Judge seeks ECJ ruling on US data transfers
Referral arises from case taken by Austrian privacy activist Schrems Facebook’s transfer of European users’ data to US comes under the spotlight
Legal uncertainty surrounds the capacity of companies such as Facebook to transfer European users’ data to the US after a High Court judge asked the most senior EU court to consider 11 questions on the issue.
The referral stems from a case taken by Austrian privacy activist Max Schrems.
The questions raise significant issues of EU law with huge implications, including whether the High Court has correctly found there is “mass indiscriminate processing” of data by US government agencies under the Prism and Upstream programmes authorised there.
The questions also ask whether EU law applies to the processing of personal data for national security purposes regardless of whether that data processing takes place in the EU or US or a third country. Other questions concern whether the Privacy Shield Decision and other measures in the US afford adequate protection for EU citizens whose data is transferred there.
The ECJ is also asked to decide the extent of a data protection authority’s (DAA) power to suspend data flows if it considers a third country is subject to surveillance laws which conflict with EU law. After Ms Justice Caroline Costello set out the questions yesterday in a formal request to the ECJ for a preliminary ruling, Paul Gallagher SC, for Facebook, asked for time to consider that in the context of possibly seeking an appeal against the judge’s decision to make a reference to the CJEU .
Michael Collins SC, for the Data Protection Commissioner (DPC), queried whether there was any entitlement to appeal a High Court decision to direct a reference but did not object to Facebook being given a short time to consider its approach.
The judge, noting she had given judgment last October sanctioning a reference, said she was anxious to make the referral but would allow Facebook time to April 30th.
Among the questions for reference include whether, when deciding if data privacy rights of an EU citizen are breached, the issue must be examined against the EU Charter and EU law or the national law of one or more EU states, or an amalgam of the laws of all member states.
The High Court had found the appropriate comparator was EU law despite Facebook disputing that. The ECJ is also asked to decide, given findings by the Irish court concerning US law, whether personal data transferred from the EU to the US under the EC decisions violates the EU Charter.