Getty Images/iStockphoto

News

Fresh blow for Facebook as court refuses stay in Max Schrems legal action

Facebook has lost a legal attempt to delay the Irish High Court from seeking answers from the European Court of Justice over the legality of EU-US data transfers

Bill Goodwin
By
Published: 02 May 2018 15:41

Facebook has failed in a belated attempt to delay Dublin’s High Court referring key questions that could decide the lawfulness of data transfers between Europe and the US to the European Union’s Court of Justice (CJEU).

In a ruling today, Judge Caroline Costello refused Facebook a stay in the legal proceedings to give it time to seek an appeal, ordering that 11 questions over the legality of data transfers between Europe and the US should be sent immediately to the Court of Justice for determination.

Facebook is seeking to argue before the Supreme Court that the court’s referral of questions to Europe is pointless because the General Data Protection Regulation (GDPR) will come into effect on 25 May, replacing existing data protection legislation.

The court’s questions raise significant issues in EU law, including whether the High Court was correct in finding there is “mass indiscriminate processing” of data by US government agencies under the US Prism and Upstream surveillance programmes.

The referral will have major implications for the EU’s decision to support Privacy Shield and standard contractual clauses, which are widely used by organisations to transfer data from the EU to the US, raising questions over whether they adequately protect the privacy of European citizens.

Judge Costello ruled that Facebook had no arguable case over whether an appeal court could overturn or vary the Dublin court’s referral to the CJEU. She said an earlier Supreme Court decision that a court of appeal had no jurisdiction to overturn a referral decision was binding on her.

The judge described Facebook’s arguments as “without merit” and “misplaced”, dismissing the social media giant’s argument that its interests would be prejudiced if a stay was refused.

Costello said delays in the case had already “potentially gravely prejudiced” the Irish data protection commissioner, Helen Dixon, Austrian lawyer Max Schrems, who made the initial complaint, and millions of data subjects.

“In my opinion, very real prejudice is potentially suffered by Mr Schrems and the millions of EU data subjects if the matter is further delayed by a stay sought in this case,” she said. “Their potential loss is unquantifiable and incapable of being remedied.

Critical of Facebook’s conduct

The judge was critical of Facebook’s conduct in the litigation and its reliance in any appeal on the GDPR, which, she said, weighed against even a limited stay.

“I am of the opinion that the court will cause the least injustice if it refused any stay and delivers the references immediately to the Court of Justice,” she said in a 12-page ruling.

Costello said Facebook had told her on day 15 of the 21-day High Court hearing that it was considering the fact that the GDPR would come into effect on 25 May as grounds for appealing to the Supreme Court.

If Facebook had wanted to argue that the reference was a moot point because of the GDPR, that should have been done “explicitly and clearly” and not in an “oblique passing fashion”, she said.

Facebook had not alerted the parties and the court that this was a point on which it intended to place “such reliance”, the judge said. The fact that the point was only now being raised gave rise to “considerable concern” as to Facebook’s conduct of the case and the manner in which it had dealt with the court, she said.

“The court was not alerted to the fact that, as far as Facebook was concerned, there was a clock ticking down,” said Costello. “This meant that the case was not expedited. Clearly, the existing delays have already potentially gravely prejudiced the data protection commissioner and Mr Schrems. I do not propose to exacerbate this potential prejudice any further.”

11 questions for determination

Costello agreed 11 questions for determination by the CJEU last month, following hearings by the parties in the case. Facebook’s lawyers said the company was seeking to appeal to the Supreme Court at a hearing on 30 April, seeking a stay on the referral to Europe.

The current hearings were initiated when Ireland’s data protection commissioner, Helen Dixon, brought legal proceedings against Facebook and Schrems. The US government, the Washington-based Electronic Privacy Information Centre, the Business Software Alliance and Digitial Europe were joined to the case.

Costello agreed to refer questions to Europe after agreeing with Dixon that there were “well-founded" grounds for believing that the EC decisions approving data transfer channels, known as standard contractual clauses (SCCs), were invalid.

The Dublin court’s questions go to the heart of SCCs, which are widely used by companies to share personal data between Europe, the US and other countries. Dublin intends to seek a determination from the CJEU as to whether SCCs are in breach of Articles 7 and 8 of the European Charter, which protect personal privacy and the privacy of European citizens’ data.

Read more on IT legislation and regulation