¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
High Court Record Number: [2013 765 JR
Date of Delivery: 16/07/2014
Court: High Court
Composition of Court:
Judgment by: Hogan J.
Status of Judgment: Approved
Neutral Citation Number: [2014] IEHC 351
BETWEEN/
MAXIMILLIAN SCHREMS
DATA PROTECTION COMMISSIONER (No.2)
JUDGMENT of Mr. Justice Gerard Hogan delivered on the 16th July, 2014
1. This is an application by notice of motion dated 26th June, 2014, on the part of Digital Rights Ireland Ltd. (“DRI”) to be joined to the present judicial review proceedings as amicus curiae. This nature of this application cannot really be fully understood without reference to my earlier judgment which was delivered on 18th June, 2014, in respect of the substantive proceedings, Schrems v. Data Protection Commissioner [2014] IEHC 310. This judgment should accordingly be read in conjunction with that earlier judgment.
The background to the present proceedings
2. In these proceedings the applicant has challenged a decision of the Data Protection Commissioner not to investigate a complaint of his pursuant to s. 10(1)(b) of the Data Protection Act 1988 (“the 1988 Act”). The complaint was lodged following the revelations which a former US security contractor, Edward Snowden, made concerning the manner in which the US security authorities access personal data of non-US citizens on a mass and undifferentiated basis.
3. While the complaint was formerly directed at the major social network, Facebook (Ireland) Ltd., the gist of the objection does not really concern Facebook at all. The complaint was rather that in the light of the revelations made from May, 2013 onwards by Edward Snowden concerning the activities of the US National Security Agency (“NSA”), there was no meaningful protection in US law and practice in respect of data so transferred to the US so far as State surveillance was concerned.
4. By letters dated 25th and 26th July, 2013, the Commissioner invoked his power under s. 10(1)(a) of the 1988 Act not to investigate this complaint further on the ground that this complaint was frivolous and vexatious, terms which in this case and in this particular statutory context simply mean that the Commissioner concluded that the claim was unsustainable in law.
5. The reason why the Commissioner reached this conclusion was because (i) there was no evidence that Mr. Schrems’ personal data had been so accessed by the NSA (or other US security agencies)(“the locus standi objection”), so that the complaint was purely hypothetical and speculative and (ii) because the European Commission had determined in its decision of 26th July 2000 (2000/520/EC)(“the Safe Harbour Decision”) that the United States “ensures an adequate level of [data] protection” in accordance with Article 25(6) of Directive 95/46/EC (“the 1995 Directive”). The Commissioner noted that the Safe Harbour decision was a “Community finding” for the purposes of s. 11(2)(a) of the 1988 Act, so that any question of the adequacy of data protection in that third country (in the present case, the United States) where the data is to be transferred was required by Irish law “to be determined in accordance with that finding.” As this was the essence of the applicant’s complaint - namely, that personal data was being transferred to another third country which did not in practice observe these standards - the Commissioner took the view that this question was foreclosed by the nature of the earlier Safe Harbour Decision.
6. In my judgment delivered on 18th June, 2014, (Schrems v. Data Protection Commissioner [2014] IEHC 310) I rejected the locus standi argument. I also found that mass and indiscriminate surveillance of communications, especially private communications generated within the home, would, as a matter of Irish law, be unconstitutional, having regard to the inter-action of the guarantees of privacy and Article 40.5.’s protection of the inviolability of the dwelling. That concept of inviolability would be wholly compromised if private communications of this kind generally made within the home were thus subjected to routine and undifferentiated surveillance by State agencies.
7. Section 11(1)(a) of the 1988 Act precludes the transfer of personal data to third countries, save where that third country “ensures an adequate level of protection for the privacy and the fundamental rights and freedoms” within the meaning of s. 11(1)(a) of the 1988 Act. I held that, were the matter judged entirely by Irish law, then measured by these constitutional standards and having regard to the (apparently) limited protection given to non-US data subjects by contemporary US law and practice so far as State surveillance is concerned, this would indeed have been a matter which the Commissioner would have been obliged to investigate. It followed, accordingly, that if the matter were to be judged solely by reference to Irish constitutional law standards, the Commissioner could not properly have exercised his s. 10(1)(b) powers to conclude in a summary fashion that there was nothing further to investigate.
8. The parties were agreed, however, the matter is only partially governed by Irish law and that, in reality, on this key issue of the adequacy of data protection law and practice in third countries, Irish law has been pre-empted by general EU law in this area. This is because s. 11(2)(a) of the 1988 Act (as substituted by s. 12 of the Data Protection (Amendment) Act 2003) effects a renvoi of this wider question in favour of EU law. Specifically, s. 11(2)(a) of the 1988 Act provides that the Commissioner must determine the question of the adequacy of protection in the third State “in accordance” with a Community finding made by the European Commission pursuant to Article 25(6) of the 1995 Directive.
9. I then held (at paragraphs 64-70 of the judgment) that:
- “64. This brings us to the nub of the issue for the Commissioner. He is naturally bound by the terms of the 1995 Directive and by the 2000 Commission Decision. Furthermore, as the 2000 Decision amounts to a “Community finding” regarding the adequacy of data protection in the country to which the data is to be transferred, s. 11(2)(a) of the 1988 Act (as amended) requires that the question of the adequacy of data protection in the country where the data is to be so transferred “shall be determined in accordance with that finding.” In this respect, s. 11(2)(a) of the 1988 Act faithfully follows the provisions of Article 25(6) of the 1995 Directive.
65. All of this means that the Commissioner cannot arrive at a finding inconsistent with that Community finding, so that if, for example, the Community finding is to the effect that a particular third party state has adequate and effective data protection laws, the Commissioner cannot conclude to the contrary. The Community finding in question was, as we have already seen, to the effect that the US does provide adequate data protection for data subjects in respect of data handled or processed by firms (such as Facebook Ireland and Facebook) which operate the Safe Harbour regime
66. It follows, therefore, that if the Commissioner cannot look beyond the European Commission’s Safe Harbour Decision of July 2000, then it is clear that the present application for judicial review must fail. This is because, at the risk of repetition, the Commission has decided that the US provides an adequate level of data protection and, as we have just seen, s. 11(2)(a) of the 1998 Act (which in turn follows the provisions of Article 25(6) of the 1995 Directive) ties the Commissioner to the Commission’s finding. In those circumstances, any complaint to the Commissioner concerning the transfer of personal data by Facebook Ireland (or, indeed, Facebook) to the US on the ground that US data protection was inadequate would be doomed to fail.
67. This finding of the Commission is doubtless still true at the level of consumer protection, but, as we have just seen, much has happened in the interval since July 2000. The developments include the enhanced threat to national and international security posed by rogue States, terrorist groupings and organised crime, disclosures regarding mass and undifferentiated surveillance of personal data by the US security authorities, the advent of social media and, not least from a legal perspective, the enhanced protection for personal data now contained in Article 8 of the Charter.
68. While the applicant maintains that the Commissioner has not adhered to the requirements of EU law in holding that the complaint was unsustainable in law, the opposite is in truth the case. The Commissioner has rather demonstrated scrupulous steadfastness to the letter of the 1995 Directive and the 2000 Decision.
69. The applicant’s objection is, in reality, to the terms of the Safe Harbour Regime itself rather than to the manner in which the Commissioner has actually applied the Safe Harbour Regime. There is, perhaps, much to be said for the argument that the Safe Harbour Regime has been overtaken by events. The Snowden revelations may be thought to have exposed gaping holes in contemporary US data protection practice and the subsequent entry into force of Article 8 of the Charter suggests that a re-evaluation of how the 1995 Directive and 2000 Decision should be interpreted in practice may be necessary. It must be again stressed, however, that neither the validity of the 1995 Directive nor the validity of the Commission’s Safe Harbour decision have, as such, been challenged in these proceedings.70. Although the validity of the 2000 Decision has not been directly challenged, the essential question which arises for consideration is whether, as a matter of European Union law, the Commissioner is nonetheless absolutely bound by that finding of the European Commission as manifested in the 2000 Decision in relation to the adequacy of data protection in the law and practice of the United States having regard in particular to the subsequent entry into force of Article 8 of the Charter, the provisions of Article 25(6) of the 1995 Directive notwithstanding. For the reasons which I have already stated, it seems to me that unless this question is answered in a manner which enables the Commissioner either to look behind that Community finding or otherwise disregard it, the applicant’s complaint both before the Commissioner and in these judicial review proceedings must accordingly fail.”
Given that the critical issue in the present case was whether US law and practice afforded sufficient data protection and that no issue was ever raised in these proceedings concerning the actions of Facebook Ireland/Facebook as such, I took the view that the real question was whether the Commissioner was bound by the earlier findings to this effect by the European Commission in the Safe Harbour Decision. In other words, this was really a complaint concerning the terms of that decision, rather than the manner in which the Commissioner had applied it: see paragraph 69 of the judgment. While it is true that Article 3(b) of the Safe Harbour Decision allows the national authorities to direct an entity to suspend data flows to that third country, this is in circumstances where - unlike the present case - the complaint is in substance directed to the conduct of that entity. Here the real objection is not to the conduct of Facebook as such, but rather to the fact that the Commission has already determined that the US law and practice provides adequate data protection in circumstances where it is clear from the Snowden disclosures that personal data of EU citizens so transferred to the US can be accessed by the US authorities on a mass and undifferentiated basis, thus permitting the physical transfer of such data from Ireland 9and elsewhere in the European Union) to the United States.”
11. In these circumstances I took the view that it would be appropriate that I should refer the question of whether, having regard in particular to my earlier findings of fact regarding the Snowden disclosures and the subsequent entry into force of Article 7 and Article 8 of the Charter and the recent judgment of the Court of Justice in Case C-293/12 Digital Rights Ireland [2014] E.C.R. I-000, the Commissioner was bound by the earlier determination of the European Commission in the Safe Harbour Decision as to the adequacy of the data protection offered by US law and practice.
12. So far as the present application is concerned, two separate issues arise. First, should DRI be joined as an amicus curiae to the present proceedings? Second, even if it were to be so joined, should it be permitted to have an additional question or questions added to the proceedings? We may now consider these issues in turn.
Should DRI be joined as an amicus curiae?
13. The jurisdiction of the High Court and Supreme Court to permit a third party to be joined as an amicus was adumbrated by Keane C.J. in I. v. Minister for Justice, Equality and Law Reform [2003] IESC 42, [2003] 3 IR 197 where he stated ([2003] 3 IR 197, 203-204):
- “While there are no statutory provisions or rules of court providing for the appointment of an amicus curiae, save in the case of the Human Rights Commission, the court is satisfied that it does have an inherent jurisdiction to appoint an amicus curiae where it appears that this might be of assistance in determining an issue before the court. It is an unavoidable disadvantage of the adversarial system of litigation in common law jurisdictions that the courts are, almost invariably, confined in their consideration of the case to the submissions and other materials, such as relevant authorities, which the parties elect to place before the court. Since the resources of the court itself in this context are necessarily limited, there may be cases in which it would be advantageous to have the written and oral submissions of a party with a bona fide interest in the issue before the court which cannot be characterised as a meddlesome busy body. As the experience in other common law jurisdictions demonstrates, such an intervention is particularly appropriate at the national appellate level in cases with a public law dimension.
It is, at the same time, a jurisdiction which should be sparingly exercised. Clearly, the assistance to be given to an appellate court will be confined to legal arguments and supporting materials. It is not necessary to consider the circumstances in which it would be appropriate for the High Court to appoint an amicus curiae. It is sufficient to say that, as was pointed out in United States Tobacco Company v. Minister for Consumer Affairs (1988) 83 ALR 79 the position of an amicus curiae is quite different from that of an intervener. It was said in that case that an amicus curiae, unlike an intervener, has no right of appeal and is not normally entitled to adduce any evidence.
In the present case, an issue of public law arises and the judgment of the court may affect parties other than those now before the court. The court was satisfied that the UNHCR might be in a position to assist the court by making written and oral submissions on the question of law certified by the High Court and, accordingly, appointed it to act as amicus curiae and, for that purpose, to make oral and written submissions.”
15. In this regard, the neutrality of the putative amicus is also a factor, since as Clarke J. observed in Fitzpatrick v. FK (No.1) [2007] 1 I.R. 406, 415, one of the important factors to be taken into account is whether:
- “the proposed amicus might reasonably be said to be partisan or, on the other hand, to be largely neutral and in a position to bring to bear expertise in respect of an area which might not otherwise be available to the court.”
17. It is also significant that in O’Brien Finnegan P. stressed that the Law Society “has not just a sectional interest, that is the interest of its members, but a general interest which should be respected and to which regard should be had”: see [2005] 3 I.R. 328, 333. That case raised wider questions regarding the solicitor/client relationship in the context of personal injuries claims and to that extent the Law Society had an important contribution to make to draw attention to the implications and importance of that relationship.
18. It is also clear that the amicus does not have the status of a party to the litigation - so that, for example, it cannot call evidence or lodge an appeal - and it cannot add materially to the costs of the litigation by, for example, seeking its own costs. The case must furthermore normally involve questions of public law, often with significant implications for the general public. Moreover, as Keane C.J. stressed in I., the jurisdiction is one to be “sparingly exercised.” Measured, then, by these standards, should, then, the Court appoint DRI as an amicus?
Costs
19. Turning first to the issue of costs it is clear from the very terms of the motion papers filed by DRI that it seeks an order directing that it should bear its own costs. It is accordingly clear that if it is joined as an amicus this fact will not in itself have any material implications for the costs of the applicant and the respondent.
Whether the case involves questions of public law with significant implications for the general public
20. There is no question but that this case involves questions of public law concerning the scope and extent of data protection which are of significant national and, indeed, international importance. This criterion is accordingly plainly satisfied.
The expertise of DRI
21. The expertise of DRI in all matters concerning the internet, the information society and data protection does not appear to be in doubt. Indeed, in his affidavit in support of the application, Antóin Ó Lachtnáin, a director of DRI, states that DRI:-
- “operates a website…designed to facilitate information about the various civil, legal and human rights that arise in the judicial age…the applicant has also sought to inform public debate through other means, including newspaper articles, meetings with elected representatives, submissions to official bodies and the organising of public events on issues such as privacy and copyright reform. The applicant has made submissions to the Oireachtas Joint Committee on Transport and Communications hearings on social media and has made a joint submission with Catherine Murphy T.D. and Stephen Donnelly T.D. and McGarr Solicitors to the Government’s Copyright Review Committee…I say that the applicant is a bona fide organisation with credibility and a track record of success in forming public debate and assisting with vindicating the rights of the general public on the internet and within the information society.”
Whether DRI has been assigned any role by either domestic or international law in the area which is the subject matter of the litigation
23. In all (or, at least, virtually all) of the cases in which an amicus has been appointed by an Irish court the amicus has been assigned an important role in relation to the subject matter of the litigation by either national or international law. This was true of the UNHCR in I, the Law Society in O’Brien and the Equality Authority in Doherty v. South Dublin County Council [2006] IESC 57, [2007] 1 IR 246 (a case concerning the rights of members of the travelling community). Conversely, the fact that DRI have been given no such public role in relation to copyright matters was a factor which weighed heavily with Kelly J. in his judgment in EMI Records (Ireland) Ltd. v. UPC Communications Ireland Ltd. [2013] IEHC 204 where he refused to make such an order in a case involving the application of the same applicant, DRI, to be joined as a party to litigation involving copyright and internet piracy.
24. At the same time I think that it clear from the case-law that the fact that the putative amicus has been given no such express role by domestic or international law cannot in itself be regarded as a disqualifying factor. Thus, for example, in Fitzpatrick Clarke J. contemplated that the Watch Tower Bible and Tract Society of Ireland might successfully apply to be made an amicus at a later stage of those proceedings were the circumstances so to warrant it. This was also the approach taken by Kelly J. in EMI when he stated that he did not regard the fact that DRI had been given no such public role as a threshold factor which justified the refusal of the amicus application in limine. It was, rather a discretionary factor which was nonetheless of “some significance”.
Whether the applicant might be expected to adopt a partisan fashion were it to be appointed as an amicus.
25. It is clear that the courts will be at least disinclined to appoint as an amicus a party that might be expected to act in a partisan fashion. This was the case in Fitzpatrick where the applicant “did not suggest that it would not adopt a partisan position”: see [2007] 1 I.R. 406, 417, per Clarke J. Similar views were also expressed in EMI where Kelly J. emphasised the fact that DRI had engaged in a public campaign directed against the introduction of a statutory instrument dealing with copyright infringement and internet piracy in proceedings which concerned these very issues. The very fact that the evidence showed that DRI would not act in a neutral fashion in relation to these matters was a factor which weighed heavily against its appointment as an amicus.
26. There is, however, no suggestion that DRI have been involved in any public campaigns in relation to the issues raised by this litigation. Mr. Ó Lachtnáin has, moreover, averred in his affidavit grounding the present motion that DRI “is concerned to take no position of partisanship in respect of the dispute between the parties here.”
27. One cannot help feeling, however, that on this question of partisanship both litigants and courts have all at times engaged in something of a polite fiction. After all, the views of the UNHCR regarding the plight of refugees are well known. The Law Society can be expected to have strong views on the rights of solicitors and their clients. One may equally assume that DRI has strong views on the adequacy of the Safe Harbour regime.
28. Partisanship cannot, moreover, be easily measured by objective standards. This is perhaps especially true of legal proceedings where, after all, the task of the advocate is to persuade. The submission which aspires to complete impartiality and icy detachment may be regarded by some on this account as bland and ineffective.
29. What is, I think, clear from the views of Kelly J. in EMI is that open partisanship which is detached from the underlying legal materials and the legal merits is most undesirable and attracts judicial disapproval. In that respect, therefore, the legal advisers representing the amicus bear a particular responsibility to ensure that the standards appropriate to legal professionals are not compromised in any written or oral legal submissions made on behalf of the amicus, even if those submissions are strongly advanced in favour of a particular legal argument. One of those duties of counsel is, of course, to bring all relevant legal materials and authorities to the attention of the court, even if those materials are adverse to the interests of the client.
30. All of this is to say that is that while prospective amicii who hold strong institutional views on the subject matter of the dispute are not disqualified on that account alone from being appointed as an amicus, they are also expected and required to confine themselves to the traditional parameters of legal argument. In view of Mr. Ó Lachtnáin’s unchallenged averments regard DRI’s likely role, I am prepared to assume in its favour that it will be abide by these strictures.
The attitude of the parties
31. Finally, the view of the actual parties to the litigation regarding the application of DRI to be joined as an amicus is a most important consideration. The Commissioner has taken a neutral view, although his counsel, Mr. McDermott, has drawn my attention to the relevant case-law, including the comments of Kelly J. in EMI regarding the role of DRI in respect of the dispute in those proceedings.
32. The applicant himself, Mr. Schrems, is opposed to the joinder of DRI as an amicus. His counsel, Mr. O’Shea, makes the point that all relevant arguments are likely to be canvassed given the large number of Member States who, it is anticipated, are likely to intervene before the Court of Justice. The applicant is a postgraduate law student in his twenties who is at the start of his legal career. He is naturally and understandably concerned about the possible costs implications of the joinder of another party.
33. So far as the costs are concerned, it will, however, be a condition of any joinder that DRI will not be allowed to seek costs from any party. In fairness, DRI have at all times recognised this limitation. It may, furthermore, be anticipated that its participation in oral argument will be confined to a short period of time, so that its participation in the proceedings will not represent an additional costs burden for either party by adding appreciably to the length of the hearing.
34. I agree with Mr. O’Shea that it is very likely that many Member States are likely to seek to intervene in the Article 267 TFEU reference, so that it is unlikely that any relevant point will be overlooked. Yet given the track record of DRI - not least its recent successful challenge to the validity of the Data Retention Directive - it is likely that it will be in a position to articulate its own distinctive views on these questions of data protection and surveillance. The articulation of these views may assist the Court of Justice as that Court grapples with these difficult questions.
Conclusions on whether DRI should be appointed an amicus
35. I confess that the application of these principles is not straightforward. The opposition of the applicant to the joinder of DRI and the fact that it has no legally conferred role in matters of data protection are factors which tell against the making of such an order. The comments of Kelly J. in EMI regarding the conduct of DRI in relation to the issues of copyright privacy which arose in that case also weigh heavily with me.
36. Yet, not without considerable hesitation, I have concluded that I should make such an order appointing DRI as an amicus. I take this view because in the light of the decision of the Court of Justice in Digital Rights Ireland, I think that DRI can articulate its own distinctive view which may possibly assist the Court in respect of these difficult and troubling questions which are the subject of the reference.
Whether DRI should be permitted to add an additional question to the questions already referred pursuant to Article 267 TFEU
37. There remains for consideration the question of whether DRI should be permitted to include an additional question on the reference. DRI urge that I should also refer the questions of the validity of the 1995 Directive and the Safe Harbour Decision itself to the Court of Justice.
38. As I indicated at the hearing, I did not think that this course of action would be appropriate. As I was at pains to stress in the first judgment, the applicant has never chosen to challenge the validity of either the Directive or the Safe Harbour decision. Quite apart from the fact that - as decisions such as I. illustrate - an amicus is normally bound by the parameters of the existing litigation, the addition of these questions would radically change the nature of the proceedings. Moreover, given that, as I have found, s. 11(2)(a) of the 1988 Act gives effect to the requirements of Article 25(6) of the 1995 Directive by obliging the Commissioner to follow the terms of the Safe Harbour Decision, a challenge to the validity of the Directive would be tantamount to a challenge to the constitutionality of s. 11(2)(a).
39. On any view, the Attorney General would have to be party to any proceedings in which the validity of the 1995 Directive was put at issue. Inasmuch as this would also amount in substance to a challenge to the constitutionality of s. 11(2)(a) - given that, on this argument, the Oireachtas would have wrongly transposed an item of Union legislation which was itself later found to be invalid by the Court of Justice - Order 60, r.1 of the Rules of the Superior Courts, 1986 requires that the Attorney General be joined as a party. Yet she was never served with the proceedings or joined as a party to the present proceedings.
40. It is, of course, true to observe that as counsel for DRI, Mr. Crehan, observed, there have been instances in the past where an amicus can formulate questions or suggest changes to draft questions in the context of a pending Article 267 TFEU reference. Mr. Crehan pointed to the fact that in Digital Rights Ireland, counsel for the amicus in that case - namely, the Irish Human Rights Commission - made suggestions of this kind.
41. Yet what is proposed here is appreciably different, given that it would radically change the nature of the proceedings and would involve the additional delay and costs associated with the joinder of a further party, namely, the Attorney General. These additional questions would effectively make DRI a party to the litigation in order to facilitate it to make a case which the parties themselves had never made.
42. For all of these reasons, I would not permit DRI as amicus to expand the scope of the proceedings or to alter the nature of the questions which I have already proposed should be transmitted to the Court of Justice.
Conclusions
43. In summary, therefore, I have concluded - albeit not without hesitation - that I should join DRI as an amicus to the present proceedings. I will not, however, permit DRI to add additional questions to the Article 267 TEU reference, as the proposed questions would radically alter the nature and scope of the existing proceedings and would require the joinder of a further additional party (namely, the Attorney General), thereby involving further additional costs and delay.
BAILII: