|
Judgment
Title: | Data Protection Commissioner |
Neutral Citation: | [2016] IEHC 414 |
High Court Record Number: | 2016 4809 P |
Date of Delivery: | 19/07/2016 |
Court: | High Court |
Judgment by: | McGovern J. |
Status: | Approved |
| |
Neutral Citation [2016] IEHC 414
THE HIGH COURT [2016 No. 4809 P.]
BETWEEN
DATA PROTECTION COMMISSIONER
PLAINTIFF AND
FACEBOOK IRELAND LIMITED AND MAXIMILLIAN SCHREMS DEFENDANTS
JUDGMENT of Mr. Justice Brian J. McGovern delivered on the 19th day of July, 2016
1. These proceedings concern the transfer of data by Facebook Ireland Limited (“FIL”) to its US parent company Facebook Inc. and whether this transfer is lawful under both national and EU data protection law.
2. The second named defendant, Maximillian Schrems, filed a complaint with the plaintiff on 25th June, 2013, in which he argued that the transfer of his personal data by FIL to its US parent company was unlawful. Following the hearing of judicial review proceedings in the High Court on 29th April, 2014, a reference was made to the Court of Justice of the European Union (“the CJEU”) in which it held, inter alia, that, by failing to afford EU citizens any possibility of pursuing effective legal remedies in the US in connection with any alleged contravention of their rights under Article 7 and/or 8 of the Charter, Commission Decision 2000/520/EC of 26th July, 2000, (“the Safe Harbour Decision”) was in breach of Article 47 of the Charter and therefore invalid. After the CJEU ruling, the judicial review proceedings returned before the High Court and, on 20th October, 2015, an order was made quashing the Commissioner’s refusal to investigate the complaint brought by Mr. Schrems. The complaint was submitted back to the Commissioner for investigation. Accordingly, the Commissioner opened an investigation into the complaint and, following the hearing of a reformulated complaint, the Commissioner, on 24th May, 2016, issued a draft decision. The decision was issued in draft form so as to preserve the right of Mr. Schrems and/or FIL to make further submissions in relation to its terms and the Commissioner will give consideration to such submissions in due course.
3. The investigation of the reformulated complaint by the Commissioner was conducted on the basis of two strands which proceeded in parallel. Strand one comprised a factual investigation which focused on establishing whether FIL had continued to transfer subscribers’ personal data to the US subsequent to the CJEU ruling and, if FIL had continued to do so, strand one of the investigation also sought to examine the legal bases on which such transfers are effected. Strand two sought to examine whether, in view of the adequacy criteria identified in Article 25(2) of Directive 95/46/EC of 24th October, 1995, (“the Directive”), the US ensures adequate protection for the data protection rights of EU citizens.
4. The Commissioner has formed the view that she cannot conclude her investigation without obtaining a ruling from the CJEU on the validity of the three Commission Decisions on standard contractual clauses that have been approved by the Commissioner as fulfilling the requirements of Article 26(4) of the Directive (“the SCC Decisions”). These are:-
(1) Commission Decision 2001/497/EC of 15th June, 2001, on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC (Text with EEA relevance) (notified under document number C(2001) 1539) [2001] OJ L181, 4.7.2001, pp. 19-31;
(2) Commission Decision 2004/915/EC of 27th December, 2004, amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries (notified under document number C(2004) 5271) (Text with EEA relevance) [2004] OJ L385, 29.12.2004, pp.74-84; and,
(3) Commission Decision 2010/87/EU of 5th February, 2010, on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (notified under document C(2010) 593) (Text with EEA relevance) [2010] OJ L39, 12.2.2010, p. 5-18.
5. In these proceedings the plaintiff claims:-
(1) a declaration as to the validity of the SCC Decisions insofar as they apply to data transfers from the European Economic Area to the United States having regard to the Charter of Fundamental Rights of the European Union (“the Charter”) and in particular Article 7 and/or Article 8 and/or Article 47 thereof.
(2) A reference to the CJEU pursuant to Article 267 of the Treaty on the Functioning of the European Union and para. 65 of the ruling of the CJEU in Maximillian Schrems v. Data Protection Commissioner (Case C-362/14), 6th October, 2015, in order to obtain a preliminary ruling on the validity of the SCC Decisions insofar as applies to data transfers from the EU to the US, having regard to the Charter and in particular to Article 7 and/or Article 8 and/or Article 47 thereof.
Applications by Parties to be joined as Amici Curiæ
6. Within the State and across the EU, there are a significant number of entities that rely on the SCC Decisions for the purpose of making data transfers between the EU and the US. The outcome of these proceedings has the potential to have significant economic and commercial consequences for a range of companies and individuals across the European Union. In view of this, a number of parties have brought applications to be admitted as amici curiæ in these proceedings. The parties seeking audience in that capacity are:-
(i) The United States of America;
(ii) BSA Business Software Alliance;
(iii) IBEC Limited;
(iv) Electronic Frontier Foundation (EFF);
(v) Digital Europe;
(vi) Irish Council of Civil Liberties and American Civil Liberties Union;
(vii) Electronic Privacy Information Centre (EPIC);
(viii) Irish Human Rights and Equality Commission; and,
(ix) Mr. Kevin Cahill.
7. The parties were largely in agreement as to the legal principles which apply. In H.I. v. Minister for Justice, Equality and Law Reform [2004] 3 I.R. 197, the Supreme Court held that the court may appoint an amicus curiæ pursuant to its inherent jurisdiction. In O’Brien v. Personal Injuries Assessment Board (No. 1) [2005] 3 I.R. 328, Finnegan P. identified a number of matters which the court ought to consider when deciding whether to exercise its discretion in favour of appointing an amicus curiæ. The first is whether the applicant has “a bona fide interest and is not just acting as a meddlesome busybody”; secondly, whether the case has a “public law dimension” and that the applicant “has not just a sectional interest, that is the interest of its members, but a general interest which should be respected and to which regard should be had”; and, thirdly, whether “the decision may affect a great number of persons”.
8. In Doherty v. South Dublin County Council [2007] 1 IR 246, the Supreme Court upheld the order of the Quirke J. in the High Court whereby the learned trial judge found that the equality authority had statutory authority to act as an amicus curiæ.
9. In Fitzpatrick v. F.K. [2007] 2 IR 406, Clarke J. said at 415-416:-
“…it seems clear that amongst the important factors to be taken into account are:-
(a) whether the proposed amicus curiæ might be reasonably said to be partisan or, on the other hand, to be largely neutral and in a position to bring to bear expertise in respect of an area which might not otherwise be available to the court; and,
(b) the stage which had been reached in the proceedings with particular reference to a distinction between trial courts and appellate courts.”
10. At p. 416, he added a further factor of particular importance as:-
“…the extent to which it may be reasonable to assume that the addition of the party concerned as an amicus curiæ might be said to bring to bear on the legal debate before the courts on an issue of significant public importance, a perspective which might not otherwise be placed before the court.”
11. At p. 417, he said:-
“While I am not persuaded that there is an absolute bar to parties being joined as amicus curiæ at trial level, I believe that the circumstances in which it would be appropriate so to do should, ordinarily, be confined to cases where there is no significant likelihood that the facts of an individual case are likely to be controversial or to have a significant effect on determining what issues of general importance may require to be determined.”
12. In H.I. v. Minister for Justice, Keane C.J. said that the jurisdiction is one to be exercised “sparingly”. In EMI Records (Ireland) Ltd. v. UPC Communications Ireland Ltd. [2013] IEHC 204, Kelly J., (as he then was), adopted the reasoning of Keane C.J. and stated, at para. 66, that the court must additionally take into account “the limited circumstances in which an amicus may be appointed in a court of trial as distinct from an appellate court”.
13. The reluctance of the court to admit a party as an amicus curiæ if they have a strong view or vested interest seems to have diminished somewhat in recent times and, in Maximillian Schrems v. Data Protection Commissioner (No. 2) [2014] IEHC 351, Hogan J. observed, at para. 35, that: “the application of these principles is not straightforward” and so far as the attitude towards the partisan nature of an applicant is concerned, he observed, at para. 27, that the courts have “…engaged in something of a polite fiction”. It is, of course, true that in many cases where a party applies to be accorded the status of an amicus curiæ it is precisely because they have a significant interest in the issue in question. So far as the court is concerned, it is important to recognise that an amicus curiæ is there to assist the court and has not become a party to the action. As Clarke J. said in Fitzpatrick v. F.K. at p. 417:-
“…an amicus should not be permitted to involve itself in the specific facts of an individual case. It is only after those facts have been determined that the extent to which issues of general importance may remain for decision will be clear. That is far more likely to be the case at the appellate rather than the trial level.”
14. In EMI Records (Ireland) Limited v. UPC Communications Ireland Limited, Kelly J. at para. 69 said:-
“If it is the intention of the applicant to contest either of the factual matters…then it will be seeking to involve itself in the factual aspects of the proceedings and there is no role for an amicus curiæ in that regard.”
15. There are a number of matters which are relevant to the court’s consideration of the applications to be joined as amici curiæ. These proceedings do involve issues of public law. But they are not, in any real sense, a lis inter partes. One of the reliefs sought by the plaintiff is a reference to the CJEU. It is accepted by all the applicants that, if a reference is made, they cannot be heard before the CJEU unless they were involved in some way before the court of first instance. (See: Article 96 of the Rules of Procedure of the Court of Justice of the European Union.)
16. Because there is no factual dispute or lis inter partes in these proceedings, the applicants argue that the usual rule, excluding the involvement of an amicus curiæ at the first instance hearing, does not apply. Furthermore, when the issues raised in the proceedings are almost certain to involve a reference to the CJEU, it is essential that any party who has a right to be heard as an amicus curiæ should be heard in the proceedings before the High Court. It seems to me that this is a reasonable view. Therefore, having regard to the particular circumstances of this case, I am prepared to entertain the applications from the various parties to be admitted as an amicus curiæ at this stage.
17. In reaching my conclusion as to which of the applicants should be admitted as an amicus curiæ, I have had regard to the jurisprudence referred to above, and also to the fact that the Data Protection Commissioner is responsible for upholding the privacy rights of individuals in relation to the processing of their personal data. As such, she can be expected to raise issues sought to be advanced by some of the applicants.
18. I have also had regard to the underlying principles that the exercise of the court’s discretion to admit an amicus curiæ, should be exercised sparingly. That is particularly relevant in this case where so many applicants seek to be joined.
Decision
19. In respect of each of the applicants, I make the following determination:-
(i) United States of America
The United States has a significant and bona fide interest in the outcome of these proceedings. At issue in the proceedings is the assessment, as a matter of EU law, of the applicant’s law governing the treatment of EU citizens’ data transfer to the US. The imposition of restrictions on the transfer of such data would have potentially considerable adverse effects on EU-US commerce and could affect US companies significantly. I am satisfied that the US meets the criteria for being joined as an amicus curiæ and that it can bring added value to the case which the parties may be unable to provide.
(ii) Electronic Privacy Information Centre (EPIC)
The applicant is a public interest, not-for-profit, independent, non-governmental, research and educational organisation based in Washington DC which claims to be the leading privacy and freedom of information organisation in the US with special expertise in government surveillance and related legal matters. It has appeared frequently in the US as an amicus curiæ and has also appeared before the European Court of Human Rights in that capacity. It seems to me that it would be in a position to offer a counterbalancing perspective from the US Government on the position in the US and could bring to bear an expertise which might not otherwise be available to the court. While the first named defendant opposed the application of the proposed amicus on the basis that the second named defendant was a member of the advisory panel, this Court has taken into consideration the fact that the advisory panel is comprised of ninety-four individuals. Additionally, it has accepted the undertaking of EPIC, given through Counsel in the hearing of the application, that the second named defendant will have no role in preparing any submissions or providing advice or any other assistance to the applicant and furthermore that there will be no communication between EPIC and the second named defendant regarding these proceedings whilst they are in existence. Accordingly, I will admit EPIC as an amicus curiæ.
(iii) BSA Business Software Alliance
The applicant is a not-for-profit international trade association. Its members include leading global technology providers such as Apple, IBM, Microsoft, Intel, Siemens PLM, SAS, Oracle and many other large and smaller innovators, some having their European headquarters or substantial operations in the State. Having considered its application and the submissions made on its behalf, I am satisfied that it meets the criteria for being admitted as an amicus curiæ. Its members include some of the largest technology providers in the world and, in my view, it is in a position to offer relevant views which might otherwise not be available to the court. I will admit this body as an amicus curiæ.
(iv) Digital Europe
Digital Europe (formerly the European Information, Communications and Consumer Electronics Technology Industry Association) was established in 1999 to represent the interests of both national associations and corporations operating in the digital technology interest in Europe. It is now the principal representative body on matters of EU public policy for the members of the digital technology industry in Europe. It is a not-for-profit association governed by Belgian law consisting of sixty-two corporate members including some of the worlds largest IT, telecoms and consumer electronic companies and thirty-seven national trade associations from across Europe. FIL is not a corporate member of Digital Europe although it is a member of some of the national trade associations that are, in turn, members of Digital Europe. I am satisfied from the evidence adduced that it is one of the most substantial and representative groups for the digital technology industry in Europe and that many of its members have an interest in and will be affected by any decision made in this case. This applicant will be in a position to assist the court by bringing to bear its expertise in a way which might not otherwise be available to the court. I will, therefore, admit Digital Europe as an amicus curiæ.
(v) Electronic Frontier Foundation (EFF)
The applicant claims to be the leading American civil liberties non-governmental organisation focusing on digital technologies and was founded in 1990, with an interest in defending civil liberties and innovation online. Its five main substantive areas of activity are:-
(i) freedom of speech and expression;
(ii) privacy;
(iii) transparency and governmental accountability;
(iv) citizen/consumer fair use of intellectual property; and,
(v) innovation.
Having considered the affidavit evidence offered by this applicant and the submissions made on its behalf, I am not satisfied that it can offer any particular assistance to the court which will not be furnished by either the parties to the proceedings or the amici curiæ whom I have decided to admit. I, therefore, refuse the application of EFF to be joined as an amicus curiæ.
(vi) Irish Council for Civil Liberties and American Civil Liberties Union
These applicants made separate representations to be admitted as amici curiæ but informed the court that, if admitted, they will make a joint submission. Having considered the applications of these parties and their respective submissions, I am not satisfied that they can bring a new perspective to the proceedings or assist the court beyond the way in which the plaintiff and the second named defendant can do and also some of the other amici curiæ that have been admitted. I, therefore, refuse their applications.
(vii) Mr. Kevin Cahill
This individual applicant has extensive expert experience in the world of Information Technology. However, it seems to me from his submission that his expertise lies in the area of giving evidence which he has done in the past before many courts and reputable bodies. He has also published extensively on the issue of data protection and Information Technology. As a general rule, an amicus curiæ is not permitted to give evidence and the thrust of the application of Mr. Cahill to be admitted as an amicus curiæ is to give the benefit of his expertise to the court in the way that an expert witness would. He is not a lawyer and has not established that he could assist the court from a different perspective to the parties before the court or other amici curiæ who have been joined. I refuse his application.
(viii) IBEC Limited
IBEC is a not-for-profit entity which operates as a representative body for business in Ireland and is a registered trade union for Irish employers. IBEC is the umbrella group for forty-four separate sectoral trade associations and has eighteen policy committees. It is charged with the role of protecting the interest of Irish business. Having considered the affidavit evidence offered by IBEC and the submissions made on its behalf, I am not satisfied that it is in a position to add anything by way of assistance in these proceedings that other parties to the proceedings or other amici curiæ cannot do. I refuse the application of IBEC to be joined as amicus curiæ.
(ix) Irish Human Rights and Equality Commission
There is no doubt that the issues arising in these proceedings come within the scope of this applicant’s functions under the Irish Human Rights and Equality Commission Act 2014. Section 10(2)(e) entitles the Irish Human Rights and Equality Commission to apply to the High Court to be heard as amicus curiæ in appropriate cases. The remit of the Commission goes way beyond data protection and information technology issues and involves the protection and promotion of human rights and equality generally. The Data Protection Commissioner is the entity in the State that has a particular remit with regard to issues of data protection. Paragraph 1 of the statement of claim in these proceedings sets out the role of the Commissioner:-
“The plaintiff is the Data Protection Commissioner in Ireland (‘the Commissioner’), a corporate body established by statute, and the person charged with the enforcement and monitoring of compliance with the Data Protection Acts 1988 - 2003 (‘the Acts’). The Commissioner is also the person designated as the national supervisory authority for the purpose of monitoring the application in Ireland of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing personal data and on the free movement of such data (‘the Directive’).”
Having considered the application of the Irish Human Rights and Equality Commission, I am not satisfied that it can offer any assistance to the court that cannot be offered by the Data Protection Commissioner or, indeed, some of the other parties to the proceedings and amici curiæ that I have allowed to be joined. I, therefore, refuse the application of the Irish Human Rights and Equality Commission to be joined as amicus curiæ.
20. I will put this matter in for further directions, at which time any issues concerning the nature of the assistance to be given by the amici curiæ can be discussed. I have in mind issues such as whether or not any such party wishes to give evidence on US law, as opposed to the US regime surrounding data transfer and whether evidence of law should be given by way of affidavit or in submissions. The parties can address me on those issues and any ancillary issues at a further directions hearing.
|
|
|
