The Data Protection Commissioner has been given the green light to investigate Max Schrems’ complaint against Facebook. The Office of the Data Protection Commissioner (ODPC) had initially refused to investigate the complaint based on a view that Commission Decision 2000/520/EC (the Safe Harbour Decision) was both valid and binding on the ODPC.
In light of the Court of Justice of the European Union (CJEU) ruling last week that Safe Harbour was in fact invalid, the matter returned before Mr Justice Hogan in the High Court yesterday. Mr Justice Hogan quashed on consent the original decision of the ODPC not to investigate. It was agreed between the parties that the initial ODPC decision should be quashed.
The initial complaint related to the transfer of data by Facebook Ireland to its US parent company on grounds that the US did not provide an adequate protection of personal data. Mr Justice Hogan declined to express any view on the route the ODPC should take.
Following the decision, the current Data Protection Commissioner Ms Helen Dixon released a statement welcoming the ruling. Ms. Dixon stated that the ODPC would now proceed to investigate the substance of the complaint "with all due diligence"
The ODPC will now have to consider whether US law provides an adequate level of protection for the privacy and the fundamental rights and freedoms of data subjects in relation to the processing of personal data. Should the ODPC form the view that the US does not ensure an adequate level of protection, they are obliged under Irish data protection law to inform both the EU Commission and the supervisory authorities of the other Member States.
There is no timeline under which the ODPC is required to reach a decision. The investigation will run parallel to the current EU-US negotiations on Safe Harbour reform and yesterday Schrems expressed concern that this would result in further delay. Counsel for the ODPC stated that there was no question that the ODPC would delay and that the delay so far was not due to the Commissioner.
In terms of timelines for investigating complaints the ODPC website states;
Each investigation is unique, and it is very hard to say in advance how long each will take. Some complaints can be resolved very quickly and informally, in a matter of weeks. Other complaints might raise important issues, and might involve in-depth investigation and careful consideration of legal issues. Such complaints might take several months to bring to a conclusion.