Facebook has claimed its EU businesses are threatened if it can’t continue to exfiltrate EU data to the US for processing. The claim comes from Yvonne Cunnane, Facebook Ireland’s head of data protection. It is contained in an affidavit that the social media giant filed with the Irish High Court. That affidavit currently remains secret although the Sunday Business Post (registration required) claims to have a copy.
The Sunday Business Post reports that in the affidavit Cunnane said: “In the event [Facebook] were subject to a complete suspension of the transfer of users’ data to the US, as appear to be what the DPC proposes, it is not clear to [Facebook] how, in those circumstances, it could continue to provide the Facebook and Instagram services in the EU.”
On Monday 14th September, the High Court gave Facebook permission to file for a Judicial Review against Ireland’s DPC (Case No 2020/617 JR). It also froze the Section 11 order that the DPC had filed against Facebook. This affidavit is Facebook’s response to that decision, and on Friday 18th September, the High Court set a November date for a full hearing into the case.
What is this all about?
In July 2020, the European Court of Justice declared the EU-US Data Protection Shield invalid. In its judgement, it pointed out that once the data was transferred to the US, data was no longer being protected in the way the GDPR sets out.
It wrote: “limitations on the protection of personal data arising from the domestic law of the United States on the access and use by US public authorities of such data transferred from the European Union to that third country, which the Commission assessed in Decision 2016/1250, are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required under EU law, by the principle of proportionality, in so far as the surveillance programmes based on those provisions are not limited to what is strictly necessary.
“On the basis of the findings made in that decision, the Court pointed out that, in respect of certain surveillance programmes, those provisions do not indicate any limitations on the power they confer to implement those programmes, or the existence of guarantees for potentially targeted non-US persons.”
The latter part of that statement concerned the use of secret FISA warrants to access data on non-US citizens.
Why does Facebook have to transfer data to the US?
This is the big question. Facebook already runs a vast data processing operation inside the EU. There is nothing to stop it from just processing EU data in that data centre. Of course, processing the data in the EU would mean adhering to all the relevant EU laws, especially those around privacy.
Those laws would also cause Facebook a significant problem with US laws on data access. The US has several laws that require US firms to provide access to data secretly, no matter where it is held. If Facebook were to do that on EU data held solely in Europe, it could find itself facing massive penalties.
Processing all that data inside the EU would also raise questions over taxation. Facebook booked over $4 billion in advertising revenue both in Q1 and Q2/2020 (source: Statista). If all processing was carried out in the EU, there is a likelihood that the company would be under pressure to pay significantly more tax in the EU than it currently does.
Enterprise Times: What does this mean?
By claiming that forcing Facebook and Instagram to process EU data in Europe could threaten its operations is a stretch. By keeping its reasons for that secret and refusing to share the affidavit with the media only adds to the suspicion that this has nothing to do with protecting user data and everything to do with Facebook’s income stream.
There will be much focus on the Irish High Court in November to see what is said by the DPC and Facebook. There are numerous other parties, including privacy groups and other US tech companies likely to be watching the court. Between now and the hearing, it will be interesting to see how many organisations side with Facebook and why.
About the only thing that is certain, at the moment, is that the long-running saga of the DPC and Facebook is set for another season with no definitive outcome.
