Facebook faces ‘devastating consequence’ if decision on data transfers stand, court told

In 2018, some $228 billion (€188 billion ) was generated through use of Facebook services, which include Instagram, Paul Sreenan SC, for Facebook, said. Of some 410 million Facebook and Instagram users in Europe, an estimated 25 million are business users, he said. If data transfers are stopped, that will also affect “multiples of billions” which Facebook attracts in advertising. “It will have devastating consequences for the plaintiff’s business.” 

 

Action 

He was opening Facebook’s action seeking to quash the DPC’s decision that transfers to the US be suspended and to her decision to conduct an inquiry. The probe has been stayed pending the outcome of this case, which originally stems from challenges to DPC decisions by Austrian privacy and data rights activist, Max Schrems, who is a notice party. 

 

Facebook claims it was denied fair procedures and an opportunity to be heard. It wants the court to halt the DPC’s probe into those transfers. It alleges failure by the DPC to conduct an inquiry before it reached its draft decision and it prejudged or prematurely judged the matter. 

It also claims the DPC took irrelevant matters into account and has not afforded Facebook fair procedures. 

 

The DPC denies the claims. The DPC move last August came after a July judgment of the European Court of Justice (ECJ) in relation to EU-US data transfers. Mr Sreenan said the DPC decided to commence a statutory inquiry into the lawfulness of Facebook’s transfers of personal data relating to millions of its EU users from the EU to the United States. 

 

That inquiry, announced in the preliminary draft decision, is under the Data Protection Act, 2018, and by reference to relevant provisions of the General Data Protection Regulations (GDPR). 

 

The DPC claims data transfer methods used by Facebook fail to guarantee a level of protection to data subjects equivalent to those provided for in EU law. GDPR regulations require that the transfer of personal data outside of the EU is prohibited unless certain limited circumstances apply using certain methods. 

 

The July ECJ decision made rulings in relation to two of those methods. It ruled that one method, the “Privacy Shield”, allowing transfers to US firms with adequate personal data protections, was valid. 

 

In relation to a second method, called Standard Contractual Clauses (SCC) – allowing data controllers to transfer data outside of the EU under a standard contract with counterparts in the US – the ECJ said a regulator (such as the DPC) must take a proactive role in ensuring compliance. 

 

As a result, the DPC launched the inquiry. 

Decision 

Mr Sreenan said, in doing so, the DPC formed a preliminary draft decision as to infringement and possible sanctions despite Facebook’s legitimate expectation and right to be properly consulted before that would happen. 

 

The DPC had, in its decision, given Facebook just 21 days to respond to the decision which was too little time for it to properly do so for something that could have “potentially catastrophic consequences” for its users and the business itself, he said. 

 

The DPC had repeated many times in the written decision that she had not made up her mind but it was done in such a way that as though someone had gone through it to “lawyer it up or boiler plate it”, he said. 

 

When Mr Justice David Barniville said this claim had not been made by Facebook in its court papers and was something of an “extravagant submission”, Mr Sreenan said he supposed it was somewhat extravagant but it was an indication of his client’s surprise at the approach taken by the DPC. 

 

Asked by the judge why he thought the DPC took the approach she did, counsel said he was not able to answer that despite Facebook having asked why. 

 

It gave rise to the apprehension the DPC was not approaching the matter with an open mind and that there was no investigation at all before it was made, he said. 

 

Counsel also said it was a flawed process, a flawed approach and the “singling out” of Facebook compared to its competitors.