Ireland’s online watchdog has been ordered to investigate a groundbreaking complaint by a privacy campaigner over the transfer of personal data by Facebook to US authorities.
The audit marks the latest step in a two-and-a-half year battle by Max Schrems, 28, to uncover the amount of information the social media giant sends to the US on European citizens.
The Data Protection Commission, which originally refused to act, said it would investigate after a landmark ruling earlier this month by the European Court of Justice (ECJ).
The Luxembourg court ruled that the EU-US Safe Harbour agreement, which allowed tech giants to transfer data on millions of European citizens to the US, was invalid.
The High Court in Dublin, which referred Mr Schrems’ lengthy battle for an audit to the ECJ, quashed the data protection commissioner’s original refusal to launch an audit and ordered the inquiry.
Advertisement
Judge Gerard Hogan said: “The parties are agreed that the commissioner’s decision must be quashed. That’s not in dispute.”
The judge said it was premised on the validity of the Safe Harbour agreement. “The commissioner is obliged now to investigate the complaint . . . and I’ve absolutely no doubt that she will proceed to do so,” he said.
Judge Hogan said Mr Schrems’ landmark challenge over data transfer was possibly the most important ruling of the ECJ in years. He also told the court it “transcended international law”.
Mr Schrems said he was happy with the outcome.
“The big question is going to be if the Irish data protection commissioner is going to do its job,” he said.
Advertisement
“They pledged that they will really investigate things swiftly. My last experience was that a complaint takes up to three years and nothing comes out of it but they now pledge the opposite and I hope that’s going to be the case.”
Mr Schrems warned it would be very hard for European and US authorities to create a Safe Harbour II based on the ECJ ruling.
“I doubt it is going to be possible to get a second Safe Harbour that also withstands another challenge at the ECJ . . . the court has been very clear a new Safe Harbour would have to give you the same rights as you have in Europe. That’s going to be hard to get a deal on.”
Mr Schrems has also been awarded costs for his legal bill and travel expenses.
Mr Schrems’ legal battle over Safe Harbour was sparked by Edward Snowden’s revelations over the US National Security Agency (NSA) Prism surveillance system, which allowed spies to access enormous amounts of data from global tech companies.
Advertisement
Helen Dixon, Ireland’s data protection commissioner ,welcomed the ruling. “My office will now proceed to investigate the substance of the complaint with all due diligence,” she said.
Facebook reiterated it does not give the US government direct access to its servers.
“We will respond to inquiries from the Irish Data Protection Commission as they examine the protections for the transfer of personal data under applicable law,” a spokesman for the social media company said.