All this month, Max Schrems is back in court in Dublin. Not content with bringing down Safe Harbor, Schrems is sticking to his guns and coming after standard contractual clauses and may even inadvertently demolish Privacy Shield — Safe Harbor’s much-maligned successor — along the way.
Schrems contends that although Facebook (like a great many other U.S. companies) switched from Safe Harbor to SCCs after the European Court of Justice’s ruling invalidating Safe Harbor, “once a recipient is subject to surveillance laws that violate the EU’s fundamental rights to privacy and data protection” data transfers are not allowed.
It is no great surprise that Schrems is going after SCCs, but what may prove more alarming to those relying on it is that Facebook now relies on the Privacy Shield decision by the European Commission it its defense. Facebook relies on the European Commission finding concerning adequate protection under U.S. law and on the new “Ombudsperson” mechanism to defend its use of SCCs when transferring data to the U.S.
In his opening address, Michael Collins, senior counsel for the Irish Data Protection Commissioner, questioned the fundamental validity and functioning of the Privacy Shield as well as the underlying findings by the European Commission in the Privacy Shield decision.
Eoin McCullough, senior counsel for Schrems, said that his complaint is not limited to the SCCs per se. He highlighted that Facebook seems to rely on other legal basis for the data transfer as well, such as consent and the performance of a contract, and that all of them should be dealt with before the complaint by Schrems goes to Luxembourg for a second time.
Although Schrems and his team believe there is sufficient material for Irish DPC Helen Dixon to resolve the case in Ireland under Article 4 of the SCCs, which he argues allow the DPA to suspend the data flows in this case, it looks increasingly likely that it will once again be referred to the CJEU. With the United States Government weighing in as an amicus curiae in its first ever involvement in litigation in the Irish courts, the DPC may well not want the responsibility.
Despite this, Dixon made a “provisional finding” that there are “deficiencies” in EU citizens' access to redress under U.S. law for any breach of their data protection rights and that SCCs do not provide the level of protection necessary.
Given this, the DPC has the power to suspend data flows, but instead suspended investigations and initiated proceedings before the Irish High Court.
If the case does indeed end up before the CJEU, it will likely be a much more straightforward case than Schrems’ original complaint. Essentially the court will only have to compare SCCs and, most likely, Privacy Shield, to the old Safe Harbor and assess whether sufficient improvements have been made. If not, then it would be required to find the same as in the Safe Harbor case.
The U.S. government argues that significantly enhanced protections for EU citizens have been put in place under Privacy Shield. Paul Gallagher, senior counsel for Facebook, meanwhile argued that the EU would face an economic crisis of “enormous” proportions if transatlantic data flows were suspended. And, he argued, many individual member states do not meet the EU-wide standards of data protection.
Other amicus curiae include the non-profit Electronic Privacy Information Center and two industry groups: the Business Software Alliance and Digital Europe, representing digital technology associations and corporations operating in Europe.
Schrems himself cannot comment while the case is ongoing, but sources close to his defense told The Privacy Advisor that he was particularly pleased with the evidence given by Ashley Gorski of the National Security Project of the American Civil Liberties Union.
Justice Caroline Costello will also hear evidence from other legal experts for Facebook, including Alston & Bird's Peter Swire and American University Washington College of Law's Stephen Vladek.
Finally, of note, last year the Data Protection Commissioner was granted additional funding of €2.8 million for her office in Ireland’s 2017 Budget. The bill for the Facebook/Schrems case last year was €610,000.
photo credit: Informedmag Business Contract via photopin