Facebook loses a round in the match that will decide the future of data transfer from Europeans to the USA. In Ireland, the justice authorized the local CNIL to continue its investigation, which could prove very unfavorable for the American social network.
The endless legal battle over the legality of the transfers made by Facebook of data from European Internet users to the United States continues, with a recent development to the detriment of the social network. Indeed, it has been reported in the press that the community site has lost a round in the Irish courts, while attempting to thwart a new investigation against it.
Concretely, the decision rendered on May 13 by the High Court authorizes the Data Protection Commission (DPC), i.e. the local National Commission for Informatics and Freedoms (Cnil), to conduct a second investigation of his own head on these transatlantic transfers. The DPC is on the front line in this case, because it is in Ireland that Facebook supervises its activities in Europe.
Facebook had made procedural arguments in an attempt to block a verdict that would pave the way for a resumption of Irish investigations, but they were swept aside by the High Court. The social network had notably argued that the local regulator had left him too little time to respond, and had also rendered a premature judgment.
A procedure with many twists and turns
The news was obviously immediately greeted by the association Noyb (None of your Business), led by the activist and Austrian lawyer Max Schrems. A press release published on May 13 now considers that the DPC can now only make a decision that requires Facebook to stop the transfer of data from Europe to the USA. Max Schrems predicts it for the next few weeks.
« We now expect the DPC to make a decision to stop Facebook’s data transfers before the summer. This would force Facebook to store most of the data from Europe locally, to ensure that Facebook USA does not have access to European data. The other option would be for the United States to change its surveillance laws. », He declares.
The case against Facebook dates back to 2013, when Edward Snowden made his revelations about US Internet surveillance programs. Since then, a legal battle has started to prevent American companies, in particular Facebook, from sending data to the United States, where they could be precisely exposed to these programs.
The case against Facebook today has many developments, which are difficult to follow. The Noyb association nevertheless provides a diagram showing the major stages which have taken place for more than seven years now. Now there are two separate procedures on the DPC table that Noyb believes must somehow lead to the interruption of these data flows.
The court decision rendered in mid-May is procedural, but it could have strong consequences on transatlantic digital relations, depending on the follow-up given to it. It is also part of a context where two legal frameworks supposed to set the rules of the game for this transfer have been shattered: the Safe Harbor in 2015 and the Privacy Shield in 2020.
The invalidations of these two devices have in common Max Schrems, who has become in less than ten years one of the pet peeves of the giants of the web. It is indeed the starting point of the procedures that brought down the Safe Harbor and the Privacy Shield. Now, Facebook could find itself forced to have to suspend the sending of information across the Atlantic.
This prospect alarms the social network, which last fall warned the European Union about the economic consequences that could arise without a framework that organizes the flow of personal data between the two continents. The American company warned that this would not only concern its case, but all the other companies which apply identical transfers.
