High Court of Ireland Decisions

THE HIGH COURT

 

COMMERCIAL

[2024] IEHC 75

[2023 645 JR]

BETWEEN

 

META PLATFORMS IRELAND LIMITED

 

APPLICANT

 

AND

 

DATA PROTECTION COMMISSION,

IRELAND AND THE ATTORNEY GENERAL

RESPONDENTS

 

THE HIGH COURT

 

COMMERCIAL

 

[2023 169 MCA]

BETWEEN

 

META PLATFORMS IRELAND LIMITED

APPLICANT

 

AND

 

DATA PROTECTION COMMISSION

RESPONDENT

 

 

JUDGMENT of Mr. Justice Michael Quinn delivered on the 13th^th day of February 2024

1.                  On 12 May 2023, the Data Protection Commission adopted a final decision, the "Decision", in an inquiry which concerned the transfers by the Applicant, formerly Facebook Ireland Limited, to its parent company Meta Platforms Inc, formerly Facebook Inc, the operator of Facebook in the US and elsewhere outside the EU/EEA, of personal data relating to individuals in the EU/EEA who visit, access, use or interact with products and services provided by the Applicant. The inquiry commenced on 20 August 2020 and is referred to in this judgment as the "Own Volition Inquiry".

2.                   In the Decision, The Commission found the following: -

(i) that the data transfers are made in circumstances which fail to guarantee a level of protection to data subjects that is essentially equivalent to that provided by EU law and in particular by the GDPR (General Data Protection Regulation), EU 2016 / 679 of 27 April 2016;

(ii) that in making the data transfers, the Applicant is infringing Article 46(1) GDPR;

(iii) that the Applicant is not entitled to rely on derogations under Article 49(1) GDPR.

3.                  The Commission made also the following orders: -

(a) that the data transfers be suspended;

(b) that the Applicant bring its processing operations into compliance with GDPR by ceasing the unlawful processing including storage in the US of personal data of EU/EEA users transferred in violation of the GDPR;

(c) the Commission imposed an administrative fine of €1.2 billion on the Applicant.

4.                  These proceedings are a statutory appeal and judicial review of the Decision.

5.                  Maximillian Schrems is a citizen of Austria. On 25 June 2013 he made a complaint to the Respondent in respect of the processing and transfer of his personal data by the Applicant to Facebook Inc in the US. The inquiry pursuant to that complaint is at an advanced stage, described below, and a final Decision is pending. That inquiry is referred to in this judgment as the Complaint Based Inquiry.

6.                  Mr. Schrems has applied to be joined as a Notice Party in these proceedings. His application is opposed by the Applicant and by the Data Protection Commission.

7.                  The second and third named respondent in the judicial review proceedings (2023 / 645 JR) do not oppose the application and did not participate in this application. Therefore, I shall use the term "Respondent" to refer to the first named respondent in those proceedings.

8.                  I have decided to make an order joining Mr. Schrems as a Notice Party.

9.                  These proceedings are the latest in a long line of proceedings before this Court, the Supreme Court and the Court of Justice of the European Union (CJEU) which concern the transfer of personal data by the Applicant to its parent company and inquiries conducted by the Respondent. The history of these cases is directly relevant to this application.

The Complaint Based Inquiry and Proceedings

10.              On 25 June 2013, Mr. Schrems made his complaint with specific reference to the lawfulness of the transfer of his personal data to the parent company Facebook Inc. The Respondent refused to investigate that matter.

11.              Arising from that refusal, on 21 October 2013 Mr. Schrems instituted judicial review proceedings, against the Data Protection Commissioner (High Court [2013] 765 JR) (the "Schrems Proceedings").

12.              In the Schrems Proceedings, the Court referred certain questions of law to the CJEU. On 6 October 2015 the CJEU delivered its judgment and on 20 October 2015 it ordered that the matter be returned for the consideration of the Respondent which undertook to investigate the complaint (the "First CJEU Judgment").

13.              Following the judgment of the CJEU and the order of the High Court, the Respondent invited Mr. Schrems to submit an updated and reformulated complaint, which he submitted on 1 December 2015.

14.              On 24 May 2016, the Respondent issued a draft decision on the reformulated complaint. In that draft decision, the Respondent raised concerns about the validity of an EU Commission Decision 2010/87/EU, referred to as the SCC Decision (which related to the validity of standard contractual clauses for transfer of data outside the EU) adopted under Article 26 of Directive 95/86 /EC ("the Data Protection Directive").

15.              The Respondent instituted proceedings seeking a reference to the CJEU for the purpose of determining its concerns relating to the validity of the SCC decision (the High Court [2016] 4809 P between the Data Protection Commissioner, plaintiff, and Facebook Ireland Limited and Maximilian Schrems, defendants) ("the DPC proceedings").

16.              Mr. Schrems participated in the DPC proceedings and judgment was delivered by Costello J. on 3 October 2017. On 2 May 2018, following further submissions by the parties arising from that judgment, the court referred eleven questions to the CJEU for its consideration ("the CJEU reference").

17.              The Decision of Costello J. was appealed and affirmed by the Supreme Court.

18.              On 16 July 2020, the CJEU delivered its judgment ("the Second CJEU Judgment") to the following effect: -

(i) that the SCC Decision was not invalid;

(ii) that the Respondent had the ability to suspend or prohibit transfers under the SCC Decision;

(iii) that the Respondent had obligations to suspend unlawful transfers in certain circumstances.

19.              The Complaint Based Inquiry remains extant. It has reached a stage where the Respondent has submitted a draft of its decision to the Concerned Supervisory Authorities of the EU pursuant to a co-operation and consistency mechanism governed by Article 60 of the GDPR.

The Own Volition Inquiry and Proceedings

20.              On 20 August 2020, the Applicant was notified by the Respondent that, on the basis of its consideration of the Second CJEU Judgment, the Respondent had decided to commence an inquiry into data transfers under s. 110 of the 2018 Act (the "Own Volition Inquiry").

21.               The affidavit grounding this application was sworn by Mr. Schrems' solicitor Mr. Michael Collins. He states that he received a letter dated 31 August 2020 from the Commission informing him of the Decision to commence the Own Volition Inquiry.

22.              Arising from the Decision of the Respondent to commence the Own Volition Inquiry, two sets of judicial review proceedings were commenced. The first was "The High Court, no. 2020 617 JR: Facebook Ireland Limited v. The Data Protection Commissioner and, by order, Maximilian Schrems, Notice Party ("the Facebook Judicial Review"). The second was initiated by Mr. Schrems no. 2020 707 JR, Maximilian Schrems v. The Data Protection Commissioner and, by order, Facebook Ireland Limited, Notice Party ("the Schrems Judicial Review").

23.              On 14 May 2021, Barniville J. (as he then was) delivered his judgment in the Facebook Judicial Review. He refused certiorari of the Decision to commence the Own Volition Inquiry.

24.              The Schrems Judicial Review proceedings were compromised before the commencement of the hearing of the Facebook Judicial Review. The compromise was that if the court in the Facebook Judicial Review were to permit the Own Volition Inquiry to proceed, the Respondent would advance both the Complaint Based Inquiry and the own Volition Inquiry as expeditiously as possible. Mr. Schrems would be heard in both inquiries, but in the case of the Own Volition Inquiry on certain terms detailed below. If the court ruled that the Own Volition Inquiry should not proceed, the Respondent would proceed with the Complaint Based Inquiry.

25.              The terms of this compromise and their relevance were the subject of some debate at the hearing of this application. They were recorded in a letter of 12 January 2021 from the Respondent's solicitors Philip Lee to Mr. Schrems' solicitors Aherne Rudden Quigley. The Applicant and the Respondent place reliance on the terms of this letter to demonstrate that Mr. Schrems was permitted to be heard in the Own Volition Inquiry as an interested party only and not as a complainant. The letter describes itself as confirmation of terms agreed between Messrs Philip Lee and Aherne Rudden Quigley and states the following: -

"(1) In the event that the court in its judgment in the Facebook Proceedings permits the DPC to proceed with its Own Volition Inquiry, subject only to the terms of such orders as may be made by the court in connection with the Facebook Proceedings, our client will advance its handling of your client's complaint and the Own Volition Inquiry from the point at which the court delivers its judgment. Each process will be progressed thereafter as expeditiously as possible in accordance with our client's obligations under relevant provisions of the GDPR and the 2018 Act.

(2) If however the court rules that the Own Volition Inquiry may not proceed, or if it rules that the Own Volition Inquiry can proceed but an appeal is brought and any order of the court is stayed pending such appeal, our client will nonetheless advance its handling of your client's complaint under and by reference to sections 109 and 113 of the Data Protection Act 2018.

(3) If the court rules that the Own Volition Inquiry may proceed (and the stay to which that inquiry is presently subject is lifted) the DPC will hear from your client in that inquiry on the terms set out in our letter of 4 December 2020. For ease of reference, those terms are reproduced below:

(i) Your client would be afforded a period of 21 days to make submissions to the DPC.

(ii) In the first instance, your client's submissions would be framed by reference to the issues identified in the DPC's preliminary draft decision, as issued on 28 August 2020. However, your client would also be invited to set out his views in relation to such submissions as may be made by Facebook in response to the preliminary draft decision, to include any reliance by Facebook on legal issues for its EU/US transfers other than the SCCs.

(iii) For the avoidance of doubt, such submissions would not be treated by the DPC as being made by your client in any representative capacity or as being representative of the interests of data subjects generally. Likewise, your clients' submissions would be made, not as a complainant, but as an interested party.

(iv) For the avoidance of doubt, your client will separately retain his right to make submissions in the process by which his reformulated complaint is being handled and pursuant to which data transfers by FIL to Facebook Inc. relating to his personal data will be examined.

(v) To preserve the integrity of the own volition process, your client agrees that material passing between the DPC and your client in connection with the Own Volition Inquiry, to include but not limited to your client's submissions, will not be disclosed to any third party without the prior agreement in writing of the DPC, it being accepted by the DPC that, once a final decision has been delivered, it will be open to your client to publish his own submissions (and only those submissions) provided that, in so doing, no information confidential to FIL is disclosed.

(4) (i) Subject only to the issue of confidentiality, to include the confidentiality issue flagged at point 3(v) above, such materials as were exchanged between our client and FIL in the period subsequent to the final order made by the High Court (Hogan J.) on 20 October 2016 will be made available to your client as soon as practicable. Please note that the 20 October 2016 date has been identified as a reference point on the basis that it marks the point from which the subject matter of your client's complaint shifted from one focused on the safe harbour decision to one focused on the SCC decisions. In principle, there is no difficulty in sharing earlier material - to the extent any such material is held by our client and has not previously been made available - insofar as it is relevant to your client's reformulated complaint.

(ii) Likewise, subject to the issue of confidentiality, such submissions as may be made by FIL in the Own Volition Inquiry and in respect of your clients (now reformulated) complaint will be shared with your client.

(iii) For the avoidance of doubt, the timing of the release of such further material as may be received by our client from FIL from this point forward will be a matter for the DPC, subject to the overriding point that all such material will be made available to your client in sufficient time to allow him to address it in such submissions as he may choose to make in the relevant procedure...

(5) The parties will ask the court to rule on the issue of costs in relation to the Schrems Proceedings once it has delivered judgment in the Facebook Proceedings".

(Barniville J. awarded the Applicant 80% of his costs in the Schrems Judicial Review).

26.              Mr. Schrems submits that this letter indicates that he was afforded a right to be heard and was treated as an "interested party" in the Own Volition Inquiry and he presumes that the Respondent took his submissions into account in reaching the Decision.

27.              Mr. Schrems submits that insofar as his submissions were received and considered by the Respondent and form part of the reasoning for the findings in the Decision, he ought to be joined in these proceedings to defend those reasons and thereby to protect his position.

28.              The Applicant says that it was not a party to this agreement.

29.              The Respondent points to a number of features of this letter in which it is made clear that Mr. Schrems was not being admitted to the Own Volition Inquiry as a party or as a substantive complainant or respondent, but merely as "an interested party". Reference is made in particular to the following contents of the letter: -

(a) that the submissions would not be treated by the Respondent as being made in any representative capacity and not as a complainant, but as an interested party;

(b) that Mr. Schrems separately retains his right to make submissions in his reformulated complaint in the Complaints Based Inquiry pursuant to which transfers of his personal data will be examined.

30.              I accept the submission of the Applicant and the Respondent that the agreement on the part of the Respondent to permit Mr. Schrems to participate in the Own Volition Inquiry does not of itself amount to a confirmation or a binding agreement that he participate as a notice party in later judicial review or appeal proceedings arising from the Decision made on that inquiry. The letter is not determinative of that question either way. It is nonetheless relevant to note the extent of the close connection in the processing of the inquiries demonstrated by this and later correspondence. A further example is an email of 6 August 2021 from the Respondent to Mr. Schrems in the course of the Complaint Based Inquiry which states inter alia the following: -

"(1) FIL submissions as received today follow the same structure as those filed in the Own Volition Inquiry;...

(ii) FIL relies on the same Transfers Impact Assessment materials as were previously released to Mr. Schrems in the context of the Own Volition Inquiry;

(iii) FIL relies on the same "Data Transfers Report" as was previously shared with you"

31.              In a letter of 22 December 2020 Messrs Philip Lee confirmed, in response to a request from Aherne Rudden Quigley, that the Respondent would be prepared to deal with the Complaint Based Inquiry and the Own Volition Inquiry and that they would be "processed concurrently and in parallel with the conduct of the Own Volition Inquiry".

32.              In a separate letter of 7 January 2021, Messrs Philip Lee confirmed to the Applicant's solicitors Mason Hayes and Curran, in the context of inquiries as to interaction between the two inquiries "it would seem sensible that with the agreement of the parties, there would be some degree of interaction between the two processes, not least to avoid the risk of draft decisions being prepared that are mutually inconsistent/incompatible".

33.              Whilst the contents of the letter of 12 January 2021 do not of themselves amount to acknowledgement of Mr. Schrems' right to participate in all future proceedings, such as these two proceedings, that letter, taken together with other correspondence, clearly illustrates that the Respondent recognises the intimate connection between the inquiries and the significant interaction between the two, to avoid the risk of inconsistent or incompatible draft decisions.

Mr Schrems in the Judicial Review Proceedings

34.              Whilst the Schrems' Judicial Review was compromised on the terms recited in the letter of 12 January 2021, he was a notice party in the Facebook Judicial Review Proceedings and duly participated in that hearing.

35.              The Applicant initially objected to the joinder of Mr. Schrems in the Facebook Judicial Review. Later it consented to his joinder as part of an agreement whereby the Applicant was joined as a notice party in the Schrems Judicial Review proceedings, both proceedings being listed for hearing together.

36.              Whatever the Applicant's initial objections to the joinder of Mr. Schrems in the Facebook Judicial Review may have been, the conditionality it attached in consenting to his joinder was fulfilled and he duly participated.

37.              After the disposal of the Judicial Review proceedings, the Own Volition Inquiry proceeded to the point where the Decision now the subject of these proceedings has been made and issued on 12 May 2023.

Order 84: Judicial Review

38.              Order 84, r. 22 provides as follows: -

"22. (1)  An application for judicial review shall be made by originating notice of motion save in a case to which rule 24 (2) applies or where the Court directs that the application shall be made by plenary summons.

(2) The notice of motion or summons must be served on all persons directly affected" (emphasis added).

39.              Order 84, r. 27 provides as follows: -

"27. (1) On the hearing of an application under rule 22, or an application which has `        been adjourned in accordance with rule 24(1), any person who desires to be heard in opposition to the application and appears to the Court to be a proper person to be heard, shall be heard, notwithstanding that he has not been served with notice of the application" (emphasis added).

40.              It is clear from O. 84, r. 22 (2) that the obligation to serve the notice of motion in a judicial review is to serve on "all persons directly affected". That obligation is a minimum requirement as to the identity of parties on whom the notice of motion must be served. On its face it does not state that only persons directly affected may be served. However, the caselaw discussed below says that a plaintiff or applicant is entitled to select who it names as a defendant or notice party, and that a party seeking to be joined against the wishes of the named parties may only be joined if it is directly affected.

41.              The phrase "persons directly affected" does not feature in O. 84, r. 27, which at one reading appears to place the court at large as to who it may consider to be "a proper person to be heard". However, it is clear from the analysis by Herbert J. in Monopower Limited v. Monaghan County Council [2006] IEHC 253 (discussed later) that this is not the case for joinder of parties in judicial review. This subrule does no more than afford the court the flexibility to hear parties where the justice of the case so demands. Herbert J. distinguished the test applying to Rule 22 from that applying to Rule 27.

42.              All of the parties to this application, including Mr. Schrems, were in agreement that the test for joinder is that an applicant be "directly affected".

Order 84 C: procedure in statutory appeals

43.              Order 84 C provides for the commencement of a statutory appeal, as in this case, by originating notice of motion. Order 84 C 2(5) governs the procedures for the issue and service of the notice of motion. Order 84 C 2(6) states that such a notice of motion: -

"shall, unless the Court otherwise permits, be made by motion on notice to any person who the relevant enactment provides shall be a respondent to the appeal and to any other person who the Court directs shall be given notice of such application" (emphasis added).

44.              The requirement that a person be "directly affected" does not appear in this provision. However, all of the submissions were made on the basis that the test is the same as for joinder in judicial review or other cases, namely that a party be a "person directly affected".

The Judicial Review: 2023/645 JR

45.              The Applicant seeks an order of certiorari quashing the Decision of the Respondent made on 12 May, 2023. It seeks also declarations of invalidity of certain provisions of the Data Protection Act, 2018, having regard to the provisions of the Constitution and of the Charter of Fundamental Rights of the EU and a declaration that certain provisions of the Act are incompatible with the State's obligations under the European Convention on Human Rights. It also seeks a declaration that certain provisions of the General Data Protection Regulation are incompatible with the Charter of Fundamental Rights of the EU and/or the European Convention of Human Rights.

46.              The Applicant seeks "insofar as necessary" a request for a reference pursuant to Article 267 of the Treaty on the Functioning of the European Union for a preliminary ruling by the Court of Justice of the European Union.

47.              The grounds on which relief are sought may be summarised as follows.

1.                       That the Respondent failed to exercise its statutory function as Lead Supervisory Authority (LSA), erred in law and fettered its own discretion and failed to investigate and find relevant facts.

2.                       Misinterpretation and misapplication of Articles 46 and 49 of the GDPR.

3.                       That the Decision was made in breach of requirements of fair procedures, due process the right to a fair trial, the right to a defence and the right to good administration.

4.                       That the Decision is unlawful and vitiated by errors of law and ultra vires by reason of the Respondent adopting the Decision on the basis of the Decision of the EDPB (European Data Protection Board).

5.                       Breaches of general principles of EU law including principles of proportionality equal treatment and legal certainty.

6.                       That certain provisions of the Act of 2018 are unconstitutional and incompatible with Article 47 of the Charter on Fundamental Rights of the EU.

The Statutory Appeal: 2023/169 MCA

48.              The Applicant claims that the Decision is vitiated by a multiplicity of errors of law and/or errors of fact. These are summarised in para. 11 of the affidavit grounding the statutory appeal sworn by Yvonne Cunnane, Director and Head of Data Protection and Privacy of the Applicant, sworn on 8 June, 2023. Ms. Cunnane summarised the grounds as follows:

               i.  failure to exercise the statutory function as Lead Supervisory Authority;

             ii. erred in law and fettered its own discretion and failed to investigate and find relevant facts;

          iii.  misinterpretation and misapplication of Article 46 and 49 of the GDPR

           iv.  breach of the requirements of due process, fair procedures and natural and constitutional justice.

             v. that the Respondent erred in law and acted ultra vires in adopting the Decision on the basis of the binding decision of the EDPB dated 13 April, 2023 insofar as EDPB exceeded its competence under Article 65 GDPR

           vi.  breaches of general principles of EU law including the principles of proportionality equal treatment and legal certainty.

49.              It is also submitted in the statutory appeal that the making of the corrective orders and the imposition of the fine were unnecessary, unfair and disproportionate.

50.              Ms. Cunnane refers to the Applicant's intention to bring an action before the General Court of the EU in accordance with Article 263 of the Treaty on the Functioning of the European Union, for annulment of the EDPB decision. She states that a preliminary ruling has been made by the General Court that an annulment application by a controller in respect of a binding decision of the EDPD was not admissible under Article 263. That order is under appeal to the CJEU.

Mr. Schrems

51.              Mr. Schrems claims that he has a "clear vital and direct interest" in these proceedings. He submits that these proceedings concern a decision of the Respondent following its investigation into whether the Applicant, via its Facebook service, has been unlawfully transferring data to the United States. He submits that this question arises directly from the substance of his original complaint. He submits that a judgment in these proceedings to permit or to quash the Decision will affect the future conduct and outcome of his Complaint Based Inquiry and therefore directly affect his interests.

52.              Mr. Schrems says that the Respondent will, in the context of his Complaint Based Inquiry, be bound by the court's decision in these proceedings and must apply the Decision the court makes and its reasoning to the Complaint Based Inquiry and therefore will directly affect the outcome of his complaint.

53.              Mr. Schrems submits that if the court were to quash the Decision this would amount to a rejection of the underlying basis of the Decision as it applies to data transfers by the Applicant to the US, which is a central issue in his complaint. He submits that this would necessitate a "reset" of the Own Volition Inquiry and most likely a reset of the Complaint Based Inquiry and affect the progress of his inquiry, resulting in further delay after more than ten years since the lodgement of his complaint. He submits that any reasoning of the court in these proceedings may also affect the manner in which the Respondent can proceed with the Complaint Based Inquiry. Therefore, a decision is likely to restrain, curtail or otherwise affect his legal rights as a complainant.

54.              Mr. Schrems submits that a finding of incompatibility of the impugned sections of the Data Protection Act 2018 or Articles of the GDPR as sought in these proceedings would not be amenable to appeal and therefore directly affect the Complaint Based Inquiry in a fashion which will have irreversible and irredeemable effect on his rights. I take this to be a submission that when these proceedings are substantively determined, and after any appeals therefrom or on references to the CJEU, become final and unappealable, his rights will be irredeemably and uniquely affected, without the possibility of any later challenge or appeal by him in proceedings arising from the Complaint Based Inquiry.

The objections

55.              The Applicant and the Respondent are united in their opposition to the joinder of Mr. Schrems. They say the following:

1.                       That the test is not whether he has a vital interest in the proceedings but whether he is "directly affected" by the outcome.

2.                       That the links between the Own Volition Inquiry and the Complaint Based Inquiry do not mean that Mr. Schrems is directly affected by the outcome of these proceedings.

3.                       That Mr. Schrems may be interested in the outcome of the proceedings but that he only has a general interest rather than a right or interest "in an individual sense".

4.                       That as regards the Own Volition Inquiry Mr. Schrems is in a position no different to that of millions of data subjects who are the users of the Facebook service in the EU/European Economic Area, by contrast with the Complaint Based Inquiry which is specific to the transfer of his personal data.

5.                       That as the effect of the outcome of these proceedings on the conduct of the Complaint Based Inquiry is no more than one of precedent and is a matter which can be addressed in the course of that inquiry.

6.                       That the joinder of Mr. Schrems would unjustifiably expand the scope of the proceedings and their complexity and length.

57.              The objectors do not object to joinder of Mr. Schrems as an amicus curiae. Such a party would have the right to make submissions, but not to adduce evidence, and would bear its own costs.

Leading authorities

58.              In BUPA Ireland Limited v. the Health Insurance Authority & Ors [2005] IESC 80, [2006] IR 201, Kearns J. considered the question of joinder in judicial review and said: -

". . . where a party has a "vital interest in the outcome of the matter" or is "vitally interested in the outcome of the proceedings" or would be "very clearly affected by the result" of the proceedings, it is appropriate for that party to be a notice party in the proceedings.

While it is true, as argued by counsel for [the Applicant], that a challenge to legislation per se is a matter of public law affecting the public at large and that a private citizen normally will not be joined in proceedings where the Attorney General seeks to uphold the constitutionality of the legislation in question, a very different situation may be said to exist when, as in the present case, a particular party would be "uniquely adversely affected" if the application to strike down the Act and Scheme were to be successful".

59.              In Monopower Limited v. Monaghan County Council [2006] IEHC 253, Herbert J. considered the provisions of O. 84, r. 22 (2) and said the following: -

"A considerable discussion took place before me as to the particular test for joining a person in judicial review proceedings. It seems to me that this motion is divided into two parts: one seeking relief under order 84 rule 22(2) dealing with the right to be served with the proceedings; and the other seeking relief under order 84 rule 26 subrule 1 dealing with a right to be heard in the course of the proceedings. I think that these are two separate and severable matters.

As to the first matter, I am not satisfied that any of these people fall within the definition of persons "directly affected"".

60.              Herbert J. also clarified that: -

"I am satisfied that it is not sufficient that a person have a vital interest in the matter unless, as the rule requires, the person is also "directly affected"".

61.              In Dowling v. Minister for Finance & Ors [2013] IESC 58, Fennelly J. expressed the view that the position may differ depending on whether the proceedings are purely civil and private or whether they concern issues of public law. He stated: -

"In civil litigation, generally speaking, parties are allowed to choose whom they wish to sue. In matters of public law persons other than the public authority may have a real and substantial interest in the outcome. The simplest example is the planning permission. While the judicial review must of necessity be sought on grounds that the planning authority or An Bórd Pleanála on appeal has committed an error of law affecting the validity of its decision, any decision of the court is very likely to affect the very real rights and interests of private persons or corporations. The holder of a planning permission is, of course, potentially affected by the outcome of an application for judicial review of its validity. Civil and public-law proceedings are not, however, in completely watertight compartments. There is an underlying principle that a person is entitled to participate in proceedings which are capable of adversely and directly affecting his or her substantial interests".

(emphasis added)

62.              Fennelly J. also endorsed the importance of the application of the test of whether a person is "directly affected" when he stated: -

"An interested party, i.e. a party directly affected, is, in my view, entitled to be represented to defend his or its interests, even if the Decision-maker is there to advance the same arguments".

63.              This summary is an important statement of the fundamental principle that a party is entitled to participate in proceedings which are "capable of adversely and directly affecting his or her substantial interests".

64.              In North Meath Wind Farm Limited & Ors. v. An Bord Pleanala & Ors. [2018] IECA 49, the applicants sought to quash the board's refusal of an SID (Strategic Infrastructure Development) planning application for a windfarm.

65.              An objector and local resident who had participated in the planning application and had a long history in engagement in relation to the same development, both by way of litigation and otherwise, applied to be joined as a notice party in the judicial review. The application was refused in the High Court (McGovern J.) and the refusal was upheld by the Court of Appeal.

66.              On the question of "direct effect", Peart J. said the following: -

". . . the appellants stand to be affected in some way by a possible decision to quash the refusal of development consent in this case, but they must be considered to be at risk only of being indirectly affected, and not directly affected for the reasons explained. In my view their interest in the proceedings represents a desire on their part to assist and support the opposition being mounted to the developer's challenge by An Bord Pleanála in the hope that the development consent will be upheld and that the matter is not remitted to the Board for further consideration and a fresh decision. The effect of a successful challenge to the refusal of development consent has no direct effect upon them".

67.              Peart J. noted that if the challenge to the refusal of the development consent succeeded, the worst that would happen from the perspective of the appellants in that case was that the matter would be remitted to the Board for fresh consideration of the application. Peart J. expressed the view that in the context of any remittal of the matter to the Board and any further judicial review should the Board decide to grant consent on such a remittal, the appellants would be directly affected, but they would then have their opportunity to participate to protect their interests.

68.              In other cases, the court has refused to join parties who have very direct and, in some cases, vital personal interests in the outcome of proceedings but where the court was not satisfied that they were parties "directly affected". See The National Maternity Hospital v. Minister for Health [2018] IEHC 565 and McElvaney v. the Standards in Public Office Commission [2019] IEHC 128.

69.              The authorities were reviewed extensively by Holland J. in Colbeam v. Dun Laoghaire Rathdown County Council [2023] IEHC 450.

70.              Again, Holland J. made it clear that his decision would turn on whether the Applicants in that case would be "directly affected" within the meaning of O. 84, r. 22 (2).

71.              In looking at the Rule itself, Holland J. stated the following: -

". . . a balance must also be struck in that the law must also recognise that the myriad of circumstances and contexts in which judicial review arises requires a criterion broad enough to ensure that those who, in the interests of justice, genuinely ought to be served, are served".

72.              As to whether the direct effect must be on rights or interests, Holland J. had the following to say: -

"O. 84 r. 22(2) RSC requires that such direct effect must be on "persons". It does not in terms stipulate whether it must be on their rights or whether effect on their interests will suffice. Given my analysis of the authorities, I consider that I can say that, at least, direct effect on such persons' "substantial interests" will suffice. In particular as O. 84 r. 22(2) is entirely silent as to any distinction between rights and interests or what aspects of a "person" must be directly affected, it seems necessary to resort to first principles as enunciated by Fennelly J in the Supreme Court in BUPA to the conclusion that:

"There is an underlying principle that a person is entitled to participate in proceedings which are capable of adversely and directly affecting his or her substantial interests."".

73.              In Fitzpatrick v. F.K. [2006] IEHC 392, Clarke J. considered the position where a party seeks to be joined in proceedings in which he has a "precedential interest". He stated: -

"It is important, in analysing the circumstances in which it is appropriate join parties, to distinguish between what counsel for the hospital described as "precedential interest" in the outcome of proceedings on the one hand and what might, properly, be called a "direct interest" on the other hand. There may be many persons who may have a "precedential interest" in the outcome of a particular set of proceedings. Such interest can arise in a whole range of areas of the law. For example, a person may have been charged with a criminal offence. Legal issues might arise in respect of the proper interpretation of statute or common law relative to that offence. Indeed, questions as to the constitutionality of the offence might arise or analogous questions concerning the appropriate construction of a statue having regard to constitutionally guaranteed rights may require to be determined. However, such issues may well be due to be determined in another case which is at an advanced stage of completion. It has never been suggested, nor could it, in my view, be suggested, that all of the persons whose own criminal trial might be affected one way or the other by the outcome of the first proceedings to come to completion, are entitled to be heard in those first proceedings. No legal system could operate if every person who might have a similar point to make could, no matter what stage proceedings involving them were at, intervene in more advanced proceedings simply on the basis that the Decision in those proceedings might have a precedential value which could adversely affect their interests in some subsequent litigation. The mere fact, therefore, that the Decision in one case may have value as a precedent which can affect subsequent cases cannot, in my view, justify joining parties who might be affected by that precedent in the case in which the precedent may well be set. The sort of "interest" that a party must have in order for it to be proper to join that party must be a more direct interest".

74.              Clarke J. continued: -

". . . it seems to me that in each of the cases where the courts have taken the view that is appropriate to join additional parties against the wishes of the plaintiff or applicant, those parties must be able to establish a direct interest in the actual subject matter of the case rather than an interest which derives from the fact that the result of the case may have value as a precedent which could, in turn, affect other similar litigation".

75.              Clarke J. said later that parties in subsequent litigation will always have the opportunity to attempt to persuade the court hearing their case that distinguishing features apply.

76.              From these cases the following principles are relevant to this case.

77.              Firstly, a party seeking to be joined must be a party "directly affected" by the proceedings.

78.              Secondly, the direct effect must be on the person, and may be an effect on rights or interests, provided in the latter case the interest is a substantial interest ('Colbeam' and 'Dowling').

79.              Thirdly, an effect which is no more than precedential is not a sufficiently direct effect ('Fitzpatrick'). The question is whether the outcome of the case will affect the party in such a unique manner as to warrant joinder.

80.              Fourthly, as identified by Fennelly J. in Dowling, "there is an underlying principle that a person is entitled to participate in proceedings which are capable of adversely and directly affecting his or her substantial interests".  This is echoed by Holland J. in Colbeam where he says the "myriad of circumstances... in which judicial review arises requires a criterion broad enough to ensure that those who, in the interests of justice, genuinely ought to be served, are served".

Joint Cases T70/23, T84/23 and T11/23

81.              The court was referred to an Order of the President of the Tenth Chamber of the General Court in Joint Cases T70/23, T84/23 and T11/23 between the Respondent and the European Data Protection Board. The Respondent sought to annul three decisions of the EDPB insofar as they required the Respondent to conduct certain new investigations and to issue a new draft decision concerning aspects of processing operations carried out by the Applicant. Three persons who had lodged complaints with their respective supervisory authorities in Austria, Belgium and Germany, applied to intervene and the President refused the applications.

82.              Article 40 of the Statute of the Court of Justice of the EU provided that any person "establishing an interest in the result of a case" may intervene. The President considered the test and stated as follows:-

"According to settled case-law the concept of 'an interest in the result of the case'... must be defined in the light of the precise subject matter of the dispute and be understood as meaning a direct, existing interest in the ruling on the forms of order sought and not as an interest in relation to the pleas in law or arguments put forward."

He continued:-

"It is necessary, in particular, to ascertain whether the intervener is directly affected by the contested measure and whether his, her or its interest in the result of the case is established. In principle, an interest in the result of the case can be considered to be sufficiently direct only in so far as that result is capable of altering the legal position of the prospective intervener..."

83.              The President refused the application to intervene, finding that provisions of the contested decision in that case were not such as to alter the legal position of the parties seeking to intervene with regard to the issues they raise "since those provisions merely oblige the Irish Supervisory Authority to conduct investigations and subsequently to draw up draft decisions, which will themselves be submitted for the opinion of the other supervisory authorities concerned".

84.              The President identified that the contested decisions were made in proceedings only between the National Supervisory Authority and the Board and relate only to questions of whether the Board may compel a National Supervisory Authority to extend the scope of an investigation and "the fate of the substantive issues relating to the lawfulness of the data processing at issue would by no means be sealed and the situation of legal uncertainty referred to in paragraph 17 above would not become definitive". Regardless of the outcome, it would remain open to the prospective interveners in certain circumstances by bringing actions before their own national courts to have their claims dealt with. He rejected the submission that the result of the case before the General Court would have a "direct and concrete impact on the cases before the national courts."

85.              The test of establishing "an interest in the result of the case" is virtually identical to the test applied in all the Irish cases, albeit expressed a little differently. This ruling concerned an attempt to intervene in proceedings between one regulator, the Respondent, and the EDPB, the outcome of which would not, as the President put it, "seal the fate" of the putative interveners. The difference in that case is that the Ruling was rooted in a finding that the most that would occur at the outcome of the annulment proceedings would be a cancellation of the Decision of the Board requiring the Respondent to conduct certain investigations. It is very similar to the planning cases considered in North Meath Wind Farm (op cit.).

Origins of the Own Volition Inquiry

86.              The Respondent submitted that the genesis of the Own Volition Inquiry is not the complaint of Mr. Schrems and predates 2013. Reference was made to concerns internationally about data privacy and protection and that these concerns had come to the Respondent's attention even before the complaint was made. No evidence was adduced to support this submission and the weight of all the evidence is to the contrary.

87.              It is informative to examine the precise scope of the inquiries as described in paras. 18 and 27 of the affidavit of Ms. Cunnane sworn 6 July 2023.

88.              In para. 18, Ms. Cunnane quotes from the preliminary draft decision in respect of the Own Volition Inquiry which states that the inquiry would consider the following two issues: -

"(1) whether FB - I is acting lawfully, and in particular, compatibly with Article 46 (1) of the General Data Protection Regulation (1) ("GDPR") in making transfers ("the Data Transfers") of personal data relating to individuals who are in the European Union / European Economic Area who visit, access, use or otherwise interact with products and services provided by Facebook Ireland Limited, each of whom is a "data subject" for the purpose of GDPR Article 4 (1) ("Users") to Facebook Inc ("Facebook") pursuant to standard contractual clauses ("SCCs") based on the clauses set out in the Annex to Commission Decision 2010 / 87 / EU 2 ("the SCC decision"), following the judgment of the Court of Justice of the European Union ("the CJEU"), delivered on 16 July 2020 in Case C - 311/18 Data Protection Commissioner v. Facebook Ireland Limited and Maximilian Schrems, EU:C:220:559 ("the judgment"); and

(2) Whether and/or which corrective power should be exercised by the Commission pursuant to GDPR Article 58 (2) in the event that the conclusion is reached that FB - I is acting unlawfully and infringing GDPR Article 46 (1)".

89.              In para. 27, Ms. Cunnane quotes from the Notice of Commencement of Inquiry for the Complaints Based Inquiry, which the Respondent received on 18 June 2021 as follows: -

"In the course of the inquiry, the DPC will examine and consider the following points, in particular: -

(1) Whether, having regard to the judgment of the CJEU of 16 July 2020 in Case C - 311 /18 Data Protection Commissioner v. FB - I and Maximilian Schrems, FB - I is acting lawfully, and in particular, compatibly with Article 46 (1) of the GDPR if/when it transfers Mr. Schrems' personal data to the United States pursuant to SCCs, based on the form of standard contractual clauses set out in the Annex to Commission Decision 2010/87/EU; and

(2) If and to the extent that it relies on a legal basis other than the SCCs in connection with any such transfers, whether FB - I is acting lawfully in so doing, having regard to the relevant provisions of Chapter 5 of the GDPR (in this latter regard, Mr. Schrems says that he does not accept that Facebook Ireland Limited may rely on Article 49(1)(b) GDPR when it transfers his personal data to the United States)".

90.              The most obvious and important distinction between these descriptions is that in the Complaints Based Inquiry, reference is made to the transfer of Mr. Schrems' personal data and in the Own Volition Inquiry, reference is made to the transfers of "personal data relating to individuals who are in the European Union / European Economic Area". It is clear that the Own Volition Inquiry applies to all those who use or access Facebook, which of course includes Mr. Schrems, whereas the Complaints Based Inquiry is stated to be particular to Mr. Schrems' own personal data.

91.              Another apparent difference is that the Preliminary Draft Decision in the Own Volition Inquiry as quoted by Ms. Cunnane does not make any reference to Article 49 GDPR, which concerns derogations. In fact, the Decision itself of 12 May 2023 makes a finding that the Applicant is not entitled to rely on any derogation pursuant to Article 49.

92.              Another difference in the texts, which is extremely limited, is that the Preliminary Draft Decision for the Own Volition Inquiry states that the inquiry would consider the issues identified "following the judgment of the Court of Justice of the European Union delivered on 16 July 2020". The Notice of Commencement in the Complaint Based Inquiry states that the issues described therein would be considered "having regard to the judgment of the CJEU of 16 July 2020".

93.              It does not seem to me that for the decision I am making anything can turn on the difference of phraseology used in the scope descriptions between the phrase "following the judgment of the Court of Justice of the European Union delivered on 16 July 2020" and the phrase "having regard to the judgment of the CJEU of 16 July 2020".

94.              The judgment of 16 July 2020 was made in Case 311/18 in which Mr. Schrems is a defendant named by the Respondent. Those proceedings in turn arose directly from the reference made by this Court in the DPC proceedings 2016 no. 4809 P between the Data Protection Commissioner and Facebook Ireland Limited and Mr. Schrems (2016 4809 P).

95.              In Ms. Cunnane's affidavit of 6 July 2023 (Paragraph 17) she makes it clear that the judgment of 16 July 2020 was made on foot of the reference which in turn had been made in the proceedings to which Mr. Schrems was a party.

96.              After the Respondent announced its intention to commence the Own Volition Inquiry, extensive correspondence was exchanged between the solicitors for the parties. Messrs Mason Hayes and Curran and Messrs Aherne Rudden Quigley raised a series of questions regarding the Own Volition Inquiry intended to be commenced and the interaction between that inquiry and the Complaints Based Inquiry which was still pending.

97.              One of the questions raised by Mason Hayes and Curran on behalf of the Applicant was whether the Respondent had ever before conducted an Own Volition Inquiry into matters concurrently with the Complaint Based Inquiry "into the same (or substantially the same) subject matter". The response from Messrs Philip Lee dated 7 January 2021 stated the following: -

"the DPC is presently conducting a number of own volition inquiries in cases that have their origin in complaints such that both processes are concerned with the same or substantially the same subject matter. In each such case, the DPC has sought to sequence matters by advancing its consideration of key points of principle in the own volition procedure before coming back to deal with any residual issues that remain to be addressed in each individual complaint" (emphasis added).

98.              Other questions were raised regarding the intended conduct of the inquiries and Messrs Lee also confirmed that the Respondent has accepted that: -

"at an appropriate point, to be determined by the DPC, it will circulate a list of issues on which individual complainants would be afforded an opportunity to make submissions in connection with the DPC's Own Volition Inquiry, without in any way cutting across the complainant's right to make submissions in due course in connection with the handling of their own complaint".

99.              The reference by Messrs Lee to "a number of own volition inquiries in cases that have their origin in complaints" is not in itself a confirmation or verification of the fact that this Own Volition Inquiry has its origins in Mr. Schrems' complaint. However, it is inconsistent with this description of events to suggest that the Own Volition Inquiry in this case does not have its origins at the very minimum in part, in Mr. Schrems' complaint.

100.          In Ms. Cunnane's affidavit of 6 July, 2023 she states at para. 18 that the letter of 28 August, 2020 notifying the Applicant that the Respondent had decided to commence an Own Volition Inquiry was "on the basis of its consideration of the CJEU Judgment". This averment is of course not made by the Respondent, but no affidavit was delivered by the Respondent to question this description.

101.          Very clearly the Own Volition Inquiry has its origins in the complaint of Mr. Schrems. If different events or concerns prompted the decision, made only weeks after the Second CJEU Judgment, to commence the Own Volition Inquiry there is no evidence of such before the court on this application. 

Role and involvement of Mr. Schrems in the Own Volition Inquiry and proceedings.

102.          The first aspect of this on which reliance is placed is the fact that the Respondent permitted Mr. Schrems to be heard in the Own Volition Inquiry. The terms of this agreement are recorded in the letter from Philip Lee dated 12 January, 2021.

103.          In that letter it is made clear that Mr. Schrems is being permitted to make submissions "not as a complainant but as an interested party". They were agreeing only to the terms of Mr. Schrems participation in the inquiry, and nothing contained in the letter of 12 January, 2021 committed them, if such a commitment were required, to agreement to his participation in other processes which would follow, such as these proceedings. The terms agreed are nonetheless of interest in the context of the recognition of the Applicant's direct interest in the matter.

104.          Of greater importance is the participation of Mr. Schrems in the Facebook Judicial Review. The parties and the court recognised Mr. Schrems as sufficiently directly affected to be entitled to participate in those proceedings, which concerned the decision to commence the Own Volition Inquiry. These proceedings concern the same inquiry, now at its more advanced stage.

Is Mr. Schrems directly affected?

105.          The questions determined by the Decision made in the Own Volition Inquiry affect Mr. Schrems. His complaint is that the transfer of his personal data to the United States is incompatible with Article 46 of the GDPR and he submits that the Respondent may not rely on derogations provided for in Article 49. It is not suggested, at least in the submissions made on this application, that his personal data is excluded from the parameters of the Decision.

106.          The Respondent says that Mr. Schrems is affected by this Decision in the same way as all the other users of Facebook and therefore his position is indistinguishable for this purpose from many millions of such users. If the position were as simple as that, the case would be clearly governed by the principles described by Clarke J. in Fitzpatrick v. F.K.. However, there is a fundamental difference between the status of Mr. Schrems and the millions of other users.

107.          Other users may have made complaints, but the court has not been informed of any other complaint based inquiry which is in terms comparable to those which arise in both the Complaint Based Inquiry and the Own Volition Inquiry, each of which clearly originates from the original complaint of Mr. Schrems.

108.          Obviously Mr. Schrems is one of the millions of persons whose data falls within the description of data the subject of the Own Volition Inquiry. But this court is being invited to disregard the following:

1.      That the Own Volition Inquiry has its genesis in Mr. Schrems' complaint.

2.      The Own Volition Inquiry was commenced, immediately following and in light of the Second CJEU Judgment, which arose on a reference in proceedings to which Mr. Schrems was himself a defendant, the DPC Proceedings.

3.      The fact of Mr. Schrems' direct engagement with the Applicant from as far back as 2013 through the mechanism of his original complaint, the reformulated complaint, the Complaint Based Inquiry and later the Facebook Judicial Review and the Schrems Judicial Review proceedings relating to the Own Volition Inquiry.

4.      Mr. Schrems has been an active participant, albeit on stipulated limiting terms, in the Own Volition Inquiry.

109.          Mr. Schrems is not simply one of millions of users with a general or indirect interest in the outcome of these proceedings. He is uniquely and directly affected both in light of the history of his engagement on the question common to both inquiries, and his current status in both inquiries.

110.          Mr. Schrems is not in the position of "any other litigant" who finds a case at a more advanced stage than his own which he would like to influence. Nor is he a person concerned about a precedential impact on his interests "in some subsequent litigation", to use the phrase adopted by Clarke J. in 'Fitzpatrick'. He already has a direct role in the inquiry now the subject of these proceedings.

111.          If the relief of certiorari sought in the judicial review proceedings and of annulment sought in the statutory appeal were granted this would have more than a "precedential" effect on Mr. Schrems. It would, as he submits, necessitate a reset of both inquiries and clearly would affect the progress of the Complaint Based Inquiry which derives from a complaint made by him in 2013. It is difficult to conceive of a more direct and unique effect on his rights.

Prejudice.

112.          The Applicant submits that the joinder of Mr. Schrems will expand the scope of the proceedings and their complexity and add therefore to the length of these proceedings "to the prejudice of Meta Ireland".

113.          The grounding affidavit of Mr. Collins sworn 14 July, 2023 on behalf of Mr. Schrems provides some detail to support his assertion that Mr. Schrems' participation would not unnecessarily contribute to the length of the proceedings or cause duplication or unnecessary repetition of argument.

114.          Mr. Collins describes in some detail the extent of the participation of Mr. Schrems in the original DPC proceedings and in the Facebook Judicial Review proceedings. This description illustrates, on the account given by Mr. Collins, that having regard to Mr. Schrems interest in the matter his engagement was not disproportionate and was as he put it "targeted, limited and directed only to the issues central to the determination of the case". He describes the number of days at hearing, time taken with witnesses, and the incremental time added by Mr. Schrems' participation. This evidence is not contradicted by any of the replying affidavits. Instead Ms. Cunnane in her affidavit of 2 October, 2023 simply refers to the absence of any undertaking by Mr. Schrems or by Mr. Collins that if joined as a notice party Mr. Schrems will not seek to introduce additional issues not raised in the proceedings by the parties or that he will not raise matters which are more properly raised in any appeal or review of the Complaint Based Inquiry.

115.          The joinder of a notice party not already in the proceedings always has the potential to increase the length of a trial and costs. That of itself would not be a ground to refuse joinder, and the question is whether doing so is oppressive to the parties or likely to cause an unnecessary lengthening of the trial, duplication of issues with other cases and unnecessary costs.

116.          The trial judge will regulate the conduct of the hearing but generally it will be a matter for the Applicant and the Respondent firstly to advance their evidence, subject to cross examination by each other and by any notice party and to make their submissions. A notice party may then add such evidence and submissions as are material from his perspective and which will be of assistance to the court.

117.          At the conclusion of the substantive hearing and after judgment, the court will consider what orders are appropriate as regards costs. Any party who adds unnecessarily to the length of a trial, or who indulges in undue prolixity or repetition, is exposed to risk of consequences in costs, both in the costs ruling of the court and in the measurement of costs by the Legal Costs Adjudicator. A notice party is no different. The combination of these consequences, and the power of the trial judge to regulate the conduct of the hearing, will all serve to limit the effects of additional time and costs incurred. I am not persuaded that the risk of prolongation of the trial are of sufficient weight in the circumstances of this case to refuse the joinder application.

The 'floodgate' submission

118.          The Respondent submitted that an order joining Mr. Schrems would have serious implications beyond this case and refers to a risk of opening a "floodgate" of potential participants in these or similar proceedings.

119.          Firstly, any further such applications will be scrutinised by the court on their own merits.

120.          Secondly, my conclusion is based on a finding that Mr. Schrems is directly affected in his unique circumstances. There are millions of other users of Facebook, but I was provided with no evidence of any other person who has not only complained but is in the same position as Mr. Schrems.

Amicus curiae

121.          Each of the Applicant and the Respondent has indicated that it would have no objection to the joinder of Mr. Schrems as an amicus curiae. As a general rule, an amicus curiae has no facility to advance his own evidence in the course of the trial. Secondly, an amicus curiae will generally be required to bear its own costs.

122.          The Respondent, in the context of the risk of prejudice, makes the point that Mr. Collins in his affidavit of 14 July 2023 discloses that if joined, Mr. Schrems would participate fully in the hearing and "to the extent necessary, adduce evidence in the proceedings". The Applicant submits that this demonstrates that the involvement of Mr. Schrems would lengthen the proceedings, expand the scope of issues and increase costs and says that "this is a matter of legitimate concern to Meta Ireland".

123.          I have considered this question earlier in the context of the question of prejudice and proportionality and concluded that these concerns do not warrant refusal of joinder. Having found that Mr. Schrems is directly affected by the proceedings he is entitled to be joined as a notice party and not confined to the role of amicus curiae.

Conclusion

124.          The Own Volition Inquiry has its origins in the complaint of Mr. Schrems and earlier proceedings before this Court, the Supreme Court and the CJEU. Having made that complaint, he pursued it by his participation in proceedings concerning both his own complaint and the Own Volition Inquiry, all permitted by this and other courts. He is uniquely and directly affected by these proceedings. I shall make an order in each case joining him as a Notice Party.