Decision by Irish High Court: DPC must now implement CJEU judgment and stop Facebook's EU-US data transfers.
The High Court ruled today, that the Irish Data Protection Commission (DPC) had the right to open a second "own volition" investigation against Facebook. Facebook's attempt to stop this second investigation failed. The judge held: "I refuse all of the reliefs sought by [Facebook Ireland] and dismiss the claims made by it in the proceedings."
The DPC now has two open procedures to implement the so-called "Schrems II" judgment, in which the European Court of Justice (CJEU) clarified that Facebook may not transfer personal data from the EU to the US. Under a separate settlement reached between Mr Schrems and the DPC (first published today) the DPC must now also investigate an original 2013 complaint that lead to the CJEU decision. The original complaints procedure will run in parallel with the new "own volition" investigation.
Schrems: "Facebook lost on every ground. It's attempt to again delay the Irish decision bought them only a couple of months. After eight years, the DPC is now required to stop Facebook's EU-US data transfers, likely before summer. Now we simply have two procedures instead of one."
Third "branch" in long-standing Facebook case. Today's decision brings the seventh court case in a long-standing battle between Mr Schrems, the DPC and Facebook to an end. In 2013, Mr Schrems brought a complaint following the Snowden disclosures against Facebook, arguing that Facebook may not transfer his personal data to the United States, where surveillance laws require the sharing of personal data with the US government. The case was referred to the Court of Justice of the European Union (CJEU) twice, leading to the so-called "Schrems I" and "Schrems II" judgments, in which the CJEU decided that the DPC had to investigate Facebook and had a duty to stop the data transfers.
Instead of swiftly implementing the CJEU decisions, the DPC produced three "branches" off the main complaints procedure (see graphic below). In 2020 it started the third detour by opening an "own volition" procedure on exactly the same subject matter as the existing complaints procedure, while indefinitely "pausing" Mr Schrems' complaints procedure. This would have ultimately removed Mr Schrems from his own case.
Facebook and Schrems filed Judicial Review. Mr Schrems and Facebook disagreed with the approach of the DPC and filed two separate Judicial Reviews, albeit for different reasons: Facebook brought countless arguments around the right to be heard and an alleged "premature" judgment by the DPC (after seven years).
At the same time, Mr Schrems argued that the DPC's approach would have locked him out of his own case, as the subject matter would be dealt with in an "own volition" case between Facebook and the DPC alone. In addition, the DPC breached an undertaking from 2015 to swiftly decide about his complaint, as it now "paused" the complaint for an indefinite time.
Settlement between DPC and Mr Schrems ensures swift decision, independent of High Court decision. Shortly before the Judicial Review of Mr Schrems would have been heard, the DPC gave in and settled the case. In the settlement, the DPC pledged to run the complaints procedure swiftly once the High Court decided on Facebook's Judicial Review. In addition, if the second "own volition" procedure is allowed by the High Court, Mr Schrems would be able to participate in it.
In short: The settlement assured that the DPC would decide on Facebook's data transfers in either one or two procedures.
Next Steps: Irish Decision and EDPB Procedure. After today's judgment the DPC will have to swiftly implement the CJEU decision and prohibit Facebook's EU-US transfers. In fall 2020 the DPC foresaw 21 days to hear from parties and another 21 days to finalise its decision, similar timelines are agreed in the settlement with Mr Schrems. Any national decision by the Irish DPC would likely have to get approved by the European Data Protection Board (EDPB), where the data protection authorities of all 28 EU member states can review the decision and object to it, if they disagree with the DPC's findings. The deadline for an objection is four weeks and triggers a vote on the European level.
Schrems: "We now expect the DPC to issue a decision to stop Facebook's data transfers before summer. This would require Facebook to store most data from Europe locally, to ensure that Facebook USA does not have access to European data. The other option would be for the US to change its surveillance laws."
