The High Court has ordered the Data Protection Commission (DPC) to pay the majority of Mr Schrems' costs in The Data Protection Commissioner v Facebook Ireland Limited & Maximillian Schrems [2020] IEHC 537 (Schrems II).
Case Background
Schrems II is the most recent in a series of linked cases which began with a complaint by Maximillian Schrems to the DPC regarding the transfer of his personal data by Facebook Ireland to its parent company in the US (Schrems I). During the Schrems II proceedings, the Irish High Court referred questions to the Court of Justice of the EU (CJEU) which led to the CJEU upholding the validity of Standard Contract Clauses (SCCs) (EU Commission Decision 2010/87) and declaring the EU-US Privacy Shield (EU Commission Decisions 2016/1250) to be an invalid basis on which to transfer data to the US.
An overview of these decisions can be found in our previous publications here and here.
Early last month, Ms Justice Costello heard submissions on costs relating to Schrems II, wherein the DPC sought her costs in the proceedings against Facebook and Mr Schrems sought his costs against the DPC. Facebook did not seek an order for costs against either the DPC or Mr Schrems but opposed any costs orders being made against it.
Cost Arguments raised by the DPC
The DPC argued that there should be an order for Mr Schrems' costs against Facebook or, in the alternative, that the DPC should be entitled to recover any costs payable by the DPC to Mr Schrems from Facebook. The DPC argued that the true dispute was between Mr Schrems and Facebook, that the dispute was only being "mediated" through the DPC and that the defendants had introduced wider, unnecessary issues during the course of the proceedings in respect of which the DPC should not be exposed to an order of costs.
Decision on Costs
Ultimately the Court did not agree with the arguments raised by the DPC. In its judgment, delivered on 30 October 2020, the Court held that the DPC could not be regarded as "a mediator who has no independent role" in the dispute. Regarding the wider issues introduced by the defendants, the Court stated that it is vital that parties are free to defend a case in a bona fide manner, without the fear that they face an "added risk" that costs might be awarded against them. The extent of the issues in the case, the Court said, did "not amount to any wrong" which it should consider in exercising its discretion to award costs.
Ms Justice Costello ordered that the DPC pay the majority of Mr Schrems' costs, including the costs of the proceedings and costs of the preliminary reference to the CJEU. As regards a four-day hearing held after Ms Justice Costello's judgment in the proceedings (delivered 3 October 2017), wherein Facebook and the US sought to correct errors in the judgment, Ms Justice Costello held that this hearing could have been confined to one day. In the circumstances, the DPC would bear the costs of one day only and Facebook would bear Mr Schrems' costs of the additional three days.
Conclusion
While Ms Justice Costello recognised the heavy financial burden that her decision would place on the DPC, she held that the DPC could not avoid the consequences of its important role by arguing that the dispute was between the data subject and the data processor.
Judge Costello remarked that it would be a matter for Government to ensure that the DPC is sufficiently resourced so that the payment of legal costs does not restrict or prevent it from carrying out its fundamental purposes.
This judgment highlights the key role of the DPC in the protection of data subjects as the "guardian of fundamental rights" and the DPC's duty to apply expertise and resources to pursue claims, including before the Irish courts.
Contributed by Florence Meagher & Shauna Robinson
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.