Irish data ruling threatens 'devastating consequences' for Facebook
James Hetherington with agencies
Facebook Ireland's data transfers to the U.S. may breach EU law. /Matt Rourke/AP

Facebook Ireland's data transfers to the U.S. may breach EU law. /Matt Rourke/AP


The proposed decision by Ireland's Data Protection Commission (DPC) to suspend data transfers by Facebook Ireland to its parent company in the U.S. threatens "devastating consequences" for its business, a lawyer representing the firm has told Ireland's High Court.

The Irish data regulator made a preliminary ruling in August after it found transfers outside the European Union were not guaranteed the same level of protection provided under EU law.

"We have made the point ... that this would have devastating consequences for the plaintiff's business," Facebook's lawyer Paul Sreenan told the court.

"In the light of such a decision, it is not clear how Facebook Ireland could continue to provide Facebook and Instagram services in the EU."



The EU's General Data Protection Regulation (GDPR) stipulates that Ireland's DPC is Facebook's lead EU regulator, because the company's European headquarters are in Dublin.

The social media giant is asking Ireland's High Court to review the preliminary ruling. It argues it was not given any warning and the 21 days it was given to respond was not sufficient after it received notice from the watchdog on August 28.

Facebook is also citing a ruling made in July by the EU's Court of Justice, which deemed valid the mechanism challenged by the DPC - Standard Contract Clauses.

Standard Contract Clauses are EU-approved terms that allow a contract covering the transfer of personal data from within the EU to outside the bloc, which is legal under GDPR to be set up. They were, however, updated in the ruling Facebook cites – along with several other major changes.

In that ruling, the Court of Justice invalidated the EU-US Privacy Shield, which Facebook had previously used to support data exports because of the access it gave the U.S. government to the personal data of Europeans. The court also emphasized the protection offered under SCCs must meet the same standard of data protection set by EU law. If it doesn't, then the transfer of personal data must be suspended or prohibited.

It was in the wake of this judgment that the DPC made its preliminary ruling to suspend the transfer of personal data by Facebook Ireland. It is the same judgment Facebook is now citing as a defence.

The DPC is due to present its case on Thursday.

Search Trends