By taking legal actions against Facebook that opened up badly-needed international debate, and spurred the enacting of new privacy laws, Austrian lawyer and privacy campaigner Max Schrems has done the State – and the world – some service. Schrems's name graces the internationally significant judgment by the European Court of Justice (ECJ) in 2015, which began as a complaint against Facebook to the Irish Office of the Data Protection Commissioner (ODPC) in 2011.
Alongside an earlier ECJ ruling siding with Digital Rights Ireland, the Schrems decision defined and strengthened Europe's data protections, and influenced the development of the groundbreaking General Data Protection Regulation (GDPR).
An additional Commercial Court case (‘Schrems II’), again involving Schrems and the legality of Facebook’s data transfers, now also referred to the ECJ, is also expected to bring a pivotal ruling on whether, under current US electronic communications surveillance laws, European data sent to the US may be deemed adequately protected to stringent EU standards.
In Dublin this week, Schrems raised some key questions. He welcomed GDPR, but is concerned that national data protection authorities (DPAs) may fail to use the new enforcement tools, including sweeping fines, they have been given. This is especially relevant to Ireland's ODPC, the regulator under GDPR for most of the powerful data-using multinationals like Facebook and Google.
:fill(white):background_color(white)/static.themebuilder.aws.arc.pub/irishtimes/1647534191476.png)
:quality(70)/cloudfront-eu-central-1.images.arcpublishing.com/irishtimes/GXZEC7H5HTIVJK4GFLIOROVUK4.jpg)
:quality(70)/cloudfront-eu-central-1.images.arcpublishing.com/irishtimes/CLBONSBUBNULJO4HLTCPMXHBPU.jpg)
Though the office is more adequately funded and staffed now, the problem of costs persists. Court costs in Ireland can be much higher than other jurisdictions and wealthy multinationals could drag out cases, making them financially prohibitive for the ODPC or individuals bringing complaints. Two simple actions would help address these looming challenges. First, our privacy laws should introduce a provision which mandates that complainant court costs cannot be prohibitively expensive. Second, Ireland needs to allow class action lawsuits, to permit actions to be taken and settled swiftly and collectively.