Ireland’s data protection commissioner (DPC) has said that ongoing publication of documents relating to its investigation of Facebook risks undermining the fairness of the process.
It was responding to criticisms by Austrian campaigner Max Schrems that the DPC is engaged in “procedural coercion” by warning him not to publish its case documents and letters.
Mr Schrems insists there is no legal impediment to publishing documents but the Irish DPC has asked Mr Schrems for an undertaking that he will not publish any more documents shared with him.
“The DPC can’t comply with its obligation to protect the confidentiality of material in its own hands, if it then passes that same material to a third party, without restriction, knowing or reasonably believing there is a strong likelihood the third party will publish it,” said the DPC in response to written questions from The Irish Times.
Complaint
After a decade of correspondence with Mr Schrems over various Facebook investigations, the current stand-off involves a 2018 complaint filed with Austria’s data protection authority (DPA) against Facebook. Under new EU data protection rules (GDPR), this was passed on to the Irish DPC as lead regulator.
While the complaint alleges that Facebook’s data collection policies breach GDPR, the social network says it adapted its legal arrangements for EU users to ensure compliance shortly before GDPR came into effect.
Last month, in a draft decision, the DPC largely agreed with Facebook but said it should have been more transparent with users on the changes made. It recommended an administrative fine of €28 million-€36 million and is now seeking submissions from other EU regulators as well as other parties before issuing a final decision.
After publishing case documents online, and refusing DPC requests to remove them, Mr Schrems has vowed to read the draft decision in a series of online video conferences to protest at what he sees as attempts to muzzle him.
Claim
The DPC denies this claim, insisting that the confidentiality it requires allows “free and frank exchanges” between all parties and the best possible outcome.
Guaranteeing confidentiality of materials when passed to third parties is one of its obligations as a statutory body.
“The Irish DPC is obliged to follow Irish fair procedures law as part of our decision-making process,” it said. “These fair procedures obligations have been confirmed on several occasions by the Irish courts, including the Supreme Court.”
It declined to say which case law it draws on to back its stance on confidential, arguing that the “open, public investigation process that appears to be advocated” by Max Schrems “isn’t something that is a feature of any regulatory decision-making process in Ireland, whether by the DPC or any other regulator”.
The DPC says the dispute will not endanger its investigation but that it may not share with Mr Schrems if he insists that “he may publish or use” them and retain “the right to change his position at his sole election and at any time of his choosing”.
