Feb 62017

Update on the Legal Challenge to Standard Contractual Clauses

William RM Long and Thomas Fearon
, , ,

The closely followed case challenging the validity of Standard Contractual Clauses for the transfer of personal data outside the EEA to countries considered not to provide an adequate level of data protection, including the US, is progressing with a hearing coming up February 7th and schedule set for the proceedings, including amicus participation.

Background

On May 31, 2016, the Irish Data Protection Commissioner (“DPC”) commenced proceedings in the Irish High Court, seeking a reference to the CJEU in relation to a complaint made by Max Schrems against Facebook Ireland Ltd’s use of an international data transfer mechanism known as “Standard Contractual Clauses” or “Model Contracts” (“SCCs”). SCCs are standard form data transfer agreements between a data exporter in the EU and a data importer outside of the EU which are entered into to provide an adequate level of protection to permit the transfer of personal data from the EU. The proceedings are titled Data Protection Commissioner v. Facebook Ireland Limited & Maxmillian Schrems 2016/4809P.

The  proceedings have  several elements in common with the application (also in relation to a complaint made by Mr. Schrems) that led to the CJEU’s 2015 decision to invalidate the U.S. EU Safe Harbour Framework.  Mr Schrems’ complaint is that Facebook Ireland Ltd’s use of SCCs for the transfer of personal data to its U.S. headquarters is an inadequate protection of his personal data under Article 8 and fails to provide sufficient remedy under Article 47 of the Charter of Fundamental Rights of the EU. The High Court fixed a date for the hearing on February 7, 2017 and the hearing is expected to run for approximately 3 weeks.

Timetable

On June 13, 2016, on the application of the DPC, the proceedings were admitted into the Commercial List of the Irish High Court. On July 19, 2016, the Court accepted four parties (the U.S. Government, BSA Business Software Alliance, Digital Europe and EPIC) to join proceedings as amicus curiae.  On July 25, 2016, the proceedings came before the High Court for directions on how the case was to progress. Court directions were made concerning the exchange of pleadings, affidavits and legal submissions between the parties for a 5-month period which commenced on September 9, 2016.

The High Court fixed a date for the hearing on February 7, 2017 and the hearing is expected to run for approximately three weeks.

The Irish High Court has recently published a short expected timetable for the hearing:

  1. The hearing will commence with opening submissions from the DPC on February 7, 2017.
  2. Short opening statements will follow from Mr Schrems and Facebook, in that order.
  3. Cross-examination of Mr Schrems’ expert witness will be on February 10, 2017.
  4. This will be followed by cross-examination of the DPC’s expert witnesses, and those of Facebook.
  5. Each of the 4 amicus curiae (“friends of the court”) will then file legal submissions as to the issues in the case.
  6. The case will close with submissions to be made by each of the parties, in the following order: Mr Schrems; followed by Facebook, and then the DPC.
  7. The High Court will then determine whether it should make a referral to the CJEU in relation to the validity of the EU Commission decisions on SCCs.
William RM Long

London

wlong@sidley.com

Thomas Fearon

tfearon@sidley.com

You might also like
UK Sets Out It’s “Pro-Innovation” Approach To AI Regulation

On 29 March 2023, the UK’s Department for Science Innovation and Technology (“DSIT”) published its long awaited White Paper on its “pro-innovation approach to AI regulation” (the “White Paper”), along with a corresponding impact assessment. The White Paper builds on the “proportionate, light touch and forward-looking” approach to AI regulation set out in the policy paper published in July 2022. Importantly, the UK has decided to take a different approach to regulating AI compared to the EU, opting for a decentralised sector-specific approach, with no new legislation expected at this time. Instead, the UK will regulate AI primarily through sector-specific, principles based guidance and existing laws, with an emphasis on an agile and innovation-friendly approach. This is in significant contrast to the EU’s proposed AI Act which is a standalone piece of horizontal legislation regulating all AI systems, irrespective of industry.

How the China Personal Information Protection Law Applies to Foreign Asset Managers

Since China’s Personal Information Protection Law (PIPL) came into effect in November 2021, there has been widespread uncertainty amongst offshore fund managers and investors with entities outside Mainland China as to how and whether the regime applies to them. Given the potential for foreign asset managers to overlook or misinterpret PIPL, this brief update outlines some guidance as to how PIPL can apply, and to whom, in a practical context.

EU Moving Closer to an AI Act – Key Areas of Impact for Life Sciences/MedTech Companies

The European Union is moving closer to adopting the first major legislation to horizontally regulate artificial intelligence. Today, the European Parliament (Parliament) reached a provisional agreement on its internal position on the draft Artificial Intelligence Regulation (AI Act). The text will be adopted by Parliament committees in the coming weeks and by the Parliament plenary in June. The plenary adoption will trigger the next legislative step of trilogue negotiations with the European Council to agree on a final text. Once adopted, according to the text, the AI Act will become applicable 24 months after its entry into force (or 36 months according to the Council’s position), which is currently expected in the second half of 2025, at the earliest.