Facebook Fails To Block EU Court Case That Could Rule Against Most Transatlantic Data Flows

Privacy

from the privacy-shield-not-looking-so-doughty dept

Last August, we wrote about the latest development in an important case moving through the EU’s legal system. At risk is the huge volume of data that flows from the EU to the US, currently authorized by the Privacy Shield scheme. The original complaint was brought by that indefatigable defender of privacy, Max Schrems. Given the importance of the outcome, the Irish High Court referred the case to the EU’s top court, the Court of Justice of the European Union (CJEU). It posed eleven quite searching questions that it asked the CJEU judges to rule on.

Schrems’s specific complaint concerns Facebook, which took the unusual step of appealing against the High Court’s decision. The received wisdom was that this was not an option, but the Irish Supreme Court disagreed, and said it would consider the appeal. Facebook alleged that the questions sent by the High Court to the CJEU contained factual errors that were serious enough to require the request to be thrown out. The Irish Supreme Court has now handed down its judgment (pdf) — against the appeal. Ireland’s Chief Justice explains why:

having analysed each of the remaining heads of appeal, I am satisfied that in each category it is more appropriate to characterise the criticisms which Facebook seeks to make of the judgment of the High Court as being directed towards the proper characterisation of underlying facts rather than towards those facts themselves. In those circumstances, I would not propose making any order overturning any aspect of the High Court judgment. If there had been an actual finding of fact as such, rather than a characterisation of facts, which I considered was not sustainable on the evidence before the High Court in accordance with Irish procedural law, I would have been happy to propose an order overturning that fact. However, it does not seem to me that any such matter has been established on this appeal.

In his press release on the decision (pdf), Schrems writes:

Facebook likely again invested millions to stop this case from progressing. It is good to see that the Supreme Court has not followed Facebook’s arguments that were in total denial of all existing findings so far. We are now looking forward to the hearing at the Court of Justice in Luxembourg next month.

That hearing is something Facebook really wanted to stop. Afterwards, the CJEU will rule whether the Privacy Shield framework should suffer the same fate as its predecessor, Safe Harbor. If it is ruled invalid, it will be a big headache not just for Facebook, but for the many US companies that depend upon Privacy Shield to make the transfer of personal data about EU citizens legal under the region’s strict data protection laws.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: cjeu, eu, ireland, max schrems, privacy, privacy shield
Companies: facebook