Background

On 22 November 2017, the Court of Justice of the European Union (“CJEU”) gave judgment in a case taken by the not-for-profit company, Digital Rights Ireland Limited (“DRIL”). DRIL sought an annulment of the European Commission’s Privacy Shield decision. This decision states that the US ensures an adequate level of protection for personal data transferred from the EU to companies in the US under the EU-US Privacy Shield (the “Contested Decision”).

The CJEU ruled that DRIL’s annulment request was inadmissible for two reasons; (1) it cannot show that it is sufficiently affected by the Contested Decision to bring proceedings in its own name; and (2) a lack of standing to bring proceedings in the name of its members, supporters and the general public.

In this case, the DRIL acted as the applicant and the European Commission was the defendant.

Admissibility of the action brought by DRIL in its own name

DRIL presented three arguments to demonstrate the admissibility of the action brought in its own name.

Argument 1: DRIL argued that, given that it possesses a mobile phone and a computer, its own personal data is liable to be transferred to the US pursuant to the Contested Decision. The CJEU rejected this argument. The CJEU ruled that in its capacity as a legal person, DRIL does not possess personal data. The Data Protection Directive only provides for the protection of personal data of natural persons, not legal entities.

Argument 2: DRIL’s second argument was that the Contested Decision affects its position as controller of the personal data of its supporters. However, the CJEU ruled that the Contested Decision applies to European controllers only in so far as it authorises them to carry out transfers to American organisations that are covered by the Privacy Shield. The CJEU further noted that the Contested Decision has the effect of entitling DRIL to carry out transfers under certain conditions. It does not restrict DRIL’s rights or impose obligations on it. Consequently, the annulment of the Contested Decision is not capable of procuring an advantage for DRIL as a controller.

Argument 3: DRIL claimed that there is a risk that the use of electronic communication services to process the data will result in its transfer to the United States by providers of those services. DRIL argued that it would be placing itself in an unlawful situation if it had to apply the Contested Decision. DRIL further argued that the transfer of personal data over which it is controller to the US undermines its obligations under the Data Protection Directive to ensure it lawfully processes personal data. However, the CJEU ruled that such transfers would be made in accordance with the applicable rules for electronic communication services. The CJEU held that DRIL could not be criticised for having breached its obligation to lawfully process personal data by transferring personal data in accordance with such applicable rules. Since implementation of the Contested Decision would not result in a breach of its obligations, the CJEU ruled that the annulment of the Contested Decision would also not bring any advantage for DRIL.

Admissibility of the action brought by DRIL in the name of its members, its supporters and the general public

Finally, the CJEU addressed the admissibility of DRIL’s action in the name and on behalf of its members, supporters and the general public. According to established case law, actions brought by associations are admissible in three situations: (1) where they represent the interests of persons who, for their part, would have standing to take action, or (2) where they are individually identified by reason of the impact on their interests as an association, particularly because their position as negotiator has been affected by the annulment sought, or (3) where a legal provision expressly grants them a number of powers of a procedural nature.

DRIL claimed to represent the interests of its members and supporters and, on the other hand, to act in the public interest under EU law. The Commission argued that DRIL is a company rather than an association. DRIL did not dispute this characterization.

Decision: The CJEU concluded that DRIL does not have standing to act in the name of its members and supporters or on behalf of the general public. DRIL was not empowered to bring legal actions in the name and on behalf of its members and supporters. DRIL’s involvement in judicial proceedings at national and EU level do not allow it to establish requisite standing to take this claim.

The action was therefore held to be inadmissible.

Comments The CJEU’s decision to dismiss the action to annul the EU-US Privacy Shield decision means that Privacy Shield remains valid and in force. Since July 2016, Privacy Shield has facilitated the free-flow of cross-border transfers of personal data between Europe and the US and will continue to do so for now. The judgment, combined with the fact that Privacy Shield has passed its first annual review, is positive news for organisations using the transfer mechanism, especially in light of the ongoing judicial challenges facing the standard contractual clauses.