Judgment
Title: | Data Protection Commissioner -v- Facebook Ireland Ltd & anor |
Neutral Citation: | [2019] IESC 46 |
Supreme Court Record Number: | 68/2018 |
High Court Record Number: | 2016 4809 P |
Date of Delivery: | 05/31/2019 |
Court: | Supreme Court |
Composition of Court: | Clarke C.J., O'Donnell Donal J., Dunne J., Charleton J., Finlay Geoghegan J. |
Judgment by: | Clarke C.J. |
Status: | Approved |
Result: | Appeal dismissed |
 | |
THE SUPREME COURTAppeal No: 2018/68
Clarke C.J.
O’Donnell J.
Dunne J.
Charleton J.
Finlay Geoghegan J.
The Data Protection Commissioner
Plaintiff/First Named Respondent
and
Facebook Ireland Limited
First Named Defendant/Appellant
Second Named Defendant/Second Named Respondent
Judgment of Mr. Justice Clarke, Chief Justice, delivered the 31st May, 2019
1. Introduction
1.1 The transfer of data from the European Union to other jurisdictions, not least to the United States, has been the subject of both political and legal controversy in recent years. The underlying issues which give rise to the background to this appeal are a further episode in the legal aspect of that controversy.
1.2 However, it is important to start this judgment by emphasising what are, on any view, a number of unusual features of this case and to emphasise, in that context, what this judgment is not about.
1.3 It will be necessary to go into somewhat more detail about the form of proceedings which were before the High Court in this case and in respect of which an appeal has been brought to this Court. However, it is fair to say that the proceedings concerned derive as to their form from the judgment of the Court of Justice (“CJEU”) in Schrems v. Data Protection Commission (Case C-362/14) EU:C:2015:650, [2016] 2 C.M.L.R. 2 (“Schrems I”). That judgment required that the national law of member states provide a procedure whereby the person or body charged with data protection in the EU member state concerned (such as the plaintiff/first named respondent in this case, the Data Protection Commissioner (“the DPC”)) should have a method of referring to the CJEU concerns relating to Union instruments in the data protection field, in circumstances where questions might arise as to the validity of the instruments in question.
1.4 The second named defendant/second named respondent, Mr. Schrems, brought a complaint to the DPC, who formed the required view as to having concerns relating to the validity of certain relevant EU instruments, being Commission Decisions 2001/497/EC, 2004/915/EC, and 2010/87/EU, which concerned “Standard Contractual Clauses”. On that basis, the DPC brought these proceedings before the High Court. The proceedings involved the DPC as plaintiff, the first named defendant/appellant, Facebook Ireland Limited (“Facebook”), and Mr. Schrems as defendants with, for reasons which will be set out later, the Government of the United States (“the US Government”) intervening. As a result of a judgment of Costello J. (The Data Protection Commissioner v. Facebook Ireland Limited & anor. [2017] IEHC 545) dated 3 October 2017, with a revised version circulated on 12 April 2018, the High Court referred certain questions to the CJEU, which reference procedure remains pending before that Court.
1.5 However, Facebook sought leave to appeal to this Court. One of the issues which concerned this Court was as to whether any appeal lay in the context of a decision of the High Court to make a reference to the CJEU. Against that backdrop, this Court decided, unusually, to hold a short oral procedure in relation to the application for leave to appeal. For the reasons set out in a judgment dated 31 July 2018 (Data Protection Commissioner & anor. v. Facebook Ireland Limited & anor. [2018] IESC 38) (“the earlier judgment”), this Court decided to grant leave. While it will be necessary to refer to the grant of leave in more detail in due course, it is fair to say that two broad sets of issues were the subject of leave to appeal. The first concerned the question of whether, as a matter of the combined effect of Irish constitutional law and the law of the European Union, any appeal at all lies to this Court in circumstances such as have arisen in this case and, if so, the permissible parameters of any such appeal. The second set of issues concern certain findings of the High Court in relation to the law of the United States and the protections which that law confers on data subjects whose data is transferred to the United States from the European Union. Some of those findings are said by Facebook to be either in error or misleadingly incomplete. To the extent that an appeal may be held to lie, Facebook invites this Court to hold that the specific findings referred to are in error or incomplete and to make such order as this Court may have jurisdiction to grant to deal with such a situation.
1.6 Thus, the two broad sets of issues are those concerning the scope, if any, of appeal which may be available to Facebook and, to the extent that an appeal may lie, the issues of US law to which reference has been made. It should also be noted that the Government of the United States was granted leave to intervene in both the High Court and on this appeal.
1.7 However, in order to understand those issues more fully, it is necessary to deal in more detail with certain aspects of these proceedings and the process to date. I propose to start by setting out what I think can fairly be said to be the unusual features of these proceedings, for that background has the potential to influence both of the sets of issues which arise.
2. The Nature of these Proceedings
2.1 The issue which arose in Schrems I concerned the validity of the so-called “Safe Harbour” arrangements entered into between the European Union and the United States of America. Briefly stated, in its decision dated the 26th July 2000 (2000/520/EC) (“the Safe Harbour Decision”), the European Commission had determined, in accordance with Article 25(6) of Directive 95/46/EC, that an adequate level of protection would be attained in relation to data transferred from the EU to an organisation established in the United States, where such organisation complied with the principles set out in the Safe Harbour Decision and self-certified that it was in compliance with those principles.
2.2 Mr. Schrems made a complaint to the DPC concerning the transfer of his data from the EU to the United States under the Safe Harbour arrangements (specifically, the transfer of his data from Facebook Ireland Limited to Facebook Inc., the US parent company of the EU based entity). Mr. Schrems complained that, in light of revelations concerning surveillance by US security agencies (particularly, the National Security Agency (“the NSA”)) of data transferred from the EU to organisations based in the US, there was no meaningful protection in the United States, in law or in practice, concerning data so transferred. The DPC considered that she had no jurisdiction to consider the validity of the Safe Harbour arrangements and, having regard to the fact that the substance of Mr. Schrems’ complaint related to material which had been transferred in accordance with those arrangements, came to the view that, under s. 10(1)(b) of the Data Protection Act 1988 (“the 1988 Act”), the complaint was “frivolous and vexatious”. She therefore exercised her discretion under s. 10 of the 1988 Act not to proceed to a full formal investigation of the complaint. This decision was reached on the basis that the DPC considered that there was no evidence that Mr. Schrems’ data had in fact been disclosed to US authorities and furthermore that the Commission had, in the Safe Harbour Decision, made an “adequacy decision”, within the meaning of that phrase as used in s. 11(2) of the 1988 Act, regarding the protections afforded to data transferred to the US. The DPC came to the view that she was bound by that decision under the terms of the 1988 Act and could not reach a conclusion contrary to its designation of the US as having adequate protection for data transferred in accordance with its terms.
2.3 Mr. Schrems brought proceedings before the High Court seeking judicial review of the conclusion of the DPC that his complaint was unsustainable in law.
2.4 In the course of those proceedings, Hogan J. referred certain questions of Union law to the CJEU. The judgment in Schrems I represents the answers given by the CJEU to those questions. In particular, the CJEU held that the Safe Harbour Decision was invalid but also, importantly for the purposes of these proceedings, made the following general observations at para. 65 of that judgment:-
“In the converse situation, where the national supervisory authority considers that the objections advanced by the person who has lodged with it a claim concerning the protection of his rights and freedoms in regard to the processing of his personal data are well founded, that authority must, in accordance with the third indent of the first subparagraph of Article 28(3) of Directive 95/46, read in the light in particular of Article 8(3) of the Charter, be able to engage in legal proceedings. It is incumbent upon the national legislature to provide for legal remedies enabling the national supervisory authority concerned to put forward the objections which it considers well founded before the national courts in order for them, if they share its doubts as to the validity of the Commission decision, to make a reference for a preliminary ruling for the purpose of examination of the decision’s validity.”
2.5 It thus followed that it was incumbent on all member states to have in place an appropriate procedure to enable a data protection body, such as the DPC, to bring any doubts concerning the validity of relevant EU measures before a court of competent jurisdiction so that that court could, if it shared the doubts concerned, refer the matter to the CJEU. The reason for the necessity for such a procedure was, of course, that no national court has the jurisdiction to invalidate a measure of Union law, that power being reserved to the CJEU. It followed that it was necessary that there be a mechanism whereby cases of doubt could be referred to the only court (being the CJEU) which had the jurisdiction to invalidate the measure of Union law if persuaded that the measure concerned was unlawful.
2.6 As it happens it was unnecessary, in the Irish context, to provide for any new form of procedure, for the traditional, and very flexible, common law equitable remedy of the declaration was considered broad enough to encompass declaratory proceedings in which the DPC could urge that the High Court should share whatever concerns have been identified and should, in accordance with Schrems I, refer the matter to the CJEU. That was the form of proceedings adopted in this case.
2.7 It follows, therefore, that these proceedings are unusual, although perhaps not unique. The sole relief claimed by the DPC is, in substance, a reference to the CJEU under Article 267 of the Treaty on the Functioning of the European Union (“TFEU”). The purpose of that relief is to bring the question of the validity or otherwise of the measures under challenge before the only court which has the jurisdiction to determine whether those measures are valid or otherwise.
2.8 It is important, in that context, to contrast that type of procedure or proceeding with what I might loosely call a “normal” case brought before the courts of a member state which might give rise to a reference to the CJEU. In such proceedings, the courts of a member state would be invited to make some form of order which falls within the normal jurisdiction of the court concerned. The claim may be one for damages or for some other form of private law remedy such as an injunction. The claim may be in public law seeking to quash an administrative order or to require a body governed by public law to act in a particular way. However, in all such cases a national court would enjoy an ordinary jurisdiction to make an order of the type sought. The reason why a reference might be required would be that, to a greater or lesser extent, the question of whether relief should be granted or refused (or where granted, the nature of the relief appropriate) might depend at least in part on a contested question of Union law whose resolution was necessary to the final determination of the proceedings, in circumstances where the issue of Union law concerned was not acte clair in the sense in which that term is used in the jurisprudence of the CJEU. In other words, in such cases, the reference is merely a means to the end of the national court exercising its own jurisdiction to make an appropriate order in proceedings of which it is seized. The CJEU does not make any order which binds the parties to the proceedings in any particular way but rather, as part of the dialogue between the CJEU and national courts, gives binding guidance to the national court on the proper interpretation of any relevant measures of Union law so as to enable that national court to make a proper determination of the proceedings in accordance with Union law and for the national court to make whatever orders binding on the parties are appropriate arising from that determination.
2.9 In such cases, the matter will always come back to the national court to make whatever order is appropriate. In some circumstances, of course, the result of the national proceedings may be fairly obvious in the light of the previous decisions made by the national court on the facts and on national law and having regard to the interpretation placed by the CJEU on applicable measures of Union law. However, in other cases there may well be further consideration which requires to be given by the national court to the relevant issues, in the light of the interpretation of Union law provided by the CJEU. For example, the judgment of the CJEU may frequently refer to the requirement of the national court to make a particular assessment having regard to principles identified in the judgment concerned. But whether there is much still to be debated or whether the proceedings may substantially be determined as a matter of practice by the result of the reference to the CJEU, it remains the case that the final order binding the parties will be made by the national court rather than the CJEU.
2.10 These proceedings are different. Here, the only issue of substance which arises before either the Irish courts or the CJEU is the question of the validity or otherwise of Union measures. Whatever the view taken by the CJEU on that issue, the Irish courts will have no further role, for the measures under question will either be found to be valid or invalid and in either event, that will be the end of the matter. If the measure is found to be invalid, then the DPC can take whatever action is considered appropriate within her jurisdiction in the light of her assessment of the merits of Mr. Schrems’ complaint and on the basis that the measures which would then stand invalid could provide no protection. If, on the other hand, the measures are upheld as being valid, then the DPC would be required to assess Mr. Schrems’ complaint on the basis that the protections provided by those measures stand. In either eventuality, there would be no further role of substance for the Irish court.
2.11 It may be that there is something of an analogy between these bespoke proceedings (which the CJEU required in Schrems I that member states permit) and the limited form of ordinary national proceedings in which the invalidation of an EU measure may fall for consideration. Frequently, in such cases, the question of the validity or otherwise of a relevant measure of Union law is but one issue in the case. A party may seek either private or public law remedies before a court of competent jurisdiction and the validity or otherwise of a Union law measure may come to play a role in answering the question as to whether some or all of the remedies sought should be granted. Assuming that a consideration of the validity of the measure turns out to be necessary to the proper determination of the case and assuming that the national court considers that there is an arguable basis for suggesting that the measure might not be valid (in other words, that its validity is not acte clair), then a reference may require to be made to enable the CJEU to determine whether the measure whose validity is sought to be challenged is in fact lawful. In at least most of such cases, the question of the lawfulness or otherwise of the measure concerned will merely be a means to an end in the national proceedings in that it may affect the proper resolution of those national proceedings and thus, the grant or refusal of ordinary relief claimed in those proceedings.
2.12 In contrast, the relief sought in these proceedings by the DPC is the reference itself (and the possibility of an invalidation of the measures under challenge as a result of that reference) which is, to a very great extent, an end in itself.
2.13 It will be necessary in due course to consider the extent, if any, to which the unusual nature of these proceedings thus described impacts on either or both of the two sets of issues which I have already identified.
2.14 It is next necessary to say a little about the relevant Union legislation and the Union measures whose validity lie at the heart of the issues in this case.
3. Union Law and the Measures under Challenge
(a) The Directive
3.1 Of central importance to these proceedings is Directive 95/46/EC of the European Parliament and Council “on the protection of individuals with regard to the processing of personal data and on the free movement of such data” (“the Directive”). It should be noted that the Directive was repealed by the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) (hereafter, “the GDPR”). However, the law applicable to the issues which arise in these proceedings is the Directive, for the relevant questions predate the GDPR.
3.2 Article 1 sets out the object of the Directive in the following terms:-
3.6 Of central relevance to these proceedings is Chapter IV of the Directive which is entitled “Transfer of Personal Data to Third Countries”. Article 25 of the Directive is included in that Chapter and sets out the following principles in that context:-
“1. The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection.
2. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country.
3. The Member States and the Commission shall inform each other of cases where they consider that a third country does not ensure an adequate level of protection within the meaning of paragraph 2.
4. Where the Commission finds, under the procedure provided for in Article 31 (2), that a third country does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, Member States shall take the measures necessary to prevent any transfer of data of the same type to the third country in question.
5. At the appropriate time, the Commission shall enter into negotiations with a view to remedying the situation resulting from the finding made pursuant to paragraph 4.
6. The Commission may find, in accordance with the procedure referred to in Article 31 (2), that a third country ensures an adequate level of protection within the meaning of paragraph 2 of this Article, by reason of its domestic law or of the international commitments it has entered into, particularly upon conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic freedoms and rights of individuals.
Member States shall take the measures necessary to comply with the Commission's decision.”
3.7 Article 26 of the Directive provides for derogation from the principles set out in Article 25:-
“1. By way of derogation from Article 25 and save where otherwise provided by domestic law governing particular cases, Member States shall provide that a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2) may take place on condition that:
(a) the data subject has given his consent unambiguously to the proposed transfer; or
(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of precontractual measures taken in response to the data subject's request; or
(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; or
(d) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; or
(e) the transfer is necessary in order to protect the vital interests of the data subject; or
(f) the transfer is made from a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case.
2. Without prejudice to paragraph 1, a Member State may authorize a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2), where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights; such safeguards may in particular result from appropriate contractual clauses.
3. The Member State shall inform the Commission and the other Member States of the authorizations it grants pursuant to paragraph 2.
If a Member State or the Commission objects on justified grounds involving the protection of the privacy and fundamental rights and freedoms of individuals, the Commission shall take appropriate measures in accordance with the procedure laid down in Article 31 (2).
Member States shall take the necessary measures to comply with the Commission's decision.
4. Where the Commission decides, in accordance with the procedure referred to in Article 31 (2), that certain standard contractual clauses offer sufficient safeguards as required by paragraph 2, Member States shall take the necessary measures to comply with the Commission's decision.”
3.8 Article 28 of the Directive provides for each member state to have a “supervisory authority” for the purposes there specified. The DPC is the relevant authority for Ireland.
(b) The “Standard Contractual Clauses” Decisions
3.9 As noted previously, this case concerns a challenge to the validity of three Commission decisions, namely:-
(1) Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC
(2) Commission Decision 2004/915/EC of 27 December 2004 amending decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries; and
(3) Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council
(collectively “the SCC Decisions”)
3.10 It should be noted that, while all three of the SCC Decisions were under challenge in the High Court, the trial judge stated as follows in her judgment having set out the terms of the third such decision (“the 2010 Decision”):-
“The other two SCC decisions the subject of these proceedings were not analysed in the hearing before me which focused exclusively upon the decision of 2010. This was the decision which Facebook said it employed to transfer Mr. Schrems’ personal data to Facebook Inc.”
That being so, reference will also only be made to the contents of that decision in this judgment.
3.12 Article 1 of the 2010 Decision provides:-
“The standard contractual clauses set out in the Annex are considered as offering adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights as required by Article 26(2) of Directive 95/46/EC.”
3.13 Article 2 provides:-
3.16 The Annex to the 2010 Decision sets out the relevant standard contractual clauses. Clause 3 is entitled “Third party beneficiary clause”:-
“1. The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary
2. The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
3. The data subject can enforce against the sub-processor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
4. The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.”
3.17 Clause 4 is entitled “Obligations of the data exporter”:-
“The data exporter agrees and warrants:
(a) that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
(b) that it has instructed and throughout the duration of the personal data-processing services will instruct the data importer to process the personal data transferred only on the data exporter’s behalf and in accordance with the applicable data protection law and the Clauses;
(c) that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
(d) that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
(e) that it will ensure compliance with the security measures;
(f) that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
(g) to forward any notification received from the data importer or any sub-processor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
(h) to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for sub-processing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
(i) that, in the event of sub-processing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
(j) that it will ensure compliance with Clause 4(a) to (i).”
3.18 Clause 5 concerns “Obligations of the data importer”. A footnote at Clause 5 provides:-
“Mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defence, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others, are not in contradiction with the standard contractual clauses. Some examples of such mandatory requirements which do not go beyond what is necessary in a democratic society are, inter alia, internationally recognised sanctions, tax-reporting requirements or anti-money-laundering reporting requirements.”
3.19 Clause 5 goes on to provide:-
“The data importer agrees and warrants:
(a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(c) that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;
(d) that it will promptly notify the data exporter about:
(i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;
(ii) any accidental or unauthorised access; and
(iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
(e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
(f) at the request of the data exporter to submit its data-processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
(g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
(h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent;
(i) that the processing services by the sub-processor will be carried out in accordance with Clause 11;
(j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.”
3.20 Clause 6 is entitled “Liability”:-
“1. The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or sub-processor is entitled to receive compensation from the data exporter for the damage suffered.
2. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his sub-processor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.
The data importer may not rely on a breach by a sub-processor of its obligations in order to avoid its own liabilities.
3. If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the sub-processor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the sub-processor agrees that the data subject may issue a claim against the data sub-processor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the sub-processor shall be limited to its own processing operations under the Clauses.”
(c) The Privacy Shield Decision
3.21 Finally, reference should be made to Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 made pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (hereafter “the Privacy Shield Decision”). The Privacy Shield Decision replaced the Safe Harbour principles following the invalidation of those arrangements as a result of the decision of the CJEU in Schrems I. Recitals 14 and 15 of the Privacy Shield Decision state as follows:-
“(14) The EU-U.S. Privacy Shield is based on a system of self-certification by which U.S. organisations commit to a set of privacy principles — the EU-U.S. Privacy Shield Framework Principles, including the Supplemental Principles (hereinafter together: ‘the Principles’) — issued by the U.S. Department of Commerce and contained in Annex II to this decision. It applies to both controllers and processors (agents), with the specificity that processors must be contractually bound to act only on instructions from the EU controller and assist the latter in responding to individuals exercising their rights under the Principles.
(15) Without prejudice to compliance with the national provisions adopted pursuant to Directive 95/46/EC, the present decision has the effect that transfers from a controller or processor in the Union to organisations in the U.S. that have self-certified their adherence to the Principles with the Department of Commerce and have committed to comply with them are allowed. The Principles apply solely to the processing of personal data by the U.S. organisation in as far as processing by such organisations does not fall within the scope of Union legislation. The Privacy Shield does not affect the application of Union legislation governing the processing of personal data in the Member States.” [footnotes omitted]
3.22 The Privacy Shield Decision provides as follows, at Article 1:-
“1. For the purposes of Article 25(2) of Directive 95/46/EC, the United States ensures an adequate level of protection for personal data transferred from the Union to organisations in the United States under the EU-U.S. Privacy Shield.
2. The EU-U.S. Privacy Shield is constituted by the Principles issued by the U.S. Department of Commerce on 7 July 2016 as set out in Annex II and the official representations and commitments contained in the documents listed in Annexes I, III to VII.
3. For the purpose of paragraph 1, personal data are transferred under the EU-U.S. Privacy Shield where they are transferred from the Union to organisations in the United States that are included in the ‘Privacy Shield List’, maintained and made publicly available by the U.S. Department of Commerce, in accordance with Sections I and III of the Principles set out in Annex II.”
3.26 It is the SCC Decisions and in particular, the 2010 Decision whose validity is challenged in these proceedings. As is clear from the Directive, the central matter which the Commission had to determine was whether a sufficient level of protection would be afforded by the terms of that Decision so as to meet the requirements of Article 26. Clearly, amongst other things, that question potentially involves an assessment of the legal position concerning relevant data if transferred to the United States. For that reason, it is clear that US law forms a necessary, and indeed important, part of the assessment. It was, of course, for that reason that the US Government was given leave to intervene both before the High Court and before this Court. However, it is important to say something at this stage about the position of foreign law in Irish litigation.
4. The Status of Foreign Law
4.1 It is a well-established principle of Irish law that findings made by a court in relation to foreign law are treated as findings of fact.
4.2 In O’Callaghan v. O’Sullivan [1925] 1 I.R. 90, Kennedy C.J. stated at p. 112 that foreign law:-
“… applicable to the circumstances of a particular case must be proved as a fact in the particular case, and … it must be so proved by the testimony and opinion of competent expert witnesses shown to possess the skill and knowledge, scientific or empirical, required for stating, expounding, and interpreting that law.”
4.3 Similarly, in MacNamara v. Owners of the Steamship “Hatteras” [1933] I.R. 675, FitzGibbon J. stated at page 698:-
“Before I deal with the appeal itself I think it is well that I should state my view upon the real issue of fact which the learned Judge had to decide. Foreign Law, i.e., the law of a foreign country, must be proved as a matter of fact in our Courts, if a question depending upon that law is in dispute.”
4.4 This principle was reiterated more recently by Hardiman J. in McCaughey v. Irish Bank Resolution Corporation [2013] IESC 17, where he stated at para. 96:-
“The above findings have been made by the learned trial judge in the course of a meticulous judgment and after a hearing in which both the plaintiff and witnesses on his behalf, including expert witnesses on New York Law, gave evidence and were cross-examined. Similarly, most of those involved on the side of the Bank and their advisers, including each sides expert on New York Zoning Law gave evidence and were cross-examined. The content of foreign law requires to be proved as a fact in this jurisdiction and in most Common Law jurisdictions. I am therefore of the view that the findings set out above, both as to the significance of the zoning issue and as to the state of mind of Mr. McCaughey, are findings of fact made by the judge of the High Court after hearing appropriate evidence to allow him to make them.”
4.5 However, there was at least some debate at the hearing of this appeal as to the proper approach which this Court should adopt on an appeal against what is said to be an erroneous or incomplete finding of fact by the High Court in circumstances where the facts concerned are a determination of foreign law. The background to that debate has to be a consideration of the standard jurisprudence of Irish appellate courts in relation to a review of facts found by a first instance court.
5. The Review of Factual Findings by an Appellate Court in Ireland
5.1 In Hay v. O’Grady [1991] 1 I.R. 210, McCarthy J. set out the following principles regarding the role of an appellate court with regard to a review of facts found at first instance at pp. 217-218:-
“1. An appellate court does not enjoy the opportunity of seeing and hearing the witnesses as does the trial judge who hears the substance of the evidence but, also, observes the manner in which it is given and the demeanour of those giving it. The arid pages of a transcript seldom reflect the atmosphere of a trial.
2. If the findings of fact made by the trial judge are supported by credible evidence, this Court is bound by those findings, however voluminous and, apparently, weighty the testimony against them. The truth is not the monopoly of any majority.
3. Inferences of fact are drawn in most trials; it is said that an appellate court is in as good a position as the trial judge to draw inferences of fact. (See the judgment of Holmes L.J. in “Gairloch”, The S.S. Aberdeen Glenline Steamship Co. v. Macken [1899] 2 I.R. 1, 18, cited by O'Higgins C.J. in the People v. Madden [1977] I.R. 336 at p. 339). I do not accept that this is always necessarily so. It may be that the demeanour of a witness in giving evidence will, itself, lead to an appropriate inference which an appellate court would not draw. In my judgment, an appellate court should be slow to substitute its own inference of fact where such depends upon oral evidence of recollection of fact and a different inference has been drawn by the trial judge. In the drawing of inferences from circumstantial evidence, an appellate tribunal is in as good a position as the trial judge.
4. A further issue arises as to the conclusion of law to be drawn from the combination of primary fact and proper inference - in a case of this kind, was there negligence? I leave aside the question of any special circumstance applying as a test of negligence in the particular case. If, on the facts found and either on the inferences drawn by the trial judge or on the inferences drawn by the appellate court in accordance with the principles set out above, it is established to the satisfaction of the appellate court that the conclusion of the trial judge as to whether or not there was negligence on the part of the individual charged was erroneous, the order will be varied accordingly.
5. These views emphasise the importance of a clear statement, as was made in this case, by the trial judge of his findings of primary fact, the inferences to be drawn, and the conclusion that follows.”
5.2 Those principles have been the subject of consideration by this Court in recent years. In my judgment in Doyle v. Banville [2012] IESC 25, [2018] 1 I.R. 505, I noted as follows at para. 2.3 of the judgment, or para. 10 of the reported judgment:-
“… Where a judge decides the facts there will be a judgment or ruling whether orally given immediately after the trial, or in writing after a period. To that end it is important that the judgment engages with the key elements of the case made by both sides and explains why one or other side is preferred. Where, as here, a case turns on very minute questions of fact as to the precise way in which the accident in question occurred, then clearly the judgment must analyse the case made for the competing versions of those facts and come to a reasoned conclusion as to why one version of those facts is to be preferred. The obligation of the trial judge, as identified by McCarthy J. in Hay v. O'Grady, to set out conclusions of fact in clear terms needs to be seen against that background.”
5.3 I further stated at para. 2.7, or para. 14 of the reported judgment:-
“… it is also important to note that part of the function of an appellate court is to ascertain whether there may have been significant and material error(s) in the way in which the trial judge reached a conclusion as to the facts. It is important to distinguish between a case where there is such an error, on the one hand, and a case where the trial judge simply was called on to prefer one piece of evidence to another and does so for a stated and credible reason. In the latter case it is no function of this Court to seek to second guess the trial judge's view.”
5.4 Similarly, in my judgment in Wright & anor. v. AIB Finance and Leasing & anor. [2013] IESC 55, I noted at para. 7.10:-
“… the findings of fact of the trial judge can, in accordance with Hay v. O'Grady [1992] 1 I.R. 210, only be disturbed if there was no evidential basis for them or if the reasoning of the trial judge in reaching those conclusions of fact does not stand up. It is important to recall that Hay v. O'Grady is concerned specifically with the assessment of the facts by a trial judge where the trial judge is required either to weigh conflicting evidence or assess the credibility or reliability of testimony. It is also clear that findings of fact can be disturbed where there is a material and significant error in the assessment of the evidence or a failure to engage with a significant element of the evidence put forward (see for example Doyle v. Banville [2012] IESC 25).”
5.5 In my judgment in Donegal Investment Group plc v. Danbywiske [2017] IESC 14, I made the following comments at paras. 5.4 to 5.7 regarding the application of Hay v. O’Grady in the context of findings of fact made by a trial judge where there was conflicting expert evidence at trial:-
“5.4 … it seems to me that counsel on both sides were correct to accept that the principles in Hay v. O'Grady do apply to the role of an appellate court in scrutinising findings made by a trial judge with the assistance of expert testimony.
5.5 However, as Charleton J. also pointed out in James Elliott Construction Limited v. Irish Asphalt Limited [2011] IEHC 269, an important part in the assessment of any evidence is the application by the trial judge of logic and common sense to the testimony heard. That approach is particularly relevant in the context of expert evidence. Where experts differ, the position adopted by the other side will be put to each of the experts in cross-examination. Their reasons for maintaining their view can be examined in some detail. The trial judge can, therefore, assess whether the reasons given by one expert or the other stand up better to scrutiny.
5.6 While it is true, therefore, that the assessment of all evidence, whether expert or factual, requires both the application of logic and common sense, on the one hand, and an assessment of the reliability or credibility of the witness gleaned from having been in the courtroom, on the other, it may be fair to say that it is likely that a decision based on expert evidence will be significantly more amenable to analysis on the basis of the logic of the positions adopted by the competing witnesses and the assessment of the trial judge of their evidence on that basis.
5.7 Precisely because a decision to prefer the evidence of one expert over another is likely to be influenced, to a much greater extent than might be the case in respect of factual evidence, by the rationale put forward by the competing witnesses, there may be somewhat greater scope for an appellate court to assess whether the reasons given by a trial judge for preferring one expert over another can stand up to scrutiny. That being said it must remain the case that an appellate court should show significant deference to the views of a trial judge on the question of findings based on expert evidence because the trial judge will have had the opportunity to see the competing views challenged and scrutinised at the hearing…”
5.6 Finally, reference might also be made to the decision of this Court in Leopardstown Club Ltd. v. Templeville Developments Ltd. [2017] IESC 50, [2017] 3 I.R. 707. In her judgment in that case, Denham C.J. provided an overview of the principles identified in the Hay v. O’Grady jurisprudence, at para. 82:-
“The principles identified by the Hay v. O'Grady jurisprudence include the following:-
• An appellate court does not proceed by way of a full re-hearing of a case.
• An appellate court is bound by the findings of fact of a trial judge which are supported by credible evidence.
• In general, an appellate court proceeds on the findings of fact of a trial judge.
• The fact that there is contrary evidence does not alter the position.
• An appellate court should be slow to substitute its own inferences of fact where such depends upon oral evidence, and a different inference has been drawn by the trial judge.
• The fact that there is some evidence before a trial judge which may lead to a different conclusion does not alter the fundamental principle.
• A finding of the credibility, or not, of a witness is a primary finding of fact.”
5.7 It is particularly in the context of the final paragraph in the passage cited from Donegal Investment Group plc v. Danbywiske that it is said that an issue arises as to the proper approach of this Court on this appeal, having regard to the fact that the matters sought to be appealed are findings as to US law which, in accordance with the jurisprudence already described, are treated as findings of fact but are based on expert testimony. There is a question which therefore arises as to the extent to which it may be appropriate for this Court to review, as a matter of Irish law, such findings of the trial judge. However, I do not see any reason to depart from the view expressed in Donegal Investment Group plc v. Danbywiske concerning the proper overall approach.
5.8 As already noted, there remains a significant issue in this appeal as to the extent, if any, to which it may be open to Facebook to invite this Court to interfere with the decision of the trial judge in the light of the fact that a reference to the CJEU remains pending. The issues which arise potentially involve questions both of Irish constitutional law and of the law of the European Union. Those issues are set out in some detail in the earlier judgment. However, it must be recalled that the earlier judgment was simply concerned with whether it was appropriate for the Court to grant leave to appeal. As noted in the earlier judgment, there are two ways in which this Court may address a question as to whether an appeal lies at all when such an issue is raised in the context of an application for leave to appeal. The Court may, if it feels that it is safe to determine the issue within the limited confines of an application for leave to appeal, proceed to make a final decision so that either the Court determines that no appeal lies and thus refuses leave to appeal or it determines that an appeal does lie and goes on to consider whether the constitutional threshold for leave to appeal is met in the circumstances of the case.
5.9 The Court has adopted a pragmatic approach to these matters in the interests of efficiency. It should also be pointed out that the approach adopted in this case is not unique, for the Court has taken the same course of action in circumstances where there are questions over whether an appeal lies to this Court from a decision of the High Court which was taken as a result of a Circuit appeal (see Pepper Finance Corporation (Ireland) Designated Activity Company v. Cannon [2019] IESCDET 5). In that case, the Court also decided to give leave with the question as to whether an appeal lies in the first place being one of the issues to be determined at the full hearing. The Court has also, in appropriate cases, determined that it was not necessary to decide whether an appeal lay in cases where the constitutional threshold would not have been met in any event (see, for example, Wynnefield House Management Ltd. v. Breatnach [2016] IESCDET 39, Costello v. Carney [2018] IESCDET 28 and Bank of Ireland Mortgage Bank v. Beakey [2019] IESCDET 77).
5.10 These are all methods of dealing in a practical way with the same question. However, in the circumstances of this case, the Court took the view that the issues concerning the scope, if any, of an appeal which might be pursued in circumstances where there had been a reference to the CJEU were sufficiently complex that it was appropriate to grant leave and allow those issues to be fully debated at a plenary hearing.
5.11 It is appropriate, therefore, to turn to that question.
6. The Limitations on the Scope of Appeal
6.1 As noted, this issue was addressed on a preliminary basis in the earlier judgment. There is particular reference to the decision of the CJEU in Cartesio (Case C-210/06) EU:C:2008:723, [2008] E.C.R. I-9641 and the passages from the judgment of the Court of Justice in that case, cited between paras. 3.9 and 3.11 of my judgment. There is also reference both to Pohotovost (Case C-470/12) EU:C:2014:101, [2014] 1 All E.R. (Comm) 1016 and to a paper written by the now President of the CJEU on this topic.
6.2 From those materials it can at least be concluded that an appellate court cannot interfere with the sole competence of the referring court to decide whether to maintain, withdraw or amend a reference already made. It seems to me to follow, in the context of the circumstances of this case, that the height of the jurisdiction which this Court might enjoy could only be to identify matters where, in accordance with the ordinary principles of Irish law, it would be appropriate for this Court to overturn findings of fact by the trial judge and to deliver a judgment on that basis.
6.3 It is also necessary to consider Campus Oil v. Minister for Industry [1983] I.R. 82. It will be recalled that one of the bases on which this Court determined in Campus Oil that an appeal did not lie to this Court against an order of reference to the Court of Justice was because it was considered that the order of reference in that case did not amount to a “decision” of a lower court, in the sense in which that term is used in the constitutional provisions concerning appeals within the Superior Courts.
6.4 However, it must be recalled that the High Court, in Campus Oil, does not appear to have reached any determination on matters of fact or of national law. The order of reference in that case simply set out the two questions which were referred to the Court of Justice. It seems to follow, therefore, that when Walsh J. spoke of the order of reference not being a “decision”, in the constitutional sense of that term, he was speaking of the decision to refer and the formulation of the questions on which the opinion of the Court of Justice was sought. In that sense, indeed, it can be said that Campus Oil is entirely consistent with the subsequently expressed view of the CJEU in Cartesio.
6.5 It must also be recalled that it is possible to distinguish between the order for reference itself, being the questions referred to the CJEU, on the one hand, and any necessary findings of fact or of national law which the referring court may have to make so as to determine whether a reference is truly necessary and also to specify any relevant facts and matters of national law in the reference document, on the other. Furthermore, there may well be cases where a court is not required to make any findings, as such, as to the facts or as to national law, for there may be no dispute between the parties on the facts and the relevant principles of national law may be well settled. In such a case, the only “decision” which would be made by the High Court would be the decision to refer itself and the determination of the form of the questions to be put to the CJEU. If that is the only determination made, then it clearly would not be capable of being an appealable decision either as a matter of national law, following Campus Oil, or as a matter of Union law, having regard to Cartesio.
6.6 It is, of course, the case that the jurisprudence of the CJEU makes clear that it is for the referring court to determine the facts. While the CJEU will normally accept a decision of a referring court to the effect that it requires an answer to the question or questions raised so as to be able to resolve the case before it, the Court of Justice will, in very limited circumstances, review the necessity to answer the questions concerned. This will be done only where it is quite obvious that the interpretation of Union law which is requested bears no relation to the actual facts, where the problem is hypothetical or where the CJEU does not have before it the factual or legal material necessary to give a useful answer (see, for example, Pohotovost at para. 27 and the joined cases cited therein). It follows that it is at least necessary for a referring court, prior to determining that a reference is necessary, to consider at least some matters of fact and/or of national law so as to satisfy itself that it requires an answer from the CJEU as to the proper interpretation of a measure of Union law so as to enable it to finally resolve the proceedings. As has been pointed out on many occasions, the CJEU does not provide advisory opinions and does not, therefore, answer hypothetical questions which have no grounding in the facts of the case.
6.7 It follows, in turn, that it may be necessary for a referring court to “decide” at least some issues of fact or of national law for it to be in a position to make a reference in the first place, although, as noted earlier, there may not, in some cases, be a requirement to resolve or “decide” any contested issues of fact or of national law so as to enable a reference to be made, for the facts may not be in dispute and national law well settled and not contested.
6.8 It is a common, although not a universal, practice for judges in Ireland who intend to make a reference to deliver a preliminary judgment which makes a final determination on relevant issues of fact and national law, as part of the process of identifying why it remains necessary for the proper resolution of the case to decide on the proper interpretation of a measure of Union law which is not acte clair and thus, which may (or must, in the case of a court of final appeal) be referred to the CJEU. However, it does not really matter whether the determination of the High Court of contested issues of fact or of national law is included in a separate judgment or simply finds its way into the facts described or the matters of national law specified in the reference.
6.9 Against that backdrop, it does not seem to me that it can properly be said that the determination of contested facts or matters of national law by a trial court, as part of the process leading to a reference, can be described in any way other than as a “decision”, in the constitutional sense of that term. It does not seem to me that such a conclusion is inconsistent with the views expressed by this Court in Campus Oil. As noted earlier, the appeal in Campus Oil was concerned with a case where the only “decision” of the High Court was to make a reference and to formulate the question set out in the order of reference. But a very different situation arises where the High Court, either in a separate preliminary judgment or in the facts and matters of national law set out in the reference document itself, has had to reach conclusions on matters of controversy. The reaching of such conclusions must undoubtedly represent a “decision” for the purposes of Art. 34 of the Constitution and must, therefore, in principle, be open to the appellate process which the Constitution provides.
6.10 However, in the vast majority of cases there will be a very strong basis for suggesting that an appellate court should not entertain an appeal against findings of fact or of national law contained in a judgment or ruling of a lower court which has made a reference to the CJEU, while the reference is pending. The reasons for adopting that course of action are derived from the interests of justice and the proper use of judicial resources. In the vast majority of cases, a party who is aggrieved by what it feels is an erroneous determination of fact or of national law will retain the opportunity, after the CJEU has given its response to the reference and the referring court has made a final determination on the merits of the case, to appeal against the overall decision to any higher court having jurisdiction. It is clear in that context that, while the appellate court will be bound by the interpretation of Union law which is to be found in the judgment of the CJEU, the appellate court will be entitled to overturn, in any manner consistent with Irish procedural law, any erroneous decisions of fact or of national law. The appellate court will thus be able to overturn the decision of the referring court if, as a result of determining that decisions of fact or of national law were incorrect, it transpires that the final resolution of the proceedings by the referring court was incorrect. Indeed, it is entirely possible to envisage such a case where the effect of the decision of the appellate court in Ireland will mean that the reference will turn out to have been unnecessary in the first place.
6.11 In passing, it seems to me to be appropriate to comment that analysis of the type which I have just identified should properly be taken into account by any lower court in considering whether it is proper for it to make a reference, rather than leave it to a higher court, including this Court, to decide whether a reference is truly necessary in the light of the final resolution of all issues of fact or national law. Whether this can present a problem will depend on the circumstances of the case in question. There will be cases where, on any view, an issue of Union law which is not acte clair and which requires clarification from the CJEU will inevitably have to be resolved in order that the proceedings themselves can be properly determined. However, there will be cases where the question of whether the clarification of an issue of Union law is necessary to the proper final determination of the proceedings may depend on how the facts and any relevant issues of national law are ultimately decided. Those matters may not, in the circumstances of a particular case, be capable of being taken to have been definitively determined until all appeals have been exhausted and a lower court considering making a reference should at least take into account the possibility that the reference may transpire to be unnecessary.
6.12 However, I would emphasise that, in making those comments, I do not want in any way to suggest that an appellate court has any role in attempting to overturn an order of reference once made. Rather, I am simply indicating some factors which I consider a judge of a lower court who is considering making a reference might properly take into account.
6.13 In any event, and for the reasons earlier analysed, there may very well be good reasons why it would be wholly inappropriate for an appellate court to consider an appeal while a reference is pending. In much the same way, Irish appellate courts have frequently emphasised that it will only be in unusual circumstances that an appellate court will entertain an appeal from a ruling made in the course of a trial or like matters. This results not from an absence of jurisdiction but rather from issues relating to the interests of justice and the proper use of judicial resources which suggest that it is better to leave all issues which might arise on appeal to be resolved in a single appeal after the proceedings have been concluded in the lower court. However, there can be exceptional circumstances where those considerations are outweighed by other factors.
6.14 In the context of the sui generis process which was carried out by the High Court in this case, by virtue of the decision of the CJEU in Schrems I, it seems to me that there are exceptional factors at play. It is clear from Schrems I that it is for the national referring court to determine the facts and to reach a conclusion as to whether it shares the concerns of the DPC, or her equivalent in other member states. Such a determination of the facts (or of national law, should it be relevant) made by a referring court is a “decision” which is capable of being appealed. However, the type of reasons why an appellate court might not normally entertain an appeal in such circumstances do not apply in this case. As already noted, in most ordinary proceedings any finding of fact or of national law will be subject to an appeal in the normal way, in accordance with the Irish appellate process. That provides a very strong justification for leaving over an appeal against such findings until after the proceedings have been finally determined at trial. However, where, as here, the only purpose of the findings of fact is to feed into the ultimate analysis by the CJEU as to the validity of the SCC Decisions under challenge, different considerations apply. Unusually therefore, there can, in practice, be no appeal against those findings of fact, for a definitive determination on the validity of the challenged measures will have been taken by the CJEU. Against that backdrop, I can see no reason which would lean the Court against entertaining an appeal on the facts at this stage. Indeed, the opposite is the case, for to decline to exercise the jurisdiction of the Court to entertain an appeal against the facts at this stage would be for this Court to abdicate its constitutional role of reviewing, within the confines of the limitations imposed by Irish procedural law, findings of fact made in a court such as the High Court.
6.15 It follows that I can see no reason of either principle or practicality which would suggest that an Irish appeal court should not entertain an appeal against the facts or against findings of national law, which were determined as part of a process leading to a reference, in circumstances where there will be no subsequent opportunity following the result of the reference and the final determination of the merits of the case to invoke any appellate regime which the Constitution would otherwise permit. On that basis, I am satisfied that there is no barrier in Irish law to this Court exercising the ordinary function which it plays in reviewing, within the jurisprudence already identified, findings of fact by the High Court which form the basis of a decision by that court to make a reference to the CJEU.
6.16 That is not, of course, the end of the matter, for it is also necessary to consider whether, and if so, to what extent, Union law imposes any restrictions. I have already identified the clear limitations which the Cartesio jurisprudence imposes. There certainly can be no appeal against the decision of the High Court to make the reference. Neither can there, in my view, be any appeal against the terms of the questions, although I will make some comments on whether all of the questions asked were fully necessary in this case. But I equally can see nothing in the Cartesio jurisprudence which suggests that there is any Union law reason why this Court cannot, in accordance with national law and procedure, entertain an appeal against a finding of fact (or of national law, if it arises) which formed part of the process leading to a reference.
6.17 In those circumstances, the judgment in Pohotovost is illustrative of an important point. In particular, at para. 31 of the judgment, it is noted that an appeal had been brought against the order for a reference in that case. In that context, the CJEU noted that, in accordance with Article 267 TFEU, the assessment of the relevance and necessity of the question referred for a preliminary ruling is, in principle, the responsibility of the referring court alone, subject to the limited verification made by the CJEU to which I have already referred. The Court went on to note that it was, therefore, “for the referring court to draw the proper inferences from a judgment delivered on an appeal against its decision to refer and, in particular, to come to a conclusion as to whether it is appropriate to maintain the reference for a preliminary ruling, or to amend it or withdraw it”. In so commenting, the CJEU cited Cartesio. It seems clear, therefore, that the CJEU fully accepted that there was nothing inappropriate about pursuing an appeal in accordance with the procedural law of the member state concerned while the reference was pending, provided that it was made clear that it was for the referring court, and it alone, to determine what to do in the light of the result of the appeal. In that context, it is clear that, as a matter of Irish law, a decision of this Court overturning a finding of fact by the High Court would be binding on the High Court. However, it is equally clear that, as a matter of Union law, the fact that such a decision by this Court would be binding on the High Court cannot remove from the High Court the entitlement which it, and it alone, enjoys to decide whether to continue with, withdraw or amend the reference. But it equally follows that there is no barrier in Union law to this Court overturning decisions of fact or of national law of the High Court, notwithstanding that a reference remains pending.
6.18 That leads to one final question. While it is clear that findings as to the laws of other jurisdictions are regarded as findings of fact in Irish law, it by no means follows that the CJEU will consider that findings by the Irish High Court as to the laws of the United States have the same status as a finding of what one might describe as pure facts, such as, for example, the practice adopted by any relevant U.S. agency in the context of data transferred to the U.S. under the sort of arrangements which are under consideration in these proceedings. The precise status which the CJEU gives to the views expressed by the Irish High Court as to U.S. law is, ultimately, itself a matter of Union law for the CJEU to determine.
6.19 In those circumstances, it seems to me that the appropriate approach is to first consider whether it would be appropriate, in accordance with the application of the ordinary principles of Irish procedural law, to interfere with any of the determinations of the High Court which are criticised on this appeal. It will then be necessary to determine what the appropriate response of this Court should be if it were to hold that findings of the High Court were not sustainable on the basis of the Hay v. O’Grady principles. Against that backdrop, I turn to the basis of Facebook’s appeal.
7. The Appeal on the Facts
7.1 In one sense, the issues on which Facebook invites this Court to find that the trial judge was incorrect in her determination of US law are relatively narrow. They can be summarised as follows:-
(a) Mass Indiscriminate Processing of Data
7.2 Facebook argues that the trial judge erroneously concluded that US agencies engage in “mass indiscriminate processing” of data. Facebook says that this finding fails to distinguish between the Upstream surveillance programme and the PRISM programme. It will be necessary to elaborate on the operation of those programmes later in this judgment. In particular, Facebook refers to para. 190 of the High Court judgment, where the trial judge stated:-
“The Directive defines processing of personal data as including any operation or set of operations which is performed upon personal data such as collection… or otherwise making available the data. On the basis of this definition and the evidence in relation to the operation of the PRISM and Upstream programmes authorised under s. 702 of [the Foreign Intelligence Surveillance Act (“FISA”)], it is clear that there is mass indiscriminate processing of data by the United States government agencies, whether this is described as mass or targeted surveillance.” (Emphasis in original)
7.3 Facebook argues that this approach is erroneous on the basis that it is inconsistent with uncontradicted evidence. Furthermore, Facebook says that the terms of the Directive do not support the conclusion reached by the trial judge.
7.4 In this regard, Facebook refers to the report of the Privacy and Civil Liberties Oversight Board (“PCLOB”) on “the Surveillance Program Operated Pursuant Section 702 of [FISA]”, dated 2 July 2014 (“the PCLOB Report”). In particular, Facebook points to the following statement in the PCLOB Report regarding the operation of Upstream:-
“To identify and acquire Internet transactions associated with the Section 702-tasked selectors on the Internet backbone, Internet transactions are first filtered to eliminate potential domestic transactions, and then are screened to capture only transactions containing a tasked selector. Unless transactions pass both these screens they are not ingested into government databases.”
7.5 It further refers to what is said to be uncontradicted expert evidence, which it says is inconsistent with the conclusion reached by the trial judge in this context.
(b) US Surveillance is “Legal unless Forbidden”
7.6 Facebook challenges the finding made by the trial judge at para. 192 of her judgment, where she stated:-
“The basic principle is that surveillance is legal unless forbidden and there is no requirement ever to give notice in relation to surveillance.”
7.7 Facebook states that this finding was made in circumstances where that issue was not part of either the DPC’s original draft decision or part of the DPC’s or Mr. Schrems’ case before the High Court. Facebook says its expert witnesses were never requested to give evidence on this issue. Had the opportunity been given for evidence in relation to this issue to be given, Facebook says it would have contradicted the finding made by the High Court judge.
7.8 Facebook submits that the apparent source of the statement “legal unless forbidden” is an outdated academic article referred to by an expert witness.
7.9 Facebook argues that the statement is inaccurate and points to evidence to the effect that the federal government of the United States is a government of limited and enumerated powers and that any action taken by the federal government must be grounded in a power enumerated by the US Constitution. Furthermore, Facebook says that, even when the federal government is acting within the scope of such a power, there must be legislation which creates and funds the entity acting and which permits the relevant conduct. Facebook says that this is true in relation to the surveillance of data by US government agencies. As such, Facebook says that the data surveillance regime is compatible with the requirement of protection of rights referred to in Schrems I, as there are “clear and precise rules governing the scope and application of a measure and imposing minimum safeguards”.
7.10 Finally, Facebook notes that the US courts have not hesitated to strike down action by US government agencies where they have exceeded the powers granted by legislation, including in relation to national security matters. In this regard, they refer to the case of ACLU v. Clapper 785 F.3d 787 (2d Cir. 2015).
(c) The Issue of Standing in US Law
7.11 Facebook submits that the High Court erred in its findings in relation to standing requirements under US law.
7.12 First, Facebook points to the findings of the trial judge at para. 226 of her judgment, where she stated:-
“The application of the test depends upon what is called the posture of the case. A plaintiff’s standing to sue can be challenged on the basis of the pleaded case by a motion to dismiss, in which case the plaintiff is required to show that he has plausibly pleaded his case in order to survive the motion to dismiss. The facts are assumed in his favour but they must amount to a legal wrong, if proven. His standing may also be challenged by a motion for summary judgment. If that occurs, it is not sufficient for the plaintiff to plead plausible allegations; he must adduce evidence to support his claim and if he fails to do so his action will be dismissed.”
7.13 Facebook argues that the trial judge failed to appreciate the significant distinction between the motion-to-dismiss stage and the summary judgment stage of litigation and that the trial judge also failed to appreciate how the requirement that a plaintiff show injury which is “concrete and particularized” operates at each stage of litigation.
7.14 Facebook also submits that the trial judge erred in suggesting that, in the national security context, a plaintiff must establish that the government’s intrusion caused some kind of pecuniary or financial harm. The trial judge stated as follows at para. 213:-
“In any event, if seeking damages, it is necessary to establish that the disclosure was intentional or wilful and that the disclosure had an adverse effect on the plaintiff. It is necessary to establish pecuniary loss and damage. Non-economic harm is insufficient. Federal Aviation Authority v. Cooper 137 S.Ct. 1441 (2012). This limitation does not apply to a claim for declaratory or injunctive relief.”
7.15 Facebook argues that the judgment in FAA v. Cooper 137 S.Ct. 1441 (2012) is concerned with a statutory requirement arising in a different context, which requires in that context that a plaintiff show “actual damage”.
7.16 Finally, in this context, Facebook says that the trial judge erred in stating, at para. 232 of the High Court judgment, that “[t]he experts all agreed that standing is notoriously indeterminative…”. Facebook refers to the Experts Meeting Report which arose from the pre-trial procedures in this case and says that in fact the experts only agreed that standing was “to a large degree indeterminate”. Facebook argues that what the experts meant was that the outcome of a case will depend on the circumstances of the particular case and the facts presented.
(d) US Administrative Procedure Act
7.17 Facebook submits that the High Court erred in its findings in relation to the importance and/or relevance of the US Administrative Procedure Act (“the APA”) in providing a judicial remedy in respect of unlawful government surveillance.
7.18 In this context, Facebook points to the following statement at para. 258 of the High Court judgment:-
“A claim under the APA only lies if there is no other statutory claim available. This rules out many potential cases. Even where the claim is not precluded, there is uncertainty whether it extends to collecting, processing or retaining the data of a particular individual.”
7.19 Facebook describes this as a cursory statement and says that it ignores the general presumption in favour of judicial review of executive action, and the numerous court decisions which they say support such review.
7.20 Facebook also refers to the following statement at para. 219 of the judgment:-
“Only Professor Vladeck placed emphasis on the Administrative Procedure Act as a possible source of remedy. It was not referred to by Professor Swire who gave evidence on behalf of Facebook or Mr. Robert Litt in his letter to the Commission included as an annex to the Privacy Shield Decision. Professor Richards and Mr. Serwin who gave evidence on behalf of the DPC both discounted it as a meaningful avenue of redress for EU citizens.”
7.21 Facebook states that in fact, the APA is referred to in the recitals to the Privacy Shield Decision (in particular, recitals 113, 130 and 131).
(e) Article 47 of the Charter
7.22 Facebook argues that the High Court erred in concluding that the arguments of the DPC to the effect that the laws and practices of the US do not respect the essence of the right to an effective remedy guaranteed by Article 47 of the Charter of Fundamental Rights of the European Union (“the Charter”) were well founded. At para. 298 of the High Court judgment, the trial judge stated:-
“To my mind the arguments of the DPC that the laws – and indeed the practices – of the United States do not respect the essence of the right to an effective remedy before an independent tribunal as guaranteed by Article 47 of the Charter, which applies to the data of all EU data subjects transferred to the United States, are well founded.”
7.23 Facebook says the judgment failed to have regard to the extent of judicial remedies in US law and what they say are the extensive oversight mechanisms provided in US law. It says that the alleged errors in this regard are linked to the trial judge’s alleged failure to appreciate the significance of certain remedies, as well as errors made in respect of the standing doctrine (both of which issues are addressed above). Facebook argues that the trial judge failed to take into account safeguards and oversight, which they say must be considered alongside remedies in the signals intelligence context.
(f) Article 52(1) of the Charter
7.24 Facebook also argues that the High Court erred in concluding that there were well-founded concerns that the limitations on the exercise of the right to an effective remedy faced by EU data subjects in the US were not proportionate and/or were not strictly necessary, within the meaning of Article 52(1) of the Charter. The trial judge stated as follows at para. 298:-
“Furthermore, even if the essence of that right is respected, there are, for the reasons advanced by the DPC, well founded concerns that the limitations on the exercise of that rights faced by EU data subjects in the United States are not proportionate and are not strictly necessary within the meaning of Article 52(1) of the Charter.”
7.25 Facebook questions, in particular, whether this finding was adequately supported by the necessary reasoning and analysis and whether the High Court engaged sufficiently with the evidence relating to proportionality. Facebook says that proportionality analysis requires a court to consider the necessity of a limitation and whether the limitation meets the objectives of general interest recognised by the Union or protects rights and freedoms. It says the High Court failed to engage in such a balancing exercise and failed to take into account other Charter rights which would render any interference with Article 47 proportionate (in particular, Facebook refers to the right to life (Article 2), the right to security (Article 6), the right to freedom of expression (Article 11), the freedom to conduct a business (Article 16)).
(g) Failure to Consider or Refer to Certain Evidence
7.26 Facebook says that the trial judge failed to consider relevant evidence and that this means that there are omissions in the statement of facts which could be crucial to how the CJEU rules on the preliminary reference. It says that the evidence which was omitted is directly relevant to the balancing exercise under Article 52 of the Charter. In particular, Facebook points to the evidence of Dr. Meltzer, Mr. DeLong, Professor Clarke, and Mr. Ratzel. Facebook says that reports produced by the latter three experts establish that signals intelligence operations protect rights and interests and advance legitimate objectives of member states regarding national security and protection of the lives of EU citizens.
7.27 Facebook also says that the trial judge erred in failing to refer to the EU-US Umbrella Agreement.
(h) Formulation of Question 1
7.28 Facebook takes issue with the reference in the first question referred by the High Court to “Law enforcement and the conduct of foreign affairs of the third country.” It argues that the inclusion of this phrase is inappropriate in circumstances where there was no evidence directed towards those issues. Facebook requests that the Court express its view on this matter, but does not request that it make an order that the question be amended.
7.29 In addition, it was argued that the Commission Decision in relation to the Privacy Shield was either binding on the High Court (such that the High Court could not, for the purposes of Schrems I, legitimately entertain doubts as to the validity of the SCC Decision in a manner which was inconsistent with the Privacy Shield Decision) or, alternatively, that the High Court was required to place great weight on the Privacy Shield Decision and had failed to do so.
7.30 In order to see how those matters of fact might fit in to the issues which are currently before the CJEU, it is necessary to set out in full the questions which the trial judge ultimately referred to that court:-
“1. In circumstances in which personal data is transferred by a private company from a European Union (EU) member state to a private company in a third country for a commercial purpose pursuant to Decision 2010/87/EU as amended by Commission Decision 2016/2297 (‘the SCC Decision’) and may be further processed in the third country by its authorities for purposes of national security but also for purposes of law enforcement and the conduct of the foreign affairs of the third country, does EU law (including the Charter of Fundamental Rights of the European Union (‘the Charter’)) apply to the transfer of the data notwithstanding the provisions of Article 4(2) of TEU in relation to national security and the provisions of the first indent of Article 3(2) of Directive 95/46/EC (‘the Directive’) in relation to public security, defence and State security?
2. (1) In determining whether there is a violation of the rights of an individual through the transfer of data from the EU to a third country under the SCC Decision where it may be further processed for national security purposes, is the relevant comparator for the purposes of the Directive:
(2) If the relevant comparator is (b), are the practices in the context of national security in one or more member states also to be included in the comparator?
3. When assessing whether a third country ensures the level of protection required by EU law to personal data transferred to that country for the purposes of Article 26 of the Directive, ought the level of protection in the third country be assessed by reference to:
(a) The applicable rules in the third country resulting from its domestic law or international commitments, and the practice designed to ensure compliance with those rules, to include the professional rules and security measures which are complied with in the third country;
or
(b) The rules referred to in (a) together with such administrative, regulatory and compliance practices and policy safeguards, procedures, protocols, oversight mechanisms and non judicial remedies as are in place in the third country?
4. Given the facts found by the High Court in relation to US law, if personal data is transferred from the EU to the US under the SCC Decision does this violate the rights of individuals under Articles 7 and/or 8 of the Charter?
5. Given the facts found by the High Court in relation to US law, if personal data is transferred from the EU to the US under the SCC Decision:
(a) Does the level of protection afforded by the US respect the essence of an individual’s right to a judicial remedy for breach of his or her data privacy rights guaranteed by Article 47 of the Charter?
If the answer to a) is yes,
(b) Are the limitations imposed by US law on an individual’s right to a judicial remedy in the context of US national security proportionate within the meaning of Article 52 of the Charter and do not exceed what is necessary in a democratic society for national security purposes?
6. (1) What is the level of protection required to be afforded to personal data transferred to a third country pursuant to standard contractual clauses adopted in accordance with a decision of the Commission under Article 26(4) in light of the provisions of the Directive and in particular Articles 25 and 26 read in the light of the Charter?
(2) What are the matters to be taken into account in assessing whether the level of protection afforded to data transferred to a third country under the SCC Decision satisfies the requirements of the Directive and the Charter?
7. Does the fact that the standard contractual clauses apply as between the data exporter and the data importer and do not bind the national authorities of a third country who may require the data importer to make available to its security services for further processing the personal data transferred pursuant to the clauses provided for in the SCC Decision preclude the clauses from adducing adequate safeguards as envisaged by Article 26(2) of the Directive?
8. If a third country data importer is subject to surveillance laws that in the view of a data protection authority conflict with the clauses of the Annex to the SCC Decision or Article 25 and 26 of the Directive and/or the Charter, is a data protection authority required to use its enforcement powers under Article 28(3) of the Directive to suspend data flows or is the exercise of those powers limited to exceptional cases only, in light of Recital 11 of the Directive, or can a data protection authority use its discretion not to suspend data flows?
9. (1) For the purposes of Article 25(6) of the Directive, does Decision (EU) 2016/1250 (‘the Privacy Shield Decision’) constitute a finding of general application binding on data protection authorities and the courts of the member states to the effect that the US ensures an adequate level of protection within the meaning of Article 25(2) of the Directive by reason of its domestic law or of the international commitments it has entered into?
(2) If it does not, what relevance, if any, does the Privacy Shield Decision have in the assessment conducted into the adequacy of the safeguards provided to data transferred to the United States which is transferred pursuant to the SCC Decision?
10. Given the findings of the High Court in relation to US law, does the provision of the Privacy Shield ombudsperson under Annex A to Annex III of the Privacy Shield Decision when taken in conjunction with the existing regime in the United States ensure that the US provides a remedy to data subjects whose personal data is transferred to the US under the SCC Decision that is compatible with Article 47 of the Charter?
11. Does the SCC Decision violate Articles 7, 8 and/or 47 of the Charter?”
7.31 Before going on to set out the position taken by the DPC and on behalf of Mr. Schrems in relation to the specific factual questions raised by Facebook, it is, perhaps, appropriate to make an observation on the general topic of the questions referred by the High Court to the CJEU.
8. Some Observations
8.1 In my view, it is not clear why it was considered necessary for the High Court to ask specific questions of the type set out in the order of reference. As noted earlier there were further submissions raised by the parties after the original judgment of the High Court had been delivered and it would appear likely that the parties made submissions on the type of questions which should be referred. I am also mindful of the fact that it is not appropriate for this Court to interfere with the dialogue between the High Court and the CJEU. In addition, I am also mindful of the fact that it will ultimately be a matter for the CJEU to determine the manner in which it approaches the issues raised on this reference, including the extent to which any or all of the specific questions referred require to be answered.
8.2 It is, of course, the case that the CJEU must determine whether the SCC Decisions generally or, in particular, the 2010 Decision, are valid, for the CJEU is the only court which has jurisdiction to make such a determination. It also may well be that assessing the issues which lie behind some or all of the questions included in the order of reference may form a part, and indeed potentially an important part, of the overall assessment which the CJEU will have to make in order to determine the validity of the SCC Decisions.
8.3 However, it is worth noting one consequence of the unusual nature of these proceedings as addressed earlier in this judgment. The reason why a number of questions are frequently addressed by national courts to the CJEU in the course of a preliminary reference procedure is that the national court will consider that it needs the answers to all of those questions, so as to enable it to properly resolve the proceedings before it in accordance with the facts, with national law and with EU law, as definitively interpreted by the CJEU.
8.4 Subject to the CJEU taking the view that some of the questions referred may not be admissible or that there may be some other reason why it is not appropriate to answer any question in the way in which it is put, the CJEU will give guidance to the national court on the proper interpretation of Union law in accordance with the questions asked, but only so as to enable the national court to exercise its jurisdiction to come to a proper determination of the case before it.
8.5 In that context, it is important to recall that, as a matter of substance, there will be nothing left for the Irish High Court to do when the answers from the CJEU in this case come back. The challenged Decisions will either be found to be valid or invalid. The sole purpose of the proceedings before the courts in Ireland was to enable the High Court to refer that question of validity to the CJEU and obtain a definitive answer from the only court which has competence to make the decision in question. It is difficult, therefore, to see how the High Court needs answers to many of the questions which have been referred, for the answers to those questions are only relevant to the question of the validity of the challenged measures and the only court which can make a decision on that validity is the CJEU itself. This is not a case where the answers to many of the questions asked could possibly assist the Irish High Court in coming to a proper decision on the case, for the Irish High Court will have no role in deciding on the validity of the Decisions, which question will have been definitively determined by the CJEU.
8.6 As noted earlier, it may well be that the CJEU will have regard to many or, possibly, all of the issues which lie behind those questions in forming its overall assessment on validity, but the role that those issues will play in that assessment is a matter for the CJEU and not a matter for the Irish High Court.
8.7 However, having made that observation, it seems to me that it is not appropriate for this Court to seek to interfere in any way with the questions asked by the High Court to the CJEU. It will be a matter for the CJEU to decide whether, and if so in what way, it considers it appropriate to answer the questions or, perhaps, to take the issues which lie behind the questions into account in its overall assessment. On that basis alone, I would not entertain the appeal sought to be brought by Facebook against the formulation of Question 1.
8.8 However, there remains the case made by Facebook to the effect that what are said to be findings of fact by the High Court are not sustainable on the evidence. It is clear from Schrems I that it is a matter for the national referring court to determine the facts necessary to enable the CJEU to reach its validity assessment. Those questions, therefore, at least potentially arise for consideration. In that context, it is appropriate to set out the position taken by both the DPC and by Mr. Schrems on the issues of fact referred to earlier.
9. The position of the Data Protection Commissioner and Mr. Schrems
9.1 The positions of the DPC and of Mr. Schrems in response to Facebook’s arguments concerning the conclusions reached by the trial judge in her determination of US law may be summarised as follows.
(a) Mass Indiscriminate Processing of Data
9.2 The DPC argues that the trial judge’s understanding of the concept of “processing”, which is defined in the Directive as including “any operation or set of operations which is performed upon personal data whether or not by automated means”, was correct and that it justified the finding of the High Court that US agencies engage in mass and indiscriminate processing of data.
9.2 The DPC says that, having identified a distinction at para. 189 of her judgment between “bulk searching and bulk acquisition, collection or retention”, the trial judge correctly concluded that there is “mass surveillance in the sense that there is mass searching of communications.” The DPC says that Facebook has failed to identify evidence which contradicts the conclusion that there was mass searching of data and that the conclusions of the High Court were fully supported by expert evidence.
9.3 Relying on the judgment of the CJEU in Google Spain SL v. Agencia Española de Protección de Datos (AEPD) (Case C-131/12), EU:C:2014:317, [2014] 3 C.M.L.R. 50, the DPC asserts that “processing” includes automated searching of the internet.
9.5 Mr. Schrems also argues that the finding of the trial judge that the US Government engages in mass indiscriminate processing was reached in the full consideration by the trial judge of the definition of “processing” in the Directive. He points to evidence of expert witnesses to the effect that billions of communications are searched by US Government agencies and that the same agencies have generalised access to the content of all communications under the Upstream programme.
9.6 Mr. Schrems asserts that there was a considerable weight of uncontradicted evidence supporting this finding of the trial judge. On that basis, he says, the trial judge was entitled to reach the conclusion that the entirety of personal data passing through the communication network in the United States is made available directly to US government agencies, whether for consultation, searching or otherwise.
9.7 Mr. Schrems asserts that Facebook’s reliance of other evidence adduced at trial and that contained in the PCLOB Report and its reference to other measures providing some element of oversight or control over access to communications is misplaced. He says that the trial judge had regard to each of these issues in the course of her consideration of the facts and therefore considered them in reaching her conclusions.
(b) US Surveillance is “Legal unless Forbidden”
9.8 The DPC refers to what she says are important amendments made by the trial judge to para. 192 of her judgment following submissions made by Facebook and the US Government, so as to include an additional two sentences as follows:-
“The basic principle is that surveillance is legal unless forbidden and there is no requirement to ever give notice in relation to surveillance. This case is concerned with electronic surveillance conducted by government agencies and individuals. This surveillance is regulated by the Constitution, statute, decisions of the courts, Executive orders, proclamations and presidential directives.” (Emphasis added)
9.9 The DPC says that there was no evidence before the trial judge to support the assertion of Facebook that the academic article, which she says supports directly, but not exclusively, the finding of the trial judge that US surveillance is “legal unless forbidden”, was out of date. The DPC says that Facebook neither tendered any expert evidence to contradict the academic article nor cross-examined the expert witness on the aspect of his evidence.
9.10 Furthermore, the DPC argues that the finding of the trial judge was supported by Recital 68 of the Privacy Shield Decision which, the DPC says, summarises relevant US law in almost precisely the same terms as the expert witness, as follows:-
“Under the U.S. Constitution, ensuring national security falls within the President's authority as Commander in Chief, as Chief Executive and, as regards foreign intelligence, to conduct U.S. foreign affairs. While Congress has the power to impose limitations, and has done so in various respects, within these boundaries the President may direct the activities of the U.S. Intelligence Community, in particular through Executive Orders or Presidential Directives. This of course also applies in those areas where no Congressional guidance exists. At present, the two central legal instruments in this regard are Executive Order 12333 (‘E.O. 12333’) and Presidential Policy Directive 28.” [footnotes omitted]
9.11 The DPC refers to further evidence which, it is said, supports the finding of the trial judge, including a letter of Robert Litt annexed to the Privacy Shield Decision, which states that “[a] mosaic of laws and policies governs US signals intelligence collection” and a range of instruments referred to by expert witnesses which may be used in the US to permit surveillance, and in particular, executive orders and presidential directives which could be amended or revoked at will.
9.12 The DPC asserts that Facebook’s submission that any action taken by the federal government must be grounded in a power enumerated by the US Constitution is inconsistent with the evidence given in the High Court and does not take into consideration the generous grant of executive power to the President, pursuant to Article II of the US Constitution.
9.13 Mr. Schrems also argues that the finding of the trial judge that surveillance by US Government of the data of non-US citizens is “legal unless forbidden” was accurate and is supported on the evidence. This finding is supported in particular, according to Mr. Schrems, by what he says is the agreed position of the experts that non-US persons may not avail of the Constitutional protections of the Fourth Amendment, as expressed at para. 194 of the judgment of the High Court as follows:-
“The experts identified the Fourth Amendment to the Constitution as being the most important protection against unlawful government surveillance. The Fourth Amendment applies to searches and seizures that take place within the US (such as data transferred to the US). The prevailing assumption is that, as the law currently stands, non-EU citizens lacking substantial voluntary connection with the United States (such as the majority of EU citizens) may not bring a Fourth Amendment case. Thus, the foremost protection under US law against unlawful Government surveillance is not available to most EU citizens. They may benefit indirectly from the protections by the Fourth Amendment to those entitled to its protections.”
9.14 Mr. Schrems accepts that the U.S Government is one of limited and enumerated powers but refers to the endowment on the US President with what he describes as the entire executive power of the United States, limited only by Constitution and by statute, which former limitation he says does not apply to non-US persons and which latter limitation must be imposed upon by Congress. Mr. Schrems says that these extensive and extremely broad executive powers further support the determination of the trial judge that surveillance conducted by the executive branch is “legal unless forbidden”.
(c) The Issue of Standing in US Law
9.15 The DPC argues that the trial judge’s assessment of the issue of standing in US law was comprehensive, detailed and grounded on the evidence. She says that there was no failure on the part of the trial judge to appreciate the distinction between the motion to dismiss and the summary judgment stage of the litigation process. The DPC says that the trial judge identified such a distinction at para. 226 of her judgment and in her consideration of ACLU v. Clapper and Wikimedia Foundation v. NSA No. 15- 2560 (4th Cir. 2017).
9.16 The DPC asserts that, in any event, Facebook overstates the distinction which, she says, only identifies part of the difficulties associated with satisfying the standing requirements in the US which, it is submitted, stand in stark contrast with the requirements of standing in EU law.
9.17 The DPC further submits that there was no error in the treatment by the trial judge of FAA v. Cooper and that at all times the trial judge directly linked the requirement to prove pecuniary loss with the requirements of the Privacy Act. The DPC says that, contrary to Facebook’s assertion, a requirement to demonstrate actual damages is not unique to the statute at issue, but rather apples to a range of statutory provisions.
9.18 Finally, the DPC says that the argument of Facebook that the High Court erred in finding that the experts agreed that the standing requirement was “notoriously indeterminate”, when the First Joint Expert Report limited the expert agreement to a statement that the standing requirement was “to a large degree indeterminate”, is based on a misconceived assumption that the High Court was bound to only use the express terms of the Report of the Experts Meeting, notwithstanding that it heard the oral evidence and cross-examination of all of the experts attending at that meeting.
9.19 Mr. Schrems also submits that the trial judge’s extensive examination of the doctrine of standing in the U.S courts, particularly as it relates to plaintiffs in a national security context, properly details the evidence and that she was entitled to reach the conclusions reached. In particular, Mr. Schrems says that the analysis of the trial judge at paras. 222-238 of her judgment are a correct statement of the principles of standing to bring an action in the United States.
(d) US Administrative Procedure Act
9.20 The DPC argues that the trial judge did not err in her findings regarding the importance and/or relevance of the APA in providing a judicial remedy in respect of unlawful government surveillance. In that context, the DPC says that the trial judge correctly identified the limitations to the statutory cause of action, including the following “zone of interests” test, referred to at p. 913 of Jewel v NSA 673 F. 3d 902 (9th Cir., 2011):-
“In the surveillance statutes, by granting a judicial avenue of relief, Congress specifically envisioned plaintiffs challenging government surveillance under this statutory constellation. Jewel’s statutory claims undoubtedly allege harms ‘within the zone of interests to be protected or regulated by the statute[s] alleviating any prudential standing concerns.”
9.21 The DPC says that the trial judge recognised that a remedy under the APA is precluded if a plaintiff has a remedy under an alternative statutory provision which is intended to be exclusive. The DPC refers to limitations to the APA cited by Professor Vladeck who, she says, concluded overall that the APA “certainly has limitations”, and that those limitations “certainly can be significant”. She further argues that it is difficult to reconcile Professor Vladek’s assertion that the APA was the “starting point” in any discussion of the remedial framework with the failure of Professor Swire to refer to the APA at all.
9.22 Mr. Schrems says that this is primarily an issue of contention between the DPC and Facebook, but says that the findings of the trial judge in relation to each of the matters are founded in the evidence before the Court and ought not to be disturbed by this Court.
(e) Article 47 of the Charter
9.23 The DPC asserts that the conclusion of the trial judge “that the arguments of the DPC that the laws - and indeed the practices – of the United States do not respect the essence of the right to an effective remedy before an independent tribunal as guaranteed by Article 47 of the Charter, which applies to the data of all EU data subjects transferred to the United States, are well founded” cannot be characterised as a factual conclusion. Rather, the DPC says that this conclusion involves the High Court, having made findings of primary fact on US law, identifying its concerns within the exercise of its discretion and within the meaning of Schrems I and appropriately referring a question for the consideration of the CJEU.
9.24 The DPC argues that the identification by the trial judge of a number of findings of fact explains why the trial judge had concerns regarding compliance with Article 47 of the Charter. The findings of fact put forward by the DPC which, she says, justify the concerns of the trial judge include: the lack of provision in US law for notification of surveillance; the lack of judicial remedies; difficulties regarding satisfying standing requirements in US law; limitations to the relief available; the exclusion of EU citizens lacking substantial voluntary connection with the US from the protection of the Fourth Amendment; and immunities of the NSA from relevant statutory frameworks.
9.25 The DPC says that the findings of primary fact are confirmed by the Privacy Shield Decision at Recital 115 and footnotes 161-171.
9.26 Furthermore, the DPC says that, contrary to Facebook’s argument, the trial judge considered oversight mechanisms in detail at paras. 239-250 of her judgment.
9.27 Mr. Schrems does not make any specific submissions in relation to this issue, but reiterates his agreement with the DPC that the conclusions of the trial judge are properly founded on the evidence.
(f) Article 52(1) of the Charter
9.28 The DPC argues that the trial judge did not err in concluding that there were well-founded concerns that the limitations on the exercise of the right to an effective remedy faced by EU data subjects in the US were not proportionate and/or were not strictly necessary within the meaning of Article 52(1) of the Charter.
9.29 The DPC asserts that the trial judge was entirely justified in having concerns as to the proportionality of the interferences with Article 47 of the Charter and that the deficiencies identified by the trial judge are too invasive to be “strictly necessary” as is required by EU law. Furthermore, the DPC says that such interferences lack the “clear and precise rules” required for any proportionate limitation on a Charter right.
9.30 The DPC says that the Privacy Shield Decision accepts the ineffectiveness of the remedies offered by US law. She refers to Recital 117 of the Privacy Shield Decision which states that the Ombudsperson “will ensure that the individual complaints are properly investigates and addressed” and Recital 122 which states that “this mechanism ensures that individual complaints will be thoroughly investigated and resolved” as indicative of the position that the Ombudsperson is necessary to ensure an effective remedy which would not otherwise be available.
9.31 The DPC further submits that the trial judge had adequate regard to other Charter rights and to the public interest in security.
9.32 Again, Schrems does not put forward his own arguments in respect of this issue but indicates his general agreement with the DPC that each of the findings of the trial judge are supported by the evidence.
(g) Failure to Consider or Refer to Certain Evidence
9.33 The DPC argues that the trial judge properly had regard to all of the evidence in reaching her conclusions. In addition to the matters referred to under headings (a)-(g) above, the DPC says that in her judgment, the trial judge had regard to the economic benefits of data transfers and the negative consequences that would flow from such transfers being prohibited.
9.34 In response to Facebook’s assertion that the trial judge did not have adequate regard to the EU-US Umbrella Agreement, the DPC says that the agreement is of limited application and had been described by expert witnesses as applying to data transfers to “law enforcement authorities” and related to “criminal investigations”.
9.35 Mr. Schrems also denies that the trial judge ignored or failed to consider evidence adduced in the course of the trial. In particular, he points to reference the trial judge made at paras. 44-47 of the judgment of the High Court to the economic, public interest and security considerations of the continuance of data transfers between the US and the EU.
9.36 Moreover, Mr. Schrems argues that Facebook failed to demonstrate how the alleged omission of evidence complained of would have had any material impact on the outcome of the case or on the conclusions ultimately reached by the trial judge in relation to US law and practice, the potential breach of the fundamental rights of Mr. Schrems and/or whether the High Court ought to refer questions to the CJEU. In that regard, he asserts that the threshold required in order for an appellate court to disturb the findings of a lower court has not been met.
9.37 Furthermore, Mr. Schrems argues, by reference to Tele2 Sverige AB v. Post-och telestyrelsen and Secretary of State for the Home Department v. Tom Watson (Joined Cases C-203/15 and C-698/15) EU:C:2016:970, [2017] 2 C.M.L.R. 30, that jurisprudence of the CJEU illustrates that similar considerations, while they may be relevant to the Court’s considerations of the issues, cannot be relied upon to trump the fundamental rights of EU citizens and to circumvent their protection.
(h) Formulation of Question 1
9.38 With regard to Facebook taking issue with the inclusion, in the request of the High Court to the CJEU, of reference in the first question referred by the High Court to “law enforcement and the conduct of foreign affairs of the third country”, the DPC states that such matters are integral to the surveillance provisions used by the US. The DPC refers to para. 166 of the judgment of the High Court, at which the trial judge identified “the conduct of the foreign affairs of the United States” as one of the “significant purposes” of the collection of data for the purpose of FISA.
9.39 The DPC says that the conclusion of the trial judge in relation to the Privacy Shield decision was extremely limited in its scope and did not preclude it from making a reference to the CJEU. The DPC points to the finding of the trial judge that Facebook was not relying on the Privacy Shield Decision in order to transfer to Facebook Inc in the US the data at issue in the case. The trial judge stated at para. 66:-
“Facebook is not relying on the Privacy Shield Decision to transfer data the subject of this case to Facebook Inc. in the United States. This case is concerned with the transfers of data pursuant to the SCC decisions.”
9.40 In that context, the DPC says that the Privacy Shield Decision has no application to the facts.
9.41 Moreover, the DPC argues that the Privacy Shield Decision does not contain a free-standing endorsement of the adequacy of US law and that the trial judge correctly concluded that the relevance of the Privacy Shield Decision to SCCs is unclear.
9.42 The DPC asserts that the High Court was entitled to raise concerns about the validity of the Privacy Shield Decision and that Facebook’s assertion that the Privacy Shield Decision must be dispositive runs directly counter to the Schrems I judgment.
9.43 Mr. Schrems also asserts that the inclusion of reference to “law enforcement and the conduct of foreign affairs” in the request for a preliminary ruling is not inappropriate or improper, particularly in circumstances where it arises directly from the applicable US statutory regime and the evidence adduced at the hearing of the action. In this regard, Mr. Schrems says that the reference to surveillance being permitted where it aids the “conduct of the foreign affairs” of the US is taken directly from the definition of “foreign intelligence information” contained in s. 702 of FISA.
9.44 Mr. Schrems further refers to the evidence of Professor Vladeck and Professor Swire in support of his argument that the evidence before the High Court establishes that personal data of EU citizens in the US may be collected by US government agencies for the purposes of, inter alia, law enforcement and the conduct of foreign affairs of the US and not simply for the purposes of national security.
9.45 Mr. Schrems argues that the attempt of Facebook to rely on the Privacy Shield decision and assert its primacy is fundamentally errant. In particular, Mr. Schrems says that the assertion of Facebook that the DPC and/or the High Court are bound by the Privacy Shield Decision is directly contrary to the judgment of the CJEU in Schrems I, in which the CJEU held that where a national court shares concerns of a national supervisory authority (the DPC, in this instance) as to the protection of a person’s fundamental rights, it may refer a question to the CJEU for consideration, notwithstanding that any adequacy decision under Article 25(6) has been made by the DPC.
9.46 Finally, Mr. Schrems contends that Facebook’s argument that the finding of adequacy for transfer under the Privacy Shield Decision must mean that US law provides sufficient safeguards for the purposes of Article 25 is fundamentally undermined by the limiting nature of the decision itself. In this context, Mr. Schrems contends that the Privacy Shield Decision does not apply in the present case, which is concerned solely with the transfer of data pursuant to the SCC Decisions.
9.47 Mr. Schrems notes that the trial judge included this issue as a basis for one of the questions referred to the CJEU and says that it is therefore the CJEU and not this Court which is properly seized of jurisdiction to determine the scope and applicability of the Privacy Shield Decision.
9.48 Against that backdrop, it is necessary to analyse the issues raised by both sides, but I consider it appropriate to make some general observations before going into each of those questions.
10. General Observations
10.1 It is important to start by recalling the function of the hearing before the High Court, in the light of the judgment of the CJEU in Schrems I. The sole function of the High Court is to determine whether that Court “shares the concerns” of the DPC. If the High Court shares those concerns, then it is required to refer the matter to the CJEU. Obviously if the High Court is not persuaded to share those concerns, then that would be the end of the case. Interestingly, in the context of the debate about whether an appeal lies in this case and if so, the scope of any such appeal, it would be clear that, as a matter of Irish law, the DPC could appeal against a refusal of the High Court to refer the matter to the CJEU and attempt to persuade either the Court of Appeal or, possibly, this Court that the High Court was in error and that the matter should be referred.
10.2 Be that as it may, it is, in my view, necessary to distinguish between two elements of the findings of the High Court. First, the High Court is required to determine the facts so that those facts can be before the CJEU. Second, and separately, the High Court is required to reach an overall conclusion as to whether the relevant concerns are shared, to enable it to determine whether it must make the reference to the CJEU. The concerns in question relate, of course, to the validity of the relevant EU measure. However, the analysis which the High Court is required to conduct will obviously relate to the issues which might arguably be seen to render the measure invalid.
10.3 But both of those matters must be seen against the backdrop of the fact that the ultimate determination of the matter, being the validity of the challenged measure, is a matter for the CJEU and that court alone. The decision of the High Court in this case that it shared the concerns of the DPC does, of course, have an important consequence, in that it led to the High Court making the reference which now is before the CJEU. But it has no other consequence for either the DPC or Facebook or, indeed, Mr. Schrems or any other interested party, for it will ultimately be for the CJEU to decide the issue on the merits. Indeed, it is unlikely that the CJEU will even address the question of whether it was reasonable for the High Court to share the concerns of the DPC. If the measure is found to be invalid, then it inevitably follows that the concerns were well founded. But even if the measure is ultimately upheld, it does not follow that the DPC or the High Court were necessarily wrong to be concerned so that the matter could be referred to the CJEU.
10.4 On the other hand, the purely factual decisions of the High Court may have an effect which is more than procedural. Those facts will at least form part of the basis on which the CJEU will carry out its assessment of the validity of the Decisions. If the facts were wrongly found, then there is at least a possibility that this could have an effect on the ultimate decision of the CJEU.
10.5 Against a backdrop of the significant limitations which European law imposes on an appellate process pending the result of a reference under Article 267, there would, in my view, be little point in this Court allowing an appeal against a judgment of the High Court which gave rise to a decision to refer under the Schrems I jurisprudence, unless this Court came to the view that the facts found by the High Court were not sustainable as a matter of Irish law, leaving this Court in a position to set out in a judgment the reasons why it came to that view, so as, in turn, to enable the High Court to consider whether it should continue to maintain or amend the reference. Furthermore, I have already set out the reasons why I have considerable doubts as to whether it was necessary or appropriate for the High Court to ask a whole range of questions of detail, having regard to the fact that the High Court does not need the answers to those questions to do anything but only needs a single answer as to whether the decisions are valid or not. Against that backdrop, it does not seem to me to be appropriate to address any of the issues raised which simply feed into the overall assessment of the High Court as to whether it did share the concerns of the DPC and thus, felt it appropriate to refer the matter.
10.6 The assessment which the High Court conducted for the purposes of deciding whether it shared the concerns of the DPC was, of course, an assessment which it was required to carry out in accordance with Schrems I. The only purpose of that assessment was to decide whether it was necessary to refer the matter in accordance with that jurisprudence. To allow an appeal against that assessment would be, in substance, to allow an appeal against the reference itself. In those circumstances, I do not consider that it is appropriate for this Court to enter into a consideration of any aspects of the High Court judgment which involve an assessment of those matters of judgment which the High Court was required to address in order to decide whether it shared the concerns of the DPC. On the other hand, for the reasons already analysed, I am satisfied that it is, at the level of principle, proper for this Court to consider whether, in accordance with Irish procedural law, it would overturn actual decisions of fact. I make this latter point while fully acknowledging that it does not necessarily follow that the CJEU will consider that questions of U.S. law are matters of fact so far as Union law is concerned or, at least, are matters of fact in quite the same way as they are considered to be in common law jurisdictions.
10.7 Finally, it is, perhaps, appropriate to comment that in some respects, it may be that the differences between the parties were more concerned with how properly to characterise facts which were not themselves in significant dispute, rather than relating to the underlying facts themselves.
10.8 Against all of that background, it seems to me that the only matters which are properly to be addressed are those which may be designed to clarify the underlying facts so as to ensure that there is at least the possibility that either the High Court or the parties may choose to rely on such clarifications (to the extent that the CJEU consider such an approach appropriate) in the submissions which they make in the Court of Justice.
10.9 Against that backdrop, I turn to the specific issues raised. I propose to deal with each in turn.
11. Discussion
(a) Mass Indiscriminate Processing of Data
11.1 It seems to me that the dispute between the parties under this heading largely comes down to one of terminology. Having regard to the definition of “processing” referred to earlier and the relevant jurisprudence, the DPC took the view that the bulk searching of data amounts to bulk processing. Given that the initial search can be directed to the entire universe of data supplied, then that bulk searching may be described as indiscriminative.
11.2 On the other hand, it is inevitable that any screening process designed to identify data of interest will necessarily involve all of the data available, for the whole point of the screening process is to identify within that entire universe of available data the relevant material which may be of interest and thus require closer scrutiny.
11.3 Perhaps part of the problem lies in the fact that the term “processing” covers a wide range of activity, apparently, in the view of the DPC, including screening. On the assumption that that is a correct view of the law, then it is technically correct to describe bulk screening as involving indiscriminate processing. But the use of that terminology might be taken to imply that other forms of processing, which are significantly more invasive, are carried out on an indiscriminate basis.
11.4 However, the underlying facts were, it would appear, correctly described in the judgment. It is the categorisation of which Facebook complains. However, once it is clear that the term “indiscriminate processing” is used having regard to a particular understanding of the interpretation of the term “processing” in data protection law, it seems unlikely that the CJEU could be in any way misled. It is more than open to Facebook to identify the precise meaning which was given to the term “indiscriminate processing” in the judgment and seek to persuade the CJEU as to the weight to be attached to that finding in the Court of Justice’s own assessment, having regard to it precise meaning.
11.5 Insofar as it was intimated at the oral hearing that intervening parties have placed reliance on that phrase as used in the High Court judgment, then, again, it seems to me that it should be possible to analyse the way in which the phrase in question is used and allow the CJEU to form its own judgment on what the consequences of the form of screening adopted must be for its overall assessment.
(b) “Legal unless Forbidden”
11.6 It seems to me again that much of the dispute between the parties under this heading comes down to a question of characterisation. As a matter of high general principle, it would appear that the United States, in common with many other jurisdictions, operates on a principle that matters generally are lawful unless there is an appropriate legal basis for determining otherwise.
11.7 However, one of the questions which arises in this case concerns another important principle of the law of the US, and many other jurisdictions, which requires that the actions of government Agencies must be regulated by legal measures, from the Constitution, through statute, to executive measures. The revised judgment records that the potential surveillance at issue in this case is conducted by government agencies and individuals. Thus, the power of such agencies and individuals to conduct surveillance is regulated.
11.8 However, it must also be recalled that ensuring national security is an executive function which can be controlled by executive measures such as those which were mentioned in Recital 68 of the Privacy Shield Decision.
11.9 Against that general background it seems to me that the real issue is not as to whether, at a level of high theory, it can be said that actions are lawful unless prohibited, but rather the identification of the regulatory framework within which surveillance activities are now carried out in the United States. The general regulatory framework seems to have been set out by the trial judge in the course of her judgment in a manner which is consistent with the evidence, or at least in a way which would not make it appropriate, in an ordinary Irish case, for this Court to interfere with those findings. Against the regulatory framework as thus set out, it may be possible that the broad statement that everything is legal unless prohibited might, if that framework were not carefully considered, have the potential to mislead. But again, under this heading it seems clear to me that Facebook will be able to draw attention to, for example, the amended version of the judgment which acknowledges that framework and to further identify those aspects of the framework which support its case. It would be a matter for the CJEU to reach its own conclusions on whether that framework is adequate.
(c) The Question of Standing
11.10 Under this heading, the principal focus of dispute concerned what was said by Facebook to be a failure on the part of the trial judge to adequately distinguish between the standing issue which might arise at the so-called “motion to dismiss” stage and the “summary judgment” stage. There is no doubt that the trial judge did make a distinction between the two stages. There would not appear to be any underlying dispute on the evidence that the position which applies at the “motion to dismiss” stage is that the matter is considered on the basis of considering the claimant’s pleadings and accepting that the facts are as asserted, while, at the summary judgment stage, it is necessary to provide an evidential basis. While the judgment could, doubtless, have been expressed in different terms, I am not satisfied that it has been established that the findings of the High Court were not open to it on the basis of the evidence. Likewise, I am not satisfied that it was not open to the High Court to come to the view that decisions on standing are so dependent on the particular circumstances of each case that they can properly be described as being “indeterminate”, meaning, as I would read the judgment, that there are no easily identifiable bright lines, but rather that the Court’s assessment will be very dependent on the circumstances of the particular case.
(d) The United States APA
11.11 Primarily the issue which the High Court had to address under this heading concerned the extent to which the APA might be said to enhance the entitlement of persons to bring appropriate challenges before the U.S. courts. I cannot see that what the High Court said in that regard was not supported by evidence which was before that Court. It may be possible to take a different view on the usefulness or otherwise of the APA but, as a matter of Irish law, it would not seem to me to be open to this Court to overturn the decision of fact by the High Court in this area. I have commented elsewhere on the question which may arise before the CJEU as to the weight to be attached to the analysis set out in the Privacy Shield Decision. But that matter is solely one for the CJEU itself.
(e) Respect for the Essence of the Right and the Availability of an Effective Remedy
11.12 As noted earlier, the High Court was, in order that it would be appropriate for it to make a reference to the CJEU, obliged to consider whether it shared the concerns of the DPC. It seems to me that the assessment of the High Court under these two headings was directed to that end. In other words, they were assessments which fed into the High Court’s own overall conclusion that it shared the concerns of the DPC. It is hard to see how those conclusions could have any proper influence, in themselves, on the ultimate assessment of the CJEU. It is for that court to reach the appropriate overall conclusions to determine the validity of the SCC Decisions. Undoubtedly, an assessment of the strength or weakness of the various building blocks which lay behind the High Court’s own assessment will form an important part of the analysis of the CJEU. But the overall conclusion is for the CJEU and it alone to reach and, in my view, the DPC is correct to argue that the conclusions under these headings are not conclusions of fact at all, but rather assessments which went into the decision of the High Court to refer the matter in the first place.
(f) Proportionality
11.13 In my view, a similar conclusion can be reached under this heading. Ultimately, the proportionality issue is one which must be assessed by the CJEU. The materials on which that assessment is to be reached can be found in the evidence and the judgment of the High Court. The view of the High Court that the Decisions do not represent a proportionate response is properly considered to be part of the determination by the High Court to share the concerns of the DPC and not to be a finding of fact in itself.
(g) The Status of the Privacy Shield Decision
11.14 Next, it is necessary to address the assertion by Facebook that the DPC and the Irish High Court were bound by, or alternatively, failed to place sufficient weight on, the assessment of relevant US data protection laws which is to be found in the Privacy Shield Decision. It seems to me to be absolutely clear that the question of whether either the DPC or the Irish High Court was bound by what might be said to be the assessment contained in the Privacy Shield Decision is a matter of EU law to be determined only by the CJEU. Insofar as there may be a question as to the weight to be attached to the relevant content of the Privacy Shield Decision, on the assumption that it is not absolutely binding, then that is, again, a matter to be determined by the CJEU and to be applied by that court in its overall assessment of the validity of the SCC Decisions.
11.15 I have already indicated that, in my view, this Court should not become engaged on an appeal such as this with questions which might go towards the correctness or otherwise of the decision of the High Court to refer. Like under so many other headings, it will ultimately be a matter for the CJEU to reach its own assessment on the status of the facts addressed in the Privacy Shield Decision.
(h) Alleged Failure to Consider or Refer to Certain Evidence
11.16 There was a great deal of evidence given before the High Court. There was clearly no obligation on the High Court judge to refer to all of it in the course of her judgment. It was principally for the High Court judge to determine the facts which, in her view, required to be referred to the CJEU. It is, of course, open to the parties to seek to persuade the CJEU that it should have regard to any evidence given before the High Court and it will be a matter for the CJEU to determine the proper course of action to adopt, should that occur.
11.17 Insofar as much of the complaint under this heading refers to matters which might be said to be relevant to the proportionality argument, I have already indicated that, in my view, the assessment of the High Court judge in that regard formed part of her overall assessment as to whether she shared the concerns of the DPC. Having regard to the fact that such an assessment was an integral part of the decision to refer, I have already indicated that I do not think that this Court should entertain an appeal in relation to any such aspects of the High Court judgment.
12. Overall Assessment and Conclusion
12.1 For the reasons already identified in this judgment, it seems to me that it is open to this Court to entertain an appeal against a decision of the High Court in circumstances where the High Court has made a reference to the CJEU under the Schrems I jurisprudence. However, there are significant limitations on the issues which this Court can properly consider on such an appeal.
12.2 First, I do not consider that this Court can entertain any appeal against the decision of the High Court to make a reference or against the terms of that reference. In accordance with the jurisprudence of the CJEU, it is for the referring court, and that court alone, to decide whether to make a reference and, indeed, whether to withdraw or amend same.
12.3 For the reasons set out above, I am also satisfied that it is not appropriate for this Court to entertain an appeal which is directly concerned with the analysis of the High Court leading to a decision by that Court to the effect that it shared the concerns of the DPC. That analysis is inextricably linked with the decision to refer and is not a matter which can properly be pursued on appeal.
12.4 However, I am satisfied that this Court can and should entertain any appeal against the facts found by the High Court and should overturn those facts, if it can be established that they are not sustainable in accordance with the relevant Irish jurisprudence. While, as a matter of Irish law, any decision by this Court to overturn such facts would be binding on the High Court it remains the case that, as a matter of Union law, it is a matter for the High Court and that Court alone to determine whether it should, in the light of the decision of this Court, continue with, amend or withdraw the reference.
12.5 On that basis, I suggest that this Court should not entertain some of the areas of appeal put forward on behalf of Facebook on the basis that they either involve a direct appeal against the text of the reference or are concerned with matters which essentially go towards the question of whether the High Court shared the concern of the DPC.
12.6 A limited number of grounds remain where the appeal can be said to be against the facts found by the High Court, although I note that, while U.S. law is considered to be a matter of fact in Irish law, it does not necessarily follow that the CJEU will determine that such is the proper characterisation of U.S. law for the purposes of proceedings before it.
12.7 However, having analysed each of the remaining heads of appeal, I am satisfied that in each category it is more appropriate to characterise the criticisms which Facebook seeks to make of the judgment of the High Court as being directed towards the proper characterisation of underlying facts rather than towards those facts themselves. In those circumstances, I would not propose making any order overturning any aspect of the High Court judgment. If there had been an actual finding of fact as such, rather than a characterisation of the facts, which I considered was not sustainable on the evidence before the High Court in accordance with Irish procedural law, I would have been happy to propose an order overturning that fact. However, it does not seem to me that any such matter has been established on this appeal.
12.8 To the extent that issues may have been identified on this appeal, and are referred to in this judgment, which go to the proper characterisation of the facts, then it is open to any of the parties to seek, to the extent that the CJEU considers it appropriate, to rely on the views of this Court in the submissions which they make on the reference. To that extent, this judgment may be of some benefit. But it does not seem to me that any of the issues identified are such that, in accordance with the principles which I have sought to analyse, they could properly justify this Court in overturning a specific finding of fact of the High Court.
12.9 In those circumstances, I would propose that the appeal should be dismissed.