EU-US data sharing under threat as Irish court refers Facebook case to Europe

Rights of redress

The Dublin court will also ask the CJEU to determine whether the US has provided adequate rights of redress under Article 47 of the European Charter of Fundamental Rights, for European citizens who believe their privacy rights have been breached in the US.

Facebook has argued in the case that the Treaty of Europe gives member states exemption from EU law over matters of national security, and that, as a consequence, processing of EU data by the US agencies should also be exempt from European law.

The court will seek a determination whether EU exemptions for national security apply, irrespective of whether the processing takes place in the EU, the US or a third country.

The court has also asked the CJEU to rule whether the EU Charter and the EU law, or the national state or national laws of EU states apply when deciding whether the data privacy rights of EU citizens are breached.

Another question asks whether the EU-US Privacy Shield agreement – the replacement for Safe Harbour, which was struck down by the European court – applies to all data transfers to the US, including SCCs.

The questions were put together after the Costello heard submissions from parties in the case following a judgment last October.

The current hearings were initiated when Ireland's Data Protection Commissioner, Helen Dixon, brought legal proceedings against Facebook and Schrems. The US government, the Washington-based Electronic Privacy Information Centre, the Business Software Alliance and Digitial Europe were joined to the case.

Costello agreed to make the referral to Europe after agreeing with the Irish data protection commissioner that there were good reasons for believing that SCCs are invalid.

Well-founded concerns

She said the commissioner had raised “well-founded” concerns about the absence of an effective remedy in US law where EU data transferred to the US “may be at risk of being accessed and processed by US state agencies for national security purposes in a manner incompatible with Articles 7 and 8 of the charter.”

In a statement after the hearing, Schrems said the Irish data protection commissioner could have dealt with the case herself, but he was hopeful that the referral to the CJEU would bring a final resolution.

“Given case law, the question in this case does not seem to be if Facebook can win it, but to what extent the European Court of Justice will prohibit Facebook’s EU-US data transfers,” he said.

During the hearing, Paul Gallagher SC, for Facebook, asked for time to consider seeking appeal against the judge’s decision to make a referral to the CJEU.

Michael Collins SC, representing the Irish data protection commissioner, said he did not object to Facebook being given time to consider its approach, but queried whether it was legally entitled to appeal against the High Court’s referral to the CJEU.

Costello told the court she had given a judgment in October ordering the reference to Europe, but would allow Facebook until 30 April to consider its position.