Facebook and Max Schrems back in court again, both pissed off at Ireland's data regulator

The Irish Data Protection Commission (DPC) copped the blame from witnesses in the European Court of Justice yesterday over its role in the Facebook case concerning the transfer of data to the US from its Irish subsidiary. Back in 2013, privacy activist Max Schrems asked the regulator whether Facebook sending his data to the US …

[Dan 55]

GDPR

I do hope a) the CJEU rule instead of kicking it back to Ireland and b) the final ruling on this matter is done under GDPR.

[doublelayer]

Re: GDPR

This concerns data transfers in 2013. Sadly, GDPR does not apply. They could make some progress, however, on getting enforcement to happen more often.*

*Operative word being "could".

[big_D]

Re: GDPR

Yes, after GDPR, Schrems launched a new complaint, which is still pending.

[Pascal Monett]

Mr Schrems, I salute you

Thank you for your dedication to the privacy of my data. Without you, the NSA would have free reign over the entire Internet and Google & Co would have an even easier life. Thanks to you, Google & Co is starting to feel the pinch, and the NSA might actually (gasp !) have to work to get their juicy data.

You are a true soldier of freedom.

[Anonymous Coward]

Re: Mr Schrems, I salute you

NSA goes to Facebook, Google & C. because it knows they do the heavy lifting for it. Surveillance capitalism is not better than a surveillance state - and the risk is usually you get both.

[Duncan Macdonald]

Irish Data Protection Commission

Should be renamed as the Irish Data Do Nothing Commission.

Have they ever decided against data transfers out of europe ?

Their entire game plan seems to be "kick the complaints around until the complainers die of old age".

[Anonymous Coward]

Re: Irish Data Protection Commission

Or Irish Commission Full of Conflicts of Interests ? They are very, very afraid to kill their gooses that lays the Golden Eggs in the green fields of Ireland... and looks to be not independent at all from the other branches of government. And these companies know how to blackmail governments.

[Mage]

Re: Irish Data Protection Commission

They did once slap Sky on the wrist when Sky announced they were going to opt everyone into 3rd party marketing. Perhaps Sky's mistake was actually sending out letters?

No fine.

[Mike 137]

Adequacy of Controller/Processor SCCs

'The court in Luxembourg is also considering whether the "standard contractual clauses (SCCs)" are sufficient protection for consumers'

The controller/processor SCCs are in fact non-compliant with the GDPR on seven counts. Consequently it's hardly a matter of considering whether they're sufficient (they're not), but rather whether we all agree to ignore their inadequacy.

[Mage]

why the Irish regulator could not make its own ruling

Because generally Irish Regulators exist to satisfy EU. Also many are "captured" by Corporations or motivated purely to raise revenue. See Financial Regulator (Anglo Irish Bank) and Comreg (Three's lack of rollout "solved" by NBS, Mobile mis-sold as Broadband and Fast Broadband, everything sold as Fibre).

The UK is worse with Ofcom.

[James Anderson]

Re: why the Irish regulator could not make its own ruling

For years the Irish government has been gaming EU regulations to maximise the amount of grants they can claim and to attract large corporations due to lax enforcement of EU regulations.

The Germans seem happy enough to foot the bills, the UK not so much.

[Anonymous Coward]

Spot on

"Facebook's lawyer warned that striking out SCCs would have a serious impact on world trade."

I doubt if anyone on either side disputes that. As I understand it, the entire point of striking out SCCs is to have a serious impact on certain types of world trade; i.e. to prevent the movement of personal data to places it doesn't need to be.

[SImon Hobson]

Re: Spot on

I've given you an upvote, but there are serious possible repercussions beyond the Google/Facebook problem. There is a LOT of international data traffic that underpins international trade. Yes, everyone would adapt, just like they've had to adapt when the original Data Protection regs came in and then GDPR.

Iin the meantime, blow Privacy ShieldFigleaf and Standard Contracts out of the water and it'll cause one heck of a lot of disruption while people adjust to it all.

But IMO both need to be blown out of the water because, AIUI, USA law is fundamentally incompatible with EU law on this - and the USA seems to think that it's the EU in the wrong.