naito8 - stock.adobe.com
Facebook is challenge to a High Court judgement, which found the data of EU citizens was at risk of interception by US intelligence services is more about the judgement's appearance than its contents, Ireland’s most senior court heard yesterday.
The social media company is opposing a High Court decision which refers 11 questions raising questions about the legality of data transfers between Europe and the US, to the European Court of Justice (CJEU).
Michael Collins SC, acting for the Irish data protection commissioner, Helen Dixon, told five Supreme Court judges that Facebook was attempting to head off a potential adverse finding by the CJEU - that data transfers between the EU and the US did not meet EU law.
“The whole reason for Facebook being here is that the whole judgement will be referred to the European Court, and they don’t want the court to make a binding decision,” he said.
He was speaking on the second day of a three-day hearing at Dublin’s Supreme Court, the latest in a long-running legal battle with Austrian lawyer Max Schrems. Schems has accused Facebook of sharing his personal data, along with that of other Facebook users with the US National Security Agency (NSA), in breach of European law.
Mass and indiscriminate surveillance
Facebook said on 21 January it objected to findings of fact in the judgment made by judge Caroline Costello, including a finding that the US intelligence services are engaged in “mass and indiscriminate surveillance”.
The social media company argues that the High Court did not take into account evidence from Facebook’s expert witnesses demonstrating there were adequate safeguards in place in the US to protect the privacy of European citizens’ data.
Collins told the Supreme Court that the High Court had heard extensive evidence from Facebook’s expert witnesses on the importance of US intelligence gathering, and on the economic importance of sharing between the EU and US.
“When you are dealing with a case like this, no judgement can cover all of the evidence,” he said.
The argument is that she was not aware of this, that there was some deficiency, but it is difficult to understand what criticism could be made.
Read more about Facebook in the Supreme Court
- Facebook challenges a ruling by Dublin’s High Court over a judgment that it says made ‘extraordinary and incorrect’ findings about the US legal system.
- A high-wire gamble with billions in compensation at stake for European internet users hides the challenge to the unlawfulness of US state internet surveillance.
Costello’s ruling – issued in October 2017 and revised in April 2018 – referred to US safeguards and oversight of the intelligence services gathering of electronic data, the court heard.
These included PDP 28, a presidential directive issued by President Obama on surveillance and US oversight bodies including the Privacy and Civil Liberties Oversight Board (PCLOB), as well as the Senate Intelligence and Judiciary Committees.
“It is difficult to understand how she can be said not to have taken into account the safeguards there,” he said.
Judge properly considered Privacy Shield
Collins said Facebook was also wrong to argue the High Court judge, Costello, did not pay enough attention the European Commission’s decision on Privacy Shield, which found there were adequate protections for EU citizens’ data in the US.
“The idea that she did not somehow consider the provisions of the Privacy Shield is a nonsense, she spent five weeks scrutinising it,” he said.
Unless the Supreme Court decided to read all the relevant EU and US law and take its own view, the proper course is to listen to experts who can compare the strengths of EU and US law, the court heard.
“The court has the benefit of expert witnesses and that is why it is a finding of fact,” said Collins. “There was very little dispute among the experts what US law actually was.”
Collins said it was very difficult to understand what Facebook is asking the Supreme Court to do about the High Court’s findings.
Facebook is objecting to presentation
Brian Murray SC, also representing the Irish Data Protection Commissioner, said most of Facebook’s complaints were concerned with the way the High Court presented its findings, rather than factual errors.
“Most are arguments based on complaints regarding expression, presentation, emphasis or indeed the optics of how the trial judge expressed her views,” he said.
“A number of the complaints are directed to the content ... That more should have been said on the US Administrative Procedures Act (APA), more time should have been spent on motions of summary judgement and more time should have been spent on Clapper [ACLU v Clapper].”
“It is not clear what that ‘more’ is, and what the court should have said,” he said. He told the judges: “I suggest that Facebook is almost inviting you to attend a conference and write a critique of the judgment. It’s all very interesting, but how does it fit into our legislative system?”
Supreme Court judge Justice Peter Charleton said that while he was not denigrating Costello’s findings, it is only one opinion of what US law provides.
“There may be circumstances where another body is in a much better position to find out what is actually happening [in US law] than a judge sitting in this building,” he said.
High Court referral “cannot be appealed”
Collins said that under Irish law, it was not open to the Supreme Court to overrule the High Court’s referral to the European Court of Justice.
“In my respectful submission, there is no ground that the court can vary the findings of fact which are the necessary predicate to the reference and a necessary part of the reference,” he said.
He compared changing the findings of fact in the judgement to setting off a hand grenade. It would have a knock-on impact on the contents of the referral to the European Court of Justice, and the decision the European Court.
Commission decision on Privacy Shield “can be challenged”
The European Commission’s decision on Privacy Shield found the oversights of the intelligence services were adequate and that EU citizens had rights to raise complaints through a US ombudsman, but it was not immune from legal challenge, said Collins.
“No commission decision can render itself immune from challenge by saying it found the law of another country is equivalent to European law, therefore you cannot challenge it. That cannot be right,” he said.
Judge Costello was “entirely in her jurisdiction to make the reference [to the European Court] that she shared the concerns of Schrems,” he said.
“As a matter of principle, this court can’t entertain arguments with the judgement's findings on privacy shield,” he said. “It is impossible to see constructively what this court can do.”
Paul Gallagher SC, representing Facebook, has not identified anything in the judge’s description that he thinks is wrong, apart from the conclusion. “That part of judgment must remain undisturbed,” Collins told the court.
“At the end of the day, it is in our submission impossible to see how these findings based on undisputed facts can present a basis for appeal,” he said.
There must be clear and precise rules so that people have sufficient safeguards to protect data. Safeguards were even more important when people’s private data were being scanned automatically by computers for selection by the US intelligence services, he said.
The court has reserved judgement.
Read more on Privacy and data protection
11 obscure questions, Facebook, Max Schrems and the European Court of Justice
Can Europe legally share data with the US? A court far away is about to decide
Facebook loses bid to halt European court decision on EU-US data sharing
Facebook: US government does not engage in mass and indiscriminate surveillance