Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems [Schrems II]

In 2005 the United States negotiated a safe-harbor treaty with the European Data Protection Commission (the commission). The agreement sought to ensure that the United States met the European Union’s requirement that other countries adequately protect European Union residents’ personal data. However, the agreement provided that national security or other public interests prevailed over the safe-harbor principles if they conflicted. Organizations, including Facebook, were invited to join the agreement. After Edward Snowden’s revelations about the National Security Agency’s data collection, questions arose in the European Union about the continuing efficacy of the agreement. Maximillian Schrems (plaintiff) was an Austrian resident who used Facebook. Any European resident who used Facebook was required to make a contract with Facebook Ireland Ltd prior to such use. Facebook Ireland transferred such users’ data to its American parent, Facebook Inc. Facebook Inc. then stored the users’ personal data on servers in the United States. Schrems filed a complaint with the commission, claiming that United States privacy law did not adequately protect European users’ personal data. As a result, Schrems asked the commission to prohibit Facebook Ireland from transferring any such data to the United States. The commission declined Schrems’s request. Schrems filed an application with the European Court of Justice to appeal the decision. The European Court of Justice invalidated the treaty between the United States and the commission. Subsequently, the commission adopted a decision (the privacy-shield decision), making another attempt at ensuring the protection of European Union residents’ data stored in third-party countries. Schrems filed an amended complaint with the European Court of Justice, again seeking to prevent the transfer of data from Facebook Ireland to the United States.