ECJ to rule on legality of EU-US data transfer
Privacy case at Europe’s highest court focuses on mechanism used across tech sector
The EU’s highest court will rule on whether the way Facebook and other technology companies transfer users’ pictures, emails and other personal data to the US should be outlawed, in a decision which will have huge implications for the sector.
Judges in Ireland, where Facebook has its European headquarters, have asked the European Court of Justice for a preliminary ruling on whether to strike down the data transfer mechanism used by thousands of tech groups, following a legal challenge by Max Schrems, an Austrian lawyer and privacy campaigner.
A separate challenge by Mr Schrems two years ago led the ECJ to ban the “safe harbour” data pact, after it was argued that Facebook had not done enough to protect users’ private information from US intelligence services.
The referral, which places the fight over data protection and commercial interests in the hands of the Luxembourg-based court, concerns one of the main alternatives to safe harbour used by companies, including Facebook, to transfer data out of Europe to non-EU countries.
Known as “model” or “standard contractual” clauses, the system allows Facebook US to enter into a contract with its Irish entity and pledge to meet the EU’s privacy rules. The mechanism has been considered legal by the European Commission since 2001 and is used by thousands of companies across the digital economy as an efficient and legal way to transfer data.
But Ireland’s data protection authority, which is regulator to nine of the world’s top 10 social media companies — which, like Facebook, are based in Ireland — has said the system does not give sufficient protection to European citizens in countries such as the US which are not considered to have adequate data protection laws.
Referring the case to the ECJ on Tuesday, Caroline Costello, an Irish high court judge, said: “European Union law guarantees a high level of protection to EU citizens. They are entitled to an equivalent high level of protection when their data is transferred outside of the European Economic Area.”
She added that there were “well founded concerns” over the legality of a mechanism which acts as a crucial workaround for companies seeking legal certainty.
The EU has some of the toughest privacy laws anywhere in the world and only allows transfers to countries with equivalent protections against surveillance. Mr Schrems reacted to the referral by saying it paved the way for the ECJ to issue a “massive new judgment on mass surveillance and how far countries can go”.
Facebook said the ECJ must consider the “extensive evidence demonstrating the robust protections in place under standard contractual clauses and US law, before it makes any decision that may endanger the transfer of data across the Atlantic and around the globe”. It added that the referral would have “no immediate impact” on its business.
The ECJ's ruling, which could take as much as two years to deliver, strikes at the core of whether the data flows that underpin much of the global economy can ever be considered legal in Europe.
Eduardo Ustaran, a partner at Hogan Lovells, the law firm, said that although the referral would generate uncertainty for business, Brussels would probably come up with alternative ways to allow legal data transfers while a judgment was pending.
“It is more likely than not that the ECJ will agree with the Irish authorities and rule model clauses do not provide enough redress for European citizens,” Mr Ustaran said. “But the European Commission will try and pre-empt another negative judgment against them and have time to draft another system which addresses the weaknesses of model clauses.” The commission said it had taken note of the decision.