You are here:

Ireland / High Court / [2014] IEHC 310

Maximillian Schrems v Data Protection Commissioner

Policy area:
Information society
Deciding Body type:
National Court/Tribunal
Deciding Body:
High Court
Decision date:

Key facts of the case:

Edward Snowden, who worked for the US National Security Agency (NSA), unlawfully appropriated thousands of highly classified NSA files in 2013. He subsequently disclosed them to various media outlets and revealed the interception and surveillance of internet and telecommunications systems by the NSA on a global scale. The applicant claimed that Snowden’s disclosures demonstrated that there was no effective data protection regime in the US and that the Irish Data Protection Commissioner should have exercised his statutory powers to direct that the transfer of personal data from Facebook Ireland to its parent company in the US should cease. The Commissioner maintained that he was bound by the terms of a Decision of the European Commission issued in 2000 to hold that the data protection regime in the US was adequate and effective where the companies which transfer or process the data to the US self-clarify that they complied with the principles set down in this Decision. This case was a judicial review of the Commissioner’s decision where the Court questioned whether the proper interpretation of pre-Lisbon EU instruments should have been re-evaluated by the Commissioner in light of the subsequent entry into force of the Charter of Fundamental Rights.

Outcome of the case:

The evidence suggests that personal data of data subjects is routinely accessed on a mass and undifferentiated basis by the US security authorities. So far as Irish law is concerned, s. 11(1)(a) of the 1988 Act forbids the transfer of personal data to a third country unless it is clear that that jurisdiction sufficiently respects and protects the privacy and fundamental freedoms of the data subjects. In this particular context of national law, the standards in question are those contained in the Constitution. The chief constitutional protections are those relating to personal privacy and the inviolability of the dwelling. The general protection for privacy, person and security which is embraced by the “inviolability” of the dwelling in Article 40.5 of the Constitution would be entirely compromised by the mass and undifferentiated surveillance by State authorities of conversations and communications which take place within the home. For such interception of communications to be constitutionally valid, it would, accordingly, be necessary to demonstrate that this interception and surveillance of individuals or groups of individuals was objectively justified in the interests of the suppression of crime and national security and, further, that any such interception was attended by appropriate and verifiable safeguards. If the matter were to be measured solely by Irish law and Irish constitutional standards, then a serious issue would arise which the Commissioner would then have been required to investigate as to whether US law and practice in relation to data privacy, interception and surveillance matched these constitutional standards. In this regard, however, Irish law has been effectively pre-empted by EU law and specifically by the provisions of the 1995 Directive and the 2000 Decision establishing the Safe Harbour regime. With the July 2000 Decision the European Commission found that US data protection law and practice was sufficient to safeguard the rights of European data subjects and it is clear from Article 25(6) of the 1995 Directive that national data protection authorities must comply with findings of this nature. If the Commissioner cannot look beyond the European Commission’s Safe Harbour Decision of July 2000, then it is clear that the present application for judicial review must fail. This is because the Commission has already decided that the US provides an adequate level of data protection and, as we have just seen, s. 11(2)(a) of the 1998 Act (which in turn follows the provisions of Article 25(6) of the 1995 Directive) ties the Commissioner to the Commission’s finding. In those circumstances, any complaint to the Commissioner concerning the transfer of personal data by Facebook Ireland (or, indeed, Facebook) to the US on the ground that US data protection was inadequate would be doomed to fail. Ninth, while the applicant maintains that the Commissioner has not adhered to the requirements of EU law in holding that the complaint was unsustainable in law, the opposite is, in fact, in truth the case. The Commissioner has rather demonstrated scrupulous steadfastness to the letter of the 1995 Directive and the 2000 Decision. In these circumstances the critical issue which arises is whether the proper interpretation of the 1995 Directive and the 2000 Commission decision should be re-evaluated in the light of the subsequent entry into force of Article 8 of the Charter and whether, as a consequence, the Commissioner can look beyond or otherwise disregard this Community finding. It is for these reasons accordingly that I have decided to refer this question (and other linked questions) to the Court of Justice pursuant to Article 267 TFEU.