Top European court should decide on Facebook privacy case, judge says
Europe's highest court should decide whether to ban how internet giants like Facebook send users' data to the US, a judge in Ireland said.
The case could have huge ramifications on EU trade with the US and centres on whether Europeans enjoy enough protection from American mass surveillance.
Thousands of companies rely on current arrangements to transfer information like credit card payments between countries.
They are essential to firms of all sizes, and upholding them is critical to ensuring the economy can continue to grow without disruption, Facebook said.
Privacy campaigners like Edward Snowden and Max Schrems have highlighted major issues surrounding how information stored by internet companies is used across the Atlantic.
On Tuesday, Ireland's High Court said concerns raised by the Republic's data protection authorities were "well founded".
Ms Justice Caroline Costello said: "Union law guarantees a high level of protection to EU citizens as regards the processing of their personal data within the EU.
"They are entitled to an equivalent high level of protection when their personal data are transferred outside the European Economic Area."
She said she was referring the matter to the European Court of Justice (CJEU), which interprets EU law, for a preliminary ruling.
A previous agreement on data-sharing between Europe and the US, Safe Harbour, was largely overturned by the European Court of Justice.
The US has sought to assuage concerns about its successor, Privacy Shield, by proposing an ombudsman to oversee the deal.
Ms Justice Costello added: "The introduction of the Privacy Shield ombudsperson mechanism in the Privacy Shield decision does not eliminate those well-founded concerns.
"A decision of the CJEU is required to determine whether it amounts to a remedy satisfying the requirements of Article 47 (of the Charter of Fundamental Rights)."
Under US law, companies with Europeans' data can be compelled to hand over information to state agencies for national security purposes.
The judge said EU citizens are entitled to an effective remedy before an independent tribunal if their rights or freedoms are violated.
She added: "These include the rights under Articles 7 and 8 to respect for private and family life and protection of personal data concerning him or her."
The case was heard in Ireland because Facebook has its European headquarters in Dublin.
Austrian lawyer and campaigner Mr Schrems has claimed his privacy rights as an EU citizen have been breached through the transfer of his data by Facebook Ireland to US parent company Facebook Inc.
He said: "US citizens would not be allowed to have such mass surveillance as for European citizens and we have to protect our citizens.
"Europe protects anybody because we see it as a human right, not as a citizens' right."
He said in the long run politicians would have to sort it out.
"So far Europe has just butted out, did not do much, just hoped that it did not come back.
"Today we have heard that it does come back so probably the EU will have to come up with a better solution."
Facebook said the standard contract clauses being scrutinised during legal proceedings provided critical safeguards to ensure Europeans' data is protected once transferred to companies that operate in the US or elsewhere around the globe.
It said they are used by thousands of companies to do business.
Its statement added: "They are essential to companies of all sizes, and upholding them is critical to ensuring the economy can continue to grow without disruption.
"This ruling will have no immediate impact on the people or businesses who use our services.
"However, it is essential that the CJEU now considers the extensive evidence demonstrating the robust protections in place under standard contractual clauses and US law before it makes any decision that may endanger the transfer of data across the Atlantic and around the globe."