Facebook to challenge DPC decision on data transfers

Facebook has significant concerns about its ability to deliver its services to its 400 million European users as a result of the Data Protection Commissioner’s decision that personal data not be sent to its US parent, the High Court has heard. 

 

Late last month, the DPC informed Facebook Ireland, the European headquarters of Facebook and Instagram platforms, of a preliminary draft decision that personal data should not be transferred to the US parent, Facebook Inc. 

 

Arising out of the decision, Facebook Ireland, represented by Declan McGrath SC and Francis Kieran BL, has brought proceedings seeking to have that decision quashed. 

 

On Monday, Mr McGrath said the DPC informed Facebook on August 28th that it had opened an inquiry of its own volition in light of a judgment from the Court of Justice of the European Union (CJEU) last July. 

 

This came as a surprise to Facebook as it had not been aware of the inquiry prior to the communication, counsel said. 

 

The CJEU, in proceedings involving the DPC, Facebook and data protection activist Max Schrems, had ruled that a key arrangement designed to protect EU citizens’ personal data when transferred to the US was invalid. 

 

The DPC said it had arrived at a draft preliminary decision that data transfers outside of the EU should be suspended as they were made in circumstances that fail to guarantee a level of protection to data subjects equivalent to those provided for in EU law. 

 

Adverse effects 

Counsel said this view, if adopted, would have “extremely significant adverse effects on Facebook, its business and many millions of users”. 

 

Facebook and Instagram have more than 400 million users in the EU and have about 25 million businesses that use apps provided by them. Its platforms generate billions of euro annually, counsel added. 

 

The challenge, aimed at quashing the decision, has been brought on several grounds including alleged failure by the DPC to conduct an inquiry before it reached its decision. Facebook was also concerned the DPC had prejudged or prematurely judged the matter, and has taken irrelevant matters into account. 

 

Counsel said Facebook had not been afforded fair procedures and had been given three weeks from the receipt of the draft finding to make submissions on the decision, a complex matter. 

 

Facebook also believes it is being treated unfairly, he said. Other businesses are involved in data transfer out of the EU to other countries or organisations but Facebook was the only one subject to this type of inquiry and decision. 

 

The DPC had departed in the disputed decision from procedures it had included in its 2018 report, he argued. 

 

Facebook is further concerned it is facing simultaneous investigations into the same matter at the same time, he added. It continuing to investigate complaints made by Mr Schrems several years ago. 

 

In its action, Facebook wants orders quashing the DPC’s preliminary draft decision in relation to the data transfer as well as the decision to commence an inquiry under the 2018 Data Protection Act. 

 

It also seeks various declarations including that the DPC has acted unlawfully, has failed to carry out its functions, and has departed from its publicly-declared procedures, and has breached Facebook’s right to fair procedures. 

 

The judge also put a stay on the DPC’s probe pending the outcome of the action but said the DPC can apply, on notice to Facebook, to seek to have that stay lifted. The matter will return before the court in November.