How a Dublin court case could derail EU-US data privacy agreements

Schrems’ complaint justified

Dixon is taking this litigation to comply with an order from both the Irish High Court and the European Court of Justice that she should investigate the original complaint made by Austrian law student Max Schrems in June 2013, and subsequently amended by him to include the complaint about SCCs.

Schrems took his complaint about transfer of data from the EU to the US, which focused on Facebook’s data collection and transfer to the US, to Ireland because the Irish data commissioner is responsible for regulating Facebook throughout the European Union.

The Irish data protection commissioner lost control of the original complaint when Schrems went to the Irish High Court in 2013. His aim was to have the refusal by Dixon’s predecessor, Billy Hawkes, to look at the complaint examined by a judge.

This occurred with spectacular effect, leading to an Irish High Court finding of fact that Schrems’ complaint, mainly about Prism, the US surveillance programme, was justified.

The Irish High Court findings in June 2014, which included a determination that the US was engaged in “mass and indiscriminate surveillance”, were referred to the European Court of Justice. That court ruled in October 2015 that the Safe Harbour agreement for the transfer of data between the EU and the US was invalid.

At that point SCCs were adopted by companies to keep business flowing. The Article 29 Regulators reluctantly agreed to this.

In the meantime, the Irish data commissioner was faced with two problems: the order to investigate Schrems’ complaint; and the content of his complaint.

The practical effect of the court actions initiated by Dixon is to postpone the core content of Schrems’ complaint, which is Prism, until such time as the European Court of Justice rules on SCCs.

SCC legality in question

Dixon has raised three key legal concerns about SCCs that also apply to Privacy Shield, however. These are the European Union Charter of Rights Article 7, covering the protection of family life; Article 8, covering data privacy; and Article 47, on the right to a trial before a court of law for matters arising under the charter.

While some commentators believe Privacy Shield will fail the legal tests proposed by Dixon over SCCs, the issue is overshadowed by Prism for so long as it continues to be run by the US.

Prism is a US surveillance program that seeks to acquire client data of at least nine of the largest US internet giants, which are named in the Irish High Court ruling.

The evidence states that they are required by the US National Security Agency (NSA) to provide the “email, chat, video and voice, videos, photos, stored data, VoIP, file transfers, video conferencing, notification of target activity, logins, online social networking details, special requests” of their foreign users.

Carried out in full, this order would affect around 67% of European internet users – as many as 300 million people.

Case summary

The case began at the Irish Commercial Court, Dublin, at 10am on Tuesday 7 February 2017, before judge McGovern.

The applicant is Helen Dixon, data commissioner of Ireland. The respondents are Max Schrems, as a private individual, and Facebook Inc.

Amicus curiae (Friends of the Court) are: the United States government; the Business Software Alliance, an IT industry lobby group; Epic, a US public interest research centre; and Digital Europe, an IT industry lobby group.