On May 14, 2021, the Irish High Court dismissed Facebook Ireland’s (“Facebook”) action against the Irish Data Protection Commissioner’s (“DPC”) investigation into Facebook’s international transfers of personal data.
Following the decision of the Court of Justice of the European Union (“ECJ”) of July 2020 in the Schrems II case (data protection officer C-311/18 against Facebook Ireland Ltd and Maximilian Schrems), the DPC initiated an investigation at its own request). In its ruling, the ECJ invalidated the EU-US Privacy Shield transfer mechanism, stating that Standard Contractual Clauses (“SCCs”) alone may not provide adequate protection for personal data if transferred to inappropriate jurisdictions. The DPC’s investigation relates to transfers made by Facebook to its US-based parent company Facebook Inc., citing SCCs.
Facebook launched a judicial review process to end the investigation. It requested the repeal of the preliminary draft decision of the DPC from August 2020, which opened the investigation and provisionally determined that the transmissions from Facebook violated the EU General Data Protection Regulation (GDPR). Facebook argued that its right to a fair trial had been violated during the DPC’s decision-making process, also because the DPC’s draft decision was issued prior to the publication of guidelines by the European Data Protection Board (“EDPB”) following the Schrems II decision. The Irish High Court ruled that while the DPC’s decisions and proceedings were open to judicial review, the DPC had the right to use the procedure they chose during its investigation, provided that it adhered to the fair process and requirements of the GDPR. The High Court ruled that the DPC did not draw conclusions too early or without access to sufficient information, as alleged by Facebook. Furthermore, the High Court found no legal obligation requiring the DPC to await recommendations or guidelines from the EDPB before conducting an investigation and that “any requirement to await the EDPB guidelines before proceeding would be inconsistent with the obligations that were imposed on the DPC to act within a reasonable period of time and with due care and to take action if required by the GDPR. “
Facebook also argued that the 21 days allotted by the DPC for its response was insufficient to submit its posts and that the DPC’s involvement, Helen Dixon, in both the investigative and decision-making stages of the investigation was yet another violation of his rights to fair trial. Both arguments were rejected by the High Court. Facebook also made the argument that the DPC violated Facebook’s equality rights when it chose to look into Facebook’s broadcasts, despite similar broadcasts being made by other organizations. This was also dismissed by the High Court, with Judge David Barniville stating: “I do not accept that the principles of equality, coherence or good administration have required the DPC to explain why it has decided to open an investigation into initiate [Facebook] and not in relation to other companies. The DPC was authorized to do so and explained why it had decided to open an investigation into the [Facebook]No explanation had to be given as to why no investigations into other companies were initiated. “
Separately, Mr Schrems also requested a judicial review regarding the DPC’s will investigation, arguing that his own longstanding complaint about the transfer of his data should first be closed. This case was settled after the DPC agreed to act swiftly on his original complaint and hear Mr Schrems as part of his wider investigation into Facebook’s referrals. Mr Schrems is also granted access to certain materials that are exchanged between the DPC and Facebook.
Facebook now has to respond to the preliminary decision of the DPC within 21 days of resuming the request.