EU-US Data Transfers - Judicial Review Proceedings

03rd December 2020

Facebook’s judicial review proceedings against the DPC are listed for hearing in the Irish High Court on 15 December 2020.

The proceedings have their origin in the judgment delivered by the CJEU on 16 July 2020 in relation to EU-US data transfers. Following that judgment, the DPC commenced a statutory inquiry into the lawfulness of Facebook’s transfers of personal data relating to millions of its EU users from the EU to the United States.

The inquiry, in which a Preliminary Draft Decision was delivered on 28 August 2020, is being conducted under the Data Protection Act, 2018, and by reference to relevant provisions of the GDPR.

In its judicial review proceedings, Facebook is asking the Court to quash the DPC’s decision to commence the inquiry; it also seeks to have the Preliminary Draft Decision set aside. Facebook’s central complaint is that, in commencing the inquiry, and in issuing the Preliminary Draft Decision, the DPC has not respected Facebook’s right to fair procedures.

The proceedings are being fully defended by the DPC.

Separately, the DPC is continuing its investigation of a complaint relating to Facebook’s EU-US data transfers, as submitted by Max Schrems (in revised form) on 1 December 2015. Because the complaint pre-dates the GDPR, and in light of requirements imposed by national legislation, that investigation is being conducted under the “old regime”, i.e. Directive 95/46/EC and the Data Protection Acts, 1988 and 2003.

Unlike the inquiry now being challenged by Facebook, which is focused on data transfers affecting millions of Facebook users across Europe, the investigation of Mr Schrems’ complaint is specifically directed to transfers of Mr Schrems’ personal data to the US.

Mr Schrems has brought his own, separate judicial review proceedings which are listed for hearing on 13 January 2021. These proceedings are not in relation to the DPC’s investigation of his complaint about transfers. Rather, in his case, which is due to be heard by the same Judge who will hear Facebook’s case, Mr Schrems is also asking the High Court to stop the DPC’s transfers inquiry into Facebook.

Several of Mr Schrems’ objections to the inquiry overlap with those of Facebook; others are different.

Pointing to his standing as a complainant in his own right, and as a de facto representative of European data subjects, Mr Schrems’ overall position is that the DPC should not be permitted to examine Facebook’s transfers by means of a more broadly-drawn inquiry, directed to the interests of Facebook users generally, and without hearing from Mr Schrems. He says the CJEU’s findings must be applied by the DPC solely through its investigation of his complaint.

The DPC respectfully disagrees with Mr Schrems and will be defending Mr Schrems’ proceedings.

Facebook has been joined to Mr Schrems’ judicial review, with Mr Schrems’ agreement; Mr Schrems has likewise been joined to Facebook’s judicial review, with Facebook’s agreement.  

By orders of the Court made on the application of Facebook and Mr Schrems, the DPC is precluded from taking any further steps to progress its application of the findings made by the CJEU’s judgment pending the outcome of the judicial review proceedings.