DPC Reply to Representation Received From Senator Malcolm Byrne on 7 October 2020

I would be grateful if you could outline for me the reasons as to why the DPC will not be covering the costs of the Schrems II case?

Reply

As in all cases, the allocation of responsibility for the costs incurred by the parties in the course of the case is a matter for the court. The parties have made their respective submissions to the court, and a ruling is now awaited.

In order to address the substance of your Representation, however, it may be of assistance to draw your attention to the following points relating to the litigation.

Purpose of the proceedings – obtaining a reference to the CJEU

It is accepted by all parties to the case that this was unusual litigation, in that the purpose of the High Court proceedings brought by the DPC was specifically targeted at (and only targeted at) the obtaining of a reference to the CJEU, if the Court shared the DPC’s concerns about EU-US data transfers under the EU Commission’s Standard Contractual Clauses, or SCCs. The DPC was obliged to bring these proceedings in light of the ruling of the CJEU in October 2015 in the precursor case, Schrems Vs Data Protection Commissioner. That ruling was to the effect that, if a data protection supervisory authority has doubts as to the validity of an EU-law instrument, it must engage in proceedings before its national courts and seek a reference to the CJEU so that the CJEU can in turn rule on the matter. That is precisely what the DPC did in the present case where, in its investigation of Max Schrems’ complaint against Facebook, a broader structural problem, applicable to data subjects generally, was identified by the DPC. The proceedings were therefore a necessary step for the DPC to take, independent of the complainant’s specific complaint against Facebook, but on the understanding that the outcome of the proceedings would also bear directly on the resolution of the complainant’s complaint.

DPC has not sued the complainant

Much has been made of the naming of Facebook and the complainant as “defendants” in the case. The DPC took this step, not because any order or relief was sought against those parties (it wasn’t), but simply because it was a requirement of the procedural mechanism by which the proceedings were brought to identify a “plaintiff” and “defendants”.

In that regard, the position is that no specific procedure had been set down in Irish law to facilitate the bringing of the form of application called for by the CJEU in its 2015 judgment in Schrems Vs Data Protection Commissioner. Accordingly, the DPC was required to use standard plenary proceedings before the High Court.

Against this backdrop, the contention that the DPC “sued” the complainant is inaccurate. No orders were sought against the complainant; nor was he obliged to participate in the proceedings, reflecting the consistent view of the DPC that his participation was not necessary, particularly where the case was targeted, not at the complainant’s individual circumstances, but at obtaining a ruling by the CJEU on points of principle of general application, reflecting the structural nature of the problem that had been identified by the DPC.

By joining Facebook and the complainant to the case, the DPC afforded those parties an opportunity to participate in the exchanges on all of the issues before the court, if they wished to do so. It is important to reiterate, however, that neither party was obliged to participate, either in the proceedings before the High Court, or in the proceedings before the CJEU.

The position just described was expressly recognised by the High Court in its judgment, where it stated as follows: “The DPC seeks no relief against either party. She joined them as defendants as they were the parties most concerned with the issues in order that they might engage fully in the proceedings. They have each done so.”

Risk of costs

Conscious that his active participation in a case concerning the interests of data subjects generally would carry risk in terms of costs, the complainant brought an application at the beginning of the case in which he asked the Court to make an order directing the DPC to fund his participation in the case, or, alternatively, insulating him from the risk of a costs order being made against him at the end of the case. Ultimately, this application was not pursued by the complainant. The DPC did, however, confirm, at this early point in the case that it would not look to recover any costs from the complainant if he elected to participate in the case in some shape or form. Facebook did likewise. This provided the complainant with a basic level of costs protection going into the case itself. It also served to clarify the position on costs before any significant costs were incurred by the complainant, and at the point when he was deciding whether or not he would take up the opportunity to participate in a case that was not directly concerned with his personal interests and, if so, to what extent.

For the avoidance of doubt, the right of any complainant to have a complaint handled by the DPC, “free of charge” was, and remains, fully preserved.

Complainant’s decision to take up the opportunity to participate in the case

In the event, the complainant decided to participate in the case, fully and actively, before the High Court and, separately, before the CJEU.  

Costs hearing

In terms of the submissions made on behalf of the DPC at the costs hearing in this matter in October 2020, you may wish to note the following points.

The DPC’s position is that it is entitled to recover its costs from Facebook on the basis that Facebook unsuccessfully opposed the making of the reference, both in the High Court and, on appeal, in the Supreme Court. When the reference was duly made, Facebook lost on the core points of EU law decided by the CJEU (the CJEU upheld the points argued for by the DPC).

The DPC is not seeking to recover any costs from the complainant.

The DPC considers that, for the same reasons identified above, Facebook, and not the DPC, should also pay the complainant’s costs.

As between the DPC and the complainant

It is important to recall again that the purpose of the case brought in the Irish High Court was to secure a reference to the CJEU and not to invite the court to make findings adverse to Facebook or the complainant.

It is also relevant to note that the High Court was the most appropriate forum in which the substance of the factual and legal issues at stake could be addressed, and findings made in relation to US law, for example. In that regard, a total of five experts on US law were called to give evidence before the High Court, with that evidence being tested in great detail through cross-examination, following which important findings were in turn made by Judge Costello (and relied on by the CJEU).

In the High Court, the complainant (and Facebook) argued that a reference was unnecessary and that the law as it related to EU-US data transfers was already very clear. Rejecting the arguments of the complainant, the High Court confirmed that it shared the concerns expressed by the DPC in relation to EU-US data transfers and it agreed to make the reference on that basis.

Subject to that important point, and while this may surprise many, the DPC and the complainant were on the same side for most of the issues addressed by both the High Court and the CJEU and, indeed, the complainant supported the DPC in the majority of its arguments against positions advocated by Facebook. For costs purposes, however, it is relevant to note that the complainant duplicated and repeated positions put forward by the DPC on several issues, rather than limiting himself to a discrete number of points where he had something to say that was additional or different to arguments advanced by the DPC. This necessarily gave rise to costs that could have been avoided.

Importantly, in those limited number of instances where the complainant introduced an additional or different point, his opponent was Facebook, not the DPC. So, for example, where the complainant argued that EU-US transfers represent a breach of Articles 7 and 8 of the Charter, his position was accepted by the DPC, but opposed by Facebook. To the extent that the complainant’s position was upheld, it follows (in the view of the DPC) that Facebook should bear the relevant costs consequences.

On the main point where the DPC and the complainant’s positions were at odds (being the question as to whether or not the DPC was bound, even before the reference, to suspend data transfers to the US by Facebook), the complainant says that the CJEU found in his favour, and so (in his view) the DPC should pay all of his costs. The DPC respectfully disagrees with the logic of this position and with the complainant’s characterisation of the CJEU’s judgment, noting, not just that the judgment is transformative of the law as it applies to the use of SCCs for transfers of data to the US, but, more specifically, that the allocation of responsibility between data controllers and data protection supervisory authorities has been significantly reworked through the judgment, with the supervisory authorities’ duty to intervene, in individual cases, and on a case by case basis, being clarified to a very significant extent. Importantly, the complainant is incorrect when he says that the CJEU found that the suspensory power vested in supervisory authorities under Article 4 of the SCCs Decision provides (and always provided) a full answer to the concerns expressed by the DPC.

All of these matters were the subject of detailed submissions by the parties to the High Court on the issue of costs and it will now be a matter for that court to weigh (and balance) all of the factors in play as it decides how responsibility for the costs of the proceedings should be allocated and apportioned.