Failure to Await Guidance from EDPB and/or Failure to Take Timing of EDPB

If you come to the conclusion that, taking into account the circumstances of the

transfer and possible supplementary measures, appropriate safeguards would not be

ensured, you are required to suspend or end the transfer of personal data. However, if

you are intending to keep transferring data despite this conclusion, you must notify

your competent [supervisory authority].” (FAQ document, pp. 2-3)

32. Another question (Question 8) asked about whether reliance could be placed on one

of the derogations contained in Article 49 of the GDPR to transfer data to the US. The answer

given was that it is still possible to transfer data from the EEA to the US on the basis of

derogations contained in Article 49 provided that the conditions contained in that Article

apply. The EDPB then addressed transfers based on consent, those necessary for the

performance of a contract between the data subject and the controller and those necessary for

important reasons of public interest (FAQ document, p. 4).

33. Question 10 asked: “What kind of supplementary measures can I introduce if I am

using SCCs or BCRs [binding corporate rules] to transfer data to third countries?”. The

answer given was as follows:-

“The supplementary measures you could envisage where necessary would have to be

provided on a case-by-case basis, taking into account all the circumstances of the

transfer and following the assessment of the law of the third country, in order to check

if it ensures an adequate level of protection. The Court highlighted that it is the

primary responsibility of the data exporter and the data importer to make this

assessment, and to provide necessary supplementary measures.

The EDPB is currently analysing the Court’s judgment to determine the kind of

supplementary measures that could be provided in addition to SCCs or BCRs,

whether legal, technical or organisational measures, to transfer data to third

countries where SCCs or BCRs will not provide the sufficient level of guarantees on

their own.

The EDPB is looking further into what these supplementary measures could consist of

and will provide more guidance.” (FAQ document, p. 5)

34. One of the grounds of challenge advanced by FBI is that the DPC should have

awaited provision of the guidance referred to in response to Question 10 before proceeding

with an inquiry into FBI’s reliance on the SCCs or that, at least, the fact that guidance from

the EDPB was to be issued was a relevant consideration which ought to have been taken into

account by the DPC when deciding to commence the inquiry and to issue the PDD.

35. In the period between the date of the CJEU’s judgment in Schrems II (16th July, 2020)

and the date on which the DPC made the PDD and wrote to FBI on 28th August, 2020,

correspondence was exchanged between ARQ, Mr. Schrems’ solicitors, and the DPC and between ARQ and FBI’s solicitors, Mason Hayes and Curran (“MHC”). It is necessary to touch on aspects of this correspondence before turning to the PDD.

36. Following the judgment in Schrems II, Mr. Schrems wrote to the DPC on 20th July,

2020 seeking to ascertain the steps which the DPC proposed taking to resolve his complaint.

In its response on behalf of the DPC on 24th July, 2020, Philip Lee made the comment that

the CJEU’s judgment in Schrems II was “transformative of the law as it relates to EU/US

data transfers”. The letter noted that the procedural means by which the findings of the

CJEU were to be implemented was “not without complexity” and that the parties’ right to due process had to be respected. Philip Lee further stated that the DPC was “expediting matters to

the greatest possible extent”. ARQ responded on 27th July, 2020 requesting the DPC to take

certain actions immediately, including providing any documentation provided to the DPC by

FBI since June, 2013 relevant to Mr. Schrems’ complaint and requesting FBI to clarify the

legal basis on which it was relying for its EU-US data transfers. Philip Lee responded on 10th

August, 2020 noting that the DPC’s consideration of the means by which it would give full effect to the CJEU’s judgment was being “expedited to the greatest possible extent” and that

that work was continuing apace.

37. ARQ also wrote to MHC, FBI’s solicitors, on 5th August, 2020 requesting that FBI

clarify the precise legal basis on which FBI was relying for the EU-US data transfers of Mr.

Schrems’ personal data and requesting a copy of the current SCCs and any other agreement or supplementary agreement which FBI may be using. It was asserted that FBI was obliged to

provide that information under certain provisions of the GDPR and under the SCCs. Certain

information was also sought in relation to the extent to which Facebook Inc. was subject to

relevant provisions of US law. MHC replied on 19th August, 2020 (it seems that similar

questions were directly sent by Mr. Schrems to FBI and were responded to by FBI, although

that exchange of correspondence was not exhibited). In response to the request that FBI

clarify the recipients and the legal basis on which FBI was relying for the EU-US data

transfers of Mr. Schrems’ personal data, MHC pointed to a section of FBI’s Data Policy

referring to the sharing of information and the transfer of data as part of its global services. It

referred to the relevant section of FBI’s Data Policy which noted “among other things, that

one of the core data uses necessary to provide Facebook’s contractual services is ‘to

transfer, transmit, store, or process your data outside the EEA, including to within the United

States and other countries’”. I observe, but draw no conclusions from the observation that,

although not expressly referring to one of the derogations contained in Article 49 of the

GDPR, this may have been intended to be a reference to the necessity derogation contained in

that Article. MHC enclosed an extract of the SCCs entered into between FBI and Facebook

Inc. in relation to the transfer of European region user data. MHC declined to furnish the

other information sought in relation to the application of the stated provisions of US law to