The European Court of Justice (ECJ) will hear a landmark privacy case regarding the transfer of EU citizens’ data to the United States in July, after Facebook’s bid to stop its referral was blocked by Ireland’s Supreme Court on Friday.
The case, which was initially brought against Facebook by Austrian privacy activist Max Schrems, is the latest to question whether methods used by technology firms to transfer data outside the 28-nation European Union give EU consumers sufficient protection from US surveillance.
A ruling by Europe’s top court against the current legal arrangements would have major implications for thousands of companies, which make millions of such transfers every day, including human resources databases, credit card transactions and storage of internet browsing histories.
The Irish High Court, which heard Schrems’ case against Facebook last year, said there were well-founded concerns about an absence of an effective remedy in US law compatible with EU legal requirements, which prohibit personal data being transferred to a country with inadequate privacy protections.
The High Court ordered the case be referred to the ECJ to assess whether the methods used for data transfers – including standard contractual clauses and the so called Privacy Shield agreement – were legal.
Facebook took the case to the Supreme Court when the High Court refused its request to appeal the referral, but in a unanimous decision on Friday, the Supreme Court said it would not overturn any aspect the ruling.
The High Court’s original five-page referral asks the ECJ if the Privacy Shield – under which companies certify they comply with EU privacy law when transferring data to the United States – does in fact mean that the United States “ensures an adequate level of protection”.
Facebook came under scrutiny last year after it emerged the personal information of up to 87 million users, mostly in the United States, may have been improperly shared with political consultancy Cambridge Analytica.
More generally, data privacy has been a growing public concern since revelations in 2013 by former US intelligence contractor Edward Snowden of mass US surveillance caused political outrage in Europe.
The Privacy Shield was hammered out between the EU and the US after the ECJ struck down its predecessor, Safe Harbour, on the grounds that it did not afford Europeans’ data enough protection from US surveillance.
That case was also brought by Schrems via the Irish courts.
“Facebook likely again invested millions to stop this case from progressing. It is good to see that the Supreme Court has not followed,” Schrems said in a statement.
