High Court to rule on landmark data privacy case next week

The High Court will rule next week on an action by the Data Protection Commissioner with potentially enormous implications for EU-US trade and the privacy rights of millions of EU citizens.

Ms Justice Caroline Costello is due to give judgment on Tuesday on the case taken by commissioner Helen Dixon.

The commissioner wants the judge to ask the Court of Justice of the EU (CJEU) to decide the validity or otherwise of European Commission decisions approving data transfer channels known as standard contractual clauses (SCCs).

Her application arises following a complaint made in 2013 by Austrian lawyer Max Schrems alleging his data privacy rights as an EU citizen were breached by transfer of his personal data by Facebook Ireland – because Facebook's European headquarters are here – to its US parent, Facebook Inc.

Facebook may be forced to shut down in Russia

---

Tech mergers may need examination outside normal competition law - LSE professor

---

Firms involved in biometric database in India contracted by Irish government

---

Social welfare Bill promotes use of public services card as ID

---

That complaint led to an earlier reference by the High Court to the CJEU which resulted in the European court striking down the Safe Harbour arrangement for data transfers.

Mr Schrems’s complaint was then subject to an investigation by Ms Dixon who, in a draft finding in May 2016, found he had “well-founded” objections over data transfers based on her views about the adequacy of remedies available in the US for EU citizens who allege breach of their data-privacy rights.

She wants the Irish court to ask the CJEU to decide on the validity of the European Commission’s decisions approving the SCCs before finalising her decision on Mr Schrems’s complaint. Her concern is “to get it right”, the court heard.

The case is against Facebook and Mr Schrems who, for different reasons, oppose a referral.

Facebook argued the commission’s draft finding was wrong and failed to take into account the 2016 agreement between the European Commission and US on a “Privacy Shield” framework for data transfers.

Mr Schrems argued a reference was unnecessary or at least premature in circumstances where, he alleged, the commissioner had not yet fully investigated his complaint.

The judge also heard evidence from various experts on US law along with arguments opposing referral from the US government, DigitalEurope and the Business Software Alliance.

The US government disputed the claims of inadequate protections there and it and the other two bodies also argued there would be potentially enormous adverse consequences for trade, business and economic interests in the EU, US and beyond if the SCCs were found invalid.

Lawyers for the Electronic Privacy Information Center, a Washington-based non-governmental organisation, endorsed the Ms Dixon’s concerns about adequacy of remedies in the US.

Ms Dixon strongly disagreed with Facebook and the US about the relevance of the Privacy Shield decision to the issues the Irish court has to decide.

New developments

After the judge had reserved judgment last March on the 21-day case, she later agreed to hear further submissions about the significance of new developments for the case, including new restrictions on the collection of a certain category of personal data by the US National Security Agency. The restrictions mean, while the NSA had historically been authorised to acquire communications to, from, or "about" a target under Section 702 of the Foreign Intelligence Surveillance Act through its Upstream internet surveillance programme, it will no longer collect communications "about" a target.

Lawyers for the US government urged the judge to factor in the new developments when preparing her judgment. The developments included a decision of the US Foreign Intelligence Surveillance Court (FISC) of April 26th which addressed the failure of US agencies to comply with surveillance restrictions imposed by the FISC and restraining collection of “about” data.

Another development was a decision by the US Court of Appeals for the Fourth Circuit that Wikimedia, but not several other plaintiffs, had the necessary legal standing to challenge the Upstream surveillance programme.

The judge agreed to receive the information, formally provided by Facebook Ireland as a party to the case, and also received brief reports from the sides’ experts of their views on the information. She also heard oral submissions on it.

Lawyers for Ms Dixon and Mr Schrems argued the new material was not significant to the core issues the High Court had to decide while Facebook maintained it was.