The High Court has referred a question to the Court of Justice of the European Union about whether Ireland’s Data Protection Commissioner could investigate concerns over personal data transferred from Facebook Ireland to the United States, despite a European Commission decision finding the US protection adequate under the Safe Harbour regime.
The judicial review was brought by Maximillian Schrems after the commissioner declined to investigate his June 2013 complaint. Schrems argued that disclosures about US surveillance showed that data transferred to the US lacked meaningful protection from access by security authorities. The commissioner considered the complaint unsustainable in law because the 2000 Commission decision bound him to treat transfers by Safe Harbour organisations as adequately protected.
Mr Justice Hogan said the evidence indicated that data transferred to the US could be accessed by US security authorities on a mass and undifferentiated basis. He also rejected the commissioner’s objection that Schrems lacked standing, finding that Schrems could bring the proceedings even though he could not show that his own data had been accessed.
The judge explained that “frivolous or vexatious” under the relevant Irish legislation could mean a complaint considered legally unsustainable; he said the complaint was not frivolous or vexatious in the ordinary sense. He noted that, if Irish constitutional standards alone governed the issue, there would be a serious question about whether US law and practice provided adequate protection. But Irish law required the adequacy question to be determined in accordance with the Commission’s 2000 finding.
The High Court did not rule that the Safe Harbour decision was invalid, or that the commissioner could disregard it. Instead, it asked the EU court whether the commissioner was absolutely bound by that finding in light of Articles 7 and 8 of the EU Charter of Fundamental Rights and the intervening developments, or could conduct an investigation based on later factual developments.
The proceedings were adjourned pending the EU court’s answer. The High Court made no final determination of the judicial review application at this stage.