The Supreme Court will rule on a later date on Facebook’s appeal over the referral to the Court of Justice of the EU of key issues concerning the validity of European Commission decisions approving EU-US data transfer channels.
The appeal concluded on Wednesday after a 2½-day hearing before the five-judge court.
The Chief Justice, Mr Justice Frank Clarke, said the court would consider what to do next and inform the parties in that regard.
The appeal concerns an October 2017 High Court judgment by Ms Justice Caroline Costello and her subsequent referral in May 2018 of issues for determination by the European Court of Justice (ECJ).
Proceedings
The judgment was given in proceedings by the Data Protection Commissioner (DPC) arising from complaints by Austrian lawyer Max Schrems that the transfer of his personal data by Facebook to the US breached his data privacy rights as an EU citizen.
The DPC case was taken against Facebook Ireland – because Facebook’s European headquarters are here – and Mr Schrems but no formal orders were sought against them and the core issue concerned the validity of data transfer channels known as standard contractual clauses (SCCs).
Ms Justice Costello directed a referral to the ECJ of 11 issues concerning the validity of European Commission decisions approving the SCCs.
A core issue in the Supreme Court appeal is whether there is any legal entitlement to appeal a referral to the ECJ.
Facebook maintains it is entitled to appeal and disputes several of the High Court’s findings, including that the DPC had “well founded” concerns, including about “mass indiscriminate processing” of data by US government agencies under programmes authorised there.
The US government is involved in the appeal as an amicus curiae, assistant to the court on legal issues.
It supported Facebook’s argument that no reference to the ECJ is required in light of the Privacy Shield agreement between the EU and US and the European Commission’s determination the US ensures an adequate level of protection for personal data transferred under the Privacy Shield.
The US said the DPC’s provisional decision that a legal remedy comparable to article 47 of the EU Charter of Fundamental Rights is not available in the US to EU citizens for any breach of their privacy rights was taken without regard to the Privacy Shield agreement.
Lawyers for the DPC said the commissioner has concerns whether the measures provided for under the Privacy Shield are comparable to the remedy available to EU citizens for breach of data privacy rights under article 47 of the EU charter.
Arguments
In closing arguments on Wednesday for the DPC, Brian Murray SC said the commissioner’s concerns include about the lack of legal standing for EU citizens who wish to pursue remedies in the US over data privacy breaches. Without legal standing, there is “no remedy”, he said.
Sean O’Sullivan, for Mr Schrems, opposed the appeal and said Facebook had failed to identify an error by the High Court and his client’s concern is about the adequacy of US data privacy protections in the context of EU data privacy law.
US lawyer Ashley Gorski, of the National Security Project of the American Civil Liberties Union, had told the High Court of bulk searching of data under the Upstream programme and her view was the targeting standard for collection of data is so low that collection involves mass surveillance, he said.
In his closing reply, Paul Gallagher SC, for Facebook, said the High Court findings should be addressed in the normal way of a Supreme Court appeal. The ECJ should not be asked to decide such important matters of EU law on the basis of what Facebook maintains are incorrect findings by the High Court, he argued.
