Last June the Irish Commercial Court admitted a case initiated by Data Protection Commissioner Helen Dixon against Facebook Ireland and Maximillian Schrems to its fast track and case managed commercial lists.
The commissioner is seeking legal clarity over three European Commission decisions dealing with the transfer of data to and from the United States under what have been termed standard contractual clauses – SCCs. The legal clarity sought could see the case being referred to the Court of Justice of the European Union should the High Court approve.
The case is scheduled to take three weeks. It is of major global importance as it will have consequences for the protection and transfers of Irish and EU citizens’ data and rights abroad and owing to the fact that an unprecedented number of international intervener amici or friends of the court were admitted to assist the court with its deliberations, including the US government.
The Facebook litigation follows on from a successful case brought by Austrian lawyer Max Schrems in 2013 challenging the transfer of personal data to the US via what was known as Safe Harbour regime.
Automated behaviours
The Safe Harbour regime had been operating relatively undisturbed until Schrems took issue with certain automated behaviours he had experienced concerning the operation of his Facebook account and the data that he and other users had chosen to place on Facebook. Those complaints were raised with the Data Protection Commissioner and ultimately ended up before the Court of Justice of the European Union following on from a detailed ruling handed down by
Mr Justice Hogan
in the High Court.
On October 6th, 2015, the Court of Justice of the European Union ruled that the Safe Harbour regime breached article 47 of the charter of fundamental rights, which provides for the right to an effective remedy under the law and a fair trial and was therefore invalid.
The most critical aspect of that case was the finding that US law provided almost no protection to European citizens against state surveillance. By being permitted to take part in the current Facebook litigation as an amicus or friend of the court, the US government seeks the opportunity to claim before the Irish court that its law has been potentially misrepresented.
Privacy laws
The US government’s position will hopefully be counterbalanced by the admission to the High Court as amici of EPIC the US Electronic Privacy Information Center, a US advocacy group familiar with the operation of US and EU privacy laws. The remaining amici are business and privacy rights advocacy groups.
The US government has persistently argued that European criticisms had been addressed by reforms following the Edward Snowden and PRISM data and phone-tapping revelations, particularly by providing new remedies for "non-US persons".
Commercial motives appear to be at the core of the US response – the profitability of technology companies being threatened by rules that require data to be stored within Europe or with strictures designed to protect European citizens' rights.
Online dating
An example of why this matters to Irish people comes from one of the most newsworthy data breaches in recent times was connected to the Canadian online dating website
Ashley Madison
. The data breach that occurred resulted in the publication and disclosure of countless personal details of Irish users who in many instances were either seeking a relationship or engaging in extra-relationship activities.
While on its face such a data breach is a criminal and serious act, the repercussions for users are very obvious and significant. The mechanisms available to users to vindicate their rights are less obvious, particularly if the subject of a data breach has been storing their data outside the jurisdiction and outside the European Union without the necessary safeguards in place to protect users.
Facebook alone has in excess of 1.86 billion active users. So the significance of the Facebook litigation should not be underestimated. It will review real data, real rights and real judges and is being carefully scrutinised by all of the internet giants located in Ireland and those considering locating in Ireland. All of whom will pay heed to how Irish law affects the privacy of Irish users and users worldwide.
Ireland will remain in the maelstrom of the debate about principles of privacy and territoriality to a borderless and nascent internet for some time to come. Our courts will remain in the invidious and perhaps accidental position of having to take a central and continued role in the global debate on online privacy and surveillance.
Ronan Lupton is a barrister