Facebook’s European privacy practices are to be investigated by the Irish data protection watchdog, after a three-year legal fight by Austrian privacy campaigner Max Schrems.
The high court in Dublin quashed the Irish data protection commissioner’s original refusal to examine Schrems’ complaint over the alleged movement of his data outside of Europe by Facebook after referring the case to the European court of justice.
Judge Gerard Hogan said the initial decision by the watchdog had been premised on the validity of the safe harbour agreement, which was recently declared invalid by the ECJ after another, separate two-year case by Schrems against Facebook.
“The commissioner is obliged now to investigate the complaint … and I’ve absolutely no doubt that she will proceed to do so,” Hogan said, while awarding Schrems costs for his legal bill and travel expenses.
Ireland’s data protection commissioner Helen Dixon welcomed the ruling and said: “My office will now proceed to investigate the substance of the complaint with all due diligence.”
Schrems, who has been critical of the Irish who govern Facebook’s operations within Europe, said: “The big question is going to be if the Irish Data Protection Commissioner is going to do its job.
“The law is clear and the facts are rather clear so theoretically you could make a decision within weeks.
“They pledged that they will really investigate things swiftly. My last experience was that a complaint takes up to three years and nothing comes out of it but they now pledge the opposite and I hope that’s going to be the case.”
Facebook reiterated that it does not give the US government direct access to its servers and it does not recognise the NSA’s Prism surveillance programme.
A Facebook spokesperson said: “We will respond to inquiries from the Irish Data Protection Commission as they examine the protections for the transfer of personal data under applicable law.”
Safe harbour no more
The news comes after the invalidation of the 15-year-old safe harbour agreement, which deemed European citizens’ data transferred between the EU and US as being adequately protected, allowing US companies to self certify their data protection practices.
The Snowden revelations over the NSA’s surveillance practices triggered unrest in Europe and provoked the Schrems’ landmark challenge, which led to what Hogan described as the most important ruling of the ECJ in years that “transcended international law”.
Schrems said: “It’s a procedure you start but you get into it step by step, you didn’t plan it to be this big thing but you think, there is actually the problem, and you poke and see what’s happening and it’s good if things get poked up all the way and solved in the end.”
The campaigner said watchdogs in 28 European states will now be able to accept complaints about the movement of personal information and that he was considering other challenges to tech giants involved in cloud services.
“There are certain companies where we know they are involved in mass surveillance because of the Snowden leaks, and I think those are the companies you should take a look at,” Schrems said.
Schrems warned it would be very hard for European and US authorities to create a version of safe harbour based on the ECJ ruling that would withstand another challenge at the ECJ.
“The court has been very clear a new safe harbour would have to give you the same rights as you have in Europe. That’s going to be hard to get a deal on,” he said.
View all comments >
comments
Sign in or create your Guardian account to join the discussion.
This discussion is closed for comments.
We’re doing some maintenance right now. You can still read comments, but please come back later to add your own.
Commenting has been disabled for this account (why?)