPC and a failure to afford sufficient time to FBI to make submissions to the DPC; a failure by the DPC to take into account relevant considerations and, in particular, to await publication by the European Data Protection Board (“EDPB”) of guidance/recommendations to assist controllers and processors as regards the use of what are called “supplementary measures” to ensure adequate protection for data subjects when transferring data to third countries; a breach of FBI's right to equal treatment and non-discrimination; a breach of the DPC's obligation to act proportionately by subjecting FBI to simultaneous inquiries (namely, the “own volition” inquiry and the complaint made by Mr. Schrems. FBI also alleges a breach by the DPC of its duty of candour in the manner in which it has defended the proceedings.

6 . In response, the DPC contends that the decision to...