Judge in Max Schrems v Facebook action raises red flag on EU-US data transfers

Court found ‘indiscriminate surveillance’

In his landmark findings, Hogan stated at paragraph 13: “I will therefore proceed on the basis that personal data transferred by companies such as Facebook Ireland to its parent company in the US is thereafter capable of being accessed by the NSA [National Security Agency] in the course of mass and indiscriminate surveillance of such data.”

These findings are settled law and cannot be overturned, and the European Court has already endorsed them – so why this current round of questions?

Instead of investigating Schrems’ complaint, the data commissioner hit upon a sub-clause in Privacy Shield about standard contractual clauses, which Facebook and others were relying on to  transfer data legally between the EU and the US.

The data commissioner told the Irish Commercial (High) Court in 2016 that she had reservations about this procedure. But she made no attempt to investigate Schrems’ complaint, especially the part that dealt with Prism, the US mass surveillance programme that Hogan had found, as a fact, was unlawfully scooping up all the EU client data of nine named internet giants, including Facebook.  

Schrems has always said he would take action against Privacy Shield, but Costello has now asked the questions he would probably have asked. These include whether an EU citizen can count on an ombudsman in the US, who would be a State Department official, with no powers to notify complainants of the details of their complaint, or to award compensation, as a substitute for the legal protection afforded EU citizens in the EU.

The laws of the EU and member states, in order to meet the requirement for redress and the right to a fair trial under Article 47 of the EU Charter, provide for local courts to make judgments in privacy cases and award both civil and criminal damages.

The judge’s questions raise another crucial issue, however: whether essentially secret decisions taken by the European Commission are valid. Costello said: “The answers to these questions are necessary to determine the validity of the SCC decisions (European Commission), the purpose of the proceedings and the reference to the court. The final question asks the logical conclusion of the prior questions – whether the SCC (Commission) decisions violate Articles 7, 8 and/or 47 of the (EU) Charter and therefore whether the Commission decisions should be declared to be invalid.”

Costello has not raised Article 41.3 of the EU Charter, which provides for compensation to anyone who has been injured through the negligence or wrong actions of EU officials. If the European Court stands by its endorsement of Hogan’s findings, and its own striking down of Safe Harbour, then the Commission could, in principle, face injury claims from upwards of 270 million European citizens – those estimated by Computer Weekly in September 2017 to be affected by US “mass and indiscriminate surveillance”.

Given the recent row over Facebook and Cambridge Analytica, it was essential for the existing law to be clarified. However, Costello has accidentally done this. By referring to Hogan’s findings of fact, she has drawn attention to the fact that “mass and indiscriminate surveillance” is already unlawful. Hogan had, in any case, done no more than put flesh on Sir Anthony May’s advice to the UK parliament on 8 April 2014 that such mass and indiscriminate activities were both criminal and unlawful.

May said: “Public concern has centred on potential intrusive invasion of privacy [arising from the Snowden revelations]. Such concerns have been expressed publicly in the US, Europe and other countries with greater force perhaps than in the UK. But unjustified and disproportionate invasion of privacy by a public authority in the UK would breach Article 8 of the European Convention on Human Rights just as much here as in other parts of the European Union.”

The first law cases against Facebook have now begun. McCue and Partners of London and Belfast has launched a class action against Facebook and Cambridge Analytica. In the UK, up to 38 million people could have a claim against Facebook arising from Hogan’s findings.

But by putting Hogan’s findings back to the European Court, Costello has raised an even more critical issue for the US government. The US government has always claimed that the Prism mass surveillance is legal because there is a law in the US – the Foreign Intelligence Surveillance Act (FISA), with an attached court. But US law does not apply in the EU, and at paragraph 18 of his findings, Hogan rejected the FISA court as a court of law.  The European Court of Justice endorsed Hogan’s findings of fact.