High Court of Ireland Lets Inquiry Into Facebook EU Data Transfers Proceed

Today, the Justice David Barniville of the High Court of Ireland issued a decision in Facebook Ireland, Ltd. and Data Protection Commission and Schrems, 2020 No. 617 JR, available at: https://noyb.eu/sites/default/files/2021-05/High%20Court%20Judgement%202021-05-14.pdf, which ruled on the application of Facebook and Schrems for judicial review of a preliminary decision by the DPC on whether Facebook was making lawful transfers of personal data of EU citizens. Facebook contends that the DPC's decision was unlawful under the GDPR because amongst other grounds, they did not conduct an investigation beforehand and because Facebook was not given sufficient time to make a submission to the DPC. Schrems stressed the importance for the DPC to act quickly under the GDPR and in light of the decision by the Court of Justice of the European Union in Schrems II. (See the Tip of the Night for July 22, 2020.)

Justice Barniville concluded that Facebook was not entitled to relief, but did request additional comments from counsel on the refusal by the DPC to provide information requested by Facebook.

DPC was found to have adequate reasoning for its decision to conduct an inquiry, and the procedure it followed was deemed to be adequate. Facebook was given reasons why the decision was made; it was given enough information to decide whether or not an appeal was needed; and the given reasons allowed for the court to conduct a proper review.

21 days was deemed to be a sufficient time period in which for Facebook to make submissions. ". . . that in addition to its obligation to respect the rights of the defence and to afford fair procedures, including the right to be heard, to those who are subject to an inquiry commenced by the DPC, the DPC also has significant obligations under the GDPR to act expeditiously in the exercise of its powers." Id. ¶ 262.

The DPC was found not to have acted ultra vires in breach of its obligations under the GDPR: ". . . I accept the DPC’s submission that in the absence of prescribed requirements for an inquiry . . . it is open to the DPC to gather information in a variety of ways, subject at all times to the overriding requirement of fair procedures as well as the other requirements contained in the GDPR concerning the need for expedition and due diligence." Id. ¶158.

The DPC was not required to wait for guidance from the European Data Protection Board in its pending examination of the Schrems II decision. "There is nothing in the GDPR concerning the establishment and functions of the EDPB which would impose such an obligation upon the DPC or preclude it from proceeding with the inquiry. On the contrary, I am satisfied that there is nothing in the GDPR which would support the contention that the absence of guidance from the EDPB amounted to a bar on the DPC commencing and proceeding with the inquiry." Id. ¶ 346

Justice Barniville also ruled that the DPC had not breached a duty of candor owed to Facebook, and that allegations of an abuse of process brought by the DPC against Facebook, and then withdrawn, were baseless and should have been withdrawn sooner.

This decision allows the inquiry by the Data Protection Commission to proceed against Facebook, and potentially halt transfers of personal data outside of the European Union.