Case could have far-reaching consequences for businesses
Facebook is facing a legal challenge at the European Court of Justice over the way it handles the transfer of users' data outside the European Union.
The case is being brought by Austrian lawyer Max Schrems, who previously took the social media giant to court four years ago in a case that resulted in the overturning of a widely used trans-Atlantic data-transfer system, because of concerns intelligence services in the United States might get unrestricted access to EU data, a dispute known as the Safe Harbor dispute.
Schrems' latest challenge queries how commercial data is transferred. This is currently covered by what are known as standard contractual clauses, widely regarded as being the most efficient transfer system since the 2015 ruling. His case also asks questions of the EU-US Privacy Shield, the trans-Atlantic data transfer pact that was brought into replace Safe Harbor in 2016.
Schrems said Facebook's policies are illegal because if users want to use the social media platform, they are forced to give their consent for Facebook to process their data. Under the EU's General Data Protection Regulations, or GDPR, brought in last year, forced consent is not regarded as a valid legal basis for data-processing.
Ross McKean, a data protection lawyer at DLA Piper in London, said this case could have more wide-reaching consequences than the previous one, because of uncertainty about what might follow.
"This is a far more important and significant case than the first Schrems decision," he said. "When the court torpedoed Safe Harbor, there was an alternative. What's different with Schrems II (as the new challenge is known) is, we don't have any alternative, at least none which is quick and easy to implement."
Schrems started his current action against Facebook in the courts of Ireland, where the company's European headquarters is based. They referred it to judges at a European level, and the potential consequences could be huge, because while Safe Harbor and Privacy Shield relate to date movement between the EU and US, standard contractual clauses cover dealings between the EU and all non-EU countries.
Facebook has spent two years trying to prevent the case being referred up to the European authorities. The company's Associate General Counsel Jack Gilbert said the clauses "enable thousands of Europeans to do business worldwide" and "provide important safeguards to ensure that Europeans' data are protected once transferred overseas", but London-based technology lawyer Peter Church told the Bloomberg that it was "pretty unlikely" the EU court would uphold the current format of standard contractual clauses.
The consequences for businesses if the clauses or the privacy shield were rejected could be deeply problematic, leaving many companies potentially in breach of GDPR rules, and possibly facing fines of as much as 4 percent of their annual sales.
