The Irish High Court has ruled that a case concerning the data transferred from the EU to the US must be examined by the European Court of Justice and that the court had the jurisdiction to make such a reference.
The case was initially brought to the attention of the Data Protection Commissioner by Maximillian Schrems, an Austrian lawyer in 2013. Mr Schrems operated a Facebook account and his personal data had been transferred from the Facebook Ireland (the main office for Facebook in the EU) to Facebook Inc. in the United States. Mr Schrems had concerns that the legal regime in the US did not afford his personal data the protection which he enjoyed under EU law.
The Data Protection Commissioner agreed that Mr Schrems had well founded objections to his data being transferred to the US, citing that the remedies for EU citizens for breach of their data privacy rights in the US were inadequate and contrary to Article 47 of the Charter of Fundamental rights.
Article 47 requires provides that: “Everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article. Everyone is entitled to a fair and public hearing within a reasonable time by an independent and impartial tribunal previously established by law. Everyone shall have the possibility of being advised, defended and represented. Legal aid shall be made available to those who lack sufficient resources in so far as such aid is necessary to ensure effective access to justice”.
The Data Commissioner also formed the view that the current arrangements for the transfer of data between the US and the EU meant such data would be at risk of being processed by US state agencies, and therefore the rights under Article 7 and 8 (the right to a private life and the protection of personal Data) were also engaged. In light of these concerns the Commissioner sought leave from the Irish High Court that a preliminary reference be made to the Court of Justice of the European Union on the validity of these arrangements. In particular regarding the Commission’s Decision 2010/87/EU, in relation to the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council.
Both Mr Schrems and Facebook opposed the referral, though on very different grounds. Mr Schrems opposed it on the grounds that the Commissioner and the Irish Courts had sufficient jurisdiction to finalise his complaint, and Facebook on the grounds that US law was sufficient to protect the privacy rights of EU citizens.
Justice Costello who oversaw the motion saw that the court was concerned with two main issues: whether or not the High Court had jurisdiction to grant the relief sought and if the court should refer the issue of the validity of Standard Contractual Clause Decision to the CJEU for a preliminary hearing.
Justice Costello noted that it was not the place of the High Court to pronounce the relative merits of the laws of the US and the EU. It was decided that the court had jurisdiction to refer the case to the CJEU for a preliminary ruling under the Treaty on the Functioning of the EU, on the basis that the Commissioner had raised well founded concerns over the 20/87/EU decision and because both the Charter of Fundamental rights and EU law were highly relevant. She went on to state that EU citizens had the right to an effective remedy under Art. 47 of the Charter if their rights were violated, including their rights under Articles 7 and 8. A decision by the CJEU was needed on whether the power conferred upon the Commissioner by Art.28 of the 1995 directive is sufficient to secure the validity of the SCC decisions. Ms. Justice Costello concluded that it was essential that EU Directives were applied uniformly cross the Union, and that only a decision but the CJEU could resolve the potential for inconsistency. Justice Costello will hear submissions as to the wording of the questions to be referred to the CJEU at a later date.
The Court was assisted by a number of amici who were invited to participate in the case including the US Government, the BSA Software Alliance, Digital Europe and EPIC (represented by FLAC).
To read the full judgement click here
For the executive summary click here, and for further articles click here and here.