Facebook's data transfer arrangements face legal challenge in Irish court

Model transfer clauses come under scrutiny as Irish data protection commissioner looks to refer them to the ECJ

Ireland's data protection commissioner, Helen Dixon, is looking to refer Facebook's use of the "model contract clauses" mechanism for transferring personal data from the EU to the US to the European Court of Justice (ECJ).

Dixon believes that the decision over the validity of model contract clauses should be taken at the highest level, and that complaints made against the mechanism are "well founded".

Model contract clauses are a standardised form of document that, once approved by the European Commission (EC), allow companies to transfer data without further reference to the authorities. For many years they have been the preferred legal mechanism for US companies seeking to transfer personal data out of the EU.

Privacy Shield, which replaced the now defunct Safe Harbour arrangement after the latter was deemed unfit for purpose by the ECJ following Edward Snowden's revelations, stipulates that for personal data to be transferred out of the EU, data protection measures in the destination jurisdiction should be broadly equivalent to the EU's own, something that many lawyers argue is not the case with the USA. There have been many complaints that model contract clauses are an unjustifiable loophole.

Last year Max Schrems, the Austrian law student whose case against Facebook brought about the demise of Safe Harbour, said: "There's no way that the ECJ can say that model contract clauses are valid if they killed Safe Harbour on the same grounds. Everyone in the room knows model contract clauses are a shaky thing, but it was the best they had so far."

If Ireland's data protection commissioner Helen Dixon does indeed refer Facebook'a use of model transfer clauses to the ECJ, the ramifications could be huge, not just for Facebook, whose European headquarters are in Dublin, but for thousands of other US companies that rely on the mechanism too, including Google, Amazon and Apple.

A hearing into the case began in the Irish High Court yesterday and is expected to last three weeks. Along with the data protection commissioner, Facebook will also present its arguments before the court, as will representatives of the US government.

The US government's case will not be made easier by recent moves to increase data sharing across the intelligence agencies signed into law by president Obama as he left office. There is also widespread distrust of the Trump administration with 80 per cent of UK citizens fearing that Donald Trump will use US state surveillance powers for personal gain, according to a survey by Privacy International.

Privacy Shield itself is expected to come under further scrutiny once the General Data Protection Regulation becomes law in 2018.

Join Computing's IT Leaders Forum Getting Ready for the GDPR - Tuesday 28 February