Welcome everybody to
our first edition of our noyb advent reading.
Marco is with me.
Good evening. Marco is one of our lawyers.
It's actually about
one of your cases, our document that we're going to disclose today,
but mainly it's kind of an intro about documents and confidentiality,
so the really hot, interesting documents we safe for the next three advent Sundays
So stay tuned. We should actually do that.
..and this is more of an idea of showing you the bigger picture,
the bigger problem and why this confidentiality topic is a big topic.
What's the ... like?
How did we end up here?
What's the background of this whole issue?
One of our data subject has been removed
from a procedure, and so have we.
Exactly. So in Ireland, we already
have a very long debate about confidentiality of documents.
The Irish law doesn't have any kind of confidential clause,
but the DPC is usually pressured by Facebook and tells Facebook --
-- actually tells Facebook that all of these documents must be shared.
So the story towards Facebook is usually everything must be shared
and then to us they say all of it is confidential.
So it's a bit of a bipolar situation there.
And the last edition was that because we published the draft decision
that we found is very problematic and really of public interest.
They ask us to sign a non-disclosure agreement,
which is not foreseen by law.
They literally wanted to have an additional agreement
because the law does not protect these documents and said
otherwise will be removed from the procedure.
We had one day for that and obviously we refused to do that
and instead filed a submission with the Austrian Prosecution
Service for criminal corruption cases, actually,
because that may actually be a corruption issue.
I think also for people to know our background and
how we usually deal with this: I think we got by now
ten thousands of pages of submissions in different cases.
I remember even the Schrems II litigation was more than 45,000 pages,
and usually no one cares about these submissions.
But if something is really relevant or of public interest or extremely problematic,
then that is something that we consider if we should publish it or not,
usually then have a debate about it and go ahead if if that's what the plan is.
-- and also redact something that might be problematic.
So now we're here at this advent reading what is this going to be about?
Yeah. So that was just more of a random idea.
So in Austria and Germany, and advent is a big thing.
We usually sit down with one of these wonderful little
advent thingies [Advent wreath] with like four candles. And on the first Sunday,
you light your first candle as we do,
and you usually should sit down with your family
and be a bit what we call "besinnlich" which is literally translated
"coming a bit back to your senses".
And we thought that maybe a nice framing to come back to everybody's senses
when it comes to sharing of documents, transparency and so on.
And this whole approach is also explicitly there so that we get sued
if we actually would violate any of these rules that exist,
that we're going to go through today a bit more.
And that is a bit of a intended
provocation to see if all of these threats that we usually get
actually have any substance or are just dramatic.
Why is the DPC
and also Facebook so eager to keep everything confidential?
Why is there this culture of putting a lid on everything?
I think usually information is always is power and also in procedure:
The more information
you have, the more power you have, the more you can combine
submissions in different documents, the more power you get.
So for example, for us,
we have to add a couple of times that we realize,
Oh, Facebook is arguing one thing in Ireland
and the other thing in a procedure here and the third thing there .
And once you can combine that and say, actually,
that's bullshit, because you said exactly the opposite
two days ago - that's a problem for them.
So the more, they can keep these things separate and confined.
And, for example, limit us in sharing with other NGOs
in other countries where they may have argued exactly the opposite .
The more power they have in the procedure. And the DPC seems to have learned
from Facebook in all of that
and does the same thing in the European cooperation procedure.
So ideally, the European Data Protection Authorities should work together,
exchange documents and so on.
And for example, for the draft decision, as far as we have heard,
the DPC did not share anything but their final decision.
So a lot is not is simply missing in that final decision.
A lot of things were just not disclosed or just "forgotten" somehow...
- Which makes it super hard for the other authorities to even contest the decision to think
whether they object to it or to know whether they should agree.
Exactly. So one part why we wanted to share documents
is that we sent a link to the DPAs and said "That's the file as we know it"
- we never got everything -
so that you can even see that, for example, we conducted a study with 1000 people on
what they actually think about Facebook because Facebook says
it's all agreed and so on. It's a long story.
But without that knowledge, other DPAs can simply not
come to any of such conclusions and actually get a proper,
correct decision in the end.
And that is that is a problem there.
In reaction to our advent reading, we also received
some fan mail, which actually thanks for reminding me we receive fan mail.
I forgot about that point.
And it's actually super important because we really, really want more fan mail.
So I would just read that out real quick.
The first one was actually from Philip Lee solicitors.
That's the DPC's Solicitors,
which is super interesting because the DPC outsources
a lot of the legal stuff, apparently to a law firm that the Irish taxpayer
is paying, in addition or instead of the DPC.
And they send us a wonderful letter demanding on the last page
that we should let them know beforehand what we're going to disclose
on which Sunday.
So they're really, really eager to know - they're big fans.
... and "to consider if it's necessary and appropriate to bring the matter
to the attention of the courts."
So we sent back to Philip Lee that
we don't know what exactly we're going to publish the next days, but we really,
really want them to bring this to the attention of the courts.
- They can do that afterwards. - ...unfortunately, they haven't done it so far.
I was hoping that on Friday or so, we're going
to get a preliminary injunction from the DPC,
not allowing us to go online with anything anymore.
Secondly, we got a communication
or a letter from Mason Hayes and Curran that's the law firm of Facebook.
Usually there is this dude with like the fancy hairdo that
writes these things, but this time we had another one.
Let's call him Bob.
And again, also highlighted on the top with private and confidential and urgent.
So very, very important sent mail here.
And on the last page underlined
they require us to confirm as a matter of urgency
that any documents which noyb or Mr Schrems is threatening to publish
do not include any documents obtained by your client in the inquiries.
That's about the data transfer cases.
We don't know if we're going to do that yet, but the more I read
the letter to more appetite, we all have to do that as well.
Finally, we sent a letter to Facebook US - because your case
that we're going to discuss today was with Facebook in the US -
if they have any objections to us
having an advanced reading from these documents,
I ended it with Happy Holidays, obviously, because it's Christmas season
and and ask if they have any legal basis for any kind of objection.
Interestingly, not Facebook US
has answered, but Facebook Ireland, because, as we all know for tax reasons,
they're absolutely separate companies that have nothing to do with each other,
and it's only sent by F-B-I-R-L-S-P, that's the sender.
And they say that these documents were marked confidential and therefore
we're not allowed to use them.
So if you just stamp your forehead confidential, it is now a legal obligation
if no one ever takes a picture of your forehead anymore.
And they also say that the Irish DPC has said that their procedures
are confidential, even though this case was before the Austrian DPA.
So it's not even the right jurisdiction or the right case
and in the end they are saying that we're not entitled to conduct
this course of action and they reserve their rights accordingly.
We hope that these reserved
rights will also come to our attention at some point, but that was the fan
mail for our first edition before we even had a first edition.
So we're really happy about all the support
before we even went online with our first edition.
We hope a lot of more fan mail in the coming episodes,
So back to our case in Austria that we actually wanted to do so.
So as mentioned today, we're not going to talk about how
not to do it, but rather how is done properly, in our view.
And so in the case, we're going to talk about soon, this is a case.
And before the Austrian Data Protection Authority and in Austria,
there is a very explicit statutory provision that deals
with the access to files of a procedure and also the right to be heard.
And this provision.
This is in the Austrian General Administrative Procedure,
and it says that usually the parties have access to all the files
and there is only very narrow exemptions and that is mostly.
If the access to the files would damage the legitimate interests
of one of the parties or of third persons, or if it would jeopardize
the procedure of the authority, and that examples of that,
if I may, is is, for example, if there's a secret undercover
investigation and access to documents would uncover that or trade secrets, I guess.
Yes, so for example, they would not have to
reveal the source code in the data protection procedure
because there might actually be a trade secret on that.
So there that would be the limit to getting access to the files.
But just stamping something as confidential? How..?
That's not - at least not in Austrian law - that's not foreseen.
So this is our assessment if we can publish that
and what the law is in Austria, but just to be really, really sure
we also asked our media lawyer if there is any other rights
or any other issues that could be involved in publishing that if we got her email,
which for dramatic reasons, obviously printed out and put in an envelope
and she basically goes on - in the whole page -
with all the different laws that could possibly apply and comes to the conclusion
that none of them do apply as long as we, for example, redact names
and do these things that we actually always do.
So we thank you a lot these assessments,
which means we can now go ahead with the actual document.
These complaints were filed
against website providers in Europe and also against data recipients
in the United States being Facebook US and Google US
because they were still conducting data transfers that were unlawful.
So we basically went through the Austrian DPA in this case
went after an Austrian website and said in addition,
we also as a codefendant - as a second defendant - we have Facebook US
because they illegally received the data in the US. - Exactly.
And actually, this case doesn't touch Ireland whatsoever.
It doesn't touch the Irish Facebook subsidiary.
It's basically an Austrian-American case, so to say.
Yes, exactly.
And we only received the files to this case pretty late.
So after there has been some exchange between Facebook U.S.
and the Austrian authority, and in the beginning, Facebook
pretty much told them that
they're not competent because they should be dealing
with Facebook Ireland and not Facebook U.S. and for Facebook Ireland,
of course, as we all know,
the competent authority would be the DPC -- allegedly [laughing]
And the Austrian authority explained to Facebook US that they're not
talking about Facebook Ireland They're talking to them.
They asked them to answer a couple of questions,
and these questions were mostly to assess if the state of processing
is even taking place.
And also to assess the applicability of the GDPR
and also the competence to even issue a decision on Facebook U.S.
And the funny part is that
Facebook U.S. from the very beginning argued
without much substance that their submission - and again
the submissions are only about the
applicability of the GDPR and the competence - should be confidential.
So they said, for example.
Finally, Facebook understands that
any correspondence between the Austrian authority and Facebook
regarding these issues should not be shared,
whether in full or by way of summary with noyb or the complainant,
or form part of the piece the authorities file for the purpose
of paragraph 17 of the Austrian Administrative Procedural Act.
That is the one I mentioned before.
The Austrian Authority pretty much rejected this this notion and said that
the complainant that is me and they are and the complainants Representative - that would be noyb -
must be granted a hearing on a submission, must have access to the files.
Facebook replied on that and they asked him
if there is anything that they find to be actually confidential and is exactly
beyond just stamping it confidential.
I just talked to you and said that
your submissions are about competence and applicability of the law.
There is nothing, no trade secrets whatsoever.
And Facebook then again replied on that and more or less repeated
their view that this must not be shared
with noyb or the complainant.
And again, the authority replied on that, saying: "We explained that to you.
We going to include it into the file.
We are going to hear the party on that". Which then again, that Facebook
got back to them and even explained - "explained" -
to the Austrian authority that there is even case-law of the
Administrative Superior Court in Austria, saying that these issues of competence
that people shouldn't be heard on that.
One thing that's interesting is also this cultural thing of like an American entity
telling an Austrian authority what Austrian law is and that actually
under Austrian law, an Austrian citizen shouldn't be heard in your view.
And that's kind of like astonishing.
It's very weird.
Even though the Austrian authority has made very clear
that they consider themselves bound by Austrian law
and not by Facebook's notion of confidentiality.
The funny thing is that Facebook even sort of requested the authority
to consult with them prior to disclosing anything to anyone.
So they basically say
you have to conduct your office only in coordination with Facebook.
Otherwise you're not allowed to do your business as an authority to disclose
this to anyone without asking them before.
Only ones they agreed
that this might be might be shared with, is the Irish authority, of course.
- So only dear friends? - Yeah, they would be allowed,
but everything else only if they give it a prior, OK.
And that's not covered in any way by law.
And that's the reason we started with that because it basically explains
how these fights go on and explains quite
well how an authority dealt the right way with it and said,
you can blacken if something is confidential,
but otherwise everybody is allowed to hear it
and to show that everybody
is allowed to hear it and everybody's allowed to publish it.
These documents are going to be online.
We have redacted the parts
that are about other issues, then confidentiality, just to be sure.
But that was basically the the explainer of how all of this works.
And last but not least, we also wanted to
think of Advent being a Christian tradition
and invite everybody, including our friends at Philip Lee,
Mason Hayns and Current and the DPC to have a short, silent prayer,
- especially silence, because it is about shutting up -
in the dear hope that
we're actually going to be sued over publishing these documents today.
But we're obviously going to escalate it further,
and we also pray for that in the future.
So I invite everybody for a short moment of prayer to hopefully get a lawsuit.
Thanks a lot for your prayers at this point.
And this was the first edition.
We have three more editions which are then going
to be more about substantive, really interesting documents,
and they will be published each Sunday on noyb.eu.
You can also find all the other documents we've published previously and our work
on noyb.eu and we very much hope that you'll tune in.
The very last thing I need to mention is
because we got such fan mail and we're really happy about it.
We also would like to give these editions of Kafka
the trial, which tells a lot about like how random trials can go on
and how terrible it is for complainants like us
if they are not heard or sent around in weird ways that are not understandable.
So for anybody that loves to send another threat letter,
there's going to be one addition for you.
Kafka the trial in English because the threat letters
were usually in English as well, but we also got a German version for you
if you want to, and
it's going to be in time for Christmas, so you can basically give it to your kid
so that they learn from your mistakes and make it better in the future.
Thanks a lot for listening and see you next Sunday.