Europe’s highest court will give its first indication this week in how it will rule in a landmark case that may determine how the data of EU citizens held by US firms is protected.
Ireland could play a central role in any eventual treatment of such data as the European Court of Justice could clear the way for the Data Protection Commissioner to investigate the issue in detail.
On Thursday, an advocate general of the court will deliver an opinion on the case taken by an Austrian law student, Maximilian Schrems, against the data protection commissioner.
Mr Schrems, a Facebook user since 2008, has single-handedly mounted an international campaign against the social media giant over its data protection protocols.
Facebook users in Europe enter an agreement with Facebook Ireland when they join the social network. However, some or all of their personal data is transferred to the US and held on servers physically located in the US.
In light of the revelations which emerged from May 2013 onwards from the US whistleblower, Edward Snowden, about how the US National Security Agency monitors telecommunications, Mr Schrems began his action against the data protection commissioner.
Mr Schrems founded the advocacy group Europe V Facebook. He complained to the then commissioner, Billy Hawkes, that there was no meaningful protection against US state surveillance of such transferred data in US law and practice based on Snowden’s revelations.
However, Mr Hawkes rejected the complaint on the basis that the European Commission had examined the situation in 2000 and declared itself satisfied that Safe Harbour — the way companies treat EU citizens’ data in the US — ensured “an adequate level of [data] protection”. The Safe Harbour regime allows US firms to self-certify that they meet EU data protection rules.
Because it was an issue on which Brussels had already issued guidance, the data protection commissioner dismissed Mr Schrems’s complaint as frivolous and vexatious.
The High Court referred the current case to the European Court of Justice after Mr Schrems sought a judicial review of Mr Hawkes’s refusal to examine his complaint.
Mr Schrems also asked the data protection commissioner to exercise his statutory power to direct Facebook Ireland to cease the transfer of personal data of its users to its parent company in the US.
In turn, the High Court asked the court whether the data protection commissioner is absolutely bound by the Safe Harbour decision in light of the fact that it is claimed that US laws and practises do not contain adequate data protection.
Alternatively, the court has been asked if the data protection commissioner may conduct his own investigation because of factual developments on data protection since the Safe Harbour decision was first published 15 years ago.
At least 12 parties, including seven EU member states, the European Commission and European Parliament, as well as the campaign group, Digital Rights Ireland, have made written submissions to the court in Luxembourg.
Although the advocate general’s opinion is non-binding, it does inform the thinking of the court and such opinions are followed in around 80% of cases.
© Irish Examiner Ltd. All rights reserved