Today at about 15:00 BST (16:00 CET) the Irish High Court has granted Facebook leave to file a Judicial Review against the DPC (Case No 2020/617 JR) and stayed a new "ex officio" procedure by the DPC into EU-US data flows.
For now Facebook has succeeded in stopping the DPC's investigation into EU-US data flows, that are not legal under an instrument called "Standard Contractual Clauses" (SCCs). On 16 June 2020 the Court of Justice of the European Union (CJEU) has held that companies like Facebook may not rely on the SCCs if they fall under US mass surveillance laws such as FISA 702. The DPC may take action against the pause of the investigation within a 72 hour notice period.
Last week the Wall Street Journal reported that Facebook was served with a confidential "preliminary decision" by the DPC in this matter.
Judicial Review
A Judicial Review allows parties to have the Courts review an ongoing procedure, even before a final decision is made. Facebook has complained to the Courts within weeks of a new "ex officio" investigation by the DPC into Facebook's EU-US data flows. This new case is aimed at the use of SCCs and limited to such data flows - completely ignoring the fact that Facebook has already announced to rely on a different transfer instruments for EU-US data transfers. The DPC planned to refer this case to the European Consistency Mechanism of all 27 Member States' Data Protection Authorities within 42 days. This timeline is now not achievable anymore.
In support of the application, Facebook made arguments that a "draft decision" from 28 August 2020 that stood at the beginning of the procedure preempted the outcome of the procedure and that three weeks to respond is not enough time for the social media giant to respond. Facebook said that it was informed about the timeline, when reviewing letters from the DPC to noyb, that noyb has published on its website. Facebook also argued that it would be "unfair" that the DPC only targeted Facebook and not also other IT companies that outsource data from Ireland to the United States. Facebook also relied on a letter by Mr Schrems demainding that the existing complaints procedure should contine and the 101 cases filed with different DPAs by noyb to argue that the DPC's approach to open a new "ex officio" investigation is flawed.
Max Schrems (complainant in the original case): "It does not come as a surprise that the DPC has again failed to run a proper procedure and was stopped by the Irish courts for now. At the same time it is not clear if Facebook will ultimately succeed with this case. Today Facebook was only granted to file a case and have the investigation by the DPC paused for the next days and maybe weeks."
Independent action by noyb against DPC procedure
Independent from the Judicial Review by Facebook, noyb has announced that it will also challenge this new "ex officio" case by the DPC insofar as the DPC has informed noyb that this case will to a large part replace a complaints procedure that is pending before the DPC for more than 7 years.This comes despite the DPC being under a court order to swiftly decide this case since 2015.
The DPC has claimed last week, that the substance of this pending case will be decided in a separate, newly started, "ex officio" investigation - without the original complainant being heard. The complaints procedure, that was ongoing for 7 years and was already subject to five court decisions before a first decision by the DPC was issues, would again be "paused".
Max Schrems (complainant in the case): "The DPC uses a very shady trick to remove the concerned data subjects from its cases. As the DPC has first called this case 'frivolous' and then failed in its assessment of the SCCs - claiming that they would be invalid. We have zero trust in the DPC being able to get this case done without an external complainant representing the users."
Within a month the DPC has (again) taken such questionable actions in its procedures, that even the opponents before it agree (for different reasons) that the procedure must be stopped. Facebook has agreed that all documentation of the "ex officio" investigation will be made available to Mr Schrems.
Mr Schrems: "The DPC is notorious for making bad procedural decisons. So far they lost almost every case and even got opponents like Facebook and me to agree that their procedures are questionable - even if for different reasons. The current case did not see a formal decision by the DPC in seven years - despite five judgments by different Courts on the way."
