Meta Platforms Ireland Ltd v Data Protection Commission and Others; Meta Platforms Ireland Ltd v Data Protection Commission

• Jurisdiction: Ireland
• Judge: Mr. Justice Michael Quinn
• Judgment Date: 13 February 2024
• Neutral Citation: [2024] IEHC 75
• Court: High Court
• Docket Number: [2023 645 JR]

Between

Meta Platforms Ireland Limited

Applicant

and

Data Protection Commission, Ireland and The Attorney General

Respondents

Between

Meta Platforms Ireland Limited

Applicant

and

Data Protection Commission

Respondent

[2024] IEHC 75

[2023 645 JR]

[2023 169 MCA]

THE HIGH COURT

COMMERCIAL

JUDGMENT ofMr. Justice Michael Quinndelivered on the 13 ^th day of February 2024

1 . On 12 May 2023, the Data Protection Commission adopted a final decision, the “Decision”, in an inquiry which concerned the transfers by the Applicant, formerly Facebook Ireland Limited, to its parent company Meta Platforms Inc, formerly Facebook Inc, the operator of Facebook in the US and elsewhere outside the EU/EEA, of personal data relating to individuals in the EU/EEA who visit, access, use or interact with products and services provided by the Applicant. The inquiry commenced on 20 August 2020 and is referred to in this judgment as the “Own Volition Inquiry”.

2 . In the Decision, The Commission found the following:-

(i) that the data transfers are made in circumstances which fail to guarantee a level of protection to data subjects that is essentially equivalent to that provided by EU law and in particular by the GDPR (General Data Protection Regulation), EU 2016 / 679 of 27 April 2016;

(ii) that in making the data transfers, the Applicant is infringing Article 46(1) GDPR;

(iii) that the Applicant is not entitled to rely on derogations under Article 49(1) GDPR.

3 . The Commission made also the following orders:-

(a) that the data transfers be suspended;

(b) that the Applicant bring its processing operations into compliance with GDPR by ceasing the unlawful processing including storage in the US of personal data of EU/EEA users transferred in violation of the GDPR;

(c) the Commission imposed an administrative fine of €1.2 billion on the Applicant.

4 . These proceedings are a statutory appeal and judicial review of the Decision.

5 . Maximillian Schrems is a citizen of Austria. On 25 June 2013 he made a complaint to the Respondent in respect of the processing and transfer of his personal data by the Applicant to Facebook Inc in the US. The inquiry pursuant to that complaint is at an advanced stage, described below, and a final Decision is pending. That inquiry is referred to in this judgment as the Complaint Based Inquiry.

6 . Mr. Schrems has applied to be joined as a Notice Party in these proceedings. His application is opposed by the Applicant and by the Data Protection Commission.

7 . The second and third named respondent in the judicial review proceedings (2023 / 645 JR) do not oppose the application and did not participate in this application. Therefore, I shall use the term “Respondent” to refer to the first named respondent in those proceedings.

8 . I have decided to make an order joining Mr. Schrems as a Notice Party.

9 . These proceedings are the latest in a long line of proceedings before this Court, the Supreme Court and the Court of Justice of the European Union (CJEU) which concern the transfer of personal data by the Applicant to its parent company and inquiries conducted by the Respondent. The history of these cases is directly relevant to this application.

The Complaint Based Inquiry and Proceedings

10 . On 25 June 2013, Mr. Schrems made his complaint with specific reference to the lawfulness of the transfer of his personal data to the parent company Facebook Inc. The Respondent refused to investigate that matter.

11 . Arising from that refusal, on 21 October 2013 Mr. Schrems instituted judicial review proceedings, against the Data Protection Commissioner (High Court [2013] 765 JR) (the “Schrems Proceedings”).

12 . In the Schrems Proceedings, the Court referred certain questions of law to the CJEU. On 6 October 2015 the CJEU delivered its judgment and on 20 October 2015 it ordered that the matter be returned for the consideration of the Respondent which undertook to investigate the complaint (the “First CJEU Judgment”).

13 . Following the judgment of the CJEU and the order of the High Court, the Respondent invited Mr. Schrems to submit an updated and reformulated complaint, which he submitted on 1 December 2015.

14 . On 24 May 2016, the Respondent issued a draft decision on the reformulated complaint. In that draft decision, the Respondent raised concerns about the validity of an EU Commission Decision 2010/87/EU, referred to as the SCC Decision (which related to the validity of standard contractual clauses for transfer of data outside the EU) adopted under Article 26 of Directive 95/86 /EC (“the Data Protection Directive”).

15 . The Respondent instituted proceedings seeking a reference to the CJEU for the purpose of determining its concerns relating to the validity of the SCC decision (the High Court [2016] 4809 P between the Data Protection Commissioner, plaintiff, and Facebook Ireland Limited and Maximilian Schrems, defendants) (“the DPC proceedings”).

16 . Mr. Schrems participated in the DPC proceedings and judgment was delivered by Costello J. on 3 October 2017. On 2 May 2018, following further submissions by the parties arising from that judgment, the court referred eleven questions to the CJEU for its consideration (“the CJEU reference”).

17 . The Decision of Costello J. was appealed and affirmed by the Supreme Court.

18 . On 16 July 2020, the CJEU delivered its judgment (“the Second CJEU Judgment”) to the following effect:-

(i) that the SCC Decision was not invalid;

(ii) that the Respondent had the ability to suspend or prohibit transfers under the SCC Decision;

(iii) that the Respondent had obligations to suspend unlawful transfers in certain circumstances.

19 . The Complaint Based Inquiry remains extant. It has reached a stage where the Respondent has submitted a draft of its decision to the Concerned Supervisory Authorities of the EU pursuant to a co-operation and consistency mechanism governed by Article 60 of the GDPR.

The Own Volition Inquiry and Proceedings

20 . On 20 August 2020, the Applicant was notified by the Respondent that, on the basis of its consideration of the Second CJEU Judgment, the Respondent had decided to commence an inquiry into data transfers under s. 110 of the 2018 Act (the “Own Volition Inquiry”).

21 . The affidavit grounding this application was sworn by Mr. Schrems' solicitor Mr. Michael Collins. He states that he received a letter dated 31 August 2020 from the Commission informing him of the Decision to commence the Own Volition Inquiry.

22 . Arising from the Decision of the Respondent to commence the Own Volition Inquiry, two sets of judicial review proceedings were commenced. The first was “The High Court, no. 2020 617 JR: Facebook Ireland Limited v. The Data Protection Commissioner and, by order, Maximilian Schrems, Notice Party (“the Facebook Judicial Review”). The second was initiated by Mr. Schrems no. 2020 707 JR, Maximilian Schrems v. The Data Protection Commissioner and, by order, Facebook Ireland Limited, Notice Party (“the Schrems Judicial Review”).

23 . On 14 May 2021, Barniville J. (as he then was) delivered his judgment in the Facebook Judicial Review. He refused certiorari of the Decision to commence the Own Volition Inquiry.

24 . The Schrems Judicial Review proceedings were compromised before the commencement of the hearing of the Facebook Judicial Review. The compromise was that if the court in the Facebook Judicial Review were to permit the Own Volition Inquiry to proceed, the Respondent would advance both the Complaint Based Inquiry and the own Volition Inquiry as expeditiously as possible. Mr. Schrems would be heard in both inquiries, but in the case of the Own Volition Inquiry on certain terms detailed below. If the court ruled that the Own Volition Inquiry should not proceed, the Respondent would proceed with the Complaint Based Inquiry.

25 . The terms of this compromise and their relevance were the subject of some debate at the hearing of this application. They were recorded in a letter of 12 January 2021 from the Respondent's solicitors Philip Lee to Mr. Schrems' solicitors Aherne Rudden Quigley. The Applicant and the Respondent place reliance on the terms of this letter to demonstrate that Mr. Schrems was permitted to be heard in the Own Volition Inquiry as an interested party only and not as a complainant. The letter describes itself as confirmation of terms agreed between Messrs Philip Lee and Aherne Rudden Quigley and states the following:-

“ (1) In the event that the court in its judgment in the Facebook Proceedings permits the DPC to proceed with its Own Volition Inquiry, subject only to the terms of suchorders as may be made by the court in connection with the Facebook Proceedings, our client will advance its handling of your client's complaint and the Own Volition Inquiry from the point at which the court delivers its judgment. Each process will be progressed thereafter as expeditiously as possible in accordance with our client's obligations under relevant provisions of the GDPR and the 2018 Act.

(2) If however the court rules that the Own Volition Inquiry may not proceed, or if it rules that the Own Volition Inquiry can proceed but an appeal is brought and any order of the court is stayed pending such appeal, our client will nonetheless advance its handling of your client's complaint under and by reference to sections 109 and 113 of the Data Protection Act 2018.

(3) If the court rules that the Own Volition Inquiry may proceed (and the stay to which that inquiry is presently subject is lifted) the DPC will hear from your client in that inquiry on the terms set out in our letter of 4 December 2020. For ease of reference, those terms are reproduced below:

(i) Your client would be afforded a period of 21 days to make submissions to the DPC.

(ii) In the first instance, your client's submissions would be framed by reference to the...