Irish High Court to Decide Whether Facebook Case Should Go to European High Court

The Irish High Court Tuesday will begin hearing a case involving Facebook's use of standard contractual clauses (SCCs) that could potentially have ramifications for EU-U.S. trade and the privacy rights of European citizens. In a move similar to the challenge against safe harbor, the Office of the Irish Data Protection Commissioner (DPC) is questioning whether SCCs, which many companies use to transfer people's personal data across the Atlantic, provide adequate protection of information (see 1607060009). Tuesday's hearing will focus on whether the court should refer the case on the validity of SCCs to the European Court of Justice (ECJ). Several experts Monday said they expect the case will be heard by the EU's high court.

Cordery attorney André Bywater emailed that "unless something completely unforeseen happens the Irish court will send the case" ECJ. He said the Irish court hearing likely will decide what questions it will ask the ECJ to rule on. "Whatever those questions are, following much of what the European Court said in the previous Safe Harbor case I think that 'model clauses' are at risk of being ruled invalid," he said. Bywater's Cordery colleague, Jonathan Armstrong, emailed that SCCs are the "standard mechanism for the transfer of personal data from the EU to the US and so its up to the European Court to rule as to their validity." He said the ECJ's ruling, which may come a year and a half later, "will be much anticipated especially given the uncertainties over Privacy Shield in part caused by [President Donald Trump's] first few weeks" (see 1701260015 and 1611100039).

Cynthia Larose, a privacy and security lawyer with Mintz Levin, also said she expected the Irish High Court to kick the SCC challenge up to the ECJ as it did with safe harbor. She said Irish DPC Helen Dixon wrote that her interpretation of the safe harbor ruling means only the ECJ can answer whether SCCs are valid -- not the DPC nor any national court. "I would be quite surprised if the SCCs suffer the same fate as Safe Harbor. It would have an enormously detrimental effect on the flow of data as between the US and the EU," emailed Larose.

The hearing in Ireland, which is expected to last three weeks, will include opening statements from the Irish DPC that may take up to four days this week, according to a timetable provided Monday by Austrian privacy activist and attorney Max Schrems, who brought the complaint against Facebook. Next week, he and the company are expected to make their opening statements and cross-examine their witnesses. In the third week of the hearing, from Feb. 21 through Feb. 24, all the parties will make closing statements. Facebook didn't comment. Georgia Institute of Technology professor Peter Swire, a privacy czar during the Clinton administration, declined to comment because he said he's one of Facebook's witnesses.

Schrems' first complaint in 2013 against Facebook's use of safe harbor resulted in the ECJ invalidating the agreement in October 2015 (see 1510060001). Soon after, the EU and US created a new trans-Atlantic data transfer framework called Privacy Shield (see 1602290003 and 1611210032), which itself is being challenged in Europe by other parties (see 1611040002). After the ECJ ruling, Schrems filed another complaint against Facebook that essentially said the company's use of SCCs didn't provide adequate legal protection of people's personal data.

In May, the DPC issued a draft decision that Schrems' complaint "was well founded," the commissioner's office said in a Jan. 2 explanatory memo that was updated last week. Since the ECJ said only it can decide the validity of SCCs, the DPC started the legal proceedings in the Irish High Court, "seeking a declaration as to the validity of the EU Commission decisions concerning SCCs and a preliminary reference to the [ECJ] on this issue." It said Facebook and Schrems were named to the proceedings so they could participate if they wanted to. Schrems issued the timetable and background on the case but didn't provide a comment. Besides witnesses for Facebook and Schrems, four other parties were accepted as amici curiae and will provide arguments: the U.S. government, BSA|The Software Alliance, Digital Europe and the Electronic Privacy Information Center (see 1607190042)