The Supreme Court has dismissed Facebook's appeal over a High Court decision to refer key issues concerning the validity of European Commission decisions approving EU-US data transfer channels to the Court of Justice of the EU.
The referral was made by the High Court in proceedings by the Data Protection Commissioner (DPC) arising from complaints by Austrian lawyer Max Schrems the transfer of his personal data by Facebook to the US breached his data privacy rights as an EU citizen.
The core issue the Supreme Court had to decide in Facebook’s appeal is whether there is any actual right to appeal over a referral decision.
Today, the five-judge court said, while the court can, with significant limitations, entertain an appeal over a High Court decision which includes a referral, the court cannot entertain an appeal over the actual referral decision itself.
The court cannot entertain an appeal against the High Court decision to make a reference or against the terms of reference, the Chief Justice, Mr Justice Frank Clarke, said.
It is for the referring court, and that court alone, to decide whether to make a reference and whether to amend or withdraw that, he said.
He was however satisfied the court could entertain an appeal against the facts found by the High Court and should overturn those if it can be established they are not sustainable in accordance with the relevant Irish jurisprudence.
However, in this case, Facebook’s criticisms related to the “proper characterisation” of underlying facts rather than the facts themselves, he said.
Established
If there had been any actual finding of facts not sustainable on the evidence before the High Court in accordance with Irish procedural law, he would have overturned it but no such matter had been established on this appeal, he ruled.
In those circumstances, the court would not make any order overturning any aspect of the High Court judgment.
Facebook's appeal concerns an October 2017 High Court judgment by Ms Justice Caroline Costello and her subsequent referral in May 2018 of issues for determination by the CJEU.
The judgment was given in a case brought by DPC Helen Dixon, arising from the complaints by Mr Schrems, against Facebook Ireland – because Facebook’s European headquarters are here – and Mr Schrems.
No formal orders were sought against them and the core issue concerned the validity of data transfer channels known as Standard Contractual Clauses (SCCs).
Ms Justice Costello directed a referral to the CJEU of 11 issues concerning the validity of European Commission decisions approving the SCCs.
Facebook argued before the Supreme Court last January it is entitled to appeal the referral.
It also disputed several of the High Court’s findings, including that the DPC had “well founded” concerns about “mass indiscriminate processing” of data by US government agencies under programmes authorised there.
The US government was involved in the appeal as an amicus curiae, assistant to the court on legal issues.
Level of protection
It supported Facebook’s argument that no reference to the CJEU is required in light of the Privacy Shield agreement between the EU and US and the European Commission’s determination the US ensures an adequate level of protection for personal data transferred under the Privacy Shield.
Lawyers for the DPC said she has concerns whether the measures provided for under the Privacy Shield are comparable to the remedy available to EU citizens for breach of data privacy rights under article 47 of the EU Charter.
Mr Schrems opposed the appeal with his lawyers arguing Facebook had failed to identify an error by the High Court.
