Facebook Ireland Ltd v Data Protection Commission
Jurisdiction | Ireland |
Judge | Mr. Justice David Barniville |
Judgment Date | 14 May 2021 |
Neutral Citation | [2021] IEHC 336 |
Date | 14 May 2021 |
Court | High Court |
Docket Number | [2020 No. 617 JR.] |
and
[2021] IEHC 336
[2020 No. 617 JR.]
[2020 No. 126 COM.]
THE HIGH COURT
JUDICIAL REVIEW
Judicial review – Preliminary draft decision – Own volition inquiry – Applicant seeking judicial review – Whether the respondent’s decision and the procedures adopted by it were amenable to judicial review
Facts: The respondent, the Data Protection Commission (DPC), decided to commence an “own volition” inquiry under s. 110 of the Data Protection Act 2018 to consider whether the actions of the applicant, Facebook Ireland Ltd (FBI), in making transfers of personal data relating to individuals in the European Union/European Economic Area were lawful and whether any corrective power should be exercised by the DPC in that regard. The DPC decided to commence the inquiry by issuing a “Preliminary Draft Decision” (PDD) to FBI on 28th August, 2020. FBI brought judicial review proceedings in respect of the PDD and the procedures adopted by the DPC. FBI contended that the DPC’s decision to issue the PDD and to adopt the procedure which it had adopted should be quashed, and declarations should be made by the High Court. FBI asserted that the DPC’s decision and the procedures adopted by it were amenable to judicial review. It said that the DPC’s decision and the procedures were unlawful on several grounds, including being in breach of the provisions of the 2018 Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April, 2016 by virtue of the DPC’s failure to conduct any investigation before issuing the PDD; a breach of FBI’s legitimate expectation that procedures published by the DPC in its 2018 Annual Report and on its website, and followed by the DPC in other inquiries, would be followed in respect of the DPC’s inquiry; breaches of FBI’s right to fair procedures, including premature judgment of the issues by the DPC and a failure to afford sufficient time to FBI to make submissions to the DPC; a failure by the DPC to take into account relevant considerations and, in particular, to await publication by the European Data Protection Board of guidance/recommendations to assist controllers and processors as regards the use of “supplementary measures” to ensure adequate protection for data subjects when transferring data to third countries; a breach of FBI’s right to equal treatment and non-discrimination; and a breach of the DPC’s obligation to act proportionately by subjecting FBI to simultaneous inquiries. FBI also alleged a breach by the DPC of its duty of candour in the manner in which it had defended the proceedings.
Held by Barniville J that the decisions of the DPC on 28th August, 2020 to commence the own volition inquiry under s. 110 of the 2018 Act in respect of FBI’s EU-US data transfers, to issue the PDD and to adopt the procedures set out in that document and in the surrounding correspondence were all amenable to judicial review. He concluded that the grounds of challenge advanced by FBI in respect of the DPC’s decision and in respect of the procedures adopted by it must be rejected and that FBI had not established any basis for impugning the DPC’s decision or the PDD or the procedures for the inquiry adopted by the DPC. He considered and rejected FBI’s allegation that the DPC was in breach of its duty of candour in the manner in which it defended the proceedings. He concluded that the DPC ought to have answered a number of the questions raised on behalf of FBI in correspondence sent on 29th October, 2020 which was responded to on behalf of the DPC on 5th November, 2020. He concluded that there was no basis for the allegation of abuse of process and improper purpose made by the DPC but withdrawn in the course of the hearing, that it ought not to have been made and that, having been made, it ought to have been withdrawn much sooner than it was.
Barniville J refused all of the reliefs sought by FBI and dismissed the claims made by it in the proceedings.
Reliefs refused.
JUDGMENT of Mr. Justice David Barniville delivered on the 14 th day of May, 2021
1. Introduction | 3 |
2. Overview of Decision | 6 |
3. Structure of Judgment | 7 |
4. Relevant Factual Background | 8 |
5. CJEU Judgment in Schrems II | 13 |
6. Developments Post Judgment in Schrems II | 17 |
7. DPC's 28 August 2020 Letter and PDD | 22 |
8. Correspondence Post the DPC's 28 August 2020 Letter and PDD | 35 |
9. Procedural Background | 46 |
10. Resolution of Mr. Schrems Proceedings | 49 |
11. Structure for Consideration of the Issues Raised | 51 |
12. Whether PDD/DPC's Procedure is Amenable to Judicial Review | 53 |
13. Alleged Failure by DPC to Conduct an Investigation/Inquiry Before Reaching a Decision | 69 |
14. Alleged Departure by DPC from Published Procedures/Breach of Legitimate Expectation | 80 |
15. Alleged Breach of Fair Procedures: 21-Day Period for Submissions | 114 |
16. Alleged Breach of Fair Procedures: Premature Judgment | 132 |
17. Alleged Breach of Fair Procedures: Involvement of Commissioner at Investigation and Decision-Making Stages | 151 |
18. Single Decision to Cover Infringement and Corrective Measures: Ultra Vires Section 111 of 2018 Act | 157 |
19. Failure to Await Guidance from EDPB and/or Failure to Take Timing of EDPB Guidance into Account | 157 |
20. Alleged Discrimination/Breach of FBI's Right to Equality: Inquiry into FBI Only | 167 |
21. Alleged Disproportionality of Simultaneous Inquiries | 180 |
22. Adequacy of DPC's Reasons | 181 |
23. Duty of Candour | 184 |
24. Abuse of Process/Improper Purpose | 192 |
25. Summary of Conclusions | 196 |
. On 16 th July, 2020, the Court of Justice of the European Union (“CJEU”) delivered its landmark judgment in Case C-311/18 Data Protection Commissioner v. Facebook Ireland Ltd and Maximilian Schrems (commonly now referred to as “ Schrems II”) on a reference from the High Court (Costello J.). This case is about what happened after that judgment.
. Following the judgment in Schrems II, the Data Protection Commission (“DPC”) decided to commence an “own volition” inquiry under s. 110 of the Data Protection Act, 2018 (the “2018 Act”) to consider whether the actions of Facebook Ireland Ltd (“FBI”) in making transfers of personal data relating to individuals in the European Union/European Economic Area are lawful and whether any corrective power should be exercised by the DPC in that regard. The DPC decided to commence the inquiry by issuing a “Preliminary Draft Decision” (“PDD”) to FBI on 28 th August, 2020.
. FBI took issue, on several grounds, with the decision by the DPC to commence the inquiry by means of the PDD and with the procedures adopted by the DPC. Mr. Schrems, who had made a complaint and a reformulated complaint to the statutory predecessor of the DPC, the Data Protection Commissioner, under the Data Protection Act, 1988 (the “1988 Act”), which had ultimately led to the reference by the High Court to the CJEU leading to the judgment in Schrems II, also took issue with the DPC's decision and procedures on a number of grounds, some of which overlapped to an extent with the grounds advanced by FBI.
. Both FBI and Mr. Schrems brought judicial review proceedings in respect of the PDD and the procedures adopted by the DPC. Each applied successfully to be joined as a notice party to the other's judicial review proceedings. Both proceedings were entered in the Commercial List. FBI's proceedings were heard by me over five days between 15 th December and 21 st December, 2020, following which they were adjourned to allow further affidavit evidence to be provided by the DPC. Mr. Schrems' proceedings were due to commence on 13 th January, 2021. However, they were resolved between Mr. Schrems and the DPC shortly prior to hearing, on terms to which it will be necessary briefly to refer later in this judgment.
. FBI contends that the DPC's decision to issue the PDD and to adopt the procedure which it has adopted should be quashed, and declarations should be made by the court, on several grounds. At the outset, FBI asserts that the DPC's decision and the procedures adopted by it are amenable to judicial review. It then says that the DPC's decision and the procedures are unlawful on several grounds, including being in breach of the provisions of the 2018 Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 th April, 2016 (the “GDPR”) by virtue of the DPC's failure to conduct any investigation before issuing the PDD; a breach of FBI's legitimate expectation that procedures published by the DPC in its 2018 Annual Report and on its website, and followed by the DPC in other inquiries, would be followed in respect of the DPC's inquiry; breaches of FBI's right to fair procedures, including premature judgment of the issues by the DPC and a failure to afford sufficient time to FBI to make submissions to the DPC; a failure by the DPC to take into account relevant considerations and, in particular, to await publication by the European Data Protection Board (“EDPB”) of guidance/recommendations to assist controllers and processors as regards the use of what are called “supplementary measures” to ensure adequate protection for data subjects when transferring data to third countries; a breach of FBI's right to equal treatment and non-discrimination; a breach of the DPC's obligation to act proportionately by subjecting FBI to simultaneous inquiries (namely, the “own volition” inquiry and the complaint made by Mr. Schrems. FBI also alleges a breach by the DPC of its duty of candour in the manner in which it has defended the proceedings.
. In response, the DPC contends that the decision to...
To continue reading
Request your trial-
Lighthouse Networks Ltd v The Minister for Communication, Climate Action and Environment
...procedural legitimate expectation, the applicants note the judgment of Barniville J. (as he was then). in Facebook Ireland Ltd v. DPC [2021] IEHC 336. The court recognised the starting point of any consideration of the legal principles applicable to legitimate expectation as the test set ou......
-
Tumblr Incorporated v Commisiun na Mean
...36, [2021] 2 ILRM 1, Ballyboden Tidy Towns Group v. An Bord Pleanála [2022] IEHC 7 and Facebook Ireland Ltd v Data Protection Commission [2021] IEHC 336. From the foregoing it is clear as a matter of Irish law that there is a duty on the part of the decision maker to communicate the reasons......
-
Ryan v Data Protection Commission
...which is properly subject to the High Court's inherent jurisdiction is provided by Facebook Ireland Ltd v. Data Protection Commission [2021] IEHC 336. There, the Commission had commenced an own-volition inquiry and had issued what was described as a “ preliminary draft decision”. Whereas th......
-
Schrems v Data Protection Commission
...Mr Schrems was a notice party to the proceedings brought by FBI (the Facebook proceedings). In a judgment delivered on 14 May 2021, [2021] IEHC 336 (the Facebook judgment), the High Court (Barniville P) dismissed FBI’s claims in the Facebook proceedings. Orders were made on consent on 20 Ma......