Will Facebook be divided into European and American versions?

On 16 July 2020, the European Court of Justice ruled in the Schrems case that the transfer of personal data to the US via the so-called "Privacy Shield" is not permissible. What does this ruling mean for Facebook and other services that routinely do business with American companies?

The history of the Schrems case goes back to 2010 when Mr. Schrems, as an Austrian citizen, filed a complaint against Facebook Ltd. based in Ireland. In his complaint Mr. Schrems contended that Facebook transfers his personal data to its parent company Facebook Inc. in the US. Irish Facebook had argued that the transfer is permitted under the so-called "Safe Harbor" decision of the European Commission, which allows the transfer to the US. The case then came before the European Court of Justice, which declared the "Safe Harbor" provisions invalid in 2015. "Safe Harbor" has been replaced by an improved "Privacy Shield", but that has also been annulled as of this day.

In the first ruling in 2015, the European Court of Justice concluded that the US must ensure a "substantially equivalent" level of personal data protection as required by European law. However, legislation that guarantees US public authorities generalized access to personal data is in conflict with EU fundamental rights. The court also did not like the fact that the foreigners concerned had no opportunity to review the processing of their data. That is why "Safe Harbor" has been replaced by an improved "Privacy Shield". There were already some possibilities to demand a review of the processing of personal data by the US authorities. However, the possibility for the US authorities to obtain the personal data of foreigners without any reason still remains.

The current dispute between Mr Schrems, resp. The Data Protection Authority of Ireland and Facebook are about the same issue, namely the transfer of personal data to the US. The court primarily reviewed the "Privacy Shield", which it annulled. The legal basis for many companies to transfer personal data to the US has thus been removed. Furthermore, the court also dealt with the amendment of the so-called standard contractual clauses. The court came to the conclusion that in some cases, it is possible to use them when transferring to other states. Standard contractual clauses continue to remain the legal basis for transfers, but supervisors can now examine whether these clauses are in conflict with the law of the country to which the personal data is proposed to be transferred. We are therefore moving towards further disputes concerning standard contractual clauses in relation to a specific state.

This ground-breaking decision will make it more difficult to transfer personal data between friendly companies in Europe and the US, and may lead to further fragmentation of services. In our opinion, the Companies will come up with different solutions or versions of their products for Europe and the USA. Perhaps the future Facebook will not be the same in Europe as it is in America.