In late August, the Irish Data Protection Commission (IDPC) issued a preliminary decision instructing Facebook to suspend transfers of personal data originating in the EU to the US. The preliminary decision follows July's landmark Schrems II judgment of the Court of Justice of the European Union (CJEU) on cross-border transfers of personal data. The CJEU's July judgment invalidated the EU-US Privacy Shield Program for cross border data transfers and imposed significant restrictions on the use of the Standard Contractual Clauses (SCCs) as a mechanism to support cross-border transfers of data and elsewhere.
On September 10, 2020, Facebook Ireland asserted legal action seeking to enjoin the IDPC's proposed ban on Facebook's transfer of personal data from the EU to the US. Facebook Ireland alleges that the IDPC's actions breach several administrative law principles, including failure to conduct a proper inquiry before issuing the preliminary decision, premature judgment and prejudice, failure to follow the IDPC's procedures, breach of fair procedures, and discriminatory treatment.
Facebook's affidavit in support of its claims states that it "is not clear to [Facebook] how, in those circumstances, it could continue to provide the Facebook and Instagram services in the EU". Facebook also warns that if it "alone is being investigated and subject to a suspension of data transfers to the U.S., this would be liable to create a serious distortion of competition".
On September 14, the High Court of Ireland issued an ex parte order temporarily suspending the IDPC's proposed ban on Facebook's data transfers to the US. The court scheduled a hearing on the matter for later this year.
CLICK HERE to read Facebook Ireland's affidavit against the Irish Data Protection Commission.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.