Explanatory Memoranda on the Litigation concerning Standard Contractual Clauses ('SCCs')
Note: This webpage is purely for guidance, and does not constitute legal advice or legal analysis.
Up to date as of 08.07.19.
Chronology of proceedings to date:
The Data Protection Commissioner (DPC) published her FIRST Explanatory Memorandum on 28 September 2016 in relation to the Irish High Court proceedings commenced by the DPC on 31 May 2016.
In these proceedings, a reference is sought to the Court of Justice of the European Union (CJEU) concerning the validity of “standard contractual clauses” (SCCs), a mechanism, implemented by way of European Commission Decisions, under which, at present, personal data can be transferred from the EU to the US. The title of those proceedings is “Data Protection Commissioner v. Facebook Ireland Limited & Maximilian Schrems”. The Court Record (reference) Number is 2016/4809P.
Please click for further information on:
- What is the background to the proceedings?
- Why has the DPC taken the current proceedings?
- A Second Explanatory Memorandum was published on 31 January 2017 to provide an update on the progress of these proceedings including applications to, and rulings by, the Court in relation to these proceedings, during the period from 29 September 2016 to 31 January 2017.
- The trial of the proceedings commenced on 7 February 2017 in the High Court (Commercial Division) before Ms. Justice Costello. While that hearing was underway, the DPC published a Third Explanatory Memorandum on 24 February 2017 as a procedural update on the progression of the hearing.
- A Fourth Explanatory Memorandum was published on 16 March 2017 as a further procedural update on the hearing, which concluded on 15 March 2017 after 20.5 days (approximately 5 and a half weeks), before Ms. Justice Costello.
- The Fifth Explanatory Memorandum relates to the judgment of Ms. Justice Costello which was delivered on 3 October 2017. In summary, Ms. Justice Costello decided that the Court would refer a number of questions to the CJEU as a request for a preliminary ruling pursuant to Article 267 of the Treaty on the Functioning of the European Union (TFEU) in order to determine a number of issues raised in the proceedings. This memorandum also details the subsequent procedural and substantive developments which occurred between 3 October 2017 and 2 May 2017, including the High Court’s decision on the questions which are to be referred to the CJEU, amendments made to the judgment of 3 October 2017 and the application for a stay which was taken by Facebook in respect of the making of the reference to the CJEU by the High Court, pending Facebook’s appeal against the making of the reference to the CJEU.
- The Sixth Explanatory Memorandum was published in December 2018, providing a further update on the progress of the case, including the progress of Facebook's appeal to the Supreme Court against the judgment of the High Court.
- The Seventh Explanatory Memorandum was published in July 2019 providing a summary of the main judgment delivered by the Supreme Court in which Facebook’s appeal was dismissed. This memorandum also provides details in relation to the pending oral hearing before the CJEU (on 9 July 2019) of the reference made to it by the Irish High Court.
Explanatory Memoranda to date
(in reverse order starting with the most recent)
On 31 May 2019 the Supreme Court delivered its main judgment, which ran to 77 pages, in the appeal taken by Facebook against the making of the reference to the CJEU by the Irish High Court. The Supreme Court judgment of 31 May 2019 can be accessed here.
In summary, the Supreme Court dismissed Facebook’s appeal in full. In doing so, the Supreme Court decided that:
- It was not open to it as a matter of Irish and EU law to entertain any appeal against a decision of the High Court to make a reference to the CJEU. Neither was it open to the Supreme Court to entertain any appeal in relation to the terms of such a reference (i.e. the specific questions which the High Court had referred to the CJEU). The Supreme Court decided that the issue of whether to make a reference to the CJEU is a matter solely for the Irish High Court. Therefore it was not appropriate for the Supreme Court to consider, in the context of Facebook’s appeal, the High Court’s analysis which led to the decision that it shared the concerns of the DPC in relation to the validity of the SCC decision. This was because this issue was inextricably linked to the High Court’s decision to make a reference to the CJEU and it was not open to Facebook to pursue this as a point of appeal.
- However it was open to the Supreme Court to consider whether the facts found by the High Court (i.e. those facts which underpinned the reference made to the CJEU) were sustainable by reference to the evidence which had been placed before the High Court, or whether those facts should be overturned.
- Insofar as Facebook disputed certain key issues of fact which had been found by the High Court concerning US law, on the basis of the expert evidence before the High Court, the Supreme Court had not identified any findings of fact which were unsustainable. Accordingly, the Supreme Court did not overturn any of the facts found by the High Court. Instead the Supreme Court was of the view that the criticisms which Facebook had made of the High Court judgment concerned the proper characterisation of the underlying facts rather than the actual facts.
Hearing before the CJEU
The CJEU (Grand Chamber) will hold an oral hearing in respect of the reference made to it by the Irish High Court on 9 July 2019. The CJEU will sit with a composition of 15 judges, including the President of the CJEU, Judge Koen Lenaerts. The Judge Rapporteur is Judge Thomas von Danwitz. The Advocate General assigned to the case is Henrik Saugmandsgaard Øe.
At the hearing, the DPC, Mr Schrems and Facebook will make oral submissions before the CJEU. The 4 parties who were joined as amicus curiae (“friends of the court”) to the case before the Irish Court (the USA, EPIC, BSA Business Software Alliance Inc. and Digital Europe) have also been permitted to make oral submissions. In addition, the European Parliament, the European Commission and 10 Member States (Austria, Belgium, Bulgaria, Czech Republic, Germany, Ireland, Netherlands, Poland, Portugal and the United Kingdom) who have each intervened in the proceedings will also make oral submissions at the hearing before the CJEU. Additionally the CJEU has invited the European Data Protection Board (EDPB) to address the CJEU on specific issues.
The 11 questions referred by the Irish High Court to the CJEU are set out in the High Court Request for a Preliminary Ruling from the CJEU (12 April 2018) together with a summary of the underlying facts and issues. This document can be accessed here.
On 11 May 2018, Facebook lodged an appeal, and applied for leave to appeal to the Supreme Court, against the judgments of 3 October 2017, the revised judgment of 12 April 2018 and the judgment of 2 May 2018 refusing a stay.
Facebook’s application for leave to appeal to the Supreme Court was heard on 17 July 2018. In a judgment delivered on 31 July 2018, the Supreme Court granted leave to Facebook allowing it to bring its appeal in the Supreme Court but directing that the refinement of the specific issues for determination in the appeal should be dealt with by way of case management ahead of the full hearing in the Supreme Court.
The hearing of the Supreme Court appeal was heard on 21-23 January 2019. The Supreme Court heard submissions from the representatives of Facebook, the United States government, the Data Protection Commission, and Max Schrems. The Court reserved judgment and will deliver a written judgment in the coming months. In the meantime, the High Court’s reference to the CJEU remains valid and is pending before the CJEU.
Fifth Explanatory Memorandum (9 May 2018)
In overall terms, the High Court decided that the concerns expressed by the DPC in her draft decision of 24 May 2016 concerning the complaint by Mr Schrems, are well-founded, and that certain of the issues raised in the case should be referred to the CJEU so that the CJEU can make a ruling as to the validity of the SCC Decisions adopted by the European Commission.
In her judgment of 3 October 2017, Ms. Justice Costello also decided that, as the parties had indicated that they would like the opportunity to be heard in relation to the questions to be referred to the CJEU, she would list the matter for submissions from the parties and then determine the questions to be referred to the CJEU. The parties to the case, along with the amicus curiae made submissions to the Court, amongst other things, on the questions to be referred, on 1 December 2017 and on 16, 17 and 18 January 2018. During these hearings, submissions were also made on behalf of Facebook and the US Government as to “errors” which they alleged had been made in the judgment of 3 October 2017. The Court reserved its judgment on these matters.
On 12 April 2018, Ms. Justice Costello notified the parties of her Request for a Preliminary Ruling from the CJEU pursuant to Article 267 of the TFEU. The High Court’s Request for a Preliminary Ruling is available here and sets out the 11 questions to be referred to the CJEU, along with a background to the proceedings. On the same date, Ms Justice Costello also indicated that she had made some alterations to her judgment of 3 October 2017, specifically to paragraphs 175, 176, 191,192, 207, 213, 215, 216, 220, 221 and 239. The amended judgment of 3 October 2017 is available here. During that hearing, Facebook indicated that it wished to consider whether it would appeal the decision of the High Court to make the reference to the CJEU and if so, seek a stay on the reference made by the High Court to the CJEU. On that basis, the High Court listed the matter for 30 April 2018.
When the proceedings came before the High Court on 30 April 2018, Facebook applied for a stay on the High Court’s reference to the CJEU pending an appeal by it against the making of the reference. Submissions were made by the parties in relation to Facebook’s application for a stay.
On 2 May 2018, Ms. Justice Costello delivered her judgment on the application by Facebook for a stay on the High Court’s reference to the CJEU. In her judgment, Ms Justice Costello refused the application by Facebook for a stay, holding that the least injustice would be caused by the High Court refusing any stay and delivering the reference immediately to the CJEU. A copy of the judgment of 2 May 2018 is available here.
The trial of the proceedings concluded on Wednesday 15 March 2017 after 20.5 days (approximately 5 and a half weeks) of hearing before the Honourable Ms Justice Caroline Costello. In summary, legal submissions were made on behalf of: (i) each of the parties, being the DPC, Facebook Ireland Ltd. and Mr. Schrems; and (ii) each of the amici curiae (“friends of the court”) being BSA, Digital Europe, EPIC and the US Government. The Court also heard oral evidence from a total of 5 expert witnesses on US law, as follows:
Judgment has been reserved (in other words, it will be delivered at a later point) but there is currently no indication as to when it will be delivered. The key issue for determination by the High Court is whether a reference should be made to the CJEU concerning the validity of SCCs insofar as they relate to EU to US data transfers.
- Ms Ashley Gorski, expert witness on behalf of Mr. Schrems;
- Professor Neil Richards, expert witness on behalf of the DPC;
- Mr. Andrew Serwin, expert witness on behalf of the DPC;
- Professor Peter Swire, expert witness on behalf of Facebook Ireland Ltd. and
- Professor Stephen Vladeck, expert witness on behalf of Facebook Ireland Ltd.
The hearing of these proceedings commenced on Tuesday, 7 February 2017 in the High Court (Commercial Division) before the Honourable Ms Justice Caroline Costello. The hearing is ongoing and the following is the current status as of close of business on Friday 24 February 2017:
Further progression of the hearing
While the hearing of the proceedings was initially fixed for 3 weeks, it is now estimated that it will take a further 1 – 2 weeks to conclude. The following matters have still to take place before the conclusion of the hearing:
- Opening submissions have been made by Counsel for the DPC and short opening statements have also been made by Counsel for Facebook and Counsel for Mr. Schrems;
- Oral evidence on US law was given to the Court by Mr. Schrems’ expert witness, Ms Ashley Gorski, who was then cross-examined by Counsel for Facebook;
- Submissions were made by Counsel for the three amici curiae (“friends of the court”) who previously delivered affidavit evidence, being BSA, Digital Europe and EPIC, as to why their evidence should be admitted to the proceedings. (The other amicus curiae, the US Government, did not deliver any affidavit evidence and so did not make any submissions in this regard). On Monday, 20 February 2017, the Court’s judgment on this issue was delivered. The Court refused the applications by each of the three amici to have their affidavit evidence admitted. This means that they will be limited to making legal submissions only during the hearing;
- Oral evidence on US law was given to the Court by the DPC’s two expert witnesses, Professor Neil Richards and Mr. Andrew Serwin (Expert Report & Supplemental Report), who were each also cross-examined by Counsel for Facebook Ireland Ltd.;
- Oral evidence on US law was given to the Court by one of Facebook’s expert witnesses, Professor Peter Swire, who was also cross-examined by Counsel for the DPC and by Counsel for Mr. Schrems.
- The conclusion of the expert witness oral evidence on behalf of Facebook and cross-examination relating to such evidence;
- Legal submissions which are to be made by Counsel on behalf of each of the four amici curiae (“friends of the court”). The sequence in which these legal submissions will be made has not yet been finalised, save that the legal submissions on behalf of the US Government will be made last of all of the amici curiae;
- Closing submissions to be made on behalf of each of Mr. Schrems, Facebook, and then the DPC, in that sequence.
In the first Schrems case, the CJEU delivered a judgment in which it found that the “Safe Harbour” arrangements for EU/US data transfers were invalid. In these proceedings, the DPC is now asking the High Court to make a reference to the CJEU in relation to the validity of SCCs mechanism. This step has been taken because the DPC has concerns as to the validity of the SCCs when considered in the light of a number of factors, to include Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union (the Charter), and the CJEU’s judgment in the first Schrems case. The DPC considers that the concerns she holds, and the concerns expressed by Mr. Schrems in a complaint filed with the DPC’s office, are well-founded. The High Court will now decide if it agrees with the DPC’s assessment.
How have the proceedings progressed since September 2016?
1. The parties and 4 amicus curiae (“friends of the Court”) filed a series of pleading documents, affidavits and legal submissions in the period between 9 September 2016 and 20 January 2017. Those documents fix the scope of the proceedings. They also set out the parties’ respective positions on the issues to be decided by the Court.
2. The First Explanatory Memorandumreferred to an application brought by Mr. Schrems in which he asked the court to limit his costs’ exposure in the case. That application was withdrawn by Mr. Schrems before it was due to be heard in November.
3. The case is listed for hearing on 7 February 2017. It is scheduled to run for approximately 3 weeks.
4. In advance of the hearing, the High Court made a number of rulings on 27 January 2017 in relation to the conduct of the hearing. Amongst other things, the Court directed that the following basic running order will apply:
(a) The hearing will commence on 7 February 2017 with opening submissions from the DPC;
(b) Short opening statements will follow from Mr. Schrems and Facebook, in that order;
(c) Mr. Schrems’ expert witness will be cross-examined on Friday, 10 February 2017;
(d) This will be followed by cross-examination of the DPC’s expert witnesses, and those of Facebook;
(e) Each of the 4 “friends of the court” will then make legal submissions in relation to the matters in issue in the case;
(f) The case will close with submissions to be made by each of the parties, in the following sequence: Mr. Schrems will go first; he will be followed by Facebook, and then the Commissioner.
There are also a number of other procedural issues that will also need to be decided by the Court in the course of the trial, at a time the Court considers appropriate. These include issues relating to the evidence which is to be admitted by the Court.
On 31 May 2016, the Data Protection Commissioner (DPC) commenced proceedings in the Irish High Court. The purpose of the proceedings is to seek a reference to the Court of Justice of the European Union (CJEU) in relation to the “standard contractual clauses” mechanism under which, at present, personal data can be transferred from the EU to the US.
While the DPC does not seek any specific relief against Mr. Schrems or Facebook Ireland Limited (Facebook), both of those parties were joined to the proceedings because the outcome of the case will impact on the DPC’s consideration of Mr. Schrems’ complaint against Facebook (see further below). By joining Mr. Schrems and Facebook to the proceedings, the DPC also ensured that those parties would have an opportunity (but not an obligation) to participate in the proceedings.
The purpose of this note is to explain the background to the case, the reasons why the DPC has taken the case and the current position in the High Court as of September 2016.
- The case has its roots in a complaint about Facebook which was made to the DPC on 25 June 2013 by Mr. Schrems, an Austrian national. Mr. Schrems was concerned that, because his personal data was being transferred from Facebook to its US parent company Facebook Inc, his personal data was then being accessed unlawfully by US state security agencies. Mr. Schrems’ concerns arose in light of the disclosures by Edward Snowden regarding a programme called “PRISM” said to be operated by the US National Security Agency (NSA). The data transfers by Facebook to Facebook Inc were being carried out under the Safe Harbour regime. This regime was established by way of an EU Commission decision in 2000 (the Safe Harbour Decision) which deemed the US to have an adequate level of data protection where the Safe Harbour regime was adhered to by parties involved in personal data transfers from the EU to the US.
- The DPC declined to investigate Mr. Schrems’ complaint as the DPC was bound under existing national and EU law to apply the Safe Harbour Decision. Mr. Schrems then applied to the Irish High Court for a judicial review of this decision. On 18 June 2014, Mr. Justice Hogan delivered his judgment holding that the essential question for determination was whether the DPC was bound by the Safe Harbour Decision as regards the adequacy of data protection law and practice in the US having regard to Article 8 of the EU Charter of Fundamental Rights (the “Charter”) which entered into force after the Safe Harbour Decision. Article 8 of the Charter establishes the right of every person to protection of their personal data. Because the Irish Court did not have authority to make any ruling in relation to the Safe Harbour Decision, it referred this issue to the CJEU to determine whether in light of Article 7 (the right to respect for private and family life, home and communications), Article 8 (mentioned above) and Article 47 (the right to an effective remedy where rights and freedoms guaranteed by EU law are violated) of the Charter, the DPC was correct in his view that he was bound in absolute terms by the Safe Harbour Decision. Please also see the judgment of Mr. Justice Hogan of 16 June 2014 in Schrems –v- Data Protection Commissioner (No.2) which was an application by Digital Rights Ireland Ltd. To be jointed to the judicial review proceedings as amicus curiae (“friends of the court”).
- In its judgment delivered on 6 October 2015 the CJEU ruled that, notwithstanding a decision of the EU Commission as to the adequacy of data protection provided by a third country (such as the Safe Harbour Decision), a data protection authority was not prevented from examining the complaint of a data subject as regards an alleged inadequate level of data protection provided by that third country. In fact the Court held that it was incumbent upon the national data protection authority to examine a complaint with all due diligence where the individual claimed that an EU Commission decision was incompatible with protection of privacy and fundamental rights and freedoms. However the CJEU made it very clear that although national data protection authorities may consider the validity of an EU act, such as an EU Commission decision, they cannot declare that decision invalid themselves and only the CJEU may. The CJEU went on to rule that the Safe Harbour Decision itself was invalid.
- The CJEU gave very specific directions (paragraph 65 of the judgment) as to how European data protection authorities should in future deal with a complaint that calls into question a decision of the EU Commission, which the national data protection authority considers to be well founded. The data protection authority must engage in legal proceedings, the CJEU said, before its national courts and, if the national Court shares those doubts as to the validity of the EU Commission decision, the national Court must then make a reference to the CJEU for a preliminary ruling on validity.
- When Mr. Schrems’ proceedings were returned before the Irish High Court again on 20 October 2015 the decision of the CJEU was implemented by the making of a High Court Order which set aside the decision by the DPC not to investigate Mr. Schrems' complaint of 25 June 2013. The High Court then remitted Mr. Schrems’ original complaint back to the DPC for investigation.
- Immediately following the Irish High Court Order of 20 October 2015, an investigation into Mr. Schrems’ complaint was commenced. Later, Mr. Schrems reformulated and resubmitted his complaint to take account of the fact that the Safe Harbour Decision had been struck down. The DPC agreed to proceed on the basis of that reformulated complaint.
- In the course of its investigation, the DPC established that Facebook continues to transfer personal data to Facebook Inc, in reliance in large part on the use of standard contractual clauses (SCCs). These are pro forma agreements which have been approved, by way of certain EU Commission decisions, as providing adequate data protection for the purposes of transferring personal data to third countries.
- Many other companies, including large internet companies, also use SCCs to transfer personal data to the US.
- On 24 May 2016, the DPC issued a draft decision to Mr. Schrems and Facebook, noting that the DPC had formed the preliminary view, subject to receipt of further submissions from the parties, that Mr. Schrems’ complaint was well founded. This was based on the DPC’s view that:
(a) A legal remedy compatible with Article 47 of the Charter is not available in the US to EU citizens whose data is transferred to the US where it may be at risk of being accessed and processed by US State agencies for national security purposes in a manner incompatible with Articles 7 and 8 of the Charter;
(b) The SCCs do not address the CJEU’s objections concerning the absence of an effective remedy compatible with the requirements of Article 47 of the Charter as outlined in its judgment of 6 October 2015, nor could they; and,
(c) The SCCs themselves are therefore considered likely to offend against Article 47 insofar as they purport to legitimise the transfer of the personal data of EU citizens to the US.
- In circumstances where the DPC considered that, as a matter of principle, the issuing of a notice prohibiting or suspending data transfers by Facebook to Facebook Inc. under Article 4(1) of the EU Commission decisions that adopted the SCCs did not provide an answer to the objections in question, the DPC was obligated to follow the judicial procedure which the CJEU had set out in paragraph 65 of its judgment of 6 October 2015 in Mr. Schrems’ judicial review proceedings (described above at paragraph 4). This was because, as per the CJEU’s judgment any question concerning the validity of SCCs cannot be determined by the DPC, nor indeed by the national courts of this jurisdiction. Such questions can only be answered by the CJEU.
- The DPC therefore commenced legal proceedings in the Irish High Court seeking a declaration as to the validity of the EU Commission decisions concerning SCCs and a preliminary reference to the CJEU on this issue. Both Facebook and Mr. Schrems were named as the joining of these parties affords them an opportunity (but not an obligation) to fully participate if they so wish and to make submissions in the case.
- In commencing the current proceedings, the DPC took account, not just of the significant issues arising in terms of citizens’ data privacy rights, but also of the very significant commercial implications arising from the value of data exchanges to EU-US trading relationships. The DPC recognised the necessity for an urgent resolution of the matters in question given the requirement of business for legal certainty at a time when the Safe Harbour Decision had been struck down and no alternative was at that point in place. Therefore the DPC brought an application to have the proceedings admitted into the Commercial List of the Irish High Court so that they could be determined as quickly as possible.