Regulator will investigate Facebook breach of privacy claims

The Data Protection Commissioner has agreed to investigate a complaint by Austrian student Max Schrems alleging Facebook Ireland is making his personal data available via Facebook Inc to US intelligence agencies.

The commissioner's lawyers told Mr Justice Gerard Hogan the investigation would proceed arising from the recent decision of the European Court of Justice concerning the Safe Harbour arrangement relating to transfer of personal data.

The ECJ ruled that the 15-year-old Safe Harbour arrangement, which allowed about 4,500 US companies to transfer personal data to the US, violates the fundamental rights of EU citizens to privacy and data protection.

Mr Schrems had, in judicial review procedings, challenged the commissioner’s refusal to investigate his complaint.

Mr Justice Hogan had referred issues concerning the validity of Safe Harbour to the ECJ and, following that court's ruling, the matter was back before the High Court Tuesday.

Arising from the ECJ decision, the commissioner’s lawyers said she was prepared to consent to orders quashing her refusal and remitting the matter for consideration by her.

There was no need for an order directing she investigate the complaint as she was consenting to do so, her counsel Paul Anthony McDermott SC said.

The initial refusal by then commissioner Billy Hawkes to investigate had been based on a view the Safe Harbour arrangement was valid, he added. There may be discussions on a new Safe Harbour arrangement and data protection commissioners across Europe are considering that matter, counsel said.

Noel Travers SC, for Mr Schrems, said there was an obligation to investigate the complaint speedily and Mr Schrems was concerned the investigation might be “long-fingered” in the hope there might be a new Safe Harbour arrangement. His client had made the complaint three years ago, counsel added.

Mr Schrems was concerned the transfers of data are continuing and there was no guarantee, even if his complaint was upheld, the data would be returned, counsel said.

Mr Schrems also wanted to be free to make submissions to the commissioner as to what law applied.

Mr McDermott said there was no question of the investigation being “long-fingered” and any delay in this matter could not be attributed to the commissioner, who would investigate in line with what the High Court and ECJ had said.

Rossa Fanning, for Facebook Ireland, which denies any breach of Irish or EU law, said his client was not pursuing its application to be permitted make submissions on a range of legal issues given the fact the judicial review proceedings were effectively at an end.

In his ruling, Mr Justice Hogan said Mr Hawkes had refused to investigate the complaint arising from the presumed validity of the Safe Harbour arrangement. Mr Hawkes considered his hands were tied as a result of Safe Harbour and it was only in that context he had found the complaint frivolous and vexatious and doomed to fail, the judge said.

There was no dispute the case raised major issues of Irish and EU law, the judge added.

Now that Safe Harbout has been invalidated, the sides agree the commisisoner’s refusal must be quashed, he said. There was no need to make a coercive order requiring the commissioner to investigate as she had said she would do so with all due speed.

There was a “mottled” legal landscape concerning the matters to be addressed by the commissioner but the sides had agreed it was unnecessary and possibly undesirable for him to express any further view on that. His earlier decision, and the ECJ decision, must speak for themselves, he said.

It is clear, under EU law, the commissioner is obliged to investigate the complaint and the court had no doubt she would do so, the judge said. In those circumstances, it was unnecessary to him to pronounce further on matters. Nothing in his ruling should be taken as expressing as view on any of the questions.

He also ruled Mr Schrems was clearly entitled to his legal costs.

In his decision on costs, the judge said this was a case of “transcendent international importance” and involved possibly one of the most important decisions of the ECJ in recent years.

He also directed, pending payment of the full award of costs to Mr Schrems, he should get a payment out of €10,000 towards travel and other costs arising from the ECJ referral.

Mr Schrems complained to the Irish commissioner in 2013 after former NSA security contractor Edward Snowden claimed Facebook and other US firms were being forced to make their personal information – including EU user data – available to US intelligence.

The commissioner's office found it had no case to investigate as Safe Harbour, and its implementation, was solely a matter for the European Commission.

Privacy rights body Digital Rights Ireland was previously joined to the Schrems case as an amicus curiae, or ‘friend of the court’.