Irish court refers landmark EU-US data transfer case to EU

Judge Caroline Costello said that “only a decision of CJEU can resolve the potential for inconsistent applications” of the mechanism used by giants such as Facebook to transfer European users’ data to the US.

“I therefore have decided to ask the Court of Justice for a preliminary ruling,” she concluded.

The legal action follows a complaint by Austrian privacy lawyer Max Schrems to Ireland’s Data Protection Commissioner (DPC) about Facebook’s use of so-called standard contractual clauses (SCCs) to transfer personal data from Europe to the US, via its European headquarters in Dublin.

SCCs are now widely used by data exporters and are intended to allow for the legal transfer of data from EU citizens as long as “adequate protection” is in place.

In an emailed statement, Facebook said it was “essential the CJEU now considers the extensive evidence demonstrating the robust protections in place under Standard Contractual Clauses and US law, before it makes any decision that may endanger the transfer of data across the Atlantic and around the globe.”

SCCs “are essential to companies of all sizes, and upholding them is critical to ensuring the economy can continue to grow without disruption,” the statement said.

Schrems argues that the SCCs offer no redress for European citizens in the US in the event of their data being accessed by a third party, such as US intelligence services, or compromised in some other way.

His legal team claimed that the Irish watchdog already had the power to stop data transfers from Facebook and should use it.

Following the ruling, Schrems told AFP that he did not want to “strike down international data transfers, because 90 percent of the cases are not a problem,” and was instead focussed on companies “which are involved in mass surveillance”.

“I suspect that she (Judge Costello) wanted to kick up the case and not deal with it too much,” he said.

“Right now we can just raise the issue over and over again by kicking up the courts, but fundamentally this is a political decision,” Schrems said.

– Data flow vital to EU economy –

Facebook argues there is nothing wrong with the current system and that there is no need for a referral.

Mason Hayes & Curran, the Dublin-based legal team acting for Facebook, has pointed to estimates that if services and cross-border data flows were to be disrupted, the European Union’s gross domestic product (GDP) could be hit by as much as 1.3 percentage points.

Facebook was forced to switch to SCCs last year after the European Court of Justice ruled in 2015 that the Safe Harbour framework, which had governed the EU-US flow of personal data, contravened EU law because the privacy of European citizens could not be guaranteed in the US.

The SCCs are considered as something of a stopgap measure designed to allow the transfer of data, pending agreement on a more comprehensive regime.

The Data Protection Commissioner issued a statement saying it welcomed the judgment.

“The High Court has confirmed it shares the Commissioner’s concerns about the protection of those rights (protection of data privacy).”

“It invites the CJEU to consider whether, under EU law, SCCs in their present form can and should be retained as a basis for the transfer of personal data from the EU to the US.”