Facebook is to bring an unprecedented legal appeal in an attempt to halt the Irish High Court referring questions over the validity of EU-US data transfer agreements to the European Court of Justice (CJEU) .
The case will have major implications for the EU’s decision to support Privacy Shield and standard contractual clauses, which are widely used by organisations to transfer data from the EU to the US, raising questions over whether they adequately protect the privacy of European citizens.
The Supreme Court in Dublin will hear the challenge by Facebook to set aside the court’s referral of 11 questions over the legality of data transfers between Europe and the US to the CJEU at a hearing on 21 January.
The case is the latest round in a long-running legal battle between Austrian lawyer Max Schrems and Facebook. Schrems has accused Facebook of sharing his personal data, and that of other Facebook users, with the US National Security Agency, in breach of European law.
In an appeal expected to last three days, Facebook is expected to argue that it is entitled to appeal against the High Court’s referral of questions to the CJEU. It will claim that under the Privacy Shield agreement between the EU and US, there is no requirement to seek clarification from the CJEU on EU-US data transfers.
The social media company also claims that the High Court made incorrect findings of fact, including findings over the applicability of US law. It is challenging a ruling by Ireland’s data protection commissioner, Helen Dixon, that there were “well-founded concerns” about the adequacy of protections in the US for the data privacy rights of EU citizens.
A UK-based IT expert and contributor to Computer Weekly, Kevin Cahill, applied to be joined to the appeal as an amicus curiae (assistant to the court) at the hearing on 1 November 2018.
Cahill said he had worked in the computer industry for 10 years before becoming a journalist writing about the industry. He had also worked as an assistant to Liberal Democrat leader Paddy Ashdown, was a chair of the Human Rights Committee in the House of Lords, and an adviser on surveillance and supercomputers.
The Prism programme – now renamed Downstream – used by the US National Surveillance Agency to collect and store huge quantities of data of internet users, was a “big issue” in the UK parliament”, said Cahill. He told the Dublin High Court that Prism involved “mass and indiscriminate surveillance”.
Cahill said “issues of fact” published by the UK parliament were “in serious conflict with the way the legal procedure is going” in Ireland.
In response to Justice Elizabeth Dunne, Cahill said he was aware of the Supreme Court determination agreeing to hear Facebook’s appeal concerned a High Court judgment by Justice Caroline Costello of October 2017 and her subsequent referral of issues arising from that judgment for determination by the CJEU.
Dunne said the Supreme Court determination permitted an appeal by Facebook on “very limited issues of law”.
‘Clearly a conflict’
Cahill said there was “clearly a conflict” between the facts he had and some of those before the court. “My field is facts, not law,” he said.
Refusing Cahill’s application, Justice Dunne said Cahill appeared to have extensive experience in areas of data protection and information technology and had given evidence on behalf of reputable bodies.
But he had accepted that the assistance he could provide related to factual issues when the issues before the court were tied up with issues of law, she said. In the circumstances, the court would not join Cahill as an amicus to the appeal.
Lawyers for Facebook and Schrems, whose complaints that Facebook sending his personal data to the US breached his data privacy rights led to the proceedings, opposed Cahill’s application, while the data protection commissioner remained neutral.
Justice Costello referred 11 issues concerning the validity of European Commission decisions approving data transfer channels, known as standard contractual clauses, to the CJEU in May 2017.
The questions raise significant issues of EU law with huge implications, including whether the High Court was correct in finding there was “mass indiscriminate processing” of data by US government agencies under the Prism and Upstream programmes.
The court previously set a provisional hearing date of 19 December, but, following a case management hearing on Thursday, it has now fixed it for 21 January.
Read more on Data protection regulations and compliance
Investigatory Powers Tribunal finds UK spy agencies unlawfully collected personal data
Irish High Court dismisses legal bid by Facebook over EU-US data transfers
All EU states can take data protection cases against Facebook, says EU court
Why data exports from the EU will be challenging without Privacy Shield