Irish privacy watchdog refers Facebook’s U.S. data transfers to EU court

A 3D-printed Facebook logo is seen in front of the logo of the European Union in this picture illustration made in Zenica, Bosnia and Herzegovina on May 15, 2015.

Reuters/Dado Ruvic

Data transfers to the United States by companies such as Facebook and Google face a renewed legal threat after the Irish privacy watchdog said on Wednesday it would refer Facebook’s data transfer mechanisms to the top EU court.

The move follows an Irish investigation into Facebook’s transfer of European Union users’ data to the United States to ensure that personal privacy is properly protected from U.S. government surveillance.

Facebook, like many other tech companies, has its European headquarters in Dublin and is regulated by the Irish Data Protection Commissioner (IDPC).

The IDPC said it would ask the Court of Justice of the European Union (ECJ) to determine the validity of Facebook’s so-called “model contracts” – common legal arrangements used by thousands of firms to transfer personal data outside the 28-nation EU.

Its investigation into the California-based company was ordered by Ireland’s High Court in October after the ECJ struck down Safe Harbour, an EU-U.S. agreement that had allowed the free transfer of data between the European Union and the United States. The ECJ ruled the agreement did not sufficiently protect Europeans’ information against U.S. surveillance.

Transfers of Europeans’ personal information to the United States have been a hot topic since 2013 revelations about mass U.S. surveillance programs such as Prism, which allowed U.S. authorities to harvest private information directly from big tech companies such as Apple, Facebook and Google.

Since the ECJ ruling, companies have had to rely on model contracts and other, more cumbersome, measures to transfer Europeans’ data to the United States in compliance with strict EU data privacy rules.

“Thousands of companies transfer data across borders to serve their customers and users,” a spokeswoman for Facebook said. “The question the Irish DPC plans to raise with the court regarding standard contract clauses will be relevant to many companies operating in Europe,” she said, adding that Facebook has a number of legal ways of moving data to the United States.

The ECJ ruling in October stemmed from a complaint by Austrian law student and privacy activist Max Schrems. He challenged Facebook’s transfers of European users’ data to its American servers, citing the risk of U.S. snooping.

“We yesterday informed Mr Schrems and Facebook of our intention to seek declaratory relief in the Irish High Court and a referral to the CJEU (Court of Justice of the European Union) to determine the legal status of data transfers under standard contractual clauses,” the IDPC said.

One of the reasons the ECJ struck down Safe Harbour is because the agreement did not offer EU citizens sufficient channels to complain about U.S. surveillance.

Schrems and other privacy campaigners contend that alternative arrangements such as model clauses don’t offer Europeans any means of redress either.

“There is no way that the CJEU can say that model contracts are valid if they killed Safe Harbor based on the existence of these U.S. surveillance laws,” Schrems said in a statement on Wednesday.

After the ECJ ruling in October, the EU Commission and the United States rushed to hash out a new data-sharing agreement, the Privacy Shield, which they are hoping to have up and running by the end of June.

However, EU privacy watchdogs have raised a number of concerns with the framework, heightening fears that it might not withstand a court challenge.

(Reporting by Julia Fioretti; Editing by Susan Fenton)