The Data Protection Commissioner's inquiry into the validity of cross-border transfers of data by Facebook can now proceed as a result of orders made by the High Court.
Mr Justice David Barniville on Thursday lifted a court-imposed stay which had halted the inquiry since last September pending the outcome of proceedings challenging the commissioner's decision.
In his lengthy judgment on proceedings by Facebook last Friday, the judge ruled Facebook had not established any basis for impugning the commissioner’s decision to commence the inquiry or her preliminary draft decision in favour of suspending data transfers by Facebook to the US.
On Thursday, when making final orders arising from his judgment, the judge, on consent of the sides, lifted the stay which means the commissioner's inquiry, initiated last August following a judgment of the Court of Justice of the EU (ECJ), can proceed.
Declan McGrath SC, for Facebook, said the court could also make consent orders for his client to pay 90 per cent of the commissioner's costs in defending the case. Facebook will also pay the costs of Max Schrems, an Austrian lawyer and privacy and data rights activist, who was a notice party to the case.
Michael Collins SC, for the DPC, and Eoin McCullough SC, for Mr Schrems, consented to those orders.
Having been told there is a dispute between Mr Schrems and the DPC concerning legal costs for his separate action over the DPC probe, the judge directed the sides to exchange submissions on costs and returned that matter for hearing in late June.
Mr Schrems’ separate case was also aimed at halting the DPC probe, although for very different reasons. He was concerned the DPC was engaged in a process that might affect the investigation and outcome of his own complaints about Facebook’s handling of his personal data.
The resolution of his case was reached earlier this year on the basis of an agreement concerning how his complaint, originally made in 2013 and reformulated in 2015, will be addressed.
Facebook took its proceedings last August after the DPC, Ireland's supervisory authority for data protection rights, informed Facebook Ireland, the EU HQ of Facebook and Instagram platforms, of her decision to open an own volition inquiry into cross-border transfers by Facebook and of her preliminary draft decision that personal data should not be transferred out of the EU to its American parent Facebook Inc.
The DPC considered the data transfers were made in circumstances which fail to guarantee a level of protection to data subjects equivalent to those provided for in EU law.
