Facebook privacy claim to be probed

The privacy campaigner who successfully challenged a treaty which allowed the data of millions of European citizens be transferred to the US has warned he may take more cases.

Max Schrems is to have his ground-breaking complaint over the alleged movement of personal information by Facebook investigated by Ireland’s online watchdog after a near three-year fight. And as the High Court in Dublin cleared the way for the audit, the Austrian law student said he was considering other challenges to tech giants involved in cloud services.

“There are certain companies where we know they are involved in mass surveillance because of the Snowden leaks, and I think that’s the companies you should take a look at,” said Mr Schrems.

His long-running legal battle over the Safe Harbour treaty was sparked by Edward Snowden’s revelations over the US National Security Agency (NSA) Prism surveillance system, which allowed spies to access enormous amounts of data from global tech companies.

It culminated in the European Court of Justice (ECJ) ruling earlier this month that the agreement was invalid and did not give citizens adequate protection, sparking chaos in diplomatic channels in Washington and Brussels.

Talks have been going on for two years over a replacement treaty. There have also been claims in business and e-commerce circles that the end of Safe Harbour will cause massive disruption for businesses trading across the Atlantic.

Ireland’s Data Protection Commission oversees the practices of Facebook Ireland, which every user outside of the US and Canada has a contract with, but the watchdog turned down Mr Schrems’s claims for an inquiry into how it handled his personal data.

The latest hurdle blocking the inquiry was cleared in the High Court in Dublin after it quashed the commissioner’s original refusal to examine the complaint after referring the case to the ECJ.

Judge Gerard Hogan said the initial decision by the watchdog had been premised on the validity of the Safe Harbour agreement.

“The commissioner is obliged now to investigate the complaint... and I’ve absolutely no doubt that she will proceed to do so,” he said.

Judge Hogan said Mr Schrems’s landmark challenge over data transfer was possibly the most important ruling of the ECJ in years and that it “transcended international law”.

The campaigner said watchdogs in 28 European states will now be able to accept complaints about the movement of personal data.

Mr Schrems added: “It’s a procedure you start but you get into it step by step, you didn’t plan it to be this big thing but you think, there is actually the problem, and you poke and see what’s happening and it’s good if things get poked up all the way and solved in the end.”

Facebook reiterated it does not give the US government direct access to its servers: “We will respond to inquiries from the Irish Data Protection Commission as they examine the protections for the transfer of personal data under applicable law,” a spokesman for the social media giant said. Facebook also insists it does not recognise Prism and that it adopts rigorous processes when governments seek data.

Ireland’s Data Protection Commissioner, Helen Dixon, said: “I welcome today’s ruling from Judge Hogan which brings these proceedings to a conclusion. My office will now proceed to investigate the substance of the complaint with all due diligence.”

Mr Schrems has also been awarded costs for his legal bill and travel expenses. He said he was happy with the outcome. “The big question is going to be if the Irish Data Protection Commissioner is going to do its job,” he said.