Privacy First et al. sue Facebook over illegal data transfers to US

Today, Privacy First along with three other Dutch human rights organisations and a number of individual users of Facebook, WhatsApp and Instagram are calling on Mark Zuckerberg to take a stand in the public debate on the implications of the European Court of Justice's ruling in the Schrems case.

The European Court of Justice on 6 October 2015 overturned the Safe Harbour decision that was the basis for Facebook's transfer of personal data from the EU to the US. The ECJ ruled that the US legislation is flawed because it does not provide a level of protection comparable to that in the EU. For example, the NSA has access to the Facebook content of users in the EU, without giving them any legal protection. According to the ECJ, this violates the essence of the fundamental right to privacy. These problems remain unresolved.

After the ruling, Facebook continued to transfer personal data from the EU to the US. Bas Filippini of Privacy First: "As long as there is no adequate level of protection in the US, transfer is clearly in violation of EU privacy law. This violates the privacy of millions of users. If this is not resolved soon, we will take legal action."

To date, Facebook has remained conspicuously aloof from the public debate following the ECJ ruling. Ton Siedsma of Bits of Freedom: "We call on Facebook to publicly engage in the debate on how to solve this problem, and to put pressure on the authorities to achieve such a solution. It would be good if Facebook publicly disclosed its current and future policies on the transfer of personal data."

Facebook received a summons letter, with a deadline of 15 January 2016 to find a solution. If that is not reached, summary proceedings will be brought against Facebook before the District Court of The Hague, demanding that Facebook stop transferring personal data to the US with immediate effect. This concerns all of Facebook's services, including WhatsApp and Instagram.

"Until the US provides adequate protection against mass surveillance, personal data should not be transferred to the US. A lawsuit against Facebook underlines the urgency to resolve this.", says Jelle Klaas of the Public Interest Litigation Project (PILP, NJCM). "Our aim is not to black out the computer screens of millions of users, but to raise the level of privacy protection. Hopefully, lawmakers will find a solution soon."

Click HERE(pdf) for the full summons letter from Privacy First et al to Facebook.

Update 21 January 2016: Just before the deadline passed, Facebook responded by fax to our summons letter, click HERE (pdf). Despite the invalidity of Safe Harbour, Facebook says a workable legal basis still exists for the transfer of personal data from the EU to the US. Privacy First et al dispute this and sent a response to Facebook today, click HERE (pdf).

After our summons letter, Facebook took public statement in the discussion of a newly proposed surveillance law in England:

"Governments should not be able to compel the production of private communications content absent authorisation from an independent and impartial judicial official. (...) Surveillance laws should not permit bulk collection of information. The principles require that the Government specifically identify the individuals or accounts to be targeted and should expressly prohibit bulk surveillance." Thus Facebook.

It is precisely on these aspects, however, that legal protection in the US falls short, according to the European Court of Justice. In our letter of this afternoon Privacy First et al have therefore asked Facebook to also express its position in the debate on mass surveillance in the US. Negotiations are currently taking place between the EU and the US on this issue. It would be good for Facebook to get involved in this substantively, in line with its position on the UK bill.

If a solution to the fundamental privacy problems highlighted by the European Court of Justice is not found in the near future, Privacy First et al are considering filing a summary proceedings in the Hague District Court.