Data Protection in the CJEU: Developments

Three updates for data protection watchers about cases with a wide-ranging potential impact in the Luxembourg courts.First, many readers will be aware that the Irish High Court referred to the CJEU a series of questions broadly aimed at considering the consistency of the standard contractual clause decisions of the European Commission with data protection standards in the context of transfers by Facebook Ireland to Facebook Inc in the USA, and the possible exposure as a result to the US national security agencies: the Schrems II litigation. You can read the (extraordinarily long) judgment explaining why a reference was to be made in Data Protection Commissioner v Facebook Ireland Ltd & Schrems [2017] IEHC 545. The eleven questions referred can be read here.

That is not a development; the reference is old news. What is a development is that the Supreme Court of Ireland has just given permission to appeal against the making of the reference. The reference is continuing in the meantime – and the written observations procedure is well underway – so it will be interesting to see how the timescales develop. The situation is unusual, but by no means unheard of and the ability to do so was recognised by the CJEU in Case C-210/06 Cartesio [2008] ECR I-9641 at [96].

Secondly, there is claim on foot before the General Court in Case T-738/16 La Quadrature du Net v European Commission which is challenging the Privacy Shield Decision as being contrary to Charter rights. You can read the issues raised here, and the proceedings are advanced in that case. The General Court has already ruled as inadmissible a challenge brought by Digital Rights Ireland in Case T‑670/16 Digital Rights Ireland v European Commission (ECLI:EU:T:2017:838).

Thirdly, the two references from France before the CJEU concerning the right to be forgotten – one in Case C-136/17 GC v CNIL (delisting of sensitive personal data) and the other in Case C-507/17 Google v CNIL (on whether delisting must be global or whether geo-blockers is sufficient) – are to be heard on 11 September 2018 and so judgment and AG opinions are inching that little bit closer.

Christopher Knight