Facebook’s owner, Meta, has been granted a short stay by the High Court on a decision that it must suspend the transfer and storage of user data from Europe to the US.
Last month, the Data Protection Commission (DPC) fined Meta Platforms Ireland Ltd €1.2billion and ordered it to cease unlawful processing and storage of personal data of millions of European Economic Area (EU countries along with Norway, Iceland and Liechtenstein) Facebook users.
That decision followed a successful legal challenge by Austrian privacy campaigner, Max Schrems, over concerns that EEA users’ data is not sufficiently protected from US intelligence agencies when it is transferred across the Atlantic.
While Meta updated its contractual terms with users following the Schrems decision, the DPC found these arrangements did not address the risks to the fundamental rights and freedoms of data subjects in accordance with a European judgment in that case.
Following an inquiry, the DPC issued orders that Meta suspend the data transfers and to cease the processing and storage of the data.
Meta says the decision means it will have to cease providing its Facebook service to EEA users by October 25th next and after that it will have to permanently delete all their accounts.
As a result, on Friday it sought leave from Mr Justice Denis McDonald, with only the Meta side represented, to bring judicial review proceedings challenging what it says is the DPC's unlawful decision.
The judge said that having read the papers in the case he was satisfied Meta had established arguable grounds for the relief sought. He was satisfied to grant leave to bring judicial review proceedings on notice to the DPC.
He said the case could come back on June 19.
Declan McGrath SC, for Meta, then asked the judge for an interim stay on the DPC decision because of the financial losses his client will incur without it.
The judge said he was only prepared to grant a stay until June 19 but stressed that in doing so, it did not call into question the validity of the DPC. His order only meant Meta had established arguable grounds to suggest the decision is invalid, he said.
In an affidavit, Meta Ireland director and head of office, Anne O'Leary, said that suspending Facebook for hundreds of millions of EEA users - or even telling them suspension will occur - would result in the loss of a very significant number of users and advertisers to competing platforms.
She said the damage will begin to occur even before the October date when the orders are to take effect and will increase significantly once users are notified of the impending suspension and deletion of accounts. Without a stay, she said, the estimated revenue loss is around $714m (€664m).
Ms O'Leary says the US government and the EU Commission have reached agreement on a new framework for transatlantic data flows (known as the Adequacy Decision) and it is likely the EU will have that framework in place shortly.
In the event of an unexpected delay in the Adequacy Decision coming into effect, Meta will find itself having to suspend and engage in the "irreversible bulk deletion" of user data which will have a massive impact on users, she said.
Without a stay on the DPC decision, she said millions of users will be unable to connect with friends and family across the globe and millions of business would no longer be able to use Facebook to sell goods and services.
It would also have serious adverse consequences for Meta's 4,700 strong EU workforce, including 4,470 in Ireland, she said.
Ms O'Leary said a significant factor to the balance of interests in this matter is that Meta Ireland is just one of many communications and technology businesses and organisations which transfer EEA personal data to the US.
Despite this, as far as Meta is aware, the DPC has not commenced own-volition inquiries or taken any steps to prevent the transfer to the US by these other businesses, she said.
