Facebook loses bid to block US-EU data sharing decision

Ireland DPC can now proceed with its investigation into Facebook data sharing

Ireland ' s High Court has dismissed Facebook ' s attempt to block the Irish Data Protection Commission ' s (DPC) ruling on the social media company's data transfers, about EU users, to the USA.

Facebook claimed that the Irish privacy regulator had issued the ruling prematurely, giving the company too little time to respond. The court has rejected that assertion, and allowed the DPC to proceed with its investigation into Facebook's data sharing.

The case is significant for the social media firm, which could be forced to store EU users ' data locally if the DPC orders it to stop moving data to the USA for processing.

The DPC issued its preliminary ruling on data flows last August, when it told Facebook to stop transferring European users' data to servers in the USA. The regulator said it was concerned that the privacy of European citizens might not be respected in the country.

The DPC has also told Facebook that the company cannot use the Standard Contractual Clauses (SCCs) mechanism to transfer users' data between the EU and the US.

The order followed a landmark judgement by the European Court of Justice (ECJ) in July when the EU ' s top court ruled that the transatlantic Privacy Shield agreement between the EU and the US was invalid, because it was unable to protect European users' data from US surveillance mechanisms.

However, the ECJ still allowed cloud companies like AWS and Google to use SCCs as a legal mechanism of data transfers, with some adjustments. Microsoft is currently testing a plan to store European data in Europe.

Facebook responded to the ruling by filing for a judicial review, obtaining a stay on the regulator ' s procedure.

In an affidavit submitted to Ireland's High Court in Dublin, Yvonne Cunnane, Facebook Ireland's head of data protection and associate general counsel, said the DPC's order would force the company to stop providing its services in Europe, leaving nearly 410 million people unable to use Facebook or Instagram.

The DPC still needs to submit a final draft of its order to EU privacy regulators. If the draft is approved, it could have a widespread impact on tech firms that have been conducting trans-Atlantic business online and transferring EU users' data to the USA.

According to Facebook, a lack of safe and secure data transfers internationally would only impede the growth of data-driven businesses in the EU.

Commenting on the court ' s order on Friday, Facebook said the issues it raised impact 'thousands' of businesses, and that it is taking 'all adequate measures' to protect data.

"We look forward to defending our compliance to the [Irish Data Protection Commission], as their preliminary decision could be damaging not only to Facebook, but also to users and other businesses," a Facebook spokesperson said.