Irish judge refers Schrems case on data transfers to EU Court

The highest Irish court has decided to refer a case brought by the Irish privacy watchdog DPA to the European Court. The case concerns so-called model contracts, which companies use for data transfers to the US.

According to a document prepared by Austrian Max Schrems, the case concerns the question of whether model contracts, like the Safe Harbor scheme, are suitable for storing personal data of citizens outside the EU. The EU Court declared Safe Harbor invalid two years ago, following a lawsuit by Schrems, in which he argued that the Snowden revelations made it clear that his Facebook data could not be stored securely in the US.

When the scheme was no longer available, Facebook turned to a different means of storing data in the US. The EU has approved these model contracts, or standard contractual clauses. Schrems and afterwards also the Irish privacy watchdog believe that the judge should also declare the model contracts invalid.

Opinions differ in the respect that Schrems believes that the DPA could immediately have made a judgment about the model contracts when he had lodged a complaint. The watchdog rejected that complaint. However, when Safe Harbor ceased to exist, the watchdog changed its mind and filed its own case with the aim of getting a referral to the EU Court. That has now been achieved, writes Reuters news agency. The case is in Ireland, because that is where Facebook’s European branch is.

Although the Safe Harbor arrangement has now been replaced by the so-called Privacy Shield, the current case could have many consequences for companies that still use model contracts. The Privacy Shield itself is also under attack, which means that it is not inconceivable that both means will not pass the review by the court. Digital Rights Ireland filed a complaint against the agreement. The EU and the US recently completed the first annual review of the Safe Harbor successor, but did not mention any problems.