Data Protection Commission hit with massive legal bill after Facebook privacy case

The DPC must now pay the legal costs of Austrian data protection activist Max Schrems, which are likely to exceed €2m. File Picture: Alex Halada

The Data Protection Commission must pay the legal costs of Austrian privacy activist Max Schrems regarding a landmark EU ruling concerning Facebook, with the final bill likely to total in excess of €2m.

Such a bill would amount to in excess of 10% of the DPC’s entire annual budget.

Today’s High Court decision by Justice Caroline Costello ruled that Mr Schrems is entitled to all costs from the DPC stemming from the action, including those which saw the original complaint referred to the Court of Justice of the European Union (CJEU), with the exception of three days given over to hearing an appeal by Facebook to the High Court.

The DPC’s own legal bills for the prolonged action, which stretches back to Mr Schrems' initial complaint in 2013, are in the region of €3m.

Several sources have suggested that though Mr Schrems’ costs are difficult to quantify, given that they will have to be adjudicated upon, they are unlikely to total less than €2m and may be substantially higher than that figure.

The DPC has been contacted for comment with regard to today’s decision.

The case was an unusual one in that Mr Schrems' initial complaint was made to the DPC itself, which then referred the suit to the High Court, and then onto Europe, with Mr Schrems and Facebook listed as the defendants.

That case culminated in a decision by the CJEU in July 2020 which, amongst many, highly significant outcomes saw the Privacy Shield in place between the US and EU for data transfers eliminated, a decision which is likely to have a highly damaging effect on Facebook’s business model.

The action originated with Mr Schrems’ objection to how Facebook shared data with the US given the known surveillance carried out on such communications by the American government’s intelligence agencies.

The DPC’s decision to refer the case to the High Court in 2016, with the stated intention of seeking "clarity" as to how the elimination of Privacy Shield’s predecessor, Safe Harbor, could be circumvented by the likes of Facebook using Standard Contractual Clauses (SCCs) to exchange data, was a highly controversial one given the inevitable lengthy duration of the resulting case and the costs involved.

Speaking in the aftermath of this morning’s decision, Mr Schrems claimed ultimate vindication in seeing his costs awarded to him at the DPC’s expense.

“I filed a short complaint and suddenly I was named as defendant in an extremely complicated case that was to a large part not necessary in my view,” he said.

“Our arguments ultimately succeeded at the European level. The DPC now has to pick up the legal bill for this case, other than three days that Facebook needs to pay.” 

He said that the costs would not cover his own unpaid work, but rather the sustained level of senior legal representation he had retained for five years.

“The costs that we now seek are the external costs for the necessary legal representation by solicitors and barristers in Ireland that had to deal with five years of court hearings and more than 45,000 pages of documents,” he said. 

“Instead of making a decision already in 2015 the DPC has invested millions into a case that has delayed the procedure for five years and that they have ultimately lost.

 “The Irish taxpayer now has to pick up parts of the bill for this exercise."