‘Shut down your Facebook page to avoid US scrutiny’

Anybody who does not want their Facebook information collected by US intelligence agencies should shut down their page. Such was the evidence given to the European Court of Justice.

The Irish Data Protection Commissioner was in the dock over the refusal to investigate a complaint from an Austrian law student that the transfer of information by Facebook to the US was a breach of his privacy rights.

The commissioner described the legal arguments as “frivolous and vexatious” and said that since the transfer of data between the EU and the US was subject to a 1999 treaty known as Safe Harbour to which he was bound, he was not in a position to deal with the complaint.

However, Max Schrems, who made the complaint, said the treaty and the fact that his personal data was being given to US agencies was a violation of his rights under the European Charter of Fundamental rights.

Mr Schrems, with crowdfunding of €60,000 from 2,000 donors, took his case to the Irish courts that referred it to the highest EU court for a decision.

Under the Safe Harbour agreement, US companies can self-certify that the data is assured of “adequate protection” according to the EU Data Protection Directive.

However, many rights’ advocates, and the European Parliament especially following the Snowden revelations, said it was obvious that Safe Harbour provided no safety. The Irish court did not disagree that “mass surveillance” of data in the US was a fact, and the European Commission agreed that US law trumped Safe Harbour every time.

Mr Schrems was supported by the European Parliament and other countries including his native Austria at yesterday’s court hearing in Luxembourg.

The parliament called for Safe Harbour to be scrapped after the NSA Prism spy scandal and after hearing evidence that many of the companies that advertised themselves as being part of Safe Harbour, in fact were not.

The Prism programme allowed a wide range of US agencies to access data, including content, being stored on servers in the US, and did not allow non-US citizens to challenge this.

If the court strikes down Safe Harbour, companies could still apply to transfer data under other clauses of the current Data Protection Directive. The case comes at a particularly sensitive time as the EU is revising its data protection rules.

Ireland, which has 29 of the world’s 30 largest IT companies based here, insists the national data commissioner is well placed to take care of any investigations.

However, other countries, including Germany, believe Ireland is too close to the US companies and say any country may appeal decisions. Mr Schrems was represented by a team of mostly Irish lawyers that included senior counsel Noel Travers, barrister Paul O’Shea and solicitor Gerard Rudden.

The court will issue a legal opinion on June 24. This opinion from the court’s advocate general will not necessarily be followed by the judges in their final decision some months later, but in 80% of cases, it is the same.