We are living in strange times. And I’m not just talking about Covid, forest fires, or the potential discovtaery of signs of alien life on Venus. No, I’m talking about the bizarro-world scenario of Max “Europe vs Facebook” Schrems joining common cause with (checks notes) Facebook against the Irish Data Protection Commission over (checks notes again) their decision to take an enforcement action against Facebook.
As I see it there are a few things going on that don’t seem to make sense.
(This blog post is my own personal opinion and does not necessarily reflect the postion of Castlebridge).
Hurry up, Go Slow!
Back in July Noby.eu announced that they had been granted leave to have a judicial review of the Data Protection Commission’s processes because Max believes the DPC is taking too long to reach decisions in cases he has filed complaints in. The only remedy he could be seeking here is for the DPC to speed things up.
A few days later, the CJEU issued its ruling in Data Protection Commissioner vs Facebook and Schrems. That case answered a range of procedural questions that the DPC had had referred to the CJEU from the Commercial Division of the Irish High Court (I’ve commented before elsewhere about how I think that that particular route to the CJEU was a bizarre choice, but I digress…). If you want to find out more about the questions raised, I wrote about them here last July.
A few weeks after that, the Data Protection Commission wrote to Facebook to advise them that an investigation had been opened on the DPC’s own volition under GDPR into Facebook’s use of Standard Contracual Clauses. Prior to this becoming public knowledge Max appeared at the LIBE Committee of the European Parliament. At this meeting he disclosed having received correspondence from the Data Protection Commission about their intention to carry out an own volition investigation and their preliminary decision. Schrems made a statement to the effect he expected it would take a number of years before the DPC would take any enforcement action.
However, the letter that Max received from the DPC set out their rationale clearly and set out the time period that Facebook were given to respond to the DPC’s preliminary position. That was 21 days. The DPC intention was then to make a draft decision for submission to the EDPB within 21 days for review as part of the consistency and co-operation mechanisms under GDPR.
Once the paperwork hit Facebook, they reacted as one would anticipate, and began a PR campaign and launched a judicial review to try and stop the DPC’s process in its tracks. Part of Facebook’s argument appears to be that the DPC has acted prematurely in this case. Which is odd, as there might have been the clue of seven years of Max’s pre-existing complaint and a CJEU court hearing which might have alerted them to the issue. Also, I don’t see anything in the Data Protection Act that requires the Commission to “Do a Denham” and give advance notice of an investigation (something which Facebook used last October to have the ICO investigation into them shelved).
The other odd thing is that Noyb.eu are also now challenging the DPC’s actions. And Max himself is commenting on how the DPC has put him in the position of being on the same side as Facebook.
Wanting to the DPC to slow things down. While at the same time wanting things to speed up.
Max’s argument…
I have some sympathy with Max’s position. His complaint was filed on the 1st December 2015. It has taken a long and winding road. However, the CJEU (as Max points out in his correspondence to the DPC) required that the finalisation of the matter referred to them be completed with all “due diligence”. The DPC has taken a narrow scope on this case, which is cause for criticism. The criticism is triggered by Facebook shifting the goal posts again in correspondence to rely on contractual necessity (one of the Article 49 derogations).
That doesn’t mean haste. And it also doesn’t mean “in the manner that any individual might desire”.
What it means is in the way that is most likely to deliver a robust result.
So, why an own volition investigation?
While Max argues that there is no rational reason for initiating an own volition investigation, I actually think there is if the DPC is trying to ensure that they are applying all due diligence to getting to the end result. The unfortunate fact (as Max keeps reminding us) is that his complaint was initiated pre 25th May 2018. Section 8 of the Data Protection Act 2018 requires the DPC to decide all cases initiated before 25th May 2018 under the old Data Protection Acts 1988 and 2003.
This is a problem. Or at least a potential pitfall.
Apart from the fact that the penalties under the old legislation were piss poor, there is the sorry fact that the DPC is currently facing an appeal and a judicial review by the Department of Employment and Social Protection in respect of an inquiry commenced under the old legislation with the decision issued post May 2018. So, it is probable that, in order to avoid falling into the same shithole on a second high profile case, the DPC took a prudent decision to move quickly on a new GDPR-based investigation focussing on the specific issues that were before the CJEU.
Another reason the DPC might want a ‘clean slate’ on things at this point is that the case, and the associated papers, will need to be brought under Article 60(3) to the EDPB. But the EDPB didn’t exist under the 1988 and 2003 legislation. And there was no consitency and co-operation mechanism. So moving forward with any disclosure of case details to other supervisory authorities under the ‘old rules’ could invite an automatic judicial review of the decision making processes of the DPC by Facebook, resulting in the whole thing being chucked.
But I’m speculating on that one. It’s just the way I’d have juggled this to ensure that the case was dealt with with all due diligence (which is legal speak for “avoiding fuck ups”).
But what would that mean for Max’s original complaint? Well, it’s still live. Which means that a result on this own volition investigation would clear the way for a simpler closure of his original complaint, because it could be dealt with locally but in a manner consistent with a parallel decision under GDPR.
Out of Sight Out of Mind?
The last few days have been good for Max. He is back at the centre of the media circle on this issue. The Data Protection Commission is constrained in commenting on active cases lest they make an arse of it like the ICO has a habit of doing. So it’s easy to make claims like it’ll take years to get a decision out of the DPC on their own case when they are not in a position to challenge it because they have to take the higher ground.
He has accused the DPC of leaking the news of their investigation to the Wall Street Journal. He has launched a Judcial Review of their process (another one), and he has found common cause with Facebook.
But he has made it all about him again. Rather than about the outcome. Which should be a long awaited decisive action against a large corporation with resources enough to keep the DPC in a pit of appeals and Judicial Reviews if the DPC were to act in haste without taking due diligence of the steps they are taking.
It’s a messy situation as the DPC has to navigate a number of mines in this minefield. But the far side would seem to be in sight. After all, the Article 49 contractual necessity argument put forward by Facebook is utter shite and fails at the first hurdle under both GDPR and the 1995 Directive/ DPA1988 & 2003, so it won’t take long to put that one to bed, leaving FB with no other angles (and Max with nothing else to complain about).
I know from personal experience that when you get into an adversarial posture with someone over a long time it can be difficult to step back and appreciate your common ground. You end up renting out space in your head to the ‘avatar’ of your counter-party. But if you don’t step back you might wind up with strange bedfellows.
It is odd that, in this case, the adage of “the enemy of my enemy is my friend” seems to have lead to Max ‘friending’ Facebook.
As the old saying goes in Irish, “déanann boscaí folmha an torann is mó“