Privacy & Information Security Law Blog

On May 14, 2021, the Irish High Court dismissed Facebook Ireland’s (“Facebook”) challenge to the Irish Data Protection Commissioner’s (“DPC”) investigation into Facebook’s international transfers of personal data.

The DPC commenced its “own volition” inquiry following the July 2020 decision of the Court of Justice of the European Union (“CJEU”) in the Schrems II case (C-311/18 Data Protection Commissioner v. Facebook Ireland Ltd and Maximilian Schrems). In its decision, the CJEU invalidated the EU-U.S. Privacy Shield transfer mechanism and determined that Standard Contractual Clauses (“SCCs”) alone may not provide sufficient protection for personal data when it is transferred to non-adequate jurisdictions. The DPC’s inquiry relates to transfers made by Facebook to its U.S.-based parent company, Facebook Inc., in reliance on SCCs.

Facebook instigated judicial review proceedings to quash the inquiry. It requested that the DPC’s Preliminary Draft Decision from August 2020, which commenced the inquiry and preliminarily found that Facebook’s transfers infringed the EU General Data Protection Regulation (“GDPR”), be set aside. Facebook argued that its right to fair procedures had been infringed during the DPC’s decision-making process, in part because the DPC’s Draft Decision was issued prior to the release of guidance by the European Data Protection Board (“EDPB”) following the Schrems II decision. The Irish High Court determined that although the DPC’s decisions and procedures were amenable to judicial review, the DPC was entitled to follow its chosen procedure during its inquiry, provided that it complied with fair procedures and the requirements of the GDPR. The High Court decided that the DPC had not drawn conclusions too early in the process or without access to sufficient information, as contended by Facebook. Further, the High Court found no statutory duty requiring the DPC to await the EDPB’s recommendations or guidance before undertaking an inquiry, and that, in fact, “any requirement to await EDPB guidance before proceeding would be inconsistent with the obligations imposed on the DPC by the GDPR to act within a reasonable period of time and with due diligence and to take action where required under the GDPR.”

Facebook also argued that the 21 days allocated by the DPC for its response was not sufficient to provide its submissions, and that the involvement of the DPC, Helen Dixon, in both the investigative and decision-making stages of the inquiry was a further breach of its rights to fair procedures. Both of these arguments were rejected by the High Court. Facebook also put forward the argument that the DPC had violated Facebook’s rights to equality when it chose to scrutinize Facebook’s transfers despite similar transfers being made by other organizations. This also was dismissed by the High Court, with Justice David Barniville stating, “I do not accept that principles of equality or of consistency or good administration…required the DPC to explain why it had decided to commence an inquiry in respect of [Facebook] and not in respect of other entities. The DPC was entitled to do so and provided that it explained why it had decided to commence an inquiry in respect of [Facebook], it did not have to provide an explanation as to why it was not commencing inquiries into other entities.”

Separately, Mr. Schrems also sought judicial review with respect to the DPC’s own volition inquiry, arguing that his own long-running complaint regarding the transfer of his data should be brought to a conclusion first. These proceedings were settled after the DPC agreed to act swiftly with respect to his original complaint, and to allow Mr. Schrems to be heard as part of its wider inquiry into Facebook’s transfers. Mr. Schrems also will be permitted access to certain materials exchanged between the DPC and Facebook.

Facebook now will need to respond to the DPC’s preliminary decision within 21 days of the resumption of the inquiry.