What does this cover?
As is well documented, in 2013 Max Schrems made 22 complaints to the Irish Data Protection Commissioner (theIDPC) in which he claimed that Facebook and other US firms were being forced to make personal information, including EU user data, available to US intelligence. The IDPC rejected the complaint on the basis that it could not look beyond the EU-US Safe Harbor Agreement.
Mr. Schrems subsequently filed an application for judicial review in the Irish High Court. Mr. Justice Hogan adjourned the case pending a reference to the CJEU. He said that Irish law relating to privacy had effectively been pre-empted by EU law and that the core issue was whether the relevant directives should be re-evaluated in the light of the subsequent entry into force of Article 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union.
The CJEU's Adovacate General for the case, Yves Bot, delivered his opinion on 23 September 2015 and declared the Safe Harbor agreement as invalid. Mr. Bot said that individual data protection authorities could suspend data transfers to third countries if they violated EU rights. On 6 October 2015 the CJEU ruled that the Safe Harbor regime is no longer considered to provide adequate protection for personal data transfers from the EU to the USA.
Irish High Court
The IDPC instructed her legal team to bring the matter back before the Irish High Court as soon as practicable. The matter was listed on 20 October 2015 before Mr. Justice Hogan. Counsel for Mr. Schrems said there was an obligation to investigate the complaint speedily and Mr. Schrems was concerned the investigation might be "long-fingered" in the hope there might be a new Safe Harbor arrangement agreed. In response, Counsel for the IDPC responded that there was “no question” of this happening.
In his ruling, Mr. Justice Hogan said that the former IDPC, Billy Hawkers, had refused to investigate the complaint arising from the presumed validity of the Safe Harbor arrangement. Now that Safe Harbor has been invalidated, both sides agree the IDPC's refusal must be quashed. Judge Hogan said that there was therefore was no need to make a coercive order requiring the IDPC to investigate as she had said she would do so with all due speed.
In response, the IDPC said that she welcomed Judge Hogan's decision "which brings these proceedings to a conclusion. My Office will now proceed to investigate the substance of the complaint with all due diligence."
To view full statement by the DPC in respect of the judgement in the Schrems case (C-362/14), please click here.
What action could be taken to manage risks that may arise from this development?
None – for interest only.
Companies should continue to monitor Safe Harbor developments.
DAC Beachcroft LLP – Rowena McCormack