In what it considered “an unusual case” (available here), the Irish High Court has referred the issue of the way data is transferred between the EU and countries outside the EU to the Court of Justice of the European Union (“CJEU”). Ms. Justice Caroline Costello will ask the CJEU for a preliminary ruling on the validity of the Standard Contractual Clauses (“SCCs”) as an adequate data transfer mechanism. Justice Costello did not comment on the laws of the EU or the US, but rather on the validity of SCCs as a data transfer measure between the EU and the US.
The case arose from a complaint received from Mr. Max Schrems, and further pursued by the Irish Data Protection Commissioner, claiming that the transfer of EU personal data by Facebook’s European Headquarters in Ireland to it US parent company breaches EU data protection rules. Mr. Schrems claimed that the legal regime in the United States does not afford his personal data the protection to which he is entitled under European law.
Justice Costello found that the Irish Data Protection Commissioner had raised well founded concerns that there was an absence of an effective remedy in US law compatible with the Charter of Fundamental Rights of the European Union (“Charter”), for EU citizens whose data is transferred to the US and may be accessed and processed by US state agencies. Justice Costello mentioned that EU law guarantees a high level of protection to EU citizens regarding the processing of their personal data in the EU, and that an equivalent level of protection is required when this data is transferred abroad. To enforce such protection, EU citizens have a right to an effective remedy before an independent tribunal, as provided by the Charter. These rights, Justice Costello mentioned, may be limited depending on the circumstances, but must be in principle respected. Limitations must be necessary and genuinely meet objectives of general interest recognized by the Union or the need to protect the rights and freedoms of others.
The High Court found that the US’s proposal to appoint an ombudsman that oversees the EU-US Privacy Shield Framework does not eliminate the above-mentioned concerns. Therefore, the CJEU should decide on whether such measures amount to an effective remedy and to a fair trial. This is more so important to ensure consistency and uniformity in the application of data protection rules across the European Union. Otherwise, individual national supervisory authorities could use their independent discretion on a case by case basis.
CJEU must also decide whether suspending or banning the transfer of data to a data importer in a third country on the basis of the legal regime of that country, as currently enshrined in the Data Protection Directive as an exceptional measure, is sufficient to secure the validity of the SCCs.
In reaching her judgment, Justice Costello referred in a number of instances, to the testimony of Professor Peter Swire, who is Senior Counsel at Alston & Bird. Professor Swire testified as an independent expert on U.S. law, and was selected to testify by Facebook. The full testimony, as well as summaries of the key points, is available here.
In highlighting the importance of the case for businesses globally, Justice Costello said that any final decision pertinent to the use of standard clauses has implications for billions of Euros worth of trade between the EU and the US.
In terms of next steps, the High Court will receive submissions from the parties regarding the questions that will be referred to the Court of Justice. The referral does not mean that the SCCs, or the Privacy Shield, are invalidated or no longer available as a means to transfer data outside the EU. It only means that the CJEU will review whether SCCs, in their current form, should be retained.