THE HIGH COURT JUDICIAL REVIEW [2020 No. 617 JR.] [2020 No. 126 COM.] BETWEEN FACEBOOK IRELAND LIMITED APPLICANT AND DATA PROTECTION COMMISSION RESPONDENT AND MAXIMILIAN SCHREMS NOTICE PARTY JUDGMENT of Mr. Justice David Barniville delivered on the 14th day of May, 2021 Index 1. Introduction……………………………………………………………………….… 3 2. Overview of Decision………………………………………………………………... 6 3. Structure of Judgment………………………………………………………..…….. 7 4. Relevant Factual Background………………………………………………….…... 8 5. CJEU Judgment in Schrems II…………………………………………………… 13 6. Developments Post Judgment in Schrems II……………………………………... 17 7. DPC’s 28 August 2020 Letter and PDD………………………………………….. 22 2 8. Correspondence Post the DPC’s 28 August 2020 Letter and PDD……………... 35 9. Procedural Background…………………………………………………………… 46 10. Resolution of Mr. Schrems Proceedings………………………………………….. 49 11. Structure for Consideration of the Issues Raised………………………………... 51 12. Whether PDD/DPC’s Procedure is Amenable to Judicial Review……………... 53 13. Alleged Failure by DPC to Conduct an Investigation/Inquiry Before Reaching a Decision…………………………………………………………………………….. 69 14. Alleged Departure by DPC from Published Procedures/Breach of Legitimate Expectation………………………………………………………………………… 80 15. Alleged Breach of Fair Procedures: 21-Day Period for Submissions…………. 114 16. Alleged Breach of Fair Procedures: Premature Judgment……………………. 132 17. Alleged Breach of Fair Procedures: Involvement of Commissioner at Investigation and Decision-Making Stages……………………………………... 151 18. Single Decision to Cover Infringement and Corrective Measures: Ultra Vires Section 111 of 2018 Act…………………………………………………………... 157 19. Failure to Await Guidance from EDPB and/or Failure to Take Timing of EDPB Guidance into Account…………………………………………………………… 157 20. Alleged Discrimination/Breach of FBI’s Right to Equality: Inquiry into FBI Only……………………………………………………………………………….. 167 21. Alleged Disproportionality of Simultaneous Inquiries………………………… 180 22. Adequacy of DPC’s Reasons……………………………………………………... 181 23. Duty of Candour………………………………………………………………….. 184 24. Abuse of Process/Improper Purpose……………………………………………. 192 25. Summary of Conclusions………………………………………………………… 196 1. Introduction 3 1. On 16th July, 2020, the Court of Justice of the European Union (“CJEU”) delivered its landmark judgment in Case C-311/18 Data Protection Commissioner v. Facebook Ireland Ltd and Maximilian Schrems (commonly now referred to as “Schrems II”) on a reference from the High Court (Costello J.). This case is about what happened after that judgment. 2. Following the judgment in Schrems II, the Data Protection Commission (“DPC”) decided to commence an “own volition” inquiry under s. 110 of the Data Protection Act, 2018 (the “2018 Act”) to consider whether the actions of Facebook Ireland Ltd (“FBI”) in making transfers of personal data relating to individuals in the European Union/European Economic Area are lawful and whether any corrective power should be exercised by the DPC in that regard. The DPC decided to commence the inquiry by issuing a “Preliminary Draft Decision” (“PDD”) to FBI on 28th August, 2020. 3. FBI took issue, on several grounds, with the decision by the DPC to commence the inquiry by means of the PDD and with the procedures adopted by the DPC. Mr. Schrems, who had made a complaint and a reformulated complaint to the statutory predecessor of the DPC, the Data Protection Commissioner, under the Data Protection Act, 1988 (the “1988 Act”), which had ultimately led to the reference by the High Court to the CJEU leading to the judgment in Schrems II, also took issue with the DPC’s decision and procedures on a number of grounds, some of which overlapped to an extent with the grounds advanced by FBI. 4. Both FBI and Mr. Schrems brought judicial review proceedings in respect of the PDD and the procedures adopted by the DPC. Each applied successfully to be joined as a notice party to the other’s judicial review proceedings. Both proceedings were entered in the Commercial List. FBI’s proceedings were heard by me over five days between 15th December and 21st December, 2020, following which they were adjourned to allow further affidavit evidence to be provided by the DPC. Mr. Schrems’ proceedings were due to commence on 13th January, 2021. However, they were resolved between Mr. Schrems and the 4 DPC shortly prior to hearing, on terms to which it will be necessary briefly to refer later in this judgment. 5. FBI contends that the DPC’s decision to issue the PDD and to adopt the procedure which it has adopted should be quashed, and declarations should be made by the court, on several grounds. At the outset, FBI asserts that the DPC’s decision and the procedures adopted by it are amenable to judicial review. It then says that the DPC’s decision and the procedures are unlawful on several grounds, including being in breach of the provisions of the 2018 Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April, 2016 (the “GDPR”) by virtue of the DPC’s failure to conduct any investigation before issuing the PDD; a breach of FBI’s legitimate expectation that procedures published by the DPC in its 2018 Annual Report and on its website, and followed by the DPC in other inquiries, would be followed in respect of the DPC’s inquiry; breaches of FBI’s right to fair procedures, including premature judgment of the issues by the DPC and a failure to afford sufficient time to FBI to make submissions to the DPC; a failure by the DPC to take into account relevant considerations and, in particular, to await publication by the European Data Protection Board (“EDPB”) of guidance/recommendations to assist controllers and processors as regards the use of what are called “supplementary measures” to ensure adequate protection for data subjects when transferring data to third countries; a breach of FBI’s right to equal treatment and non-discrimination; a breach of the DPC’s obligation to act proportionately by subjecting FBI to simultaneous inquiries (namely, the “own volition” inquiry and the complaint made by Mr. Schrems. FBI also alleges a breach by the DPC of its duty of candour in the manner in which it has defended the proceedings. 6. In response, the DPC contends that the decision to issue the PDD is not amenable to judicial review (although it accepts that the procedures which it decided to follow are so amenable). It initially maintained that the proceedings amounted to an abuse of process by 5 FBI and advanced that claim in its pleadings and in its written submissions but ultimately withdrew the point at the hearing. In response to the grounds advanced by FBI, the DPC contends that FBI is fundamentally mistaken when it asserts that no investigation was carried out by the DPC before issuing the PDD and further maintains that FBI was invited to make submissions on the facts and on the law and to provide such further information as it felt necessary in response to the preliminary views set out in the PDD. The DPC relies on the fact that it was in possession of a vast amount of information in light of the procedural history leading up to the judgment of the CJEU in Schrems II. The DPC disputes the contention that FBI had a legitimate expectation that any particular procedure would be followed by it arising from the description of an “illustrative” process in its 2018 Annual Report and on its website or by virtue of any practice adopted by it. It also disputes the allegations of premature judgment and contends that the views set out in PDD were expressly stated to be preliminary only and subject to such submissions on the facts and on the law which FBI were invited to make. It further disputes the allegations of breaches of fair procedures, and asserts that no extension of time was sought by FBI to make a submission in response to the PDD and that no extension of time was refused by the DPC. The DPC confirmed at the hearing of proceedings that, in the event that FBI failed in its proceedings, the time allowed for FBI to put in its submissions would run from the resumption of the inquiry and that the DPC would consider any reasoned request for an extension of time. The DPC further maintains that it was and is entitled and obliged to proceed as it has done, notwithstanding the absence of guidelines or recommendations from the EDPB (which recommendations were put out for consultation on 10th November, 2020). The DPC disputes the allegations of unequal treatment and discrimination. It also disputes the contention that there is a breach of any obligation of proportionality by reason of the existence of the inquiry and the ongoing complaint by Mr. 6 Schrems. It further disputes that there was any breach of the duty of candour in its defence of the proceedings. 7. For his part, as a notice party in these proceedings, Mr. Schrems supports the quashing of the PDD on the grounds that it infringes his legitimate expectation that his complaint would be determined by the DPC following the CJEU’s judgment in Schrems II. He also supports FBI’s complaints in relation to the disproportionality of the DPC conducting simultaneous inquiries. However, Mr. Schrems opposes the reliefs being sought by FBI on the grounds of an alleged departure by the DPC from its published procedures in issuing the PDD and commencing the own-volition inquiry. He also disagrees with FBI that the DPC was obliged to await publication of EDPB guidance before proceeding with the inquiry. Mr. Schrems stressed the obligation on the DPC under the GPDR and the judgment of the CJEU in Schrems II to act expeditiously. Consistent with that contention, Mr. Schrems disputes FBI’s case that it was afforded insufficient time to make submissions to the DPC in response to the PDD. 8. As can be seen from this brief summary of the respective contentions of the parties, several important issues of national administrative law arise for consideration in these proceedings as well as significant issues of EU law arising from the GDPR and from the judgment of the CJEU in Schrems II.