Killian Flood BL

About this case:

• Court:
  High Court
• Judge:
  Mr Justice David Barniville

In the case, Facebook made a number of complaints about the procedure which the DPC had adopted in an “own-volition” inquiry following the landmark CJEU decision in Case C-311/18 Data Protection Commissioner v. Facebook Ireland Ltd and Maximilian Schrems (Schrems II).

Essentially, Facebook complained that the preliminary draft decision (PDD) issued by the DPC was inappropriate and that it violated Facebook’s entitlement to fair procedures. However, Mr Justice David Barniville rejected each of Facebook’s submissions and held that the DPC’s procedural steps were lawful.

Despite this, the court was critical of the DPC for maintaining certain allegations against Facebook which “ought not to have been made”.

Background

The background to the proceedings is long and complicated. In 2013, Mr Maximilian Schrems made a complaint to the DPC regarding the processing of his personal data by Facebook, contending that the transfer of his data to the US was unlawful as a matter of domestic and EU law. In the intervening years, there were several judgments of the High Court, Supreme Court and CJEU relating to the fundamental issue of data transfers. The litigation culminated in the Schrems II decision by the CJEU in July 2020, which was described as “transformative” of the area of data protection law.

The crucial aspect of the Schrems II case was the extent to which Facebook was entitled to rely on so-called standard contractual clauses (SCCs) to justify EU-US data transfers. It was determined that equivalent protection had to be provided by the US in order for a data transfer to be lawful under the SCCs and this lawfulness had to be assessed on a case-by-case basis.

Arising from this decision, the DPC began an “own-volition” inquiry into the data transfers by Facebook to the US. In so doing, the DPC adopted the PDD, which was a preliminary draft of the Commissioner’s views regarding the lawfulness of the transfers. The purpose of the PDD was to give full effect to the Schrems II decision in a quicker timeframe that usual inquiries. The DPC emphasised in correspondence with Facebook that no final decision had been reached and that Facebook was entitled to make submissions on the PDD within 21 days.

Following the further exchange of correspondence between the parties, Facebook issued judicial review proceedings against the DPC, arguing that the PDD and associated procedures were unfair in a number of respects. It was argued, inter alia, that the PDD breached Facebook’s legitimate expectations for how the inquiry would be conducted, that it demonstrated premature judgment/objective bias and that Facebook was being treated unequally compared to other data processors. It was also claimed that the DPC had breached her duty of candour in defending the proceedings by not giving adequate information about how the investigation would be conducted.

Each of the grounds was opposed by the DPC. Further, Mr Schrems was a notice party to the present case, although his submissions to the court were limited.

High Court

In a 197-page judgment, Mr Justice Barniville refused Facebook’s application for judicial review, holding that Facebook had failed to identify any unfairness in the procedure adopted by the DPC. The court dealt with a wide number of issues in the proceedings and this case report will only deal with the most significant matters in dispute.

First, the court rejected a submission by the DPC that the PDD and associated procedure was not amenable to judicial review. The court stated that the commencement of the inquiry by the DPC had legal consequences for Facebook, with the DPC having certain investigative powers arising from the decision. Criminal sanctions could apply to Facebook’s officers. It was also noted that the draft decision would likely form the final views of the DPC regarding the lawfulness of the transfers.

In considering whether the DPC had an obligation to conduct an investigation before issuing the PDD, the court noted that the Data Protection Act 2018 conferred a wide discretion on the DPC to regulate its own procedures. The court held that the PDD was merely designed to commence the inquiry and notify Facebook on the preliminary views of the DPC on the issues in the case. As such, the court held that the DPC had not reached any final decision on the issues themselves. Further, the DPC was already in possession of a “vast amount” of information prior to beginning the inquiry. In light of all of this, it was fair for the DPC to begin the inquiry with the PDD.

The court then went on to consider whether the legitimate expectations of Facebook had been breached by the procedure adopted by the DPC. Facebook’s submissions were twofold: first, it was said that it was entitled to the procedures as set out by the DPC’s 2018 Annual Report and website information; second, it was said that it had to be treated similarly to other inquiries. Applying case law to the submissions, the court determined that the published information fell far short of providing legitimate expectations to Facebook, particularly as there were express qualifications that the procedures could be altered by the DPC. Further, it was held that tying the DPC to any particular procedure would be an unlawful interference with the discretion conferred on the DPC by the 2018 Act. (Glencar Exploration Plc v. Mayo County Council (No. 2) [2002] 1 IR 84; Cromane Seafoods Ltd v. Minister for Agriculture [2017] 1 IR 119; Garda Representative Association v. Minister for Public Expenditure and Reform [2018] IESC 4 considered).

The court held that the 21-day period given to Facebook to make submissions to the DPC was adequate, having regard to the heavy involvement of Facebook in the entire Schrems proceedings. Further, there was no reasoned request by Facebook for additional time to make the submissions. (Case C-349/07 Sopropé v. Fazenda Puplica [2008] ECR I-10369; C-277/11 MM v. Minister for Justice)

Mr Justice Barniville went on to hold that the PDD did not constitute a premature judgment by the DPC. The court said that the PDD was obviously a preliminary decision, rather than a final decision. There was nothing impermissible about placing an onus on Facebook to change the DPC’s views based on the PDD, the court said. Having regard to the entire background to the proceedings, it was fair for the DPC to structure the process as it did. (O’Callaghan v. Mahon [2008] 2 IR 514; A.P. v. McDonagh [2009] IEHC 316)

Other matters arising

The court also rejected Facebook’s contention that it was being treated unequally or in a discriminatory manner by the DPC. It was claimed that other data processors had not been subject to the same investigation by the DPC. The court stated that the focus on Facebook was obvious, asit arose out of Mr Schrems’ complaint in 2013. The PDD clearly set out why the DPC initiated the proceedings against Facebook and there was no obligation on the DPC to set out why it did not pursue other similar entities.

The final substantive issue dealt with by the court related to a claim that the DPC was in breach of its duty of candour by failing to answer questions raised in correspondence by Facebook. Although the court held that the DPC had not breached this duty in its defence of the High Court proceedings, the court determined that the DPC had adopted an “overly defensive” approach about issues raised by Facebook prior to the proceedings. Most of the issues raised by Facebook were potentially relevant to the case but the DPC undertook a “very rigid and inflexible approach.” The DPC was required to err on the side of caution when it came to providing adequate information as to its procedures, the court held (Garda Representative Association v. Minister for Public Expenditure and Reform [2018] IESC 4) and therefore should have answered Facebook’s questions prior to the proceedings.

However, the court also noted that Facebook had chosen not to seek discovery in the proceedings and did not pursue the issue in further correspondence. As such, there was no breach of candour in the case by the DPC.

However, the court criticised the DPC for making a specific pleading of abuse of process and improper purpose against Facebook. The allegation centred around a claim that Facebook were seeking to stall the DPC’s inquiry and that there was no legitimate basis for the case. This was only retracted on day three of the hearing. The court said that this was a “serious allegation” for which there was “no basis”. The case raised “weighty and difficult issues” that Facebook were entitled to pursue. The allegation “ought not to have been made” and should have been retracted much sooner, the court said. The court would hear further submissions on the consequences for making such an inappropriate allegation.

Conclusion

Overall, the court dismissed the judicial review proceedings and held that the DPC was entitled to issue the PDD. Further, the DPC’s proposed procedure was not unfair to Facebook on any ground. The court would have a further hearing to determine the issues of final orders and costs.