Privacy activist Schrems challenges DPC probe of Facebook EU-US data transfers
Privacy and data rights activist Max Schrems has brought a High Court challenge in Dublin aimed at halting the Data Protection Commissioner’s probe into Facebook Ireland’s transfer of data to its US-based parent.
Mr Schrems has brought judicial review proceedings because of his real and immediate concerns that the DPC is engaged in a process that will have an effect on the investigation and outcome of a complaint he made several years ago to the DPC about Facebook’s handling of his personal data.
He believes that the DPC’s probe will exclude him from a process which he has been engaged in for several years.
In late August, the DPC informed Facebook Ireland, which is the EU HQ of Facebook and Instagram platforms, that it has made a preliminary draft decision that personal data should not be transferred out of the EU to its American parent, Facebook Inc.
This was because the data transfers were made in circumstances which fail to guarantee a level of protection to data subjects equivalent to those provided for in EU law.
The DPC then invited Facebook to make submissions on its preliminary decision.
The DPC’s decision to open an inquiry is the subject of a separate High Court challenge by Facebook.
The DPC opened the inquiry, at its own volition, following a judgment from the Court of Justice of the European Union handed down last July.
However, in proceedings that came before the High Court yesterday, Mr Schrems says his earlier complaint about the data transfers, which lead to the proceedings in the Irish and European courts, has not been completed by the DPC.
His original complaint about the transfer of his personal data was made to the DPC in 2013 and was reformulated in 2015.
Mr Schrems, an Austrian national based in Vienna, claims the own volition inquiry has had the effect of suspending the DPC’s investigation into his complaints, and breaches his rights to be heard.
He also claims that the DPC’s own volition inquiry would fail to examine certain bases upon which Facebook is trying to rely on to legitimise EU-US data transfers.
In his action against the DPC, Mr Schrems, represented by Eoin McCullough SC and James Doherty SC, seeks an order quashing the DPC’s decision to open an own volition inquiry into Facebook’s transfer of data.
He also seeks an order directing the DPC to complete the investigation of his complaint with all due diligence and speed.
He further seeks various declarations from the court including that any inquiry into the issues including in the DPC’s own volition inquiry must be conducted as part of a complaint-based inquiry.
Mr McCullough told the court that it is Mr Schrems’ case that the DPC has failed to give adequate reasons for her decision to open an own volition inquiry rather than a complaint-based inquiry.
Counsel added that the DPC has acted in breach of Mr Schrems’ rights to fair procedures by refusing to provide him with copi9es of documents submitted by or sent to Facebook in the context of his original complaint.
Permission to bring the challenge was granted, on an ex parte basis, by Mr Justice Anthony Barr.
The judge, who also put a stay on the DPC’s investigation from continuing pending further order of the court, adjourned the matter to a date in December.