The Data Protection Commissioner has been ordered to pay the bulk of the substantial costs of long running litigation in the State and in Europe concerning the validity of decisions approving EU-US data transfer channels used by Facebook Ireland for data transfers to its US parent.
Ms Justice Caroline Costello noted the Court of Justice of the EU, in its judgment last July on matters referred to it by the High Court on the application of the DPC, upheld data rights and privacy activist Max Schrems’ reasons for opposing that reference.
For those and other reasons, it would amount to a “grave injustice” not to award him his full costs, against the DPC, of the litigation before the Irish courts and the CJEU, she said.
The Commissioner and Facebook are each liable for their own costs of the litigation, she ruled.
Poaching of wild songbirds so lucrative criminals are monitoring nests
‘Slow’ justice process criticised after man accused of killing dies before trial
Gardaí believe men in Cork murder-suicide chose to let woman survive
Rape victims to be legally represented at trial if their sexual history is examined
She was “acutely aware” her decision would place a very heavy financial burden on the DPC who brought the proceedings in fulfilment of her obligations under EU and national law.
Despite the fact the DPC acted entirely correctly, her office must bear the majority of the costs of this application, the judge said. This was an “unavoidable incident” of her role and the outcome ought not to impact on the future functioning of the DPC’s office.
The judge made the orders in a judgment on Friday on costs issues arising from the Commissioner’s litigation, the ultimate aim of which was to secure a reference to the CJEU to decide issues concerning the validity of EC decisions approving Facebook’s use of data transfer channels known as Standard Contractual Clauses (SCCs).
Several years before the DPC initiated her litigation, Mr Schrems had taken proceedings against her office over the failure to determine his complaint, initially made in 2013 and reformulated in 2015, that the transfers breached his data privacy rights.
He argued there was no need for a reference to the CJEU, insisting there was sufficient information before the Commissioner for her to decide his complaint without any reference.
CJEU
In her High Court judgment on the Commissioner’s proceedings in October 2017, Ms Justice Costello agreed to make a reference to the CJEU.
In July 2020, the CJEU found there are insufficient protections against snooping by US intelligence agencies and the EU’s data protection authorities should vet the sending of any new data to ensure people’s personal information remains protected according to the EU’s data protection regime, the GDPR.
At a hearing earlier this month concerning liability for costs of the proceedings, the Commissioner sought her costs against Facebook Ireland while Mr Schrems sought his costs against the Commissioner.
Facebook did not seek any order for costs in its favour, either against the Commissioner or Mr Schrems, but opposed any costs orders being made against it.
In a detailed judgment, the judge concluded the DPC should pay the bulk of the costs of this “most unusual” case.
The normal costs order is that costs follow the “event” - outcome - and the judge disagreed with the DPC the obtaining of a reference was the “event”.
She accepted Mr Schrems arguments he was successful before the CJEU on each of the points in the case where his position was different to that of the DPC and must therefore be regarded as successful on the event.
She rejected arguments the Commissioner was entitled to an “order over” against Facebook Ireland concerning Mr Schrems costs.
While the DPC argued the essential dispute was between Facebook and Mr Schrems, the DPC brought the proceedings seeking a reference to the CJEU on the basis they were necessary for her to progress her investigation into Mr Schrems’ complaint and cannot therefore be regarded as “a mediator with no independent role in this drama”.
The Commissioner has an essential function mandated by EU law and cannot avoid the implications of that role by saying the dispute was between the data subject and data processor, she said.
While the DPC’s lawyers described Facebook’s approach to the litigation as “warfare”, its case was not of a kind to justify an award of costs in favour of the DPC against Facebook, she held.
However, Facebook should bear the costs incurred by the DPC and Mr Schrems of three days of a four day hearing after the court’s judgment was issued on the DPC’s proceedings, she said. Those three days centred on a bid by Facebook to correct alleged “errors” in her judgment, which she rejected.
