The Irish Data Protection Commissioner has told the High Court she will speedily investigate a complaint by Austrian student Max Schrems alleging Facebook Ireland is making personal data available via Facebook Inc to US intelligence agencies.
Mr Justice Gerard Hogan was told the investigation will proceed arising from the recent decision of the European Court of Justice concerning the Safe Harbour arrangement relating to transfer of personal data.
The ECJ ruled the 15-year-old Safe Harbour arrangement, which allowed about 4,500 US companies to transfer personal data to the US, violates the fundamental rights of EU citizens to privacy and data protection.
Mr Schrems had in judicial review proceedings challenged the Commissioner's 2013 refusal to investigate his complaint, made after former National Security Agency security contractor Edward Snowden claimed Facebook and other US firms were being forced to make their personal information, including EU user data, available to US intelligence.
The commissioner's office said Safe Harbour, and its implementation, was solely a matter for the European Commission.
Mr Justice Hogan had referred issues concerning the validity of Safe Harbour to the ECJ and, following that court’s ruling, the matter returned before the judge to decide how the case should proceed.
Having heard from the sides, the judge said former commissioner Billy Hawkes had considered “his hands were tied” as a result of Safe Harbour and it was only in that context he found the complaint frivolous and vexatious and doomed to fail.
There was no dispute the case raised major issues of Irish and EU law, the judge added.
Arising from the ECJ decision, the commissioner Helen Dixon was now consenting to orders quashing the 2013 refusal and remitting the matter for consideration by her, the judge noted.
It is clear, under EU law, the commissioner is obliged to investigate the complaint and the court had no doubt she would do so, the judge said.
There was a “mottled” and “aquamarine” legal landscape of Irish and EU law concerning the matters to be addressed by the commissioner but the sides had agreed it was unnecessary, and possibly undesirable, for the judge to express any further view on that. His earlier decision, and the ECJ decision, “must speak for themselves”.
Mr Justice Hogan said Mr Schrems was clearly entitled to his legal costs of this case of “transcendent international importance”, involving “possibly one of the most important decisions” of the ECJ in recent years. Pending payment of the full costs to Mr Schrems, he is to get a payment on account of €10,000 towards travel and other costs.
Earlier, Paul Anthony McDermott SC, for the commissioner, said the refusal by Mr Hawkes to investigate was based on the assumption the Safe Harbour arrangement was valid. There may be discussions on a new Safe Harbour arrangement and data protection commissioners across Europe are considering that, counsel said.
Noel Travers SC, for Mr Schrems, said his client was concerned the investigation might be “long-fingered” in the hope there might be a new Safe Harbour arrangement.
Mr Schrems made the complaint three years ago, was concerned the transfers of data are continuing and there was no guarantee, even if his complaint was upheld, the data would be returned, counsel said.
Mr McDermott said there was no question of the investigation being “long-fingered” and any delay to date could not be attributed to the Commissioner who would investigate in line with what the High Court and ECJ had said.
Rossa Fanning BL, for Facebook Ireland, which denies any breach of Irish or EU law, said, because the judicial review was now at and end, he was not pursuing an application to be permitted make submissions on a range of legal issues.
Privacy rights body Digital Rights Ireland was previously joined to the Schrems case as an amicus curiae, or ‘friend of the court’.
Fergal Crehan BL for Digital Rights Ireland noted the “rather circumscribed” role the organisation had played in the Schrems case and thanked the court for the opportunity to address the issues before it and before the Court of Justice.
“We feel our role has now largely been played out,” he said.
Mr Crehan said DRI was “at pains not to take any position” as regards the issues, or potential issues, between the parties.
In a statement following the ruling, the Data Protection Commissioner said: “I welcome today’s ruling from Judge Hogan which brings these proceedings to a conclusion.
“My office will now proceed to investigate the substance of the complaint with all due diligence.”
Deputy data protection commissioner John O’Dwyer was in the High Court for the proceedings.
In a statement after the case, a spokesman for Facebook said: “Facebook is not and has never been part of any program to give the US government direct access to our servers.”
It would respond to inquiries from the Data Protection Commissioner as it examined the protections for the transfer of personal data “under applicable law”.
