Facebook has been handed a comprehensive defeat in the High Court which could have implications for its operations.
The tech giant had taken a judicial review, heard last December, against Ireland’s Data Protection Commissioner Helen Dixon after she moved to implement the findings of the landmark Schrems II judgment from the Court of Justice of the EU (CJEU) last July.
Responding to the ruling, DPC deputy commissioner Graham Doyle said simply: “The DPC welcomes today’s judgement.”
In dismissing Facebook’s challenge, Justice David Barniville has potentially cleared the way for the DPC to shut down its system of transferring data across the Atlantic, which is core to its way of doing business.
The Schrems II ruling had found that Facebook’s method of transferring data to the US via a medium known as contractual clauses (SCCs) is potentially unlawful.
The case was first taken by Austrian privacy activist Max Schrems in 2013 on foot of the alleged breaches of his privacy by Facebook resulting from the accepted practice by American intelligence agencies of intercepting data entering their country.
This afternoon Justice Barniville, in a 197-page ruling, stated that he would “refuse all of the reliefs sought by Facebook Ireland and dismiss the claims made by it in the proceedings”.
He agreed that the DPC commencing an own-volition inquiry last August to give effect to the Schrems II judgement was indeed subject to judicial review (a process for testing the lawfulness of decisions given by State bodies), but that the company had failed on each of its grounds of challenge.
He said, however, that he had also “made certain comments” in his judgement regarding an allegation made, and subsequently withdrawn, by the DPC against Facebook of “abuse of process” and on the refusal by the DPC to provide certain information to the company during the proceedings.
He said it remains to be seen “what, if any consequences, should flow from these comments”.
The matter has been adjourned until next Thursday, giving the respective counsel for all concerned time to consider the lengthy judgement.
Mr Schrems, a frequent critic of the DPC’s allegedly overly-slow processes who had been joined as a notice party to the proceedings, said that the ruling means the DPC must now stop Facebook’s transfer of data into the US.
“Facebook lost on every ground,” Mr Schrems said.
“Its attempt to again delay the Irish decision bought them only a couple of months. After eight years, the DPC is now required to stop Facebook's EU-US data transfers, likely before summer.”
Facebook released a statement that made no mention of potentially appealing Justice Barniville’s judgement, but which rather suggested it is “looking forward” to defending itself against the DPC’s inquiry itself.
“Today's ruling was about the process the DPC followed,” a spokesperson said.
“The larger issue of how data can move around the world remains of significant importance to thousands of European and American businesses that connect customers, friends, family and employees across the Atlantic,” they said.
“Like other companies, we have followed European rules and rely on Standard Contractual Clauses, and appropriate data safeguards, to provide a global service and connect people, businesses and charities.”
“We look forward to defending our compliance to the IDPC, as their preliminary decision could be damaging not only to Facebook, but also to users and other businesses,” they added.