In the ongoing procedure on Facebook’s involvement with the NSA under the so-called “PRISM” surveillance program before the Irish Data Protection Commission (DPC) and the Irish High Court, the Irish Supreme Court has today decided over an unprecedented application by Facebook.
Facebook’s application was denied in substance. While the Supreme Court found that it has the jurisdiction to intervene with a lower court’s reference, Facebook was unable to substantiate the application and the Supreme Court decided to not take the actions requested by Facebook.
Key Info and Downloads
- English Press Release (PDF)
- Copy of the judgment (PDF)
- Case dismissed by the Supreme Court
- Hearing at CJEU in Luxembourg on July 9th
First Statement by noyb.eu
Max Schrems (complainant and chairperson of noyb): “Facebook likely again invested millions to stop this case from progressing. It is good to see that the Supreme Court has not followed Facebook’s arguments that were in total denial of all existing findings so far. We are now looking forward to the hearing at the Court of Justice in Luxembourg next month.”“
Background on the case:
The case centers on a complaint by privacy lawyer Max Schrems against Facebook in 2013 (link to complaint). More than six years ago, Edward Snowden disclosed that Facebook allows the US secret services access to personal data of Europeans under surveillance programs like “PRISM” (see Wikipedia). So far, the Irish DPC has not taken concrete actions, despite the clear demands within the complaint to stop the EU-US data transfers of Facebook.
The case was first rejected by the Irish Data Protection Commissioner (DPC) in 2013 and then subject to judicial review and a reference to the Court of Justice of the European Union (CJEU), who ruled in 2015 that the so-called “Safe Harbor” agreement that allowed EU-US data transfers is invalid (link to judgment in C‑362/14) and that the Irish DPC has to investigate the case.
The investigation lasted only a couple of months between December 2015 and spring of 2016. Instead of deciding over the complaint, the DPC has filed a lawsuit against Facebook and Mr Schrems at the Irish High Court in 2016, aimed at sending further questions to the CJEU. After more than six weeks of hearings mainly taking place in 2017, the Irish High Court found that the US government engaged in “mass processing” of Europeans’ personal data and referred eleven questions to the CJEU for the second time (link to judgement) in 2018.
In an unprecedented application made thereafter, Facebook has tried to stop the reference by asking the Irish Supreme Court to “advise” the High Court on the reference. It is undisputed by the parties, that the Supreme Court has no jurisdiction to overturn the reference by the High Court.
The CJEU has announced last week that it plans to hear the case (now C-311/18) in a month on July 9th 2019 – about six years from the filing of the original complaints.
After a judgement of the CJEU, the DPC would have to finally decide over the complaint for the first time, which would again be subject to possible appeals by Facebook or Mr Schrems within the Irish Court.
