Schrems v. Data Protection Commissioner (Joined by Digital Rights Ireland) [Schrems I]

In 2005 the United States negotiated a safe-harbor treaty with the European Data Protection Commission (the commission). Under the agreement, the United States and companies that signed on met the European Union’s requirement that other countries adequately protect European Union residents’ personal data. Organizations, including Facebook, were invited to join the agreement. However, the agreement provided that national security or other public interests prevailed over the safe-harbor principles if they conflicted. After Edward Snowden’s revelations about the National Security Agency’s data collection, questions arose in the European Union about the continuing efficacy of the agreement. Maximillian Schrems (plaintiff) was an Austrian resident who used Facebook. Any European resident who used Facebook was required to make a contract with Facebook Ireland Ltd prior to such use. Facebook Ireland transferred such users’ data to its American parent, Facebook Inc. Facebook Inc. then stored the users’ personal data on servers in the United States. Schrems filed a complaint with the commission, claiming that United States privacy law did not adequately protect European users’ personal data. As a result, Schrems asked the commission to prohibit Facebook Ireland from transferring any such data to the United States. The commission declined Schrems’s request. Schrems filed an application with the European Court of Justice to appeal the decision.