Ireland's High Court has been dealing with a case stemming from concerns in the European Union that US government surveillance does not respect the privacy rights of EU citizens, when their personal data is sent to the US for commercial use - including targeted advertising around Facebook services.
Ireland's Data Protection Commissioner (DPC) - which is Facebook's lead regulator in the European Union - launched an inquiry last August and issued a provisional order that the main mechanism Facebook uses to transfer EU user data to the US “cannot in practice be used”.
Facebook then challenged both the inquiry and that Preliminary Draft Decision (PDD), claiming they threatened “devastating” and “irreversible” consequences for its business.
But the High Court has rejected this challenge. “I refuse all of the reliefs sought by Facebook Ireland and dismiss the claims made by it in the proceedings,” said Justice David Barniville in a judgement that runs to almost 200 pages.
“Facebook Ireland has not established any basis for impugning the DPC decision or the PDD or the procedures for the inquiry adopted by the DPC,” he added.
Though the decision does not trigger any immediate halt to data flows between Facebook in the EU and the US, the Austrian privacy activist Max Schrems - who has forced the Irish data regulator to act in a series of legal actions over the past eight years - said he believed the court decision would cause a halt to the transfers.
Schrems said: “After eight years the DPC is now required to stop Facebook's EU-US data transfers, likely before summer.”
It was Facebook's Standard Contractual Clause (SCC) covering data that was questioned by the Irish regulator. Although such an SCC was deemed valid by the European Court of Justice last year, it also ruled that privacy watchdogs must suspend or prohibit transfers outside the EU if data protection in other countries cannot be assured.
The regulator welcomed the judgement. If it enforces its provisional order, it would effectively block the privileged access companies in the US have to personal data from Europe, putting them in the same boat as firms based outside the European Union.
Facebook said it would continue defending its “compliance” with EU data rules.
