On 14 May 2021, the High Court delivered its ruling in the latest Schrems-related action in which Facebook challenged the legality of the Data Protection Commission (DPC) decision to investigate the transfer by Facebook of EU individuals’ personal data to the US. The High Court has rejected Facebook’s challenge thus paving the way for the DPC investigation to proceed.
Background in brief
This latest court ruling follows the Court of Justice of the European Union’s (CJEU) 2020 ruling in the Schrems II case, which affirmed the use of Standard Contractual Clauses (SCC) to transfer data to a country outside the EU in certain cases but held that the EU-US Privacy Shield was invalid and could not be relied on for EU-US data transfers. As a result of the CJEU ruling, the DPC launched its investigation into the EU-US data transfers facilitated by Facebook and issued a Preliminary Draft Decision (PDD) in which it determined that the SCC mechanism Facebook employed could not be used. Facebook challenged both the PDD and the inquiry itself in the High Court by means of judicial review.
High Court ruling
In its 14 May ruling, the High Court refused all reliefs sought, and dismissed all claims made by Facebook. As a result, the DPC has two open procedures to implement the ruling from the Schrems II decision of the CJEU; the investigation on its own volition commenced in 2020 and the original complaint made by Mr. Schrems in 2013.
The Hight Court determined that, while the DPC’s decision to investigate Facebook’s EU-US data transfers and to issue the PDD was amenable to judicial review, it rejected each of the grounds for relief put forward by Facebook. While the Court considered and rejected Facebook’s allegation that the DPC was in breach of its duty of candour in respect of its defence of Facebook’s challenge, it also held that the DPC failed to adequately address queries raised by Facebook during pre-hearing exchanges of correspondence between the parties. The DPC responded to Facebook’s queries noting that they were not relevant to the proceedings, however, Mr Justice Barniville was of the view that “the DPC ought to have erred on the side of caution, as stated by the Supreme Court in GRA (No. 2) by providing the information and ought not to have acted in an overly defensive manner by refusing to do so had responses been provided, this would have obviated the need for further sworn affidavits to be submitted to the Court.”
Schrems Judicial Review
In addition to Facebook’s challenge, Mr. Schrems also brought judicial review proceedings against the DPC, challenging the legality of its investigation. These were due to be heard in January 2021 but were settled, subject to several conditions, prior to hearing. A key condition was that, if the Court ruled that the DPC’s investigation may proceed, the DPC would accept a submission from Mr. Schrems as part of that inquiry. Another was that Mr. Schrems would separately retain his right to make submissions as part of his reformulated complaint to the DPC.
Next steps
As a result of the High Court’s rejection of Facebook’s challenge, the DPC is no longer precluded by the Court from progressing its investigation of EU-US data transfers facilitated by Facebook. The DPC has written to Facebook, giving it six weeks to provide submissions in relation to its investigation. The DPC expects to finalise its investigation and issue a decision within 21 days of receipt of Facebook’s requested submission. Once published, EU Member States have four weeks in which to lodge any objection to the DPC’s decision. As such, the result of the DPC investigation may be available by mid-summer.
Contributed by David Kirton & Sinéad Cullen