The privacy campaigner who successfully challenged a treaty which allowed the data of millions of European citizens to be transferred to the US has warned he may take more cases.
Max Schrems is to have his ground-breaking complaint over the alleged movement of personal information by Facebook investigated by Ireland’s online watchdog after a near three-year fight.
And as the High Court in Dublin cleared the way for the audit, the Austrian law student said he was considering other challenges to tech giants involved in cloud services.
“There are certain companies where we know they are involved in mass surveillance because of the Snowden leaks, and I think that’s the companies you should take a look at,” Mr Schrems said.
His long-running legal battle over the Safe Harbour treaty was sparked by Edward Snowden’s revelations over the US National Security Agency (NSA) Prism surveillance system, which allowed spies to access enormous amounts of data from global tech companies.
It culminated in the European Court of Justice (ECJ) ruling earlier this month that the agreement was invalid and did not give citizens adequate protection, sparking chaos in diplomatic channels in Washington and Brussels.
Talks have been going on for two years over a replacement treaty.
There have also been claims in business and e-commerce circles that the end of Safe Harbour will cause massive disruption for businesses trading across the Atlantic.
The Data Protection Commission oversees the practices of Facebook Ireland, which every user outside of the US and Canada has a contract with, but the watchdog turned down Mr Schrems’s claims for an inquiry into how it handled his personal data.
The latest hurdle blocking the inquiry was cleared in the High Court after it quashed the commissioner’s original refusal to examine the complaint after referring the case to the ECJ.
Judge Gerard Hogan said the initial decision by the watchdog had been premised on the validity of the Safe Harbour agreement.
“The commissioner is obliged now to investigate the complaint ... and I’ve absolutely no doubt that she will proceed to do so,” he said.
Judge Hogan said Mr Schrems’s landmark challenge over data transfer was possibly the most important ruling of the ECJ in years and that it “transcended international law”.
The campaigner said watchdogs in 28 European states will now be able to accept complaints about the movement of personal information.
Mr Schrems added: “It’s a procedure you start but you get into it step by step, you didn’t plan it to be this big thing but you think, there is actually the problem, and you poke and see what’s happening and it’s good if things get poked up all the way and solved in the end.”
Facebook reiterated it does not give the US government direct access to its servers.
“We will respond to inquiries from the Irish Data Protection Commission as they examine the protections for the transfer of personal data under applicable law,” a spokesman for the social media giant said.
Facebook also insists it does not recognise Prism and that it adopts rigorous processes when governments seek data.
Data Protection Commissioner Helen Dixon said: “I welcome today’s ruling from Judge Hogan which brings these proceedings to a conclusion. My office will now proceed to investigate the substance of the complaint with all due diligence.”
Mr Schrems said he was happy with the outcome.
“The big question is going to be if the Irish Data Protection Commissioner is going to do its job,” he said.
“They pledged that they will really investigate things swiftly. My last experience was that a complaint takes up to three years and nothing comes out of it but they now pledge the opposite and I hope that’s going to be the case.”
Mr Schrems warned it would be very hard for European and US authorities to create a Safe Harbour II based on the ECJ ruling.
“I think for the US on the one hand they would have to turn down their surveillance state and the only thing they would get is a little easier access to the European market,” he said.
“I doubt it is going to be possible to get a second Safe Harbour that also withstands another challenge at the ECJ ... the court has been very clear a new Safe Harbour would have to give you the same rights as you have in Europe. That’s going to be hard to get a deal on.”
Mr Schrems has also been awarded costs for his legal bill and travel expenses.
During the court hearing, judge Hogan was told relations between Mr Schrems and the data watchdog were strained.
Noel Travers, senior counsel for Mr Schrems, said: “The investigation should be conducted with all due speed.
“The transfers of data are still going on two-and-a-half years later.”
The barrister warned of the risk that the audit would put on the long finger and added: “The level of trust between the Data Protection Commission and their client is not very high judge.”