Facebook Appeals Order from Irish Data Protection Commission

Written by: Charles R. Langhorne IV, Esq.

In August 2020, the Irish Data Protection Commission (the “DPC”) issued a preliminary order to Facebook requiring Facebook to suspend data transfers to the U.S. that involve personal data of EU residents. This is the DPC’s first action to enforce the Schrems II ruling issued by the Court of Justice of the European Union (“CJEU”).

Schrems II Decision

The Schrems II decision issued in July 2020, invalidated the EU-US Privacy Shield, which many businesses were relying on to comply with GDPR Article 45 to transfer personal data outside of the EU. Notably, the decision was effective immediately, and did not provide for a grace period to implement an alternative approved cross-border transfer mechanism. The decision did bring into question whether Standard Contractual Clauses (“SCCs”) provide adequate protection for cross-border transfers of personal data, but it did not invalidate the SCCs.

The invalidation of the Privacy Shield has very abruptly left many businesses without a mechanism in place to comply with GDPR Article 45. Due to the sudden nature of the ruling, most EU data protection authorities are not taking any action against businesses for cross-border transfer violations. The buzz in the industry is that the data protection authorities are hopeful the European Data Protection Board will issue some guidance; or the EU Commission and the U.S. will come up with a revised framework, similar to what happened after the EU-US Safe Harbor framework was invalidated.

Irish DPC Preliminary Order

Ireland, however, is moving forward with investigating violations based on the Schrems II decision. The preliminary order issued by the DPC speaks not only to the invalidation of the Privacy Shield, but also notes that SCCs do not provide adequate protection, and orders Facebook to cease any cross-border transfers that rely on SCCs. The DPC’s underlying reason for the order is to ensure EU residents’ data is not stored in the U.S. where it could be subject to government surveillance programs. At this time there is no official ruling that invalidates the SCCs. As a result, Facebook is appealing the preliminary order.

We will continue to follow the judicial review process and provide updates as available.