Facebook loses challenge to data regulator inquiry

The Data Protection Commissioner can proceed with an inquiry that could lead to a ban on Facebook's data transfers from the European Union to the United States, the High Court has ruled.

The DPC launched an inquiry in August and issued a provisional order that the mechanism Facebook uses to transfer EU user data to the United States "cannot in practice be used".

Facebook had challenged both the inquiry and the Preliminary Draft Decision (PDD), saying they threatened "devastating" and "irreversible" consequences for its business, which relies on processing user data to serve targeted online ads.

The High Court has rejected the challenge.

"I refuse all of the reliefs sought by FBI (Facebook Ireland) and dismiss the claims made by it in the proceedings,"the court said in a judgment.

"FBI has not established any basis for impugning the DPC decision or the PDD or the procedures for the inquiry adopted by the DPC," the judgment said.

In his 197 page judgment dismissing the case, Mr Justice David Barniville rejected claims by Facebook that the DPC was in breach of its duty of candour in how the case was defended. However, the DPC should have answered certain questions raised on behalf of Facebook in correspondence of October 29th 2020, he said.

Austrian privacy activist Max Schrems, who was instrumental in forcing the data regulator to initiate the inquiry, said he believed the decision made it inevitable that Facebook's data flows would be halted.

"After eight years, the DPC is now required to stop Facebook's EU-US data transfers, likely before summer," Mr Schrems said in a statement.

Facebook said it looked forward to defending its compliance to the Data Protection Commission.

In a statement, it said the DPC's preliminary decision could be damaging not only to Facebook, but also to users and other businesses.

"Today's ruling was about the process the IDPC followed. The larger issue of how data can move around the world remains of significant importance to thousands of European and American businesses that connect customers, friends, family and employees across the Atlantic," a company spokesperson said.

"Like other companies, we have followed European rules and rely on Standard Contractual Clauses, and appropriate data safeguards, to provide a global service and connect people, businesses and charities."

Facebook took its proceedings last August after the DPC, Ireland's supervisory authority for data protection rights, informed Facebook Ireland, the EU HQ of Facebook and Instagram platforms, of her preliminary draft decision that personal data should not be transferred out of the EU to its American parent Facebook Inc.

The DPC said the data transfers were made in circumstances which fail to guarantee a level of protection to data subjects equivalent to those provided for in EU law.

The DPC opened the inquiry following a judgment from the Court of Justice of the European Union handed down last July.

Commenting on the case, the American Chamber of Commerce in Ireland said the flow of international data transfers were critically important for Irish and EU business activity, as well as for facilitating trade within the digital economy.

"This judgment shows the importance of finding a replacement for the US-EU Privacy Shield, which was struck down in the European Courts and was relied on by firms, including SMEs within the EU for data transfers," it said in a statement.

"It is of upmost important that both the EU and the US prioritise the negotiation of a new agreement to create a framework which both protects data privacy rights and allows businesses to have certainty for their international data transfers."

The Chamber said businesses in the EU could not afford to face trade disruptions or further business uncertainty, especially as economies recover from the pandemic.

Ibec said the situation since the European court ruling on the Schrems II case last July has created uncertainty for thousands of firms who rely on legitimate safeguards to enable secure international data transfers.

‘’Ireland should use its unique position as a bridge between the EU and the US to try and expedite attempts to negotiate a new and lasting data transfer agreement," said Erik O'Donovan, Senior Digital Policy Executive at Ibec.

"We encourage the EU and US authorities to swiftly conclude ongoing work to ensure a revised and resilient framework for EU-US data exchange, addressing privacy issues as well as the needs of modern digitalised business.’’