CJEU strikes down Privacy Shield and finds US law inadequate to protect data of EU residents. EU Court agrees with submissions of US NGO seeking to uphold data privacy rights.

16 July 2020

The Court of Justice of the European Union has today issued a Judgement in the case of Data Protection Commissioner v. Facebook & Max Schrems, on privacy protection for transatlantic data transfers in which FLAC represented EPIC, a US NGO, to make expert submissions before the Court concerning data privacy laws in the US.

In today’s judgement the CJEU found that the Privacy Shield decision of the EU Commission is invalid. The decision made a finding that the transfers of personal data relating to EU Citizens from the EU to the US enjoyed an adequate level of protection for the purpose of EU law. The Court found, however that such data could be subject to interference by US authorities for national security reasons, but that such interference was not attended by adequate legal safeguards to provide a level of protection essentially equivalent to that afforded by EU law. In particular it was found that access to the data of EU citizens transferred to the US was not accompanied by safeguards in terms of limitations on access and use and adequate judicial oversight and remedies in respect of wrongful access.

Legal rights group FLAC (Free Legal Advice Centres) represented EPIC, the Electronic Privacy Information Centre, a Washington based NGO, to act as a “friend of the court” (amicus curiae) in this case. As an amicus curiae, EPIC provided the High Court and the CJEU with a comprehensive assessment of the strengths and weaknesses of the US legal system and the protection afforded to the personal data of people resident in the EU, including Ireland, a perspective that was of assistance to both the High Court and the CJEU in assessing the adequacy of US law from a EU data protection perspective.

"As a small NGO with limited funding, which seeks to act as a counter-balance to large business and state interests, Epic needed representation in order to be able to participate, and we in FLAC, as one of the few independent law centres in Ireland, were pleased to support a peer NGO seeking to uphold fundamental rights." – Eilis Barry, FLAC Chief Executive

FLAC decided to represent EPIC in this case as it involves fundamental rights of privacy. FLAC provides representation in cases that have strategic value and that may affect positive social change, whether to vindicate human rights or to improve access to justice in Ireland.

FLAC have long promoted the wider use of the amicus curiae mechanism in the courts, particularly for civil society organisations that have significant expertise gained from front-line work. It can provide the courts with a plurality of legal views and a democratic approach to cases that involve the broader public interest. This case is notable in that the appointment of an NGO as amicus is rare, and rarer still is the appointment of a non-Irish amicus.

FLAC would like to thank barristers Grainne Gilmore and Colm O’Dwyer, SC, for providing representation in this very long complex case.

/ENDS

 

Editors’ notes:

1. FLAC (Free Legal Advice Centres) is a human rights organisation which exists to promote equal access to justice for all. As an NGO, FLAC relies on a combination of statutory funding, contributions FLAC offers basic legal information through its telephone information line (1890 350 250). Free legal advice is available to the public through a network of volunteer evening advice centres – more at www.flac.ie/help/.  It also campaigns and does policy & law reform work on a range of issues including consumer credit, personal debt, fairness in social welfare law, public interest law and civil legal aid.
2. EPIC is a public interest research centre based in Washington, DC, Established in 1994, EPIC focuses public attention on emerging privacy and civil liberties issues and seeks to protect privacy, freedom of expression, and democratic values in the information age. An independent organisation with no state funding, EPIC routinely files amicus briefs in federal courts, pursues open government cases, defends consumer privacy, organizes conferences and speaks before Congress and judicial organisations about emerging issues. More at www.epic.org .
3. The Data Protection Commissioner had asked the High Court to refer to the Court of Justice of the European Union the question of whether certain contracts, known as  ‘standard contractual clauses’, protect the privacy rights of EU citizens when their personal data is transferred outside Europe. The Commissioner is suing two parties in the case: Facebook Ireland, and Austrian privacy campaigner and lawyer Max Schrems.
   
   Standard contractual clauses have been approved by various European Commission decisions. They were designed to allow businesses to transfer the personal data of EU citizens to countries outside the European Economic Area while ensuring the citizens enjoyed equivalent privacy rights to those they have in the EU.
   
   The case follows a landmark decision  invalidating an international arrangement for transferring data in light of the U.S. surveillance regime. In the challenge by privacy advocate Max Schrems , the Court of Justice of the European Union found insufficient legal protections for the transfer of European data to the United States.
4. Amicus curiae translates as ‘friend of the court’. The amicus is not a party to the case. Its role is to provide expertise to the court as an impartial third party and assist the Court in arriving at its decision. There has been limited use of the amicus mechanism in the Irish courts, although the practice is growing. This case is notable in that the appointment of an NGO as amicus is rare, and rarer still is the appointment of a non-Irish amicus.