Facebook’s attempt to block a series of legal questions relating to a long-running EU privacy case from being referred to Europe’s top court has been throw out by Ireland’s High Court.
Earlier this week the company’s lawyers had asked the Irish High Court to stay the referral to the CJEU of a number of key legal questions pertaining to existing data transfer mechanisms that are being used by thousands of companies (Facebook included) to authorize flows of personal data outside the bloc.
Both the lawfulness of Standard Contractual Clauses and the EU-US Privacy Shield mechanism are now facing questions as a result of this challenge.
However in a ruling today the Irish High Court denied the company’s request for a stay on the CJEU referral — with the judge ordering the referral to be immediately delivered to the Court of Justice, and emphasizing the risk that “millions” of EU data subjects, including privacy campaigner and lawyer Max Schrems whose complaint triggered the court case and subsequent referral, could be having their data processed unlawfully.
“In my opinion very real prejudice is potentially suffered by Mr Schrems and the millions of EU data subjects if the matter is further delayed by a stay as sought in this case,” writes Ms Justice Costello.
She also criticizes Facebook for delaying tactics, and for not making it clear that its appeal against the referral — which Facebook still intends to pursue in the Irish Supreme Court — relates to a time-bound argument that the decision is moot because of an incoming update to EU privacy law (the GDPR).
“The fact that the point is only now being raised gives rise to considerable concern as to the conduct of the case by Facebook and the manner in which it has dealt with the court,” writes the judge in a withering critique.
In a statement on the latest developments in the case, a Facebook spokesperson told us: “We are disappointed not to have been granted a stay on the preliminary reference being made to the CJEU. We intend on continuing with seeking leave to appeal the High Court’s decision to the Irish Supreme Court.”
Schrems’ view is there’s no case for Facebook to make that the legal questions involved here are moot under GDPR, just as he says “no such appeal exists in Ireland” for Facebook to try to appeal against a referral to the CJEU via the Irish Supreme Court — even though the company is trying to do both. (But, as the judge has pointed out, it appears to like trying to buy itself time.)
Depending on how quickly the CJEU rules we’ll soon know for sure — perhaps in a little over a year’s time.
