Irish DPC settles Judicial Review and agrees to decide swiftly.
Blocked procedure on Facebook's EU-US data flows can continue.
The DPC has agreed with Max Schrems' demand to swiftly end a 7.5 year battle over EU-US data transfers by Facebook and come to a decision on Facebook's EU-US data flows. This only came after a Judicial Review against the DPC was filed by Mr Schrems. The case would have been heard by the Irish High Court today.
New "own volition" procedure blocked pending complaint from 2013. The Irish Data Protection Comission (DPC) oversees the European operations of Facebook. In Summer 2020 the European Court of Justice (CJEU) ruled on a complaint by Mr Schrems that had been pending since 2013 and came before the CJEU for the second time ("Schrems II"): Under the CJEU jdugement the DPC must stop Facebook's EU-US data flows over extreme US Surveillance Laws (like FISA 702). Instead of implementing this ruling, the DPC started a new "own volition" case and paused the original procedure for an indefinite time. Mr Schrems and Facebook brought two Judicial Review procedures against the DPC: While Facebook argued in December that the "own volition" procedure should not go ahead, Mr Schrems argued that his complaints procedure should be heard independently of the "own voltion" case.
Walls are closing in on Facebook's EU-US data transfers. The DPC has now settled the second Judicial Review with Mr Schrems just a day before the hearing was to take place, and pledged to finalize his complaints proceudure swiftly.
As part of the settlement, Mr Schrems will also be heard in the "own volition" procedure and get access to all submissions made by Facebook, should the Court allow the "own volition" investigation to go ahead. Mr Schrems and the DPC further agreed that the case will be dealt with under the GDPR, not the Irish Data Protection Act that was applicable before 2018. The DPC may await the High Court judgement in Facebook's Judicial Review before investigating the original complaint.
This agreement could in essence make the original complaints procedure from 2013 the case that ultimately determines the destiny of Facebook's EU-US transfers in the wake of the Snowden disclosures. Under the GDPR the DPC has every liberty to issue fines of up to 4% pf Facebook's gloabl turnover and transfer prohibitions, even on the basis of this individual case.
Gerard Rudden, Solicitor for Mr Schrems: "When it comes to the question of whether Facebook can continue to transfer data to the US, the DPC has largely been in agreement with us before the Courts and in a recent draft decision. It repeatedly took the firm view that Facebook cannot continue to transfer EU data to the US. However, the DPC has not issued a decision to that effect in 7.5 years."
Costs. The case has already led to substantial costs for Mr Schrems and his non-profit organisation noyb.eu. The matter of costs was reserved and will be decided by the Court. Even when a case is settled, costs follow the event under Irish law. As the DPC largely conceeded, Mr Schrems intends to make an application for his costs to be paid by the DPC.
The trial was adjurned within minutes and the matter of costs will be decided after the Court issues a Judgement in Facebook's Judicial Review from December 2020.
