Freely Available British and Irish Public Legal Information
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
High Court of Ireland Decisions
You are here: BAILII >> Databases >> High Court of Ireland Decisions >> Schrems -v- Data Protection Commissioner (No.2) [2014] IEHC 351 (16 July 2014)
URL: http://www.bailii.org/ie/cases/IEHC/2014/H351.html
Cite as: [2014] 2 ILRM 506, [2014] 3 CMLR 38, [2014] IEHC 351
[New search] [Help]
Judgment Title: Schrems -v- Data Protection Commissioner (No.2) Neutral Citation: [2014] IEHC 351 High Court Record Number: [2013 765 JR Date of Delivery: 16/07/2014 Court: High Court Composition of Court: Judgment by: Hogan J. Status of Judgment: Approved |
Neutral Citation Number: [2014] IEHC 351 THE HIGH COURT [2013 No. 765JR] BETWEEN/ MAXIMILLIAN SCHREMS APPLICANT AND
DATA PROTECTION COMMISSIONER (No.2) RESPONDENT JUDGMENT of Mr. Justice Gerard Hogan delivered on the 16th July, 2014 1. This is an application by notice of motion dated 26th June, 2014, on the part of Digital Rights Ireland Ltd. (“DRI”) to be joined to the present judicial review proceedings as amicus curiae. This nature of this application cannot really be fully understood without reference to my earlier judgment which was delivered on 18th June, 2014, in respect of the substantive proceedings, Schrems v. Data Protection Commissioner [2014] IEHC 310. This judgment should accordingly be read in conjunction with that earlier judgment. The background to the present proceedings 3. While the complaint was formerly directed at the major social network, Facebook (Ireland) Ltd., the gist of the objection does not really concern Facebook at all. The complaint was rather that in the light of the revelations made from May, 2013 onwards by Edward Snowden concerning the activities of the US National Security Agency (“NSA”), there was no meaningful protection in US law and practice in respect of data so transferred to the US so far as State surveillance was concerned. 4. By letters dated 25th and 26th July, 2013, the Commissioner invoked his power under s. 10(1)(a) of the 1988 Act not to investigate this complaint further on the ground that this complaint was frivolous and vexatious, terms which in this case and in this particular statutory context simply mean that the Commissioner concluded that the claim was unsustainable in law. 5. The reason why the Commissioner reached this conclusion was because (i) there was no evidence that Mr. Schrems’ personal data had been so accessed by the NSA (or other US security agencies)(“the locus standi objection”), so that the complaint was purely hypothetical and speculative and (ii) because the European Commission had determined in its decision of 26th July 2000 (2000/520/EC)(“the Safe Harbour Decision”) that the United States “ensures an adequate level of [data] protection” in accordance with Article 25(6) of Directive 95/46/EC (“the 1995 Directive”). The Commissioner noted that the Safe Harbour decision was a “Community finding” for the purposes of s. 11(2)(a) of the 1988 Act, so that any question of the adequacy of data protection in that third country (in the present case, the United States) where the data is to be transferred was required by Irish law “to be determined in accordance with that finding.” As this was the essence of the applicant’s complaint - namely, that personal data was being transferred to another third country which did not in practice observe these standards - the Commissioner took the view that this question was foreclosed by the nature of the earlier Safe Harbour Decision. 6. In my judgment delivered on 18th June, 2014, (Schrems v. Data Protection Commissioner [2014] IEHC 310) I rejected the locus standi argument. I also found that mass and indiscriminate surveillance of communications, especially private communications generated within the home, would, as a matter of Irish law, be unconstitutional, having regard to the inter-action of the guarantees of privacy and Article 40.5.’s protection of the inviolability of the dwelling. That concept of inviolability would be wholly compromised if private communications of this kind generally made within the home were thus subjected to routine and undifferentiated surveillance by State agencies. 7. Section 11(1)(a) of the 1988 Act precludes the transfer of personal data to third countries, save where that third country “ensures an adequate level of protection for the privacy and the fundamental rights and freedoms” within the meaning of s. 11(1)(a) of the 1988 Act. I held that, were the matter judged entirely by Irish law, then measured by these constitutional standards and having regard to the (apparently) limited protection given to non-US data subjects by contemporary US law and practice so far as State surveillance is concerned, this would indeed have been a matter which the Commissioner would have been obliged to investigate. It followed, accordingly, that if the matter were to be judged solely by reference to Irish constitutional law standards, the Commissioner could not properly have exercised his s. 10(1)(b) powers to conclude in a summary fashion that there was nothing further to investigate. 8. The parties were agreed, however, the matter is only partially governed by Irish law and that, in reality, on this key issue of the adequacy of data protection law and practice in third countries, Irish law has been pre-empted by general EU law in this area. This is because s. 11(2)(a) of the 1988 Act (as substituted by s. 12 of the Data Protection (Amendment) Act 2003) effects a renvoi of this wider question in favour of EU law. Specifically, s. 11(2)(a) of the 1988 Act provides that the Commissioner must determine the question of the adequacy of protection in the third State “in accordance” with a Community finding made by the European Commission pursuant to Article 25(6) of the 1995 Directive. 9. I then held (at paragraphs 64-70 of the judgment) that:
65. All of this means that the Commissioner cannot arrive at a finding inconsistent with that Community finding, so that if, for example, the Community finding is to the effect that a particular third party state has adequate and effective data protection laws, the Commissioner cannot conclude to the contrary. The Community finding in question was, as we have already seen, to the effect that the US does provide adequate data protection for data subjects in respect of data handled or processed by firms (such as Facebook Ireland and Facebook) which operate the Safe Harbour regime 66. It follows, therefore, that if the Commissioner cannot look beyond the European Commission’s Safe Harbour Decision of July 2000, then it is clear that the present application for judicial review must fail. This is because, at the risk of repetition, the Commission has decided that the US provides an adequate level of data protection and, as we have just seen, s. 11(2)(a) of the 1998 Act (which in turn follows the provisions of Article 25(6) of the 1995 Directive) ties the Commissioner to the Commission’s finding. In those circumstances, any complaint to the Commissioner concerning the transfer of personal data by Facebook Ireland (or, indeed, Facebook) to the US on the ground that US data protection was inadequate would be doomed to fail. 67. This finding of the Commission is doubtless still true at the level of consumer protection, but, as we have just seen, much has happened in the interval since July 2000. The developments include the enhanced threat to national and international security posed by rogue States, terrorist groupings and organised crime, disclosures regarding mass and undifferentiated surveillance of personal data by the US security authorities, the advent of social media and, not least from a legal perspective, the enhanced protection for personal data now contained in Article 8 of the Charter. 68. While the applicant maintains that the Commissioner has not adhered to the requirements of EU law in holding that the complaint was unsustainable in law, the opposite is in truth the case. The Commissioner has rather demonstrated scrupulous steadfastness to the letter of the 1995 Directive and the 2000 Decision. 69. The applicant’s objection is, in reality, to the terms of the Safe Harbour Regime itself rather than to the manner in which the Commissioner has actually applied the Safe Harbour Regime. There is, perhaps, much to be said for the argument that the Safe Harbour Regime has been overtaken by events. The Snowden revelations may be thought to have exposed gaping holes in contemporary US data protection practice and the subsequent entry into force of Article 8 of the Charter suggests that a re-evaluation of how the 1995 Directive and 2000 Decision should be interpreted in practice may be necessary. It must be again stressed, however, that neither the validity of the 1995 Directive nor the validity of the Commission’s Safe Harbour decision have, as such, been challenged in these proceedings.70. Although the validity of the 2000 Decision has not been directly challenged, the essential question which arises for consideration is whether, as a matter of European Union law, the Commissioner is nonetheless absolutely bound by that finding of the European Commission as manifested in the 2000 Decision in relation to the adequacy of data protection in the law and practice of the United States having regard in particular to the subsequent entry into force of Article 8 of the Charter, the provisions of Article 25(6) of the 1995 Directive notwithstanding. For the reasons which I have already stated, it seems to me that unless this question is answered in a manner which enables the Commissioner either to look behind that Community finding or otherwise disregard it, the applicant’s complaint both before the Commissioner and in these judicial review proceedings must accordingly fail.” Given that the critical issue in the present case was whether US law and practice afforded sufficient data protection and that no issue was ever raised in these proceedings concerning the actions of Facebook Ireland/Facebook as such, I took the view that the real question was whether the Commissioner was bound by the earlier findings to this effect by the European Commission in the Safe Harbour Decision. In other words, this was really a complaint concerning the terms of that decision, rather than the manner in which the Commissioner had applied it: see paragraph 69 of the judgment. While it is true that Article 3(b) of the Safe Harbour Decision allows the national authorities to direct an entity to suspend data flows to that third country, this is in circumstances where - unlike the present case - the complaint is in substance directed to the conduct of that entity. Here the real objection is not to the conduct of Facebook as such, but rather to the fact that the Commission has already determined that the US law and practice provides adequate data protection in circumstances where it is clear from the Snowden disclosures that personal data of EU citizens so transferred to the US can be accessed by the US authorities on a mass and undifferentiated basis, thus permitting the physical transfer of such data from Ireland 9and elsewhere in the European Union) to the United States.” 11. In these circumstances I took the view that it would be appropriate that I should refer the question of whether, having regard in particular to my earlier findings of fact regarding the Snowden disclosures and the subsequent entry into force of Article 7 and Article 8 of the Charter and the recent judgment of the Court of Justice in Case C-293/12 Digital Rights Ireland [2014] E.C.R. I-000, the Commissioner was bound by the earlier determination of the European Commission in the Safe Harbour Decision as to the adequacy of the data protection offered by US law and practice. 12. So far as the present application is concerned, two separate issues arise. First, should DRI be joined as an amicus curiae to the present proceedings? Second, even if it were to be so joined, should it be permitted to have an additional question or questions added to the proceedings? We may now consider these issues in turn. Should DRI be joined as an amicus curiae?
It is, at the same time, a jurisdiction which should be sparingly exercised. Clearly, the assistance to be given to an appellate court will be confined to legal arguments and supporting materials. It is not necessary to consider the circumstances in which it would be appropriate for the High Court to appoint an amicus curiae. It is sufficient to say that, as was pointed out in United States Tobacco Company v. Minister for Consumer Affairs (1988) 83 ALR 79 the position of an amicus curiae is quite different from that of an intervener. It was said in that case that an amicus curiae, unlike an intervener, has no right of appeal and is not normally entitled to adduce any evidence. In the present case, an issue of public law arises and the judgment of the court may affect parties other than those now before the court. The court was satisfied that the UNHCR might be in a position to assist the court by making written and oral submissions on the question of law certified by the High Court and, accordingly, appointed it to act as amicus curiae and, for that purpose, to make oral and written submissions.” 15. In this regard, the neutrality of the putative amicus is also a factor, since as Clarke J. observed in Fitzpatrick v. FK (No.1) [2007] 1 I.R. 406, 415, one of the important factors to be taken into account is whether:
17. It is also significant that in O’Brien Finnegan P. stressed that the Law Society “has not just a sectional interest, that is the interest of its members, but a general interest which should be respected and to which regard should be had”: see [2005] 3 I.R. 328, 333. That case raised wider questions regarding the solicitor/client relationship in the context of personal injuries claims and to that extent the Law Society had an important contribution to make to draw attention to the implications and importance of that relationship. 18. It is also clear that the amicus does not have the status of a party to the litigation - so that, for example, it cannot call evidence or lodge an appeal - and it cannot add materially to the costs of the litigation by, for example, seeking its own costs. The case must furthermore normally involve questions of public law, often with significant implications for the general public. Moreover, as Keane C.J. stressed in I., the jurisdiction is one to be “sparingly exercised.” Measured, then, by these standards, should, then, the Court appoint DRI as an amicus? Costs Whether the case involves questions of public law with significant implications for the general public The expertise of DRI
Whether DRI has been assigned any role by either domestic or international law in the area which is the subject matter of the litigation 24. At the same time I think that it clear from the case-law that the fact that the putative amicus has been given no such express role by domestic or international law cannot in itself be regarded as a disqualifying factor. Thus, for example, in Fitzpatrick Clarke J. contemplated that the Watch Tower Bible and Tract Society of Ireland might successfully apply to be made an amicus at a later stage of those proceedings were the circumstances so to warrant it. This was also the approach taken by Kelly J. in EMI when he stated that he did not regard the fact that DRI had been given no such public role as a threshold factor which justified the refusal of the amicus application in limine. It was, rather a discretionary factor which was nonetheless of “some significance”. Whether the applicant might be expected to adopt a partisan fashion were it to be appointed as an amicus. 26. There is, however, no suggestion that DRI have been involved in any public campaigns in relation to the issues raised by this litigation. Mr. Ó Lachtnáin has, moreover, averred in his affidavit grounding the present motion that DRI “is concerned to take no position of partisanship in respect of the dispute between the parties here.” 27. One cannot help feeling, however, that on this question of partisanship both litigants and courts have all at times engaged in something of a polite fiction. After all, the views of the UNHCR regarding the plight of refugees are well known. The Law Society can be expected to have strong views on the rights of solicitors and their clients. One may equally assume that DRI has strong views on the adequacy of the Safe Harbour regime. 28. Partisanship cannot, moreover, be easily measured by objective standards. This is perhaps especially true of legal proceedings where, after all, the task of the advocate is to persuade. The submission which aspires to complete impartiality and icy detachment may be regarded by some on this account as bland and ineffective. 29. What is, I think, clear from the views of Kelly J. in EMI is that open partisanship which is detached from the underlying legal materials and the legal merits is most undesirable and attracts judicial disapproval. In that respect, therefore, the legal advisers representing the amicus bear a particular responsibility to ensure that the standards appropriate to legal professionals are not compromised in any written or oral legal submissions made on behalf of the amicus, even if those submissions are strongly advanced in favour of a particular legal argument. One of those duties of counsel is, of course, to bring all relevant legal materials and authorities to the attention of the court, even if those materials are adverse to the interests of the client. 30. All of this is to say that is that while prospective amicii who hold strong institutional views on the subject matter of the dispute are not disqualified on that account alone from being appointed as an amicus, they are also expected and required to confine themselves to the traditional parameters of legal argument. In view of Mr. Ó Lachtnáin’s unchallenged averments regard DRI’s likely role, I am prepared to assume in its favour that it will be abide by these strictures. The attitude of the parties 32. The applicant himself, Mr. Schrems, is opposed to the joinder of DRI as an amicus. His counsel, Mr. O’Shea, makes the point that all relevant arguments are likely to be canvassed given the large number of Member States who, it is anticipated, are likely to intervene before the Court of Justice. The applicant is a postgraduate law student in his twenties who is at the start of his legal career. He is naturally and understandably concerned about the possible costs implications of the joinder of another party. 33. So far as the costs are concerned, it will, however, be a condition of any joinder that DRI will not be allowed to seek costs from any party. In fairness, DRI have at all times recognised this limitation. It may, furthermore, be anticipated that its participation in oral argument will be confined to a short period of time, so that its participation in the proceedings will not represent an additional costs burden for either party by adding appreciably to the length of the hearing. 34. I agree with Mr. O’Shea that it is very likely that many Member States are likely to seek to intervene in the Article 267 TFEU reference, so that it is unlikely that any relevant point will be overlooked. Yet given the track record of DRI - not least its recent successful challenge to the validity of the Data Retention Directive - it is likely that it will be in a position to articulate its own distinctive views on these questions of data protection and surveillance. The articulation of these views may assist the Court of Justice as that Court grapples with these difficult questions. Conclusions on whether DRI should be appointed an amicus 36. Yet, not without considerable hesitation, I have concluded that I should make such an order appointing DRI as an amicus. I take this view because in the light of the decision of the Court of Justice in Digital Rights Ireland, I think that DRI can articulate its own distinctive view which may possibly assist the Court in respect of these difficult and troubling questions which are the subject of the reference. Whether DRI should be permitted to add an additional question to the questions already referred pursuant to Article 267 TFEU 38. As I indicated at the hearing, I did not think that this course of action would be appropriate. As I was at pains to stress in the first judgment, the applicant has never chosen to challenge the validity of either the Directive or the Safe Harbour decision. Quite apart from the fact that - as decisions such as I. illustrate - an amicus is normally bound by the parameters of the existing litigation, the addition of these questions would radically change the nature of the proceedings. Moreover, given that, as I have found, s. 11(2)(a) of the 1988 Act gives effect to the requirements of Article 25(6) of the 1995 Directive by obliging the Commissioner to follow the terms of the Safe Harbour Decision, a challenge to the validity of the Directive would be tantamount to a challenge to the constitutionality of s. 11(2)(a). 39. On any view, the Attorney General would have to be party to any proceedings in which the validity of the 1995 Directive was put at issue. Inasmuch as this would also amount in substance to a challenge to the constitutionality of s. 11(2)(a) - given that, on this argument, the Oireachtas would have wrongly transposed an item of Union legislation which was itself later found to be invalid by the Court of Justice - Order 60, r.1 of the Rules of the Superior Courts, 1986 requires that the Attorney General be joined as a party. Yet she was never served with the proceedings or joined as a party to the present proceedings. 40. It is, of course, true to observe that as counsel for DRI, Mr. Crehan, observed, there have been instances in the past where an amicus can formulate questions or suggest changes to draft questions in the context of a pending Article 267 TFEU reference. Mr. Crehan pointed to the fact that in Digital Rights Ireland, counsel for the amicus in that case - namely, the Irish Human Rights Commission - made suggestions of this kind. 41. Yet what is proposed here is appreciably different, given that it would radically change the nature of the proceedings and would involve the additional delay and costs associated with the joinder of a further party, namely, the Attorney General. These additional questions would effectively make DRI a party to the litigation in order to facilitate it to make a case which the parties themselves had never made. 42. For all of these reasons, I would not permit DRI as amicus to expand the scope of the proceedings or to alter the nature of the questions which I have already proposed should be transmitted to the Court of Justice. Conclusions |