Technology

US surveillance hangs over Schrems privacy proceedings

Treatment of EU citizens’ data by US will be critical to outcome of High Court case

Max Schrems, Austrian law student and data-privacy activist. Photograph: Lisi Niesner/Bloomberg

Elaine Edwards
Tue Feb 7 2017 - 13:04

It will require a particular interest, or perhaps a peculiar dedication, to the finer points of EU data protection law to sit through the expected three-week duration of a case that opened before the High Court in Dublin on Tuesday.

US government surveillance of non-US citizens, however, hangs over the proceedings and the treatment of the data of EU citizens by the authorities there will be critical to the outcome.

The case is being taken by the Data Protection Commissioner, who is seeking a referral to the EU's highest court on questions concerning the validity of certain contracts used by companies such as Facebook to transfer their customers' personal data outside the EU, and particularly to the US.

The ultimate outcome may, however, have implications for EU-US trade as well as the privacy rights of hundreds of millions of EU citizens. The case opened before Ms Justice Caroline Costello at the commercial division of the High Court.

READ MORE

Facebook is a party to the case, in which the commissioner has asked the court to refer to the Court of Justice of the European Union the question of whether so called 'standard contractual contracts' protect the privacy rights of EU citizens when their personal data is transferred outside Europe.

Austrian privacy campaigner Max Schrems was also joined to the proceedings by the commissioner and is in Dublin for the case, which is expected to last three weeks.

The case arose following a complaint to the commissioner by Mr Schrems in relation to how his data was handled by Facebook in the US and his arguments that it was not afforded adequate privacy protections.

Mr Schrems was in court on Tuesday, sitting alongside a handful of observers and a small number of journalists. On the legal benches, a lineup of eminent senior counsel represents variously the commissioner, Facebook, Mr Schrems, the US government and a number of parties who have been granted rights to make representations as ‘friends of the court’.

Maurice Collins SC, for the commissioner, began his submission on Tuesday morning, opening to the court EU legislation and other instruments governing the data protection rights of citizens in the union.

Mr Collins noted the case had “some unusual features”.

He said the commissioner was bringing these proceedings “not out of any particular vested interest or any agenda she might have” but arising from her statutory functions as commissioner.

The court heard the commissioner had formed the preliminary view that some of Mr Schrems’s concerns about the transfers of his personal data were well founded and that she was therefore obliged to bring the matter before the court.

In forming this preliminary view, the commissioner agreed that there were deficiencies in the rights of EU citizens to access remedies under US law in relation to their personal data.

The commissioner was not seeking any order against Facebook or Mr Schrems, Mr Collins said.

They were only named in order to give them an opportunity to participate should they wish, and they were there of their own volition to express their views.

At the heart of the matter is the question of what happens to citizens’ personal data when transferred to the US by companies such as Facebook and whether it is open to the possibility of surveillance by the national security authorities. The issue was also alluded to by Mr Collins’s in his submission on Tuesday morning.

He told the court that the personal data transferred by Facebook was not subject to an exemption in EU data protection law which allowed processing of such information within the EU on national security grounds.

The case will involve a comparison of the different regimes in operation in the EU and the US with regard to the protection of personal data.

Mr Collins noted that unlike in Europe, where there is a single EU directive in place, US law was a “patchwork quilt” of “labyrinthine” regulations and administrative remedies.

Mr Collins said that if the court shared the commissioner's concerns about the transfers of personal data to the US under the contracts, it was for the CJEU to decide the validity of the European Commission decisions underpinning them.

If there were deficiencies regarding the ability of EU citizens to access remedies under US law, then it did not matter what administrative oversights were in place there, Mr Collins said.

He said he believed much of the volume of information submitted by Facebook would not be relevant to the court at this stage.

Mr Collins also gave the court an outline of the Prism and Upstream surveillance programmes unveiled by Snowden in a series of revelations from 2013 on, and information on the operation of the Foreign Intelligence Surveillance Act (Fisa) in the US.

Submissions on behalf of the US government are not due to be heard until at least Friday.

LATEST STORIES