CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
authorities’ powers in that way and, consequently, the CJEU held the Safe
Harbour Decision to be invalid.
5. Data Protection Commissioner v Facebook Ireland and Maximillian
Schrems Case (C-311/18; ECLI:EU:C:2020:559)
117. Following the judgment of the CJEU of 6 October 2015, the
referring court annulled the rejection of Mr Schrems’ complaint and referred
that decision back to the Commissioner. In the course of the
Commissioner’s investigation, Facebook Ireland explained that a large part
of personal data were transferred to Facebook Inc. pursuant to the standard
data protection clauses set out in the annex to Commission Decision
2010/87/EU, as amended.
118. Mr Schrems reformulated his complaint, claiming, inter alia, that
the United States’ law required Facebook Inc. to make the personal data
transferred to it available to certain United States’ authorities, such as the
National Security Agency (“the NSA”) and the Federal Bureau of
Investigation. Since those data were used in the context of various
monitoring programmes in a manner incompatible with Articles 7, 8 and 47
of the Charter, Decision 2010/87/EU could not justify the transfer of those
data to the United States. On this basis, he asked the Commissioner to
prohibit or suspend the transfer of his personal data to Facebook Inc.
119. In a draft decision published on 24 May 2016, the Commissioner
took the provisional view that the personal data of European Union citizens
transferred to the United States were likely to be consulted and processed by
the United States’ authorities in a manner incompatible with Articles 7 and
8 of the Charter and that United States’ law did not provide those citizens
with legal remedies compatible with Article 47 of the Charter. The
Commissioner found that the standard data protection clauses in the annex
to Decision 2010/87/EU were not capable of remedying that defect, since
they did not bind the United States’ authorities.
120. Having considered the United States’ intelligence activities under
section 702 of FISA and Executive Order 12333, the High Court concluded
that the United States carried out mass processing of personal data without
ensuring a level of protection essentially equivalent to that guaranteed by
Articles 7 and 8 of the Charter; and that European Union citizens did not
have available to them the same remedies as citizens of the United States,
with the consequence that United States’ law did not afford European Union
citizens a level of protection essentially equivalent to that guaranteed by
Article 47 of the Charter. It stayed the proceedings and referred a number of
questions to the CJEU for a preliminary ruling. It asked, inter alia, whether
European Union law applied to the transfer of data from a private company
in the European Union to a private company in a third country; if so, how
the level of protection in the third country should be assessed; and whether