The Irish High Court referred this challenge by Europe v Facebook to the Court of Justice for the European Union (“CJEU”).
At a hearing on March 24, 2015, a lawyer for Mr. Schrems called for rescinding the Safe Harbor Agreement, and stated that, “Mass surveillance is manifestly incompatible with the fundamental right to privacy and data protection.” He maintained that Mr. Schrems’ right to privacy was violated even though there was no evidence that the NSA had specifically accessed his data. Lawyers for the governments of Belgium, Poland and Austria supported Schrems, while the European Commission, the UK, and the Irish Data Protection Supervisor argued in support of the Safe Harbor Agreement.
Although the Advocate General of the CJEU was originally scheduled to issue a non-binding opinion on June 24, 2015, the CJEU notified Schrems on June 9 that the opinion would be delayed, and did not set a new date for its issuance.
The Advocate General issued his Opinion on September 23. Although the CJEU usually issues its Judgment three to six months after the Advocate General’s opinion, the CJEU’s Judgment was issued on October 6, 2015. The Advocate General and CJEU both held that the European Commission’s Decision 2000/520 (the “Safe Harbor Decision”) that the Safe Harbor Agreement ensures an adequate level of protection for EU citizens’ data transferred to the US did not preclude the Irish Data Protection Commissioner from investigating Mr. Schrems’ complaint. After holding further that jurisdiction to invalidate the Commission’s Decision belonged to the CJEU alone, the Advocate General and CJEU both invalidated the Safe Harbor Decision for failing to take account of US law’s lack of protection for the fundamental rights of EU citizens.