Data Protection Commission welcomes Supreme Court judgment

The Data Protection Commission (DPC) welcomes the Supreme Court judgment and looks forward to the substantive issues in the case being the subject of a hearing by the CJEU soon.

By a unanimous judgment delivered by the Chief Justice, the Supreme Court rejected Facebook’s appeal in proceedings brought by the DPC on the back of her concerns about the protections afforded to EU persons when Facebook (and others) transfer personal data to the US under the ‘standard contractual clauses’ mechanism. The Court agreed with the High Court’s endorsement of the concerns expressed by the DPC, accepting them to be “well-founded”. It also accepted that the DPC had followed the correct procedural route (as laid down by the Court of Justice of the European Union) in order to bring those concerns to the attention of the CJEU.

In rejecting Facebook’s appeal, the Court refused to interfere with the conclusions drawn by the High Court, having heard detailed evidence in relation to relevant points of US law.

Equally, it upheld the High Court’s approach to the treatment of applicable EU law principles, and the “Privacy Shield” introduced by the EU Commission following the striking down of the “Safe Harbour” arrangements.

The core issues presented by Facebook’s data transfers under the ‘standard contractual clauses’ mechanism will now be adjudicated upon by the CJEU.