Data Protection Commissioner Helen Dixon’s “preliminary draft decision” to conduct an inquiry into, and suspend data transfers, by Facebook Ireland to the US will have “devastating” consequences for the social media giant’s business if it is allowed to stand, the Commercial Court has been told.

In 2018, some $228 billion (€188 billion)was generated through use of Facebook services which include Instagram, Paul Sreenan SC, for Facebook, said.

Of some 410 million Facebook and Instagram users in Europe, an estimated 25 million are business users, he said. If data transfers are stopped, that will also affect the “multiples of billions” which Facebook attracts in advertising. “It will have devastating consequences for the plaintiff’s business.”

Action

He was opening Facebook’s action seeking to quash the decisions by the Data Protection Commissioner (DPC) to suspend transfers to the US, and to conduct an inquiry. The probe has been stayed pending the outcome of this case, which originally stems from challenges to DPC decisions by Austrian privacy and data rights activist Max Schrems, who is a notice party.

Facebook claims it was denied fair procedures and an opportunity to be heard. It wants the court to halt the DPC’s probe into those transfers. It alleges failure by the DPC to conduct an inquiry before it reached its draft decision and it prejudged or prematurely judged the matter.

It also claims the DPC took irrelevant matters into account and has not afforded Facebook fair procedures. The DPC denies the claims.

The DPC move last August came after a July judgment of the European Court of Justice (ECJ) in relation to EU-US data transfers. Mr Sreenan said the DPC decided to commence a statutory inquiry into the lawfulness of Facebook’s transfers of personal data relating to millions of its EU users from the EU to the US.

That inquiry, announced in the preliminary draft decision, is under the Data Protection Act, 2018, and by reference to relevant provisions of the General Data Protection Regulations (GDPR).

The DPC claims data transfer methods used by Facebook fail to guarantee a level of protection to data subjects equivalent to those provided for in EU law. GDPR regulations require that the transfer of personal data outside of the EU is prohibited unless certain limited circumstances apply using certain methods.

The July ECJ decision made rulings in relation to two of those methods. It ruled that one method, the “Privacy Shield”, allowing transfers to US firms with adequate personal data protections, was invalid.*

In relation to a second method, called Standard Contractual Clauses (SCC) – allowing data controllers to transfer data outside of the EU under a standard contract with counterparts in the US – the ECJ said a regulator (such as the DPC) must take a proactive role in ensuring compliance.

As a result, the DPC launched the inquiry.

Decision

Mr Sreenan said, in doing so, the DPC formed a preliminary draft decision as to infringement and possible sanctions despite Facebook’s legitimate expectation and right to be properly consulted before that would happen.

The DPC had given Facebook just 21 days to respond, which was too little time for it to properly do so for something that could have “potentially catastrophic consequences” for its users and the business itself, he said.

The DPC had repeated many times in the written decision that she had not made up her mind, but it was done in such a way that as though someone had gone through it to “lawyer it up or boiler plate it”, he said.

When Mr Justice David Barniville said this claim had not been made by Facebook in its court papers and was something of an “extravagant submission”, Mr Sreenan said he supposed it was somewhat extravagant but it was an indication of his client’s surprise at the approach taken by the DPC.

Asked by the judge why he thought the DPC took the approach she did, counsel said he was not able to answer that despite Facebook having asked why.

It gave rise to the apprehension the DPC was not approaching the matter with an open mind and that there was no investigation at all before it was made, he said.

Counsel also said it was a flawed process, a flawed approach and the “singling out” of Facebook compared to its competitors.

The case continues.

*Article amended on December 16th.