All Facebook subscribers living in the EU are required to conclude, at the time of registration, a contract with Facebook Ireland, a subsidiary of Facebook Inc. established in the US. Some or all of their personal data is transferred from Facebook Ireland to servers in the US, where it is processed. Maximillian Schrems is an Austrian Facebook subscriber living in Austria. In June 2013, he made a complaint to the Irish Data Protection Commissioner (DPC) by which he asked the DPC to exercise its powers to prevent Facebook Ireland from transferring his personal data to the US on the basis that US law and practice did not ensure adequate protection of the personal data held in its territory against the mass surveillance of data carried out there by the public authorities (for example, under the NSA's PRISM programme).

The DPC took the view that it was not required to investigate the matters raised in the complaint and rejected it as unfounded. In particular, the DPC argued that he was bound by the European Commission's findings in Decision 2000/520 that Safe Harbor ensured adequate protection.

Mr Schrems brought an action before the High Court challenging the decision. The Irish High Court found that although the electronic surveillance and interception of personal data transferred from the EU to the US serve necessary and indispensable objectives in the public interest, the revelations made by Edwards Snowden had demonstrated a "significant over-reach" on the part of the NSA and other federal agencies. In addition, the court found that EU citizens have no effective right to be heard as part of US oversight proceedings. As a result, the court considered that Decision 2000/520 does not satisfy the requirements flowing both from Articles 7 and 8 of the Charter and from the principles set out by the ECJ's judgment in Digital Rights Ireland and Others (C-293-/12 and C-594-12).

The High Court referred the following questions to the ECJ for a preliminary ruling:

In September 2015, the EU Advocate General gave an opinion on the referred questions. For details, see Legal update, Advocate General opinion on EU-US Facebook data transfer suggests Safe Harbor decision invalid.

The ECJ has given a judgment in which it agrees with the Advocate General's opinion. Its answers to the referred questions can be paraphrased as follows:

The ECJ's reasoning can be summarised as follows.

The ECJ's judgement has resulted in immediate reaction by both the European Commission and the Article 29 Working Party.

During a press conference on 6 October, First Vice-President Timmermans described the judgement as "a confirmation of the European Commission's approach for the renegotiation of the Safe Harbor". He stressed that in the meantime, transatlantic data flows between companies can continue using other mechanisms for international transfers of personal data available under EU data protection law. Similarly, Commissioner Jourová emphasised the importance of the judgment for European businesses. She outlined that the Commissions priorities will be to:

In a press release issued by the Article 29 Working Party, it welcomes the fact that the Court’s decision reaffirms that data protection rights are an inherent part of the EU fundamental rights regime. The Working Party points out that it has been studying the impact of mass surveillance on international transfers and has on several occasions presented its concerns. The Working Party is aware that the judgment, taken in the context of the negotiation on the draft Data Protection Regulation and the discussions on the Safe Harbor between the European Commission and the US authorities, has major consequences for all stakeholders. It therefore plans to organise a first round of discussions between experts in order to provide a coordinated analysis of the Court’s decision and to determine the consequences on transfers.

Even ignoring the commercial and political impact the ECJ's decision will have on data flows between the EU and the US and, consequently, on the relationship between the two, the judgment is interesting for a number of reasons.

For a start, it is increasingly clear that the Court has now fully accepted its own role as the guardian of the EU fundamental rights framework set out in the Charter and the Treaties. The declaration that it alone is the ultimate arbiter of whether EU acts, both legislative and executive, comply with Charter rights essentially confirms its relatively recent role as a true EU "constitutional court" that will act alongside the European Court of Human Rights (ECHR) and the national constitutional courts to ensure fundamental rights protection in Europe. This will be welcomed by some countries, which have long harboured concerns that the standard of judicial redress with regard to fundamental rights protection at EU level falls below that provided at national or ECHR level. Other countries like the UK, where powers of the courts to invalidate legislation are often viewed with suspicion, are more likely to receive this development with concern.

Procedurally, the judgment has the potential to cause an administrative headache for those member states, again like the UK, where opportunities for judicial review of legislative acts are strictly limited. The ECJ's requirement that national supervisory authorities must have the right (and may indeed have the duty) to apply, before the national courts, for judicial review of an EU act (if the authority, along with a complainant, considers that act to be incompatible with Charter rights) is not reflected as such in the Data Protection Act 1998. Standing to request judicial review is strictly limited in some countries including the UK and it will take some time until the member states' legislators as well as the supervisory authorities will have achieved clarity on the exact changes that will need to be made to both national law and practice to comply with the ECJ's dictum. This will inevitably contribute and potentially extend the legal uncertainty regarding transatlantic data flows created by the judgment.

On a practical level, the judgment leaves both EU data controllers and US recipients of data flows that have relied on the Safe Harbor to legitimise their data transfers in an immediately precarious situation, meaning that the Commission's initial reaction that controllers can just switch to other justifications seems maybe somewhat optimistic. Although there is generally no impediment that would keep the Commission from reissuing Decision 2000/520, provided that the requirement to review whether the US legislation complies with the requirements set out in Article 25 (2) and (6) is met, this process is likely to take time and may only be completed with full cooperation by the US authorities. Even then, it may be difficult to establish that the US does in fact provide an adequate level of protection, which is one of the reasons why the Safe Harbor was adopted in the first place.

Without Decision 2000/520, businesses will have to rely on other derogations and exemptions from the general prohibitions on data transfers to third countries that do not provide adequate protection. In the short term, it is likely that both the use of standard contractual clauses and Binding Corporate Rules (BCRs) (see Practice note, Cross-border transfers of personal data) will increase. However, both of those methods are now equally vulnerable to judicial review and a potential declaration of invalidity at least to the extent that they are used to authorise transfers of personal data to the US. This applies, in particular, to the standard contractual clauses, that were also adopted by the Commission on the basis of a provision set out in the Data Protection Directive (Article 26(4)). While the current judgment is unlikely to have direct effect in this regard, it is entirely possible that the ECJ, following a similar challenge, will come to a similar conclusion. Both BCRs and standard contractual clauses are designed to enable the transferring EU data controller to prove that the personal data transferred under them will come to no harm in the receiving country. However, for as long as US recipients of those data are under a legal obligation to allow US public authorities wide-ranging access to those data in a way and to an extent that is unacceptable under the EU's fundamental rights framework, that proof will be difficult to deliver.

Finally, EU data controllers may consider relying on one of the other derogations set out in Article 26(1) of the Directive. Among other things, those derogations justify transfers that are made with the data subject's consent or that are necessary, say, for the performance of a contract or on important public interest grounds. However, there are limitations to the usefulness of most of those derogations. Data protection authorities have long cautioned against relying exclusively on the data subject's consent given that it can be withdrawn at any time. Even in cases where the data controller makes the provision of its services conditional on receiving such consents, there is now at least a question mark over whether a contractual requirement for the data subject to consent to a transfer of his data to a potentially unsafe jurisdiction can be considered fair under the circumstances. Some member states' courts (like Germany) have already started to review privacy policies under their national consumer protection regimes and it is probably unlikely that those courts will approve contractual consents of that nature.

The other derogations largely rely on a requirement of "necessity", which - on the basis of settled case law of both the national courts and the ECJ - will often be difficult to construe. In the medium term it may therefore be incumbent upon the European Commission to take political steps to persuade the US to review its own legal framework both with regard to substantive protections afforded to EU citizens' personal data and their rights to judicial redress. Previous endeavours in this regard have mostly been unsuccessful. However, it remains to be seen whether - faced with the potential inability of US companies to provide services involving the transfer of personal data to the US to the lucrative EU market - there will be a change in attitude and approach. The recent promise in the context of the negotiation of the EU-US data protection "umbrella agreement" to improve EU citizens access to the US courts (see Legal update, European Commission announces that negotiations of data protection umbrella agreement have been finalised) is certainly a step in the right direction. However, in the light of this judgment it is now unclear whether or not that initiative, which in any case seems to be stuck in the US legislative process for the time being, will be sufficient to fulfil the requirements as defined by the ECJ. Similarly, other legal developments in the US, like Microsoft's appeal against a decision by a New York district court that US law enforcement agencies should have access to personal data Microsoft stores on its servers in Ireland, will undoubtedly also have to be taken into consideration by the Commission were it to review the US domestic legal framework and international obligations for the purpose of a revised adequacy decision.

For EU data controllers this leaves a period of legal uncertainty that may only be resolved through the adoption of the new Data Protection Regulation. However, it remains to be seen whether the judgment may now even derail the timetable for that legislative project.

Maximillian Schrems v Data Protection Commissioner, Case C‑362/14, 6 October 2015 (Curia).