Introduction

1. Introduction

1. On 16th July, 2020, the Court of Justice of the European Union (“CJEU”) delivered its landmark judgment in Case C-311/18 Data Protection Commissioner v. Facebook Ireland

Ltd and Maximilian Schrems (commonly now referred to as “Schrems II”) on a reference

from the High Court (Costello J.). This case is about what happened after that judgment.

2. Following the judgment in Schrems II, the Data Protection Commission (“DPC”) decided to commence an “own volition” inquiry under s. 110 of the Data Protection Act,

2018 (the “2018 Act”) to consider whether the actions of Facebook Ireland Ltd (“FBI”) in making transfers of personal data relating to individuals in the European Union/European

Economic Area are lawful and whether any corrective power should be exercised by the DPC

in that regard. The DPC decided to commence the inquiry by issuing a “Preliminary Draft

Decision” (“PDD”) to FBI on 28th August, 2020.

3. FBI took issue, on several grounds, with the decision by the DPC to commence the

inquiry by means of the PDD and with the procedures adopted by the DPC. Mr. Schrems,

who had made a complaint and a reformulated complaint to the statutory predecessor of the

DPC, the Data Protection Commissioner, under the Data Protection Act, 1988 (the “1988 Act”), which had ultimately led to the reference by the High Court to the CJEU leading to the

judgment in Schrems II, also took issue with the DPC’s decision and procedures on a number of grounds, some of which overlapped to an extent with the grounds advanced by FBI.

4. Both FBI and Mr. Schrems brought judicial review proceedings in respect of the PDD

and the procedures adopted by the DPC. Each applied successfully to be joined as a notice

party to the other’s judicial review proceedings. Both proceedings were entered in the Commercial List. FBI’s proceedings were heard by me over five days between 15th

December and 21st December, 2020, following which they were adjourned to allow further

affidavit evidence to be provided by the DPC. Mr. Schrems’ proceedings were due to

commence on 13th January, 2021. However, they were resolved between Mr. Schrems and the

DPC shortly prior to hearing, on terms to which it will be necessary briefly to refer later in

this judgment.

5. FBI contends that the DPC’s decision to issue the PDD and to adopt the procedure

which it has adopted should be quashed, and declarations should be made by the court, on

several grounds. At the outset, FBI asserts that the DPC’s decision and the procedures adopted by it are amenable to judicial review. It then says that the DPC’s decision and the procedures are unlawful on several grounds, including being in breach of the provisions of

the 2018 Act and Regulation (EU) 2016/679 of the European Parliament and of the Council

of 27th April, 2016 (the “GDPR”) by virtue of the DPC’s failure to conduct any investigation

before issuing the PDD; a breach of FBI’s legitimate expectation that procedures published by the DPC in its 2018 Annual Report and on its website, and followed by the DPC in other

inquiries, would be followed in respect of the DPC’s inquiry; breaches of FBI’s right to fair procedures, including premature judgment of the issues by the DPC and a failure to afford

sufficient time to FBI to make submissions to the DPC; a failure by the DPC to take into

account relevant considerations and, in particular, to await publication by the European Data

Protection Board (“EDPB”) of guidance/recommendations to assist controllers and processors as regards the use of what are called “supplementary measures” to ensure

adequate protection for data subjects when transferring data to third countries; a breach of

FBI’s right to equal treatment and non-discrimination; a breach of the DPC’s obligation to act proportionately by subjecting FBI to simultaneous inquiries (namely, the “own volition”

inquiry and the complaint made by Mr. Schrems. FBI also alleges a breach by the DPC of its

duty of candour in the manner in which it has defended the proceedings.

6. In response, the DPC contends that the decision to issue the PDD is not amenable to

judicial review (although it accepts that the procedures which it decided to follow are so

amenable). It initially maintained that the proceedings amounted to an abuse of process by

FBI and advanced that claim in its pleadings and in its written submissions but ultimately

withdrew the point at the hearing. In response to the grounds advanced by FBI, the DPC

contends that FBI is fundamentally mistaken when it asserts that no investigation was carried

out by the DPC before issuing the PDD and further maintains that FBI was invited to make

submissions on the facts and on the law and to provide such further information as it felt

necessary in response to the preliminary views set out in the PDD. The DPC relies on the fact

that it was in possession of a vast amount of information in light of the procedural history

leading up to the judgment of the CJEU in Schrems II. The DPC disputes the contention that

FBI had a legitimate expectation that any particular procedure would be followed by it arising

from the description of an “illustrative” process in its 2018 Annual Report and on its website

or by virtue of any practice adopted by it. It also disputes the allegations of premature

judgment and contends that the views set out in PDD were expressly stated to be preliminary

only and subject to such submissions on the facts and on the law which FBI were invited to

make. It further disputes the allegations of breaches of fair procedures, and asserts that no

extension of time was sought by FBI to make a submission in response to the PDD and that

no extension of time was refused by the DPC. The DPC confirmed at the hearing of

proceedings that, in the event that FBI failed in its proceedings, the time allowed for FBI to

put in its submissions would run from the resumption of the inquiry and that the DPC would

consider any reasoned request for an extension of time. The DPC further maintains that it was

and is entitled and obliged to proceed as it has done, notwithstanding the absence of

guidelines or recommendations from the EDPB (which recommendations were put out for

consultation on 10th November, 2020). The DPC disputes the allegations of unequal treatment

and discrimination. It also disputes the contention that there is a breach of any obligation of

proportionality by reason of the existence of the inquiry and the ongoing complaint by Mr.