High Court judge hears arguments on issues to be addressed in Facebook data case

Ms Justice Caroline Costello remarked today this was “no ordinary reference” and the questions would have to be carefully drafted.

The judge had last October granted the Data Protection Commissioner’s application for a reference.

During the hearing today, Paul Gallagher SC, for Facebook, indicated his side are considering whether to seek an appeal against the reference, notwithstanding apparent legal authority to the effect such appeals cannot be brought.

Facebook and the US government had opposed Commissioner Helen Dixon’s application for a reference and contended US law and various measures including the 2016 Privacy Shield data transfer agreement between the European Commission and US afford adequate protection for data privacy rights of EU citizens.

The judge agreed to refer after concurring with the Commissioner there are "well founded" grounds for believing the European Commission decisions approving the data transfer channels known as Standard Contractual Clauses (SCCs) are invalid.

Her judgment was primarily concerned with the EC Data Protection Directive and its focus on whether third country protections for EU citizens data privacy rights are "adequate".

She held the Commissioner had raised "well-founded" concerns about the absence of an effective remedy in US law compatible with the requirements of Article 47 of the Charter of Fundamental Rights of the EU for an EU citizen whose data is transferred to the US "where it may be at risk of being accessed and processed by US state agencies for national security purposes in a manner incompatible with Articles 7 and 8 of the Charter".

Austrian lawyer Max Schrems, from whose complaint about transfer of his Facebook data to the US the proceedings emanated, also opposed a referral but for different reasons. He argued the Commissioner has enough information to decide his complaint and a referral was unnecessary.

During today’s hearing on the wording of questions for referral, there was disagreement concerning what prominence should be given to Articles 25 and 26 of the Data Protection Directive. Article 25 requires EU member states to ensure, where transfers of data of EU citizens are transferred to third countries, the latter provide an adequate level of protection. Article 26 allows for a derogation from Article 25 and permits, once adequate safeguards are provided, transfers to third countries which do not provide adequate protection.

The Commissioner, represented by Michael Collins SC, argues both Articles are relevant while Facebook and the US government maintain the focus is essentially on Article 26.

Mr Gallagher, for Facebook, said the formulation of appropriate questions is of “immense” importance, particularly because the CJEU will be addressing findings of fact made by a court of one EU member state - Ireland - concerning the state of law and remedies in a non EU state – the US.

Eoin McCullough SC, for Mr Schrems, said the level of detail being advanced in the questions put forward on behalf of the DPC and Facebook was verging “on the ridiculous”. The reference should be simple as many parties, including from different member states, would be involved in the CJEU hearing and would have limited time for submissions, he said.

Counsel said Mr Schrems considered it very important that the court address issues related to Articles 7, 8 and 47 of the Charter of Fundamental Rights of the EU.

Mr McCullough will continue his submissions on a date to be fixed after which the judge will hear from lawyers for the US government, Business Software Alliance, Digital Europe and the Washington-based Electronic Information Privacy Center in their capacity as assistants to the court on legal issues.

She will also hear applications by the US government and Facebook to correct what they claim are “errors” in her October judgment.