Key facts of the case:
Edward Snowden, who worked for the US National Security Agency (NSA), unlawfully appropriated thousands of highly classified NSA files in 2013. He subsequently disclosed them to various media outlets and revealed the interception and surveillance of internet and telecommunications systems by the NSA on a global scale. The applicant claimed that Snowden’s disclosures demonstrated that there was no effective data protection regime in the US and that the Irish Data Protection Commissioner should have exercised his statutory powers to direct that the transfer of personal data from Facebook Ireland to its parent company in the US should cease. The Commissioner maintained that he was bound by the terms of a Decision of the European Commission issued in 2000 to hold that the data protection regime in the US was adequate and effective where the companies which transfer or process the data to the US self-clarify that they complied with the principles set down in this Decision. This case was a judicial review of the Commissioner’s decision where the Court questioned whether the proper interpretation of pre-Lisbon EU instruments should have been re-evaluated by the Commissioner in light of the subsequent entry into force of the Charter of Fundamental Rights.
Outcome of the case:
The evidence suggests that personal data of data subjects is routinely accessed on a mass and undifferentiated basis by the US security authorities. So far as Irish law is concerned, s. 11(1)(a) of the 1988 Act forbids the transfer of personal data to a third country unless it is clear that that jurisdiction sufficiently respects and protects the privacy and fundamental freedoms of the data subjects. In this particular context of national law, the standards in question are those contained in the Constitution. The chief constitutional protections are those relating to personal privacy and the inviolability of the dwelling. The general protection for privacy, person and security which is embraced by the “inviolability” of the dwelling in Article 40.5 of the Constitution would be entirely compromised by the mass and undifferentiated surveillance by State authorities of conversations and communications which take place within the home. For such interception of communications to be constitutionally valid, it would, accordingly, be necessary to demonstrate that this interception and surveillance of individuals or groups of individuals was objectively justified in the interests of the suppression of crime and national security and, further, that any such interception was attended by appropriate and verifiable safeguards. If the matter were to be measured solely by Irish law and Irish constitutional standards, then a serious issue would arise which the Commissioner would then have been required to investigate as to whether US law and practice in relation to data privacy, interception and surveillance matched these constitutional standards. In this regard, however, Irish law has been effectively pre-empted by EU law and specifically by the provisions of the 1995 Directive and the 2000 Decision establishing the Safe Harbour regime. With the July 2000 Decision the European Commission found that US data protection law and practice was sufficient to safeguard the rights of European data subjects and it is clear from Article 25(6) of the 1995 Directive that national data protection authorities must comply with findings of this nature. If the Commissioner cannot look beyond the European Commission’s Safe Harbour Decision of July 2000, then it is clear that the present application for judicial review must fail. This is because the Commission has already decided that the US provides an adequate level of data protection and, as we have just seen, s. 11(2)(a) of the 1998 Act (which in turn follows the provisions of Article 25(6) of the 1995 Directive) ties the Commissioner to the Commission’s finding. In those circumstances, any complaint to the Commissioner concerning the transfer of personal data by Facebook Ireland (or, indeed, Facebook) to the US on the ground that US data protection was inadequate would be doomed to fail. Ninth, while the applicant maintains that the Commissioner has not adhered to the requirements of EU law in holding that the complaint was unsustainable in law, the opposite is, in fact, in truth the case. The Commissioner has rather demonstrated scrupulous steadfastness to the letter of the 1995 Directive and the 2000 Decision. In these circumstances the critical issue which arises is whether the proper interpretation of the 1995 Directive and the 2000 Commission decision should be re-evaluated in the light of the subsequent entry into force of Article 8 of the Charter and whether, as a consequence, the Commissioner can look beyond or otherwise disregard this Community finding. It is for these reasons accordingly that I have decided to refer this question (and other linked questions) to the Court of Justice pursuant to Article 267 TFEU.
24. The European Commission did adopt such a decision on 26th July, 2000 (2000/520/EC) (O.J. L 215, 25th August, 2000), citing Article 25(6) of the 1995 Directive as the legal basis for this decision. The date of this decision is, perhaps, of some significance, given that it was taken some months before the EU Charter of Fundamental Rights was adopted at Nice in December 2000 and it ante-dated by several years the coming into force of the Lisbon Treaty on 1 December 2009, which is the date on which the Charter itself was first given legally justiciable status.
44. This is also clearly the position under EU law as well, a point recently confirmed by the Court of Justice in Case C-293/12 Digital Rights Ireland in a case where the Data Retention Directive, Directive 2006/24/EC was held to be invalid by reason of the absence of sufficient safeguards in respect of the accessing of such data by national authorities: “By requiring the retention of the data listed in Article 5(1) of Directive 2006/24 and by allowing the competent national authorities to access those data, Directive 2006/24, ...derogates from the system of protection of the right to privacy established by Directives 95/46 and 2002/58 with regard to the processing of personal data in the electronic communications sector, directives which provided for the confidentiality of communications and of traffic data as well as the obligation to erase or make those data anonymous where they are no longer needed for the purpose of the transmission of a communication, unless they are necessary for billing purposes and only for as long as so necessary. To establish the existence of an interference with the fundamental right to privacy, it does not matter whether the information on the private lives concerned is sensitive or whether the persons concerned have been inconvenienced in any way (see, to that effect, Cases C 465/00, C 138/01 and C 139/01 ÖsterreichischerRundfun and Others EU:C:2003:294, paragraph 75). As a result, the obligation imposed by Articles 3 and 6 of Directive 2006/24 on providers of publicly available electronic communications services or of public communications networks to retain, for a certain period, data relating to a person’s private life and to his communications, such as those referred to in Article 5 of the directive, constitutes in itself an interference with the rights guaranteed by Article 7 of the Charter. Furthermore, the access of the competent national authorities to the data constitutes a further interference with that fundamental right….Accordingly, Articles 4 and 8 of Directive 2006/24 laying down rules relating to the access of the competent national authorities to the data also constitute an interference with the rights guaranteed by Article 7 of the Charter. Likewise, Directive 2006/24 constitutes an interference with the fundamental right to the protection of personal data guaranteed by Article 8 of the Charter because it provides for the processing of personal data. It must be stated that the interference caused by Directive 2006/24 with the fundamental rights laid down in Articles 7 and 8 of the Charter is… and it must be considered to be particularly serious. Furthermore, as the Advocate General has pointed out in paragraphs 52 and 72 of his Opinion, the fact that data are retained and subsequently used without the subscriber or registered user being informed is likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance.”
58. The position under EU law is equally clear and, indeed, parallels the position under Irish law, albeit perhaps that the safeguards for data protection under the EU Charter of Fundamental Rights thereby afforded are perhaps even more explicit than under our national law. These fundamental protections are contained in Article 7 and Article 8 of the EU Charter of Fundamental Rights. Article 7 provides: “Respect for private and family life Everyone has the right to respect for his or her private and family life, home and communications.”
59. Article 8 provides: “Protection of personal data 1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority.”
60. Given that the validity of the administrative decision taken by the Commissioner is contingent on the proper interpretation and application of a Directive and, indeed, a Commission Decision taken pursuant to that Directive, it is plain that this is a case concerning the implementation of the EU law by a Member State within the meaning of Article 51(1) of the Charter, sufficient – at least so far as this part of the case is concerned – to trigger the application of the Charter: see, e.g., Cases C-411/10 and C-493/10 N.S.  E.C.R. I – 13991, paras. 64-69.
61. In Digital Rights Ireland the Court of Justice held that the Data Retention Directive was invalid, precisely because not only did it not contain appropriate safeguards, but it failed to provide for the retention of the data within the European Union with supervisions by an independent authority in the manner required by Article 8(3) of the Charter. As the Court observed (at paras. 65-69): “It follows from the above that Directive 2006/24 does not lay down clear and precise rules governing the extent of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter. It must therefore be held that Directive 2006/24 entails a wide-ranging and particularly serious interference with those fundamental rights in the legal order of the EU, without such an interference being precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary. Moreover, as far as concerns the rules relating to the security and protection of data retained by providers of publicly available electronic communications services or of public communications networks, it must be held that Directive 2006/24 does not provide for sufficient safeguards, as required by Article 8 of the Charter, to ensure effective protection of the data retained against the risk of abuse and against any unlawful access and use of that data. In the first place, Article 7 of Directive 2006/24 does not lay down rules which are specific and adapted to (i) the vast quantity of data whose retention is required by that directive, (ii) the sensitive nature of that data and (iii) the risk of unlawful access to that data, rules which would serve, in particular, to govern the protection and security of the data in question in a clear and strict manner in order to ensure their full integrity and confidentiality. Furthermore, a specific obligation on Member States to establish such rules has also not been laid down. Article 7 of Directive 2006/24, read in conjunction with Article 4(1) of Directive 2002/58 and the second subparagraph of Article 17(1) of Directive 95/46, does not ensure that a particularly high level of protection and security is applied by those providers by means of technical and organisational measures, but permits those providers in particular to have regard to economic considerations when determining the level of security which they apply, as regards the costs of implementing security measures. In particular, Directive 2006/24 does not ensure the irreversible destruction of the data at the end of the data retention period. In the second place, it should be added that that directive does not require the data in question to be retained within the European Union, with the result that it cannot be held that the control, explicitly required by Article 8(3) of the Charter, by an independent authority of compliance with the requirements of protection and security, as referred to in the two previous paragraphs, is fully ensured. Such a control, carried out on the basis of EU law, is an essential component of the protection of individuals with regard to the processing of personal data... Having regard to all the foregoing considerations, it must be held that, by adopting Directive 2006/24, the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality in the light of Articles 7, 8 and 52(1) of the Charter.”
62. Judged by these standards, it is not immediately apparent how the present operation of the Safe Harbour Regime can in practice satisfy the requirements of Article 8(1) and Article 8(3) of the Charter, especially having regard to the principles articulated by the Court of Justice in Digital Rights Ireland. Under this self-certification regime, personal data is transferred to the United States where, as we have seen, it can be accessed on a mass and undifferentiated basis by the security authorities. While the FISA Court doubtless does good work, the FISA system can at best be described as a form of oversight by judicial personages in respect of applications for surveillance by the US security authorities. Yet the very fact that this oversight is not carried out on European soil and in circumstances where the data subject has no effective possibility of being heard or making submissions and, further, where any such review is not carried out by reference to EU law are all considerations which would seem to pose considerable legal difficulties. It must be stressed, however, that neither the validity of the 1995 Directive nor the Commission Decision providing for the Safe Harbour Regime are, as such, under challenge in these judicial review proceedings.
63. The Safe Harbour Regime was, of course, not only drafted before the Charter came into force, but its terms may also reflect a somewhat more innocent age in terms of data protection. This Regime also came into force prior to the advent of social media and, of course, before the massive terrorist attacks on American soil which took place on September 11th, 2001. Outrages of this kind – sadly duplicated afterwards in Madrid, London and elsewhere - highlighted to many why, subject to the appropriate and necessary safeguards, intelligence services needed as a matter of practical necessity to have access to global telecommunications systems in order to disrupt the planning of such attacks.
67. This finding of the Commission is doubtless still true at the level of consumer protection, but, as we have just seen, much has happened in the interval since July 2000. The developments include the enhanced threat to national and international security posed by rogue States, terrorist groupings and organised crime, disclosures regarding mass and undifferentiated surveillance of personal data by the US security authorities, the advent of social media and, not least from a legal perspective, the enhanced protection for personal data now contained in Article 8 of the Charter.
68. While the applicant maintains that the Commissioner has not adhered to the requirements of EU law in holding that the complaint was unsustainable in law, the opposite is in truth the case. The Commissioner has rather demonstrated scrupulous steadfastness to the letter of the 1995 Directive and the 2000 Decision.
69. The applicant’s objection is, in reality, to the terms of the Safe Harbour Regime itself rather than to the manner in which the Commissioner has actually applied the Safe Harbour Regime. There is, perhaps, much to be said for the argument that the Safe Harbour Regime has been overtaken by events. The Snowden revelations may be thought to have exposed gaping holes in contemporary US data protection practice and the subsequent entry into force of Article 8 of the Charter suggests that a re-evaluation of how the 1995 Directive and 2000 Decision should be interpreted in practice may be necessary. It must be again stressed, however, that neither the validity of the 1995 Directive nor the validity of the Commission’s Safe Harbour decision have, as such, been challenged in these proceedings.
70. Although the validity of the 2000 Decision has not been directly challenged, the essential question which arises for consideration is whether, as a matter of European Union law, the Commissioner is nonetheless absolutely bound by that finding of the European Commission as manifested in the 2000 Decision in relation to the adequacy of data protection in the law and practice of the United States having regard in particular to the subsequent entry into force of Article 8 of the Charter, the provisions of Article 25(6) of the 1995 Directive notwithstanding. For the reasons which I have already stated, it seems to me that unless this question is answered in a manner which enables the Commissioner either to look behind that Community finding or otherwise disregard it, the applicant’s complaint both before the Commissioner and in these judicial review proceedings must accordingly fail.
71. Given the general novelty and practical importance of these issues which have considerable practical implications for all 28 Member States of the European Union, it is appropriate that this question should be determined by the Court of Justice. In these circumstances, I propose to refer the following questions to that Court in accordance with Article 267 TFEU: “Whether in the course of determining a complaint which has been made to an independent office holder who has been vested by statute with the functions of administering and enforcing data protection legislation that personal data is being transferred to another third country (in this case, the United States of America) the laws and practices of which, it is claimed, do not contain adequate protections for the data subject, that office holder is absolutely bound by the Community finding to the contrary contained in Commission Decision of 26 July 2000 (2000/520/EC) having regard to Article 7 and Article 8 of the Charter of Fundamental Rights of the European Union (2000/C 364/01), the provisions of Article 25(6) of Directive 95/46/EC notwithstanding? Or, alternatively, may the office holder conduct his or her own investigation of the matter in the light of factual developments in the meantime since that Commission Decision was first published?”
84. Eleventh, in these circumstances the critical issue which arises is whether the proper interpretation of the 1995 Directive and the 2000 Commission decision should be re-evaluated in the light of the subsequent entry into force of Article 8 of the Charter and whether, as a consequence, the Commissioner can look beyond or otherwise disregard this Community finding. It is for these reasons accordingly that I have decided to refer this question (and other linked questions) to the Court of Justice pursuant to Article 267 TFEU.