Facebook loses challenge over DPC’s draft decision to suspend data transfers to US

A High Court judge has dismissed Facebook’s challenge over the Data Protection Commissioner’s (DPC) draft decision to inquire into, and to suspend, data transfers by Facebook Ireland to the US.

Mr Justice David Barniville ruled on Friday that Facebook had not established any basis for impugning the Commissioner’s decision to commence the inquiry or her preliminary draft decision on the suspension.

Final orders will not be made until the sides have considered the judgment and a stay continues on the disputed decisions.

In his 197 page judgment dismissing the case, the judge rejected claims by Facebook that the DPC was in breach of its duty of candour in how the case was defended. However, the DPC should have answered certain questions raised on behalf of Facebook in correspondence of October 29th, 2020, he said.

He said there was “no basis” for an allegation made by the DPC, but withdrawn during the course of the hearing before him, that the Facebook proceedings amounted to an abuse of process or were brought for an improper purpose.

There was a proper purpose for bringing the case, in that Facebook was seeking to enforce and vindicate what it believed to be its rights and restraining what it believed were unlawful actions by the Commissioner, he said.

The allegation of abuse of process/improper purpose should not have been made and, having been made, should have been withdrawn much sooner than it was, he added.

Max Schrems

A separate action by privacy and data rights activist Max Schrems which was also aimed at halting the DPC probe, although for very different reasons, was previously resolved apart from costs and other issues to be addressed followed the Facebook judgment.

Mr Schrems was concerned the DPC was engaged in a process that might affect the investigation and outcome of his own complaints about Facebook’s handling of his personal data. The resolution of his proceedings over the DPC’s own volition inquiry was reached earlier this year on the basis of an agreement concerning how his complaint, originally made in 2013 and reformulated in 2015, will be addressed.

Facebook took its proceedings last August after the DPC, Ireland’s supervisory authority for data protection rights, informed Facebook Ireland, the EU HQ of Facebook and Instagram platforms, of her preliminary draft decision that personal data should not be transferred out of the EU to its American parent Facebook Inc.

The DPC said the data transfers were made in circumstances which fail to guarantee a level of protection to data subjects equivalent to those provided for in EU law.

The DPC opened the inquiry following a judgment from the Court of Justice of the European Union handed down last July.