ECJ hears landmark case over Facebook data security

A landmark case concerning Facebook's transfer of personal data to the US opened in the European Court of Justice (ECJ) on Tuesday.

The case could have major consequences not only for the social media giant's operations in Europe, but also for thousands of other companies that also transfer personal data around the world.

What is the case about?

• ECJ judges must decide whether Facebook's data transfers violate EU citizens' fundamental right to privacy.
• The privacy activist who brought the case, argued that the data is not sufficiently protected against United States surveillance.
• Max Schrems, the complainant in the case, noted that companies in the US are required to make data available to federal authorities, such as the FBI.
• Furthermore, EU users who are impacted cannot challenge the decision in court.
• Facebook has argued that EU law does not apply to national security decisions.

Irish court refers case

Schrems, an Austrian law student and privacy activist, first challenged Facebook in Ireland, where Facebook's international headquarters is located. He urged the Irish data protection authority to halt all data transfers the social media firm makes to the US. Irish courts then referred the case to the ECJ, despite attempts by Facebook to block the case.

He has previously successfully fought against the European Union's former data-sharing agreement, Safe Harbor, which the ECJ struck down in 2015.

What are the possible consequences?

The key issue behind the case concerns a framework called "Privacy Shield" that went into place in 2016. Under the EU-US agreement, companies certify that they comply with EU privacy laws.

Should the current legal arrangement be ruled inadequate by the ECJ, the decision would have a major impact not only on Facebook, but on all companies operating within the European Union that carry out cross-border data transfers.

Facebook under fire

The social media giant has come under increasing scrutiny recently after it emerged last year that the 87 million users' personal information was improperly shared with the UK-based Cambridge Analytica political consultancy.

Larger concerns over data privacy issues — particularly in Europe — have been growing since Edward Snowden leaked confidential surveillance information in 2013. The former US intelligence contractor revealed the scope of mass US surveillance, even against European allies.

What happens next: ECJ judges heard oral arguments on Tuesday, though a final decision is not expected until the end of the year. At Tuesday's hearing the court announced it would issue an opinion on December 12. Though not legally binding, the advice the court's advocate general provides is very influential to final ECJ decisions.

rs/rc (AFP, Reuters)

DW sends out a daily selection of the day's news and features. Sign up here.