October 12, 2017

Mr Schrems complained to the Data Protection Commissioner (DPC) in Ireland about the transfer of his personal data by Facebook Ireland Ltd outside the EU to Facebook Inc in the USA for further processing. Mr Schrems argued that the regime in the USA did not afford his personal data the protection to which he was entitled under European law.

Facebook told the DPC that the transfer of Mr Schrems data outside the EEA to Facebook in the US was authorised on the basis of standard contractual clauses (SCC) pursuant to European Commission Decision 2010/87/EU.

The DPC decided that there were well-founded concerns that there was no effective remedy in US law compatible with the requirements of Article 47 of the Charter of Fundamental Rights for an EU citizen whose data are transferred to the US where the data may be at risk of being accessed and processed by US state agencies for national security purposes in a way that was incompatible with Articles 7 and 8 of the Charter. The safeguards purportedly constituted by the SCC did not address this objection, the DPC found.

The DPC sought a ruling on the validity of the Commission Decision and asked the Irish courts to make a preliminary reference to the CJEU.

The Irish High Court agreed with the DPC that there were well-founded concerns over whether there was an effective remedy in US law compatible with the requirements of Article 47 of the Charter and a decision of the CJEU was required to determine the matter. (The Data Protection Commissioner v Facebook Ireland Ltd (2016 No. 4809 P) — to access the executive summary of the judgment and the full judgment, click here.