Worldwide: High Court issues ruling in Facebook data transfer case
To print this article, simply register or connect to Mondaq.com.
On May 14, 2021, the High Court issued its ruling in the latest Schrems-related action in which Facebook challenged the legality of the Data Protection Commission (CPD) decision to investigate Facebook’s transfer of personal data of individuals from the EU to the US. The High Court dismissed Facebook’s challenge, paving the way for the DPC’s investigation to continue.
Context in brief
This latest court decision follows the decision of the Court of Justice of the European Union (CJEU) 2020 decision in the Schrems II case, which confirmed the use of standard contractual clauses (CSC) to transfer data to a country outside the EU in some cases, but found the EU-US Privacy Shield to be invalid and cannot be invoked for EU-data transfers United States. Following the CJEU decision, the DPC launched its investigation into EU-US data transfers facilitated by Facebook and published a preliminary draft decision (PDD) in which he determined that the SCC mechanism employed by Facebook could not be used. Facebook challenged both the PDD and the investigation itself in the High Court through judicial review.
High Court decision
In its May 14 decision, the High Court denied all requested remedies and dismissed all claims made by Facebook. Consequently, the DPC has two procedures open to implement the judgment of the Schrems II decision of the CJEU; the investigation on his own initiative began in 2020 and the initial complaint filed by Mr Schrems in 2013.
The High Court determined that while the DPC’s decision to investigate Facebook’s EU-U.S. Data transfers and issue the DDP was subject to judicial review, it dismissed each of the grounds for redress put forward. by Facebook. Although the court considered and dismissed Facebook’s claim that the DPC had breached its duty of openness with respect to its defense of the Facebook challenge, it also found that the DPC had failed to respond in a meaningful way. adequate to the issues raised by Facebook during the pre-hearing correspondence between the parties. The DPC responded to Facebook’s questions noting that they were not relevant to the proceedings, however, Judge Barniville was of the opinion that “the DPC should have erred on the side of caution, as the Supreme Court said in the GRA judgment (no.2) in providing the information and should not have acted too defensively in refusing to do so if responses had been provided, which would have avoided the need to submit further affidavits under oath to the Court. ”
Schrems judicial review
In addition to Facebook’s challenge, Mr. Schrems also initiated judicial review proceedings against the DPC, challenging the legality of its investigation. These were due to be heard in January 2021 but were settled, subject to several conditions, before the hearing. A key condition was that, if the court decided that the DPC investigation could proceed, the DPC would accept a submission from Mr Schrems as part of that investigation. Another was that Mr. Schrems would separately retain his right to comment on his reformulated complaint to the DPC.
Following the High Court’s dismissal of the Facebook challenge, the DPC is no longer prevented by the court from continuing its investigation into the data transfers between the EU and the US facilitated by Facebook. The DPC wrote to Facebook, giving it six weeks to submit comments regarding its investigation. The DPC hopes to finalize its investigation and issue a decision within 21 days of receiving the requested submission by Facebook. Once published, EU member states have four weeks to object to the DPC’s decision. As such, the result of the DPC’s investigation could be available by mid-summer.
Contribution of David Kirton and Sinéad Cullen
The content of this article is intended to provide a general guide on the subject. Specialist advice should be sought regarding your particular situation.
POPULAR POSTS ON: Worldwide Privacy