High Court told of 'devastating consequences' for Facebook if commissioner decision stands

Facebook is seeking to quash the Data Protection Commissioner's decision that transfers to the US be suspended and to her decision to conduct an inquiry.

There are 410 million Facebook and Instagram users in Europe, an estimated 25 million of them are business users, the court heard. File picture: Pexels

Data Protection Commissioner (DPC) Helen Dixon's "preliminary draft decision" to conduct an inquiry into and suspend data transfers by Facebook Ireland to the US will have "devastating" consequences for the social media giant's business if it is allowed to stand, the High Court has heard.

In 2018, some US€228 billion was generated through the use of Facebook services, which include Instagram, Paul Sreenan SC for Facebook said.

There are 410 million Facebook and Instagram users in Europe, an estimated 25 million of them are business users, he said.

If data transfers are stopped, it will also affect "multiples of billions" which Facebook attracts in advertising, he said.

"It will have devastating consequences for the plaintiff's business", he said.

He was speaking on the opening of Facebook's action seeking to quash the DPC's decision that transfers to the US be suspended and to her decision to conduct an inquiry. The probe has been stayed pending the outcome of this case.

The case originally stems from challenges to DPC decisions by Austrian privacy and data rights activist, Max Schrems, who is a notice party.

Facebook claims it was denied fair procedures and an opportunity to be heard.

Facebook, which wants the court to halt the DPC's probe into those transfers, claims there was a failure by the DPC to conduct an inquiry before it reached its draft decision and prejudged or prematurely judged the matter. It also claims the DPC took irrelevant matters into account and has not afforded Facebook fair procedures.

The DPC denies the claims.

The DPC move last August came after a July judgment at the European Court of Justice (ECJ) in relation to EU-US data transfers, a case which arose out of a second Max Schrems' legal challenge.

Mr Sreenan said in August the DPC decided to commence a statutory inquiry into the lawfulness of Facebook’s transfers of personal data relating to millions of its EU users from the EU to the United States.

That inquiry, announced in the preliminary draft decision, is under the Data Protection Act, 2018, and by reference to relevant provisions of the General Data Protection Regulations (GDPR). The DPC claims data transfer methods used by Facebook fail to guarantee a level of protection to data subjects equivalent to those provided for in EU law.

GDPR regulations require that the transfer of personal data outside of the EU is prohibited unless certain limited circumstances apply using certain methods.

The July ECJ decision made rulings in relation to two of those methods. One, called the "Privacy Shield" - allowing transfers to US firms with adequate personal data protections - which the ECJ said was valid.

In relation to a second method, called Standard Contractual Clauses (SCC) - allowing data controllers to transfer data outside of the EU under a standard contract with counterparts in the US - the ECJ said a regulator must take a proactive role in ensuring there is compliance in this method.

As a result, the DPC launched the inquiry.

Mr Sreenan said in doing so the DPC formed a preliminary draft decision as to infringement and possible sanctions despite Facebook's legitimate expectation and right to be properly consulted before that would happen.

The DPC had, in its decision, given Facebook just 21 days to respond to the decision which was too little time for it to properly do so for something that could have "potentially catastrophic consequences" for its users and the business itself, he said.

The DPC had repeated many times in the written decision that she had not made up her mind but it was done in such a way that as though someone had gone through it to "lawyer it up or boilerplate it", he said.

When Mr Justice David Barniville said this claim had not been made by Facebook in its court papers and was something of an "extravagant submission", Mr Sreenan said he supposed it was somewhat extravagant but it was an indication of his client's surprise at the approach taken by the DPC.

Asked by the judge why he thought the DPC took the approach she did, counsel said he was not able to answer that despite Facebook having asked why.

It gave rise to the apprehension that the DPC was not approaching the matter with an open mind and that there was no investigation at all before it was made.

Counsel also said it was a flawed process, a flawed approach and noted the singling out of Facebook compared to its competitors.

The case continues.