The Supreme Court has dismissed Facebook Ireland Limited’s appeal against findings made by the High Court in proceedings concerning the transfer of personal data from the European Union to the United States.
The appeal arose from a complaint by Maximillian Schrems to the Data Protection Commissioner (DPC). The DPC brought proceedings asking the High Court to refer concerns about the validity of European Commission decisions on standard contractual clauses (SCCs) to the Court of Justice of the European Union (CJEU). The High Court made that reference, which was pending when the Supreme Court heard the appeal.
Facebook challenged a number of the High Court’s findings about US law and surveillance, including findings on data processing, access to remedies in US courts and the role of the US Administrative Procedure Act. It also contested the wording of questions sent to the CJEU and the High Court’s assessment of whether the SCC decisions raised concerns under the EU Charter of Fundamental Rights.
The Supreme Court distinguished between the High Court’s decision to refer questions and its findings of fact. It held that the appeal could address findings of fact, but could not challenge the decision to refer or the terms of the reference. Whether to maintain, amend or withdraw the reference remains for the High Court alone, in light of the CJEU’s role.
The Court considered Facebook’s challenges to the High Court’s account of US law. It said several disputes were chiefly about how underlying facts were described. For example, bulk screening may count as “indiscriminate processing” under the relevant data protection definition, while that description could be misunderstood to imply that more invasive forms of processing were also indiscriminate. The Court said Facebook could explain its interpretation to the CJEU.
On other issues, including standing and the Administrative Procedure Act, the Court was not satisfied that the High Court’s findings could be overturned under Irish appellate principles. It treated the High Court’s conclusions about effective remedies and proportionality as part of its assessment that it shared the DPC’s concerns, rather than as findings of fact open to appeal in this case. The CJEU will determine the validity of the SCC decisions and the relevance of the Privacy Shield decision.
The Supreme Court made no order overturning any part of the High Court judgment and dismissed the appeal. It said parties could draw the CJEU’s attention to the Supreme Court’s observations on how the facts were characterised. The judgment did not decide whether the SCC decisions were valid; that question remained for the CJEU.