Facebook v DPC (Notice Party: Schrems) – 14 May 2021

• Judgment Date: 14 May 2021
• Issuer: High Court

THE HIGH COURT

JUDICIAL REVIEW

[2020 No. 617 JR.]

[2020 No. 126 COM.]

BETWEEN

FACEBOOK IRELAND LIMITED

APPLICANT

AND

DATA PROTECTION COMMISSION

RESPONDENT

AND

MAXIMILIAN SCHREMS

NOTICE PARTY

JUDGMENT of Mr. Justice David Barniville delivered on the 14th day of May, 2021

Index

1. Introduction……………………………………………………………………….… 3

2. Overview of Decision………………………………………………………………... 6

3. Structure of Judgment………………………………………………………..…….. 7

4. Relevant Factual Background………………………………………………….…... 8

5. CJEU Judgment in Schrems II…………………………………………………… 13

6. Developments Post Judgment in Schrems II……………………………………... 17

7. DPC’s 28 August 2020 Letter and PDD………………………………………….. 22

2

8. Correspondence Post the DPC’s 28 August 2020 Letter and PDD……………... 35

9. Procedural Background…………………………………………………………… 46

10. Resolution of Mr. Schrems Proceedings………………………………………….. 49

11. Structure for Consideration of the Issues Raised………………………………... 51

12. Whether PDD/DPC’s Procedure is Amenable to Judicial Review……………... 53

13. Alleged Failure by DPC to Conduct an Investigation/Inquiry Before Reaching a

Decision…………………………………………………………………………….. 69

14. Alleged Departure by DPC from Published Procedures/Breach of Legitimate

Expectation………………………………………………………………………… 80

15. Alleged Breach of Fair Procedures: 21-Day Period for Submissions…………. 114

16. Alleged Breach of Fair Procedures: Premature Judgment……………………. 132

17. Alleged Breach of Fair Procedures: Involvement of Commissioner at

Investigation and Decision-Making Stages……………………………………... 151

18. Single Decision to Cover Infringement and Corrective Measures: Ultra Vires

Section 111 of 2018 Act…………………………………………………………... 157

19. Failure to Await Guidance from EDPB and/or Failure to Take Timing of EDPB

Guidance into Account…………………………………………………………… 157

20. Alleged Discrimination/Breach of FBI’s Right to Equality: Inquiry into FBI

Only……………………………………………………………………………….. 167

21. Alleged Disproportionality of Simultaneous Inquiries………………………… 180

22. Adequacy of DPC’s Reasons……………………………………………………... 181

23. Duty of Candour………………………………………………………………….. 184

24. Abuse of Process/Improper Purpose……………………………………………. 192

25. Summary of Conclusions………………………………………………………… 196

3

1. Introduction

1. On 16th July, 2020, the Court of Justice of the European Union (“CJEU”) delivered its

landmark judgment in Case C-311/18 Data Protection Commissioner v. Facebook Ireland

Ltd and Maximilian Schrems (commonly now referred to as “Schrems II”) on a reference

from the High Court (Costello J.). This case is about what happened after that judgment.

2. Following the judgment in Schrems II, the Data Protection Commission (“DPC”)

decided to commence an “own volition” inquiry under s. 110 of the Data Protection Act,

2018 (the “2018 Act”) to consider whether the actions of Facebook Ireland Ltd (“FBI”) in

making transfers of personal data relating to individuals in the European Union/European

Economic Area are lawful and whether any corrective power should be exercised by the DPC

in that regard. The DPC decided to commence the inquiry by issuing a “Preliminary Draft

Decision” (“PDD”) to FBI on 28th August, 2020.

3. FBI took issue, on several grounds, with the decision by the DPC to commence the

inquiry by means of the PDD and with the procedures adopted by the DPC. Mr. Schrems,

who had made a complaint and a reformulated complaint to the statutory predecessor of the

DPC, the Data Protection Commissioner, under the Data Protection Act, 1988 (the “1988

Act”), which had ultimately led to the reference by the High Court to the CJEU leading to the

judgment in Schrems II, also took issue with the DPC’s decision and procedures on a number

of grounds, some of which overlapped to an extent with the grounds advanced by FBI.

4. Both FBI and Mr. Schrems brought judicial review proceedings in respect of the PDD

and the procedures adopted by the DPC. Each applied successfully to be joined as a notice

party to the other’s judicial review proceedings. Both proceedings were entered in the

Commercial List. FBI’s proceedings were heard by me over five days between 15th

December and 21st December, 2020, following which they were adjourned to allow further

affidavit evidence to be provided by the DPC. Mr. Schrems’ proceedings were due to