THE HIGH COURTJUDICIAL REVIEW[2020 No. 617 JR.][2020 No. 126 COM.]
BETWEENFACEBOOK IRELAND LIMITEDAPPLICANTANDDATA PROTECTION COMMISSIONRESPONDENTAND

MAXIMILIAN SCHREMSNOTICE PARTYJUDGMENT of Mr. Justice David Barniville delivered on the 14th day of May, 2021
Index
1. Introduction……………………………………………………………………….… 3
2. Overview of Decision………………………………………………………………... 6
3. Structure of Judgment………………………………………………………..…….. 7
4. Relevant Factual Background………………………………………………….…... 8
5. CJEU Judgment in Schrems II…………………………………………………… 13
6. Developments Post Judgment in Schrems II……………………………………... 17
7. DPC’s 28 August 2020 Letter and PDD………………………………………….. 22

2
8. Correspondence Post the DPC’s 28 August 2020 Letter and PDD……………... 35
9. Procedural Background…………………………………………………………… 46
10. Resolution of Mr. Schrems Proceedings………………………………………….. 49
11. Structure for Consideration of the Issues Raised………………………………... 51
12. Whether PDD/DPC’s Procedure is Amenable to Judicial Review……………... 53
13. Alleged Failure by DPC to Conduct an Investigation/Inquiry Before Reaching a
Decision…………………………………………………………………………….. 69
14. Alleged Departure by DPC from Published Procedures/Breach of Legitimate
Expectation………………………………………………………………………… 80
15. Alleged Breach of Fair Procedures: 21-Day Period for Submissions…………. 114
16. Alleged Breach of Fair Procedures: Premature Judgment……………………. 132
17. Alleged Breach of Fair Procedures: Involvement of Commissioner at
Investigation and Decision-Making Stages……………………………………... 151
18. Single Decision to Cover Infringement and Corrective Measures: Ultra Vires
Section 111 of 2018 Act…………………………………………………………... 157
19. Failure to Await Guidance from EDPB and/or Failure to Take Timing of EDPB
Guidance into Account…………………………………………………………… 157
20. Alleged Discrimination/Breach of FBI’s Right to Equality: Inquiry into FBI
Only……………………………………………………………………………….. 167
21. Alleged Disproportionality of Simultaneous Inquiries………………………… 180
22. Adequacy of DPC’s Reasons……………………………………………………... 181
23. Duty of Candour………………………………………………………………….. 184
24. Abuse of Process/Improper Purpose……………………………………………. 192
25. Summary of Conclusions………………………………………………………… 196
1. Introduction

3
1.

On 16th July, 2020, the Court of Justice of the European Union (“CJEU”) delivered its

landmark judgment in Case C-311/18 Data Protection Commissioner v. Facebook Ireland
Ltd and Maximilian Schrems (commonly now referred to as “Schrems II”) on a reference
from the High Court (Costello J.). This case is about what happened after that judgment.
2.

Following the judgment in Schrems II, the Data Protection Commission (“DPC”)

decided to commence an “own volition” inquiry under s. 110 of the Data Protection Act,2018 (the “2018 Act”) to consider whether the actions of Facebook Ireland Ltd (“FBI”) inmaking transfers of personal data relating to individuals in the European Union/European
Economic Area are lawful and whether any corrective power should be exercised by the DPC
in that regard. The DPC decided to commence the inquiry by issuing a “Preliminary Draft
Decision” (“PDD”) to FBI on 28th August, 2020.
3.

FBI took issue, on several grounds, with the decision by the DPC to commence theinquiry by means of the PDD and with the procedures adopted by the DPC. Mr. Schrems,
who had made a complaint and a reformulated complaint to the statutory predecessor of theDPC, the Data Protection Commissioner, under the Data Protection Act, 1988 (the “1988Act”), which had ultimately led to the reference by the High Court to the CJEU leading to the
judgment in Schrems II, also took issue with the DPC’s decision and procedures on a numberof grounds, some of which overlapped to an extent with the grounds advanced by FBI.
4.

Both FBI and Mr. Schrems brought judicial review proceedings in respect of the PDD

and the procedures adopted by the DPC. Each applied successfully to be joined as a notice
party to the other’s judicial review proceedings. Both proceedings were entered in theCommercial List. FBI’s proceedings were heard by me over five days between 15th
December and 21st December, 2020, following which they were adjourned to allow further
affidavit evidence to be provided by the DPC. Mr. Schrems’ proceedings were due tocommence on 13th January, 2021. However, they were resolved between Mr. Schrems and the4
DPC shortly prior to hearing, on terms to which it will be necessary briefly to refer later inthis judgment.
5.

FBI contends that the DPC’s decision to issue the PDD and to adopt the procedure

which it has adopted should be quashed, and declarations should be made by the court, on
several grounds. At the outset, FBI asserts that the DPC’s decision and the procedures
adopted by it are amenable to judicial review. It then says that the DPC’s decision and theprocedures are unlawful on several grounds, including being in breach of the provisions of
the 2018 Act and Regulation (EU) 2016/679 of the European Parliament and of the Councilof 27th April, 2016 (the “GDPR”) by virtue of the DPC’s failure to conduct any investigation
before issuing the PDD; a breach of FBI’s legitimate expectation that procedures publishedby the DPC in its 2018 Annual Report and on its website, and followed by the DPC in otherinquiries, would be followed in respect of the DPC’s inquiry; breaches of FBI’s right to fair
procedures, including premature judgment of the issues by the DPC and a failure to afford
sufficient time to FBI to make submissions to the DPC; a failure by the DPC to take into
account relevant considerations and, in particular, to await publication by the European Data
Protection Board (“EDPB”) of guidance/recommendations to assist controllers andprocessors as regards the use of what are called “supplementary measures” to ensure
adequate protection for data subjects when transferring data to third countries; a breach ofFBI’s right to equal treatment and non-discrimination; a breach of the DPC’s obligation to act
proportionately by subjecting FBI to simultaneous inquiries (namely, the “own volition”
inquiry and the complaint made by Mr. Schrems. FBI also alleges a breach by the DPC of its
duty of candour in the manner in which it has defended the proceedings.
6.

In response, the DPC contends that the decision to issue the PDD is not amenable tojudicial review (although it accepts that the procedures which it decided to follow are soamenable). It initially maintained that the proceedings amounted to an abuse of process by5
FBI and advanced that claim in its pleadings and in its written submissions but ultimately
withdrew the point at the hearing. In response to the grounds advanced by FBI, the DPC
contends that FBI is fundamentally mistaken when it asserts that no investigation was carriedout by the DPC before issuing the PDD and further maintains that FBI was invited to makesubmissions on the facts and on the law and to provide such further information as it felt
necessary in response to the preliminary views set out in the PDD. The DPC relies on the factthat it was in possession of a vast amount of information in light of the procedural history
leading up to the judgment of the CJEU in Schrems II. The DPC disputes the contention that
FBI had a legitimate expectation that any particular procedure would be followed by it arisingfrom the description of an “illustrative” process in its 2018 Annual Report and on its website
or by virtue of any practice adopted by it. It also disputes the allegations of premature
judgment and contends that the views set out in PDD were expressly stated to be preliminary
only and subject to such submissions on the facts and on the law which FBI were invited to
make. It further disputes the allegations of breaches of fair procedures, and asserts that noextension of time was sought by FBI to make a submission in response to the PDD and thatno extension of time was refused by the DPC. The DPC confirmed at the hearing ofproceedings that, in the event that FBI failed in its proceedings, the time allowed for FBI to
put in its submissions would run from the resumption of the inquiry and that the DPC would
consider any reasoned request for an extension of time. The DPC further maintains that it was
and is entitled and obliged to proceed as it has done, notwithstanding the absence ofguidelines or recommendations from the EDPB (which recommendations were put out for
consultation on 10th November, 2020). The DPC disputes the allegations of unequal treatment
and discrimination. It also disputes the contention that there is a breach of any obligation of
proportionality by reason of the existence of the inquiry and the ongoing complaint by Mr.

6Schrems. It further disputes that there was any breach of the duty of candour in its defence ofthe proceedings.
7.

For his part, as a notice party in these proceedings, Mr. Schrems supports thequashing of the PDD on the grounds that it infringes his legitimate expectation that hiscomplaint would be determined by the DPC following the CJEU’s judgment in Schrems II.
He also supports FBI’s complaints in relation to the disproportionality of the DPC conducting
simultaneous inquiries. However, Mr. Schrems opposes the reliefs being sought by FBI on
the grounds of an alleged departure by the DPC from its published procedures in issuing the
PDD and commencing the own-volition inquiry. He also disagrees with FBI that the DPC
was obliged to await publication of EDPB guidance before proceeding with the inquiry. Mr.
Schrems stressed the obligation on the DPC under the GPDR and the judgment of the CJEU
in Schrems II to act expeditiously. Consistent with that contention, Mr. Schrems disputes
FBI’s case that it was afforded insufficient time to make submissions to the DPC in responseto the PDD.
8.

As can be seen from this brief summary of the respective contentions of the parties,

several important issues of national administrative law arise for consideration in theseproceedings as well as significant issues of EU law arising from the GDPR and from thejudgment of the CJEU in Schrems II. It should be noted, however, that what is at issue inthese proceedings are the procedural rights and obligations of FBI, the DPC and Mr. Schrems
in the context of the DPC’s inquiry post the judgment of the CJEU in Schrems II and not themerits of the preliminary views expressed by the DPC in the PDD.
2. Overview of Decision9.

As I explain in detail in this judgment, I have concluded that the decision of the DPC

to issue the PDD and to adopt the procedures notified to FBI and Mr. Schrems are amenable
to judicial review. However, having so concluded, I have proceeded to consider each of the

7grounds of challenge advanced by FBI to impugn the PDD and the procedures adopted by the
DPC. I have concluded that FBI must fail on those grounds of challenge and that it is,therefore, not entitled to any of the reliefs claimed in the proceedings.
10.

I have, however, made certain comments on the manner in which an allegation of

abuse of process was made by the DPC and withdrawn at the hearing and on the refusal by
the DPC to provide certain information requested by FBI during the course of theproceedings. I have indicated that I will hear further from counsel and to what, if any
consequences, should flow from those comments.
3. Structure of Judgment
11.

It will first be necessary to set out in some detail the relevant factual backgroundleading up to the DPC’s decision to commence an own-volition inquiry and to issue the PDD
in late August, 2020 following the judgment of the CJEU in Schrems II. It will then benecessary to consider the correspondence exchanged between the parties prior to thecommencement of the proceedings in mid-September, 2020. I will then outline the relevant
procedural history of the proceedings and refer in that context to the terms on which theseparate proceedings commenced by Mr. Schrems were resolved as between him and the
DPC in mid-January, 2021. After that, I will address the respective contentions of the parties
as to the amenability of the judicial review of the decision of the DPC to issue the PDD and
to adopt the procedures adopted in respect of its inquiry. I will then turn to consider each of
the grounds of challenge advanced by FBI in the proceedings and set out my conclusions in
respect of each of those grounds. Finally, I will consider the allegation of abuse of process by
the dpc and the allegation made by FBI of breach of the duty of candour by the DPC. I willthen provide a summary of my conclusions.

8
4. Relevant Factual Background12.

The applicant, FBI, is a company incorporated in Ireland which has its registeredoffice and principal place of business in Dublin. It is a subsidiary of Facebook Inc., a US
corporation. FBI provides the Facebook and Instagram social networks in the European
region. The European headquarters and central administration of the Facebook and Instagrambusiness in the EU is in Dublin.
13.

The DPC was established pursuant to, and for the purposes of carrying out functions

under, the 2018 Act, with effect from 25th May, 2018. It is the supervisory authority in
Ireland within the meaning of, and for the purposes specified, in the GDPR. It is the
successor to the Data Protection Commissioner who was appointed under the 1988 Act (forease of reference, where necessary, I will refer in this judgment to the Data Protection
Commissioner also as the “DPC”). Although provision is made under the 2018 Act for theappointment of up to three members, only one member (known as a commissioner) has been
appointed, Ms. Helen Dixon (referred to as the “Commissioner” or “Ms. Dixon”, dependingon the context).
14.

Mr. Schrems, an Austrian national who resides in Austria, is a privacy and data rights

activist. He has been a user of the Facebook social network since 2008.
15.

In June, 2013, Mr. Schrems made a complaint to the DPC in relation to the processingof his personal data by FBI. He contended that the transfer of his personal data by FBI to
Facebook Inc. in the US for processing was unlawful under national and EU law. He
requested, in essence, that FBI be prohibited from transferring his personal data to the US on
the ground that the law and practice in the US did not ensure adequate protection of personal
data held in its territory against the surveillance activities carried out by public authorities in
the US.

9
16.

The DPC declined to investigate Mr. Schrems’ complaint, deeming it to beunsustainable in law by reason of the fact that the European Commission had adopted adecision in July, 2000 under Directive 95/46/EC of the Parliament and of the Council (the“Directive”), namely, Decision 2000/520/EC (the “Safe Harbour Decision” or “SHD”), in
which it found, in effect, that the US did ensure an adequate level of protection for personal
data from the surveillance activities of the authorities there.
17.

Mr. Schrems brought judicial review proceedings in the High Court in October, 2013

challenging the DPC’s refusal to investigate his complaint and seeking an order directing the
DPC to do so and to decide his complaint on its merits.
18.

In June, 2014, the High Court (Hogan J.) referred a number of questions to the CJEU

under Article 267 TFEU on issues concerning the interpretation and validity of the SHD. The
CJEU gave its judgment on that reference on 6th October, 2015: Case C-362/14 Maximilian
Schrems v. Data Protection Commissioner ECLI:EU:C:2015:650 (“Schrems I”). The CJEU
held (inter alia) that the SHD was invalid.
19.

Following the judgment in Schrems I, the High Court (Hogan J.) made an order on

20th October, 2015 quashing the decision of the DPC to refuse to investigate Mr. Schrems’
complaint and remitting the complaint to the DPC who, through counsel, undertook that thematter would be “investigated promptly with all due diligence and speed”.
20.

The DPC invited Mr. Schrems to reformulate his complaint in light of the CJEU

judgment in Schrems I and in light of the fact that the SHD had been found to be invalid inthat judgment. Mr. Schrems submitted a reformulated complaint on 1st December, 2015.
There followed an extensive exchange of correspondence between the DPC and FBI andbetween the DPC and Mr. Schrems between December, 2015 and May, 2016 when the DPC
issued a draft decision to which reference will shortly be made.

10
21.

In the course of the correspondence between the DPC and the FBI, on 22nd January,

2016, FBI provided a submission to the DPC setting out a legal analysis of the legal bases forFBI’s transfer of personal data to Facebook Inc. in the US since the judgment of the CJEU in
Schrems I and one further proposed legal basis. That submission was not furnished at the timeto Mr. Schrems and was, apparently, only seen by him for the first time when he received acopy with FBI’s judicial review papers in these proceedings. In very brief summary, the threelegal bases identified by FBI in that submission were (a) transfers pursuant to standard
contractual clauses (“SCCs”) (or model contractual clauses (“MCCs”), as they were referred
to in the submission) derived from three European Commission decisions made under Article
26 of the Directive (the “SCC Decisions”), including, in particular, Commission Decision
2010/87/EU (the “SCC Decision”); (b) transfers with the consent of the data subject (under aderogation contained in Article 26(1)(a) of the Directive); and (c) transfers under thecontractual necessity derogation under Article 26(1)(b) of the Directive. The proposed further
basis is not relevant for present purposes.
22.

On 24th May, 2016, the DPC wrote to FBI and Mr. Schrems enclosing a draft decisionof that date (the “draft decision”). In her covering letter, the DPC stated that she had formed
the view on a “preliminary basis” and subject to consideration of further submissions to bemade by the parties that Mr. Schrems’ contention that SCCs could not lawfully be relied uponin respect of transfers of personal data of EU citizens to the US was well founded and that the
SCC Decisions were likely to offend against Article 47 of the Charter of Fundamental Rightsof the European Union (the “Charter”). However, the DPC stated that any question
impugning the validity of the SCC Decisions could not be determined by her or by thenational courts and that, having regard to the judgment of the CJEU in Schrems I, she
intended to commence proceedings in the High Court seeking a declaration that the SCCs
were invalid as a matter of EU law and seeking a reference to the CJEU for the purposes of

11
establishing the validity or otherwise of the SCC Decisions. It is unnecessary to outline thecontents of the draft decision save to note that the DPC set out her view, pending receipt offurther submissions, that the SCC Decisions were likely to offend against Article 47 of theCharter by purporting to legitimise the transfer of the personal data of EU citizens to the US
in the absence of a “complete framework for any citizen to pursue effective legal remedies in
the US” (para. 64). The DPC considered that she was bound by the judgment of the CJEU in
Schrems I to bring proceedings and to seek a reference for a preliminary ruling to the CJEU.
The DPC stated that she could not conclude her investigation without obtaining a ruling of
the CJEU on the validity of the SCC Decisions and that a final decision would be issued by
the DPC following conclusion of the proceedings which she intended to issue (para. 67). At
the conclusion of her letter of 24th May, 2016, the DPC stated that, on the conclusion of theproceedings “and having first considered such submissions as may be made by the parties, I
will then deliver a final decision in relation to the subject matter of Mr. Schrems’ complaint”.
23.

The DPC commenced proceedings in the High Court on 31st May, 2016, naming FBI

and Mr. Schrems as co-defendants (the “DPC Proceedings”). The PDD, the subject of theseproceedings, summarises the steps taken in the proceedings and attaches a chronologicaloverview of the procedural steps taken in the proceedings, an analysis of the evidence given
and the submissions made in the proceedings and a list of the “main body of material” before
the High Court. As well as participation by FBI and Mr. Schrems, there were four amici
curiae who participated in the proceedings, namely, Business Software Alliance, Digital
Europe, Electronic Privacy Information Centre and the US Government. Evidence was given
by five experts in US law. The hearing extended over 22 days. The High Court (Costello J.)
delivered a very detailed judgment on 3rd October, 2017: Data Protection Commissioner v.
Facebook Ireland Ltd and Maximilian Schrems [2017] IEHC 545. The High Court decided torefer a series of questions to the CJEU under Article 267 TFEU. There were further hearings

12in the High Court in relation to certain of the factual findings made by the High Court and in
relation to the terms of the questions to be referred. A slightly revised version of the High
Court judgment was issued on 12th April, 2018. On 4th May, 2018, the High Court made anorder referring the questions to the CJEU for preliminary ruling. FBI appealed to theSupreme Court. There was an issue as to whether an appeal was possible. The Supreme Court
heard the appeal in January, 2019 and on 31st May, 2019 it dismissed the appeal: Data
Protection Commissioner v. Facebook Ireland Ltd and Maximilian Schrems [2019] IESC 46.
24.

Shortly after the DPC commenced the DPC Proceedings, the European Commission

adopted Commission Implementing Decision (EU) 2016/1250 of 12th July, 2016 pursuant to
Article 25(2) of the Directive on the adequacy of the protection provided by the EU-US
Privacy Shield (the “Privacy Shield Decision”). Under Article 1 of the Privacy Shield
Decision, the European Commission decided that, for the purposes of Article 25(2) of the
Directive, the US ensured an adequate level of protection for personal data transferred fromthe EU to organisations in the US under the EU-US Privacy Shield. The EU-US Privacy
Shield was constituted by certain principles issued by the US Department of Commerce inJuly, 2016 and official representations and commitments contained in certain otherdocuments.
25.

Another significant development occurred while the DPC Proceedings were ongoing.

The GDPR and the 2018 Act came into force on 25th May, 2018.
26.

The CJEU heard the reference from the High Court in the DPC Proceedings on 9thJuly, 2019. Among the intervening parties of the hearing was the US. Prior to the hearing, theCJEU issued a series of questions to the US to be answered in writing and requested theparties and interested persons to concentrate their oral submissions on certain questions. The
information requested by the CJEU from the US prior to the hearing included information
concerning measures based on certain provisions of US law and practice, including s. 702 of

13
the Foreign Intelligence Surveillance Act (the “FISA”), Executive Order 12333 (“EO
12333”) and Presidential Policy Directive-28 (“PPD 28”) and the safeguards which had forceof law in the US and were applicable to EU citizens in respect of those measures. The parties
and interested parties were also requested to submit their observations on the replies of the
US Government to those questions.
5. CJEU Judgment in Schrems II
27.

The CJEU gave its judgment in Schrems II on 16th July, 2020. It will be necessary

later in this judgment to refer to certain aspects of the judgment in Schrems II in more detail.
It is sufficient for the purpose of this factual background to refer to some of those aspects.
Although the questions referred by the High Court for preliminary ruling by the CJEU wereposed by reference to the provisions of the Directive, as the Directive was repealed andreplaced by the GDPR with effect from 25th May, 2018, before the DPC had adopted a final
decision on Mr. Schrems’ complaint, the CJEU decided that the questions referred by theHigh Court had to be answered in light of the provisions of the GDPR rather than those of the
Directive.
28.

Among the conclusions and rulings made by the CJEU were the following:(1)Articles 46(1) and 46(2)(c) of the GDPR had to be interpreted as meaning thatthe appropriate safeguards, enforceable rights and effective legal remedies
required by those provisions must ensure that data subjects whose personal
data are transferred to a third country pursuant to standard data protection
clauses (SCCs) are afforded a level of protection “essentially equivalent tothat guaranteed within the European Union by [the GDPR], read in the lightof the Charter”. The CJEU held that to that end, the assessment of the level ofprotection afforded must take into consideration the contractual clauses
agreed between the controller or processor established in the EU and the14recipient of the transfer established in the third country and, with regard toaccess by the public authorities of the third country to the personal datatransferred, the relevant aspects of the legal system of that country, including
those set out in Article 45(2) of the GDPR (para. 105).
(2)

Articles 58(2)(f) and (j) of the GDPR had to be interpreted as meaning that,unless there is a valid Commission adequacy decision (under Article 45(3)),
the competent supervisory authority is required to suspend or prohibit atransfer of data to a third country which is made pursuant to SCCs adopted by
the European Commission if, in the view of the supervisory authority and inlight of all of the circumstances of the transfer, the SCCs are not or cannot becomplied with in the third country and the protection of the data transferredwhich is required by EU law ( and, in particular, by Articles 45 and 46 of the
GDPR and by the Charter) cannot be ensured by other means, where thecontroller or processor has not itself suspended or ended the transfer (para.
121).

(3)

SCCs are not capable of binding the authorities in the third country, as they
are not parties to the relevant contracts (para. 125). Depending on the law andpractices in force in the relevant third country, the recipient of a transfer of
personal data from a controller or processor established in the EU may be in aposition to guarantee the necessary protection of the data solely on the basisof the SCCs but, in other cases, the SCCs might not constitute a sufficientmeans of ensuring, in practice, the effective protection of personal datatransferred to the relevant third country. The CJEU held that that was the casewhere the law of the third country allows its public authorities to interferewith the rights of the data subjects to which the data relates (para. 126).

15
Having considered the relevant provisions of the GDPR, the CJEU held that it
was for the controller or processor to verify on a case by case basis whether
the law of the relevant third country ensured adequate protection under EU
law of the personal data transferred pursuant to the SCCs by providing, where
necessary, additional safeguards (para. 134). The Court held that where thecontroller or processor established in the EU is not able to take “adequate
additional measures to guarantee such protection”, it or, failing that, thecompetent supervisory authority, is required to suspend or end the transfer of
personal data to the relevant third country (para. 135).
(4)The CJEU held that the mere fact that the SCCs do not bind the authorities ofthird countries to which personal data may be transferred cannot affect thevalidity of the SCC Decision and that such validity depends on whether, in
accordance with the requirements of Articles 46(1) and 46(2)(c) of the GDPR,
interpreted in the light of Articles 7, 8 and 47 of the Charter, the SCC decision
incorporates “effective mechanisms that make it possible, in practice, toensure compliance with the level of protection required by EU law and thattransfers of personal data pursuant to the clauses of such a decision aresuspended or prohibited in the event of the breach of such clauses or it being
impossible to honour them” (para. 136 and 137). Having reviewed the termsof the SCC Decision, the CJEU held that Article 4 of the SCC Decision, readin the light of recital 5 of the European Commission’s Implementing Decision
2016/2297, supported the view that the SCC Decision did not prevent thecompetent supervisory authority from suspending or prohibiting a transfer of
personal data to a third country pursuant to the SCCs. It held that thecompetent supervisory authority may be required under Articles 58(2)(f) and16(j) of the GDPR to suspend or prohibit such a transfer if, in light of all thecircumstances of the transfer, the SCCs are not or cannot be complied with in
the third country and the protection of the data transferred which is requiredby EU law cannot be ensured by other means, where the controller or aprocessor has not itself suspended or put an end to the transfer (para. 146).
The CJEU held, therefore, that the SCC Decision provides for effective
mechanisms which, in practice, ensure that the transfer of personal data to athird country pursuant to the SCCs in the SCC Decision is suspended or
prohibited where the recipient of the transfer does not comply with thoseclauses or is unable to comply with them and that, therefore, the SCC
Decision, considered in light of Articles 7, 8 and 47 of the Charter, was notinvalid.
(5)

However, the CJEU held that the Privacy Shield Decision was invalid in that,having considered the relevant provisions of the law and practice of the US,
the Court held that, in finding that the US ensured an adequate level ofprotection for personal data transferred from the EU to organisations in the
US under the EU-US Privacy Shield, the European Commission had
disregarded the requirements of Article 45(1) of the GDPR, read in the lightof Articles 7, 8 and 47 of the Charter (paras. 198 and 199). The Privacy
Shield Decision was held, therefore, to be invalid. The CJEU further held thatthe annulment of the Privacy Shield Decision was not liable to create a “legal
vacuum” in light of the provision for derogations contained in Article 49 of
the GDPR. It held that Article 49 set out the conditions under which transfersof personal data to third countries could take place in the absence of an17adequacy decision under Article 45(3) of the GDPR or appropriate safeguards
under Article 46 of the GDPR (such as SCCs) (para. 202).
6. Developments Post Judgment in Schrems II
29.

The judgment of the CJEU in Schrems II was undoubtedly a very significant one. All

parties were agreed on that. In correspondence with Mr. Schrems’ solicitors, Ahern Rudden
Quigley (“ARQ”), after the judgment, the DPC’s solicitors, Philip Lee, described thejudgment as being “transformative of the law as it relates to EU/US data transfers” (letterfrom Philip Lee to ARQ dated 24th July, 2020). That description was repeated in the DPC’s
letter to ARQ dated 10th September, 2020.
30.

The DPC issued a statement on the day of the CJEU judgment which included thefollowing comments:“Reflecting the complexity of many of the legal issues it addresses, the judgment (and,indeed, the case as a whole) has many layers, each of which will require carefulconsideration in the coming days and weeks.

So, while in terms of the points of principle in play, the Court has endorsed the DPC’s
position, it has also ruled that the SCCs transfer mechanism used to transfer data tocountries worldwide is, in principle, valid, although it is clear that, in practice, theapplication of the SCCs transfer mechanism to transfers of personal data to theUnited States is now questionable. This is an issue that will require further andcareful examination, not least because assessments will need to be made on a case bycase basis.

As well as providing clarity on points of substance, today’s judgment also contains
important statements of position relating to matters of process, to include the18allocation of responsibility between data controllers and national supervisory
authorities when it comes to ensuring that the rights of EU citizens are protected in
the context of EU/US data transfers. While noting the Court’s reference to the factthat a supervisory authority could not suspend data transfers while an adequacy
decision – such as Privacy Shield – was in force, the DPC acknowledges the central
role that it, together with its fellow supervisory authorities across the EU, must playin this area. In that regard, we look forward to developing a common position with
our European colleagues to give meaningful and practical effect to today’s
judgment.”
31.

The EDPB (which was established under Article 68 of the GDPR and consists ofrepresentatives of the supervisory authorities in each Member State as well as the European
Data Protection Supervisor) issued a document on 23rd July, 2020 which answered a numberof questions arising from the CJEU’s judgment in Schrems II (the “FAQ document”). It isonly necessary to refer to a few of the questions in the FAQ document. In response to
Question 5 which asked: “I am using SCCs with a data importer in the US, what should I
do?”, the EDPB stated:“The Court found that US law (i.e., Section 702 FISA and EO 12333) does not ensure
an essentially equivalent level of protection.

Whether or not you can transfer personal data on the basis of SCCs will depend on
the result of your assessment, taking into account the circumstances of the transfers,
and supplementary measures you could put in place. The supplementary measures
along with SCCs, following a case-by-case analysis of the circumstances surrounding
the transfer, would have to ensure that U.S. law does not impinge on the adequatelevel of protection they guarantee.

19

If you come to the conclusion that, taking into account the circumstances of thetransfer and possible supplementary measures, appropriate safeguards would not beensured, you are required to suspend or end the transfer of personal data. However, if
you are intending to keep transferring data despite this conclusion, you must notify
your competent [supervisory authority].” (FAQ document, pp. 2-3)32.

Another question (Question 8) asked about whether reliance could be placed on oneof the derogations contained in Article 49 of the GDPR to transfer data to the US. The answer
given was that it is still possible to transfer data from the EEA to the US on the basis ofderogations contained in Article 49 provided that the conditions contained in that Article
apply. The EDPB then addressed transfers based on consent, those necessary for the
performance of a contract between the data subject and the controller and those necessary forimportant reasons of public interest (FAQ document, p. 4).
33.

Question 10 asked: “What kind of supplementary measures can I introduce if I am

using SCCs or BCRs [binding corporate rules] to transfer data to third countries?”. The
answer given was as follows:“The supplementary measures you could envisage where necessary would have to beprovided on a case-by-case basis, taking into account all the circumstances of thetransfer and following the assessment of the law of the third country, in order to check
if it ensures an adequate level of protection. The Court highlighted that it is theprimary responsibility of the data exporter and the data importer to make thisassessment, and to provide necessary supplementary measures.

The EDPB is currently analysing the Court’s judgment to determine the kind of
supplementary measures that could be provided in addition to SCCs or BCRs,

20
whether legal, technical or organisational measures, to transfer data to third
countries where SCCs or BCRs will not provide the sufficient level of guarantees on
their own.

The EDPB is looking further into what these supplementary measures could consist of
and will provide more guidance.” (FAQ document, p. 5)
34.

One of the grounds of challenge advanced by FBI is that the DPC should haveawaited provision of the guidance referred to in response to Question 10 before proceedingwith an inquiry into FBI’s reliance on the SCCs or that, at least, the fact that guidance fromthe EDPB was to be issued was a relevant consideration which ought to have been taken into
account by the DPC when deciding to commence the inquiry and to issue the PDD.
35.

In the period between the date of the CJEU’s judgment in Schrems II (16th July, 2020)

and the date on which the DPC made the PDD and wrote to FBI on 28th August, 2020,
correspondence was exchanged between ARQ, Mr. Schrems’ solicitors, and the DPC andbetween ARQ and FBI’s solicitors, Mason Hayes and Curran (“MHC”). It is necessary totouch on aspects of this correspondence before turning to the PDD.
36.

Following the judgment in Schrems II, Mr. Schrems wrote to the DPC on 20th July,

2020 seeking to ascertain the steps which the DPC proposed taking to resolve his complaint.
In its response on behalf of the DPC on 24th July, 2020, Philip Lee made the comment that
the CJEU’s judgment in Schrems II was “transformative of the law as it relates to EU/US
data transfers”. The letter noted that the procedural means by which the findings of the
CJEU were to be implemented was “not without complexity” and that the parties’ right to due
process had to be respected. Philip Lee further stated that the DPC was “expediting matters to
the greatest possible extent”. ARQ responded on 27th July, 2020 requesting the DPC to takecertain actions immediately, including providing any documentation provided to the DPC by

21
FBI since June, 2013 relevant to Mr. Schrems’ complaint and requesting FBI to clarify thelegal basis on which it was relying for its EU-US data transfers. Philip Lee responded on 10th
August, 2020 noting that the DPC’s consideration of the means by which it would give full
effect to the CJEU’s judgment was being “expedited to the greatest possible extent” and thatthat work was continuing apace.
37.

ARQ also wrote to MHC, FBI’s solicitors, on 5th August, 2020 requesting that FBI

clarify the precise legal basis on which FBI was relying for the EU-US data transfers of Mr.
Schrems’ personal data and requesting a copy of the current SCCs and any other agreement
or supplementary agreement which FBI may be using. It was asserted that FBI was obliged toprovide that information under certain provisions of the GDPR and under the SCCs. Certain
information was also sought in relation to the extent to which Facebook Inc. was subject torelevant provisions of US law. MHC replied on 19th August, 2020 (it seems that similar
questions were directly sent by Mr. Schrems to FBI and were responded to by FBI, althoughthat exchange of correspondence was not exhibited). In response to the request that FBI
clarify the recipients and the legal basis on which FBI was relying for the EU-US datatransfers of Mr. Schrems’ personal data, MHC pointed to a section of FBI’s Data Policy
referring to the sharing of information and the transfer of data as part of its global services. It
referred to the relevant section of FBI’s Data Policy which noted “among other things, that
one of the core data uses necessary to provide Facebook’s contractual services is ‘totransfer, transmit, store, or process your data outside the EEA, including to within the UnitedStates and other countries’”. I observe, but draw no conclusions from the observation that,
although not expressly referring to one of the derogations contained in Article 49 of the
GDPR, this may have been intended to be a reference to the necessity derogation contained inthat Article. MHC enclosed an extract of the SCCs entered into between FBI and Facebook
Inc. in relation to the transfer of European region user data. MHC declined to furnish the22other information sought in relation to the application of the stated provisions of US law to
Facebook Inc. on the basis that it was contended that that information fell outside the scopeof the Articles of the GDPR relied on in ARQ’s letter. In the final paragraph of the letter,
MHC stated that:“As explained in the ‘How do we operate and transfer data as part of our global
services?’ section of [FBI’s] Data Policy…, information controlled by [FBI] will betransferred or transmitted to, or stored and processed in, the United States or othercountries outside of where your client lives for the purposes described in the data
policy. These data transfers are necessary to provide the services set forth in the
Facebook terms of service and to globally operate and provide these services. If yourclient does not want his personal data to be transferred in the context of providing
and operating the Facebook service, he can delete his account at any time…”
38.

ARQ replied to MHC on 21st August, 2020 asserting that FBI had not explicitly

specified the precise legal basis and the identity of the recipients and jurisdictions to which
FBI sends Mr. Schrems’ personal data. ARQ set out the basis for those assertions and raisedsome further queries, including a query as to the exact processing operations which it is said
were necessary to provide the Facebook service globally. MHC replied on 25th August, 2020
asserting that FBI had already provided Mr. Schrems with all of the information to which he
was entitled under the GDPR and that there was no other reason why Mr. Schrems wasentitled to more information.
7. DPC’s 28 August 2020 Letter and PDD
39.

It appears that while the DPC was in correspondence with ARQ, on behalf of Mr.

Schrems, after the CJEU judgment in Schrems II, in response to correspondence initiated by
Mr. Schrems, there was no correspondence between the DPC and FBI until the DPC’s letter
to FBI dated 28th August, 2020 which enclosed the PDD. That is a critical letter which merits

23
close attention in light of the claims advanced in the proceedings by FBI concerning the PDD
and the procedures adopted by the DPC. I will refer first to the DPC’s letter of 28th August,2020 and will then consider the PDD itself.
(a) DPC’s 28 August 2020 letter40.

In its letter to FBI of 28th August, 2020, the DPC stated that it had given “very carefulconsideration” to how it had to proceed, both generally and more specifically in respect of
Mr. Schrems’ reformulated complaint, in light of the CJEU’s judgment in Schrems II. The
DPC observed that, having considered the judgment and the issues raised, it considered it
appropriate that the DPC would undertake an own-volition inquiry to be conducted pursuant
to s. 110 of the 2018 Act and Article 60 of the GDPR. It stated that, on the conclusion of thatinquiry, the DPC would “in turn, review and consider such further other steps as may berequired to conclude its ongoing investigation into Mr. Schrems’ complaint”. It recorded thatin coming to the decision to commence an inquiry under s. 110, the DPC had regard, amongst
other things, to the following:(i)The fact that Mr. Schrems’ complaint was formulated by reference to the
Directive;(ii)

The contents of and the findings in the CJEU’s judgment in Schrems II;(iii)

The extent to which the analysis contained in the CJEU’s judgment was
conducted by reference to the GDPR; and(iv)

The DPC’s “preliminary view” that data transfers between FBI and Facebook
Inc. involve cross-border processing of personal data relating to users of theFacebook network who are resident in the EU/EEA.

41.

The DPC noted that it had prepared a PDD which was enclosed with the letter. The

stated purpose of the PDD (according to the letter) was “to set out the background and basis
for the inquiry and to identify the issues the subject of the inquiry”, which issues would

24
ultimately have to be determined under the co-decision-making process in Article 60 of the
GDPR. The letter continued:“With a view to assisting FBI in making targeted submissions, the [PDD] sets out the[DPC’s] preliminary views on the issues arising, prior to the formulation of any draft
decision for the purpose of GDPR Article 60. That is to say, the document serves as apreliminary draft of a draft decision which, having first received and considered such
submissions as may be received from FBI, the [DPC] will make for the purposes of
GDPR Article 60.”
The DPC stated that the views set out in the PDD were “as expressly stated therein –preliminary in nature” and it emphasised that “no action will be taken by the [DPC] pursuant
to [the PDD]”.
42.

The DPC invited FBI to submit a response to the issues referred to in the PDD withina period of 28 days from the date of the letter. The DPC acknowledged that:“…FBI may make submissions in relation to any of the factual and legal mattersaddressed in the document, and in relation to the [DPC’s] preliminary view on boththe lawfulness of the actions of FBI in respect of its transfers of users’ data from the
EU/EEA to the United States, and on the question as to whether or not any one ormore of the corrective powers set out in Article 58(2) of the GDPR should be
exercised (and, if so, which such power(s) should be exercised).”43.

The letter then stated that FBI’s response will be “carefully considered” by the DPC,

following which a draft decision will be prepared pursuant to Article 60(3) of the GDPR andissued to the other supervisory authorities (in other Member States). Pausing there for a
moment, the PDD enclosed with the letter was described in the letter as a “preliminary draftof a draft decision”. The “draft decision” is what the DPC said it would prepare, having
considered FBI’s submissions, and that that “draft decision” is what would be issued to the25other supervisory authorities under the Article 60 cooperation and consistency procedure
contained in the GDPR.
44.

The DPC informed FBI that it would notify Mr. Schrems of the inquiry “as it isundoubtedly relevant to the [DPC’s] ongoing investigation into [Mr. Schrems’ complaint]”.
The DPC stated, however, that it was proposing to progress the own-volition inquiry to aconclusion and then review and consider whether any other steps may be required toconclude its ongoing investigation into Mr. Schrems’ complaint. The DPC noted that as theinquiry is an own-volition inquiry, it was not its intention to accept submissions from Mr.
Schrems. I observe here that that position changed under the terms of settlement of the
judicial review proceedings brought by Mr. Schrems. The DPC concluded its letter byreiterating its request for a response from FBI within the 21-day period referred to.
(b) The PDD
45.

The PDD is the prime target and central focus of FBI’s proceedings. FBI does, ofcourse, also challenge the procedures adopted by the DPC and other aspects of the inquirycommenced by the DPC. It is appropriate, therefore, to highlight a number of aspects of the
PDD. It will be necessary to refer to some of these later when considering the grounds ofchallenge maintained by FBI. In that context, it is necessary to consider the PDD as a wholerather than to focus on selected parts or extracts.
46.

In the introduction section of the PDD, the DPC identifies the two purposes of the

document. The first is to notify FBI that the DPC “is commencing” an own volition inquiry
pursuant to s. 110 of the 2018 Act to consider two issues: (1) whether FBI is acting lawfully
and, in particular, in a manner compatible with Article 46(1) of the GDPR in making
transfers of personal data relating to individuals in the EU/EEA using or interacting with
FBI’s services to Facebook Inc. pursuant to SCCs based on clauses set out in the SCC
Decision, following the judgment of the CJEU in Schrems II and (2) whether, and if so,

26
which corrective power should be exercise by the DPC pursuant to Article 58(2) of the
GDPR in the event that the conclusion is reached that FBI is acting unlawfully and infringing
Article 46(1) (PDD, para. 1.2). The second identified purpose of the PDD is to set out “thebackground and basis for the inquiry” and to present the DPC’s (Ms. Dixon being the soledecision maker of the DPC in this context) “preliminary view” on the issues arising prior to
the formulation of a “draft decision” for the purposes of Article 60 of the GDPR. It is statedthat the PDD “serves as a preliminary draft of a draft decision which, having first received
and considered such submissions as may be received from FBI, the [DPC] will make for the
purposes of GDPR Article 60”. That is why the document is described as a “preliminary
draft decision” or PDD (para. 1.3).
47.

Paragraph 1.4 of the PDD states that the inquiry and the PDD arise in the context of

the judgment in Schrems II and the DPC Proceedings in which, the PDD notes, “multiple
parties participated, voluminous factual and expert evidence was adduced, and extensive
legal submissions were made” (para. 1.4).
48.

At para. 1.5, the PDD states that the document comprises “a preliminary view only”

and that “no action will be taken by the [DPC] pursuant to its contents”. At para. 1.6, the
PDD states:“Rather, as already indicated, the purpose of the document is to inform FBI that theinquiry is being commenced, to set out the background and basis for conducting theinquiry, and to indicate [the DPC’s] preliminary views, in order to assist FBI inmaking targeted submissions to the [DPC] in the inquiry on the issues arising.” (para.
1.6)
49.

At para. 1.7 of the PDD, it was proposed that FBI would be afforded a period of 21days from the date of the PDD to submit its response to the PDD. The PDD states that that
period appeared to the DPC to be reasonable given that the judgment in Schrems II was27
delivered on 16th July, 2020 and given that FBI had “a great deal of familiarity” with theissues arising (para. 1.7). The PDD states (at para. 1.8) that the DPC would then “carefully
consider” FBI’s response. It then states (at para. 1.9) that the DPC would issue a “draft
decision” pursuant to Article 60(3) of the GDPR and it was the DPC’s “preliminary andprovisional view” that the processing of personal data at issue involved “cross-borderprocessing” (para. 1.9).
50.

At para. 1.10, the PDD states:“The contents of such a draft decision will necessarily reflect this present [PDD],
FBI’s submissions in response thereto, and my careful consideration of same. In thisregard, I wish to emphasise that it is acknowledged that FBI may wish to makesubmissions in relation to any of the factual and legal matters arising in this [PDD],
and in relation to my preliminary view on both the lawfulness of FBI’s actions inmaking the data transfers and on any corrective power to be exercised by the [DPC].”(para. 1.10)

51.

At para. 1.11, the PDD states:“Consequently, this [PDD] preserves in full FBI’s right to make such submissions as
it may wish and ensures that I will have an opportunity to give full consideration to
any such submissions in due course.”

52.

The PDD contains a summary at paras. 1.12 to 1.13. At para. 1.12, it states for thereasons set out below and “subject to such submissions as FBI may make”, the DPC’s“preliminary view” is that, given the CJEU’s findings in Schrems II and “all of thecircumstances of which the [DPC] is aware”:(1)The data transfers at issue are made in circumstances which fail to guarantee alevel of protection to data subjects which is “essentially equivalent” to thatprovided by EU law and, in particular, by the GDPR read in light of the28Charter and that, in making those transfers, FBI is infringing Article 46(1) of
the GDPR; and(2)

The DPC is, therefore, considering proposing that the data transfer should besuspended pursuant to its powers under Article 58(2)(j).

53.

At para. 1.13, the PDD states that the DPC will notify Mr. Schrems of the inquiry “asit is undoubtedly relevant to the [DPC’s] ongoing investigation” into Mr. Schrems’ complaint
and that the DPC was proposing to progress the inquiry to a conclusion and, at that point,consider further or other steps which may be required to conclude the investigation into thecomplaint and that it was not the DPC’s intention to accept submissions from Mr. Schrems in
the course of the inquiry (as noted earlier, that position has changed in light of the settlementof Mr. Schrems’ proceedings). It was also stated that the DPC would notify the EDPB thatthe DPC had commenced the inquiry.
54.

At paras. 1.14 to 1.25, the PDD identifies the sources and materials considered by the

DPC. At para. 1.14, the PDD states that, in commencing the inquiry and in reaching the“preliminary view”, the DPC has had regard to a range of material including, of course, thejudgment in Schrems II. Reference is also made to the provisions of Articles 13 and 14 of the
GDPR and to the transparency obligations which the DPC asserts FBI is under and also to theTransparency Guidelines adopted by the Article 29 Working Party. In light of the asserted
transparency obligations, it is noted, at para. 1.21 of the PDD, that the DPC consulted theinformation made available to users on the Facebook website in its Data Policy andFacebook’s Transparency Report and its Statement of Rights and Responsibilities (the“SRR”) (paras. 1.21-1.22). At para. 1.23, it is stated that the DPC also had regard to evidence
adduced and the submissions made in the DPC Proceedings and to the findings in the
judgment of the High Court (Costello J.). It lists a number of the affidavits sworn on behalf of
FBI in those proceedings (para. 1.23). At para. 1.24, the PDD states that the DPC also had

29regard to Data Transfer and Processing Agreements between FBI and Facebook Inc. from2015 and 2018.
55.

At para. 1.25, the PDD states:“Obviously, the affidavits referenced above were delivered some four years ago at
this point. FBI will of course have an opportunity to direct me to any additional
and/or updated factual material to which I ought to have regard when submitting its
response, and I will, of course, have regard to same.”

56.

The PDD then provides a detailed factual and procedural background to the CJEU’s

judgment in Schrems II and to the inquiry (paras. 2.1 to 2.41). It sets out the DPC’s functions
and powers relevant to the inquiry (paras. 3.1 to 3.24). There is then a section on the DPC’s
position as the lead supervisory authority under the GDPR (paras. 4.1 to 4.21) in which
certain “preliminary views” of the DPC are set out, which are expressly stated to be “subject
to such submissions as FBI may make” (para. 4.1), concerning the issues as to whether thedata transfers involve “cross-border processing” and whether the DPC is to be considered
the “lead supervisory authority” in respect of the data transfers.
57.

The PDD then sets out (at paras. 5.1 to 5.34) what the DPC has identified as the legal

provisions relevant to EU-US data transfers. In that context, it refers to certain provisions of
the Charter (including Articles 7, 8 and 47), the SCC Decision and the SCCs annexed to that
Decision.
58.

At paras. 6.1 to 6.7, the PDD sets out what the DPC considers to be the “current

factual position relating to the data transfers”. At para. 6.1 of the PDD, it is stated that:“It appears to be clear that FBI makes the data transfers and that it does so pursuant
to SCCs.”
Reference in that context is made to the Data Policy and to the statement there that FBI uses
SCCs. I would observe that there is also a reference in the Data Policy to the data transfers

30
being “necessary to provide the services set forth in the Facebook terms…, and to globally
operate and provide our products to you”. FBI asserted at the hearing that this is a reference
to one of the derogations contained in Article 49(1) of the GDPR, namely, the derogation
contained in Article 49(1)(b) where the transfer is “necessary for the performance of acontract between the data subject and the controller…”.
59.

At para. 6.3 of the PDD, reference is made to SCCs and to a hyperlink in the Data

Policy to a webpage containing an explanation of SCCs, where it is said that whentransferring data from the EEA for processing in a territory outside the EEA which does nothave the same statutory levels of data protection as the EEA, FBI utilises the SCCs approvedby the European Commission “in order to ensure that your data has equivalent levels ofprotection”. At para. 6.5, the PDD states:“It is clear therefore from the data policy that, as a matter of fact, the data transfers
are taking place pursuant to the SCCs.”
60.

Reference is made at para. 6.6 to a statement published by FBI on its platform on 17th

August, 2020 to the effect that in light of the judgment in Schrems II, FBI “intends to utilise
SCCs to effect the transfer of certain other categories of personal data from the EU/EEA tothe US that, up to now, were the subject of transfers to the US effected under Privacy Shield”.
At para. 6.17, the PDD states that “as a matter of fact, it appears that: (1) FBI makes thedata transfers pursuant to the SCCs; (2) FBI complies with US law, and this includes
complying with access requests made by the US Government when such access requests are
made in accordance with US law”.
61.

Section 7 of the PDD sets out the DPC’s “preliminary view on the lawfulness of thetransfers” (paras. 7.1 to 7.66). At para. 7.1, the PDD notes that a number of the findings in
the CJEU’s judgment in Schrems II “are critical both in respect of the framework that I must
adopt when assessing the lawfulness of the data transfers and in respect of the substance of

31that assessment itself”. There is then a discussion of certain of the provisions of the GDPR
and the judgment of the CJEU. At para. 7.18 of the PDD, the DPC provides a summary of theframework for its assessment of the lawfulness of the data transfers on a preliminary basis.
Paragraph 7.18 provides as follows:“In summary, therefore, arising from these findings in the judgment, it appears to me– subject to such submissions as FBI may make – that I must consider:(1)

Whether US law provides a level of protection that is essentiallyequivalent to that provided by the GDPR, read in light of thefundamental rights in the Charter;(2)

If not, whether the SCCs can compensate for any inadequacies in theprotection afforded by US law; and(3)

If not, whether there are any supplemental measures in place which
can compensate for any inadequacies in the protection afforded by US
law.”

62.

In considering whether US law provides an essentially equivalent level of protection

to that provided by the GDPR (paras. 7.19-7.49), the PDD notes that the judgment in Schrems
II makes a number of findings which are binding on the DPC and reference is also made tofindings of fact as to US law made by the High Court (Costello J.), which it is stated wereendorsed by the Supreme Court and accepted by the CJEU (paras. 7.19-7.21). In the summary
at the end of that part of the PDD, the following is said (at paras. 7.48-7.49):“7.48 I am obviously bound by the detailed analysis and accompanying findings of
the CJEU in the judgment.

7.49

I am therefore bound to conclude that US law does not provide a level ofprotection that is essentially equivalent to that provided by the EU law.”

32
63.

The PDD then considers “whether the SCCs can remedy the inadequate protection

afforded by US law” (paras. 7.50-7.60). At para. 7.51, the PDD states that it appears to the
DPC that “in this respect also, the issue has already been determined by the CJEU” in its
judgment in Schrems II. Paragraph 7.52 of the PDD refers to what is termed a “criticalfinding” of the CJEU at para. 126 of its judgment. At para. 7.53 the PDD notes that the CJEU
has “clearly found” that, in circumstances where the law of a third country allows its publicauthorities to interfere with the rights of the data subjects to which the data relate “SCCs will
not suffice to guarantee the necessary protection of the data” (para. 7.53). Then, at para.
7.54, the PDD states:“Given that the CJEU found that US law interferes with the rights of data subjects
under Articles 7, 8 and 47 of the Charter…, it necessarily follows that SCCs cannot
compensate for the inadequacies in the level of protection afforded by US law.”64.

At para. 7.55, it is stated that given the “clear findings of the CJEU”, it did not appear

to the DPC to be necessary to analyse that issue further. The PDD goes on to state (at para.
7.56) that even if the CJEU had not made the finding at para. 126 of its judgment, “it isobvious that the SCCs cannot address inadequacies of the protection afforded by US law”.
Then at para. 7.60, the PDD states:“Accordingly, it is my preliminary view – subject to such submissions as FBI may
make – that the SCCs cannot compensate for the inadequate level of protection
provided by US law.”
65.

The PDD then considers “whether there are supplemental measures that could

address the inadequate protection provided by US law” (at paras. 7.61-7.64). At para. 7.61 of
the PDD, it is stated that the DPC is “not aware of any supplemental measures adopted by
FBI which would address the inadequate protection provided by EU law”. It is noted (atpara. 7.62) that “no such measures are identified in the Data Policy or the SRR” as, it is33
observed, would be expected, having regard to the requirements of Articles 13 and 14 of the
GDPR.
66.

The PDD provides a summary of the DPC’s preliminary views in respect of thematters referred to at para. 7.18, at para. 7.65 which states as follows:“In summary, therefore, it is my preliminary view – subject to such submissions as
FBI may make – that:(1)

US law does not provide a level of protection that is essentiallyequivalent to that provided by EU law;

(2)

SCCs cannot compensate for the inadequate protection provided by
US law; and(3)

FBI does not appear to have in place any supplemental measures
which would compensate for the inadequate protection provided by
US law.”

67.

The PDD then states (at para. 7.66) that in making the data transfers at issue, “itappears to me, subject to such submissions as FBI may make, that FBI is infringing GDPR
Article 46(1)”.
68.

The PDD then sets out in s. 8 the DPC’s “preliminary view on appropriate corrective

power”. At para. 8.1, it states that, in its judgment in Schrems II, the CJEU has provided“very clear guidance”. The PDD then addresses the “obligation of an EU controller orprocessor to suspend EU/US data transfers” and refers to para. 135 of the CJEU’s judgment
in Schrems II and para. 144 of the Advocate General’s Opinion. At para. 8.5 of the PDD, it isstated that “it is only where the EU controller fails to guarantee the required protection, thatthe supervisory authority is required to take action”. Then, at para. 8.6, the PDD states:“…I have afforded FBI a period of 21 days from the date hereof in which to makesubmissions. If, contrary to the preliminary views expressed herein, it is the position

34
of FBI and Facebook that the legislation of the US enables Facebook to comply with
the SCCs, I would ask FBI to set out, in particular, in the context of its submissions,the basis upon which it, and Facebook, maintain that position, and the basis uponwhich they have verified that the level of protection required by EU law is respectedin the US.”69.

The PDD then considers (at paras. 8.7-8.16) the issue of “corrective power” and notes(at para. 8.7) that in the event that the DPC maintains its “preliminary view” following
consideration of FBI’s submissions and in the event that the data transfers are not suspended
or ended by FBI, the DPC has a range of corrective powers under Article 58(2) of the GPDR.
The PDD says (at para. 8.8) that the “clear preference” of the CJEU is for a supervisory
authority (such as the DPC) to suspend or end unlawful data transfers. Reference is thenmade in the subsequent paragraphs to parts of the judgment of the CJEU in Schrems II. The
PDD then states (at para. 8.13) that given the “clear terms” of the CJEU’s judgment and thecircumstances of the data transfers, and having considered Article 83(2) of the GDPR, it
appears to the DPC “subject to such submissions as FBI may make, that a suspension of datatransfers would likely be appropriate” (para. 8.13).
70.

A number of matters considered relevant by the DPC in that regard are set out at para.

8.14. At para. 8.15 of the PDD, it is stated that in the event that the DPC maintains its“preliminary view” that FBI is infringing Article 46(1) of the GDPR in making the datatransfers and “subject to such submissions as FBI may make”, the DPC would regard it asappropriate to propose suspension of the data transfers under Article 58(2)(j). At para. 8.16, itis stated that suspension appeared to be a “proportionate response in all the circumstances”
and that the DPC would not propose imposing a ban on the data transfers as it may bepossible that measures could be adopted by FBI to address the deficiencies identified earlier
in the PDD.

35
71.

Finally, the PDD sets out at s. 9 the “next steps”. At para. 9.10, it is stated that the

PDD involves “a preliminary view only and is subject to such submissions as FBI may
make”. The PDD invited submissions from FBI within 21 days (i.e. by 5.00pm on 18th
September, 2020) (para. 9.2). Paragraph 9.3 states that the DPC will “carefully consider
FBI’s submissions” and issue a “draft decision” pursuant to Article 60(3) of the GDPR.
Reference is then made in the following paragraphs (paras. 9.4 to 9.11) to the process under
Article 60 of the GDPR which requires the DPC to circulate a draft decision to othersupervisory authorities concerned by the processing of personal data (within the meaning of
Article 4(22) of the GDPR) for their opinion and to take due account of their views.
8. Correspondence Post the DPC’s 28 August 2020 Letter and PDD
72.

Immediately on receipt of the DPC’s letter of 28th August, 2020 and the PDD, MHC

sent an email to the DPC that same day raising an issue concerning the confidentiality ofmaterial relating to FBI held by the DPC. FBI was concerned to ascertain what information
the DPC intended to provide, or had already provided, to Mr. Schrems. The DPC replied on
31st August, 2020. In that letter, the DPC stated that the PDD had not been shared with Mr.
Schrems or with the organisation in which he is involved and that it was not intended to sharethe document with them. However, it was stated that as the inquiry was “clearly relevant” to
the DPC’s ongoing consideration of Mr. Schrems’ reformulated complaint, Mr. Schrems had
been notified of a number of “basic matters”, namely:“-

The fact of the present inquiry and the issues now under examination;-

The fact that the [DPC’s] preliminary views have been put to [FBI], and that
[FBI] has been invited to make submissions within a defined time period of 21days; and,

36-

The fact that, on receipt of such submissions, their contents will be carefully
considered, and a draft decision prepared and submitted to the procedureprovided for by GDPR Article 60.”73.

It was stated that the context in which the information was provided to Mr. Schrems

had also been outlined to him and that the information provided was confidential and should
not be disclosed to any third party. It was further stated that the EDPB had been informed ofcertain matters, although that position was subsequently corrected in subsequent letters from
Philip Lee to MHC dated 4th November, 2020 and 11th November, 2020.
74.

In its letter to Mr. Schrems dated 31st August, 2020, the DPC referred to its decision

to commence the inquiry to consider the two issues referred to in the DPC’s letter to FBI of
28th August, 2020 and in the PDD and noted that the DPC had set out its “preliminary views”
on those issues. The letter stated that FBI had been invited to submit its written response
within 21 days and that that response would be “carefully considered” by the DPC following
which a “draft decision” would be prepared under Article 60(3) of the GDPR and issued tothe other supervisory authorities concerned. The letter then stated:“It is anticipated that a draft decision will be submitted to the Article 60 procedure
within a period of 21 days of receipt of the above referenced submissions from FBI.”It was further stated that the DPC would “in turn, review and consider such further or othersteps as may be required to conclude its ongoing investigation into your complaint”. The
DPC informed Mr. Schrems that it was not intended to call for further submissions him, thatthe DPC would “review and, if necessary, determine [Mr. Schrems’] complaint following thecompletion of the inquiry described above” and that Mr. Schrems would be given an
opportunity to make a submission to the DPC at that point prior to the determination of hiscomplaint. The letter concluded by acknowledging that the inquiry described in the letter was
relevant to the DPC’s ongoing handling of Mr. Schrems’ complaint.

37
75.

The DPC did not inform MHC that it had told Mr. Schrems, in the letter of 31st

August, 2020, that the DPC “anticipated” that a draft decision would be submitted to the
Article 60 procedure within 21 days of receipt of FBI’s submissions. The failure to do so wasrelied upon by FBI in support of a number of the grounds of challenge advanced by it in theproceedings.
76.

MHC wrote to the DPC on 1st September, 2020 in response to the DPC’s letter of 28th

August, 2020 and the PDD. The letter expressed surprise at the procedure which the DPC
was planning to adopt in the proposed inquiry and at the fact that the DPC had alreadyreached “preliminary conclusions” before factual or legal submissions had been sought from
FBI. It was contended that that appeared to depart from the DPC’s “published approach tostatutory inquiries and the actual approach which [the DPC had] adopted in other inquiries
to date”. It noted that this was the first opportunity which FBI had to correspond with the
DPC on the matter since the CJEU’s judgment in Schrems II which had made “a number ofnovel and complex findings” in respect of which neither the EDPB nor the DPC had set out
any guidance “as to what supplemental measures should be adopted to support data transfers
pursuant to SCCs”. The letter than stated that should the final decision reached in the inquiry
reflect the views and conclusions set out in the PDD, it was likely to have “very significant
implications” for FBI including “potentially its ability to provide its services” and was also
likely to be the case for many other data exporters.
77.

The letter then addressed the timeframe within which submissions were requested by

the DPC from FBI as follows:“Whilst our client appreciates the need for your office to address the judgment in an
appropriate and timely manner, in light of the above [FBI] cannot reasonably be
expected to be in a position to respond in any meaningful way within the three-weektimeframe provided. This is especially true given that [FBI], like all other data

38
exporters currently relying on SCCs, still awaits further regulatory guidance on thisissue following the judgment (which it had understood to be forthcoming).”
Reference was made in that context to the FAQ document issued by the EDPB following the
judgment in Schrems II. An issue arises in the proceedings as to whether this statement
amounted to a request on behalf of FBI for an extension of time to put in its submissions andthat is an issue which I consider later in the judgment.
78.

The letter then suggested that in the “particularly unusual circumstances”, MHC wasproposing a telephone conversation between the DPC and FBI to discuss the “preliminary
conclusions” and the DPC’s “expectations” of FBI in response. The letter concluded bynoting that FBI would have to consider and take advice in relation to all of the options open
to it in respect of the inquiry and in respect of the DPC’s decision to prepare the PDD at thatstage and that it was reserving all of its rights in that regard. The letter noted that FBI was not
to be taken as agreeing to or acquiescing in anything set out in the DPC’s letter of 28th
August, 2020 or in the PDD.
79.

The DPC replied to MHC on 3rd September, 2020. With regard to the procedures

adopted by the DPC in the inquiry, the DPC referred to s. 110(1) and s. 12(8) of the 2018 Act
and to the discretion of the DPC in relation to the format of the inquiry and in relation to its
procedures. It was stated that the DPC had not adopted a “‘published approach’ comprising afixed set of procedures which are in turn applied, rigidly and uniformly, in all statutory
inquiries” and that the DPC was satisfied that the procedure being adopted was “entirely
appropriate”.
80.

The letter than addressed the “preliminary views” expressed by the DPC in the PDD

and disputed the characterisation of those views as being “conclusions”. The letter stated:“As will be clear from the contents of the [PDD], no conclusions have been drawn by
the [DPC] at this point. On the contrary, the document makes clear that, by its

39
expression of its views on a preliminary basis, the [DPC] had provided [FBI] with areference point against which it may make targeted submissions on all such matters offact and/or law as it considers relevant to the issues under examination in the inquiry.
The [DPC] will carefully consider such submissions and, thereafter, will prepare a
draft decision for submission to the process provided for at GDPR Article 60.”
81.

FBI takes issue with the request in the letter for “targeted submissions” which

repeated similar references in the DPC’s letter of 28th August, 2020 and in the PDD itself. It
suggests that the use of that term indicates a frame of mind on the part of the DPC which
devalues or diminishes the extent of the submissions which the DPC was expecting to receiveand reinforces the complaints made by FBI in the proceedings of premature judgment andother breaches of fair procedures by the DPC.
82.

Under the heading “Regulatory Guidance” in the letter of 3rd September, 2020, theDPC rejected the contention that it was necessary for the DPC to await publication of
guidance by the EDPB or by the DPC itself in relation to the judgment in Schrems II before
the DPC could formulate its own position. In that context, the DPC asserted that FBI had
published material updating its users and customers in relation to its transfer arrangements
and made no reference in that material to FBI’s reliance or intended reliance on additional or
supplementary measures to the SCCs. The DPC further contended that the CJEU had clearly
identified the obligations imposed on parties engaging in transfers of personal data under
SCCs and that compliance with those obligations was not contingent upon the publication of
guidance in relation to the CJEU’s judgment. The DPC asserted that the “timing of
publications of guidelines by the EDPB” was not of relevance “in the present context”.
Again, FBI takes issue with the approach taken by the DPC in this letter and contends that not
only was the timing of the publication of guidance by the EDPB relevant, but that the DPC

40
ought to have awaited publication of that guidance before commencing and proceeding with
the inquiry.
83.

The DPC then addressed in the letter of the 3rd September, 2020 the assertion by FBI

that it could not reasonably be expected to respond to the PDD in any meaningful way within
the three-week period set out in the PDD. The DPC referred to the proceedings which
culminated in the CJEU’s judgment in Schrems II and to FBI’s active participation in those
proceedings. The DPC stated:“It remains the firm view of the [DPC] that [FBI] should be in a position to furnish its
submissions within a period of three weeks.”
84.

The DPC also rejected the contention that the timing of the publication of guidelines

by the EDPB was relevant to the timing of FBI’s submissions. FBI contends that the
timeframe provided for responding to the PDD was inadequate for several reasons andcontends that it requested an extension of time which was refused by the DPC. The DPC
maintains that the time period provided was adequate in all the circumstances, that FBI did
not seek an extension of time and that the DPC did not refuse any such extension. That was
an issue between the parties at the hearing which I address below. I observe at this point thatthe position of the DPC did shift significantly on this issue at the hearing to such an extent
that the DPC confirmed through its counsel that, in the event that FBI was unsuccessful inchallenging the PDD and the procedures for the inquiry, the three-week period would only
start to run from the date of the resumption of the inquiry and that the DPC would consider areasoned request for further time by FBI.
85.

The DPC declined the request for a telephone conference and stated that FBI’s

submission should be made in writing and that the procedures required “a level of formality”.
The DPC reiterated in the letter that no “conclusions” had been drawn by the DPC in respectof the matters the subject of the inquiry and that it expected FBI’s response to set out its

41
position by reference to the judgment in Schrems II and the “preliminary views” expressedby the DPC in the PDD. It further reiterated that “having reflected on [FBI’s] submissions”,
the DPC would prepare a “draft decision” for the purposes of the cooperation andconsistency procedure in Article 60 of the GDPR.
86.

The DPC concluded the letter of 3rd September, 2020 by noting the following withrespect to the submissions to be made by FBI:“…It will be open to your client to set out its position on all of those matters of fact
and/or law it considers relevant to the issues under examination in the inquiry.
Equally, and for the avoidance of doubt, it may address such other matters that it
believes bear (or ought to bear) on the [DPC’s] analysis, including issues relating
to… ‘the potential for a significant disruption [FBI’s] business that a suspension may
cause’.”
87.

There was no response from MHC to the DPC letter of 3rd September, 2020.

Correspondence was exchanged between Philip Lee and MHC on 11th and 12th September,
2020, prior to FBI’s application for leave to bring its judicial review proceedings. In its letterof 11th September, 2020, Philip Lee complained about the absence of a pre-action letter. In
response, on 12th September, 2020, MHC sent soft copies of the papers in respect of its
proposed judicial review proceedings in advance of the application for leave which was to bemade on 14th September, 2020. In that letter, MHC stated:“Given the clear position expressed by [the DPC in the letter of 3rd September, 2020]
that no change of approach would be made, no engagement with [FBI] would beentertained and no pause would be placed on the progress of the inquiry, [FBI]reasonably did not consider further correspondence, including a pre-action letter, tobe of value in addressing the serious matters that arise from [the DPC’s] approach.”88.

MHC then stated:-42“If [the DPC] is in fact willing to restart the inquiry in a manner which follows thesteps outlined in the DPC’s Annual Report for 25 May 2018 to 31 December 2018
within timelines which are more appropriate for the multiple complex issues to becovered therein and potential consequences of the corrective measures proposed, or
indeed declines to proceed with the inquiry, [FBI’s] need to proceed with theproceedings is removed.”
The letter further asserted that the DPC had refused to extend the time for FBI to make its
submissions beyond the three-week period (which was to expire on 18th September, 2020).
89.

FBI applied and obtained leave to bring these proceedings from the High Court(Meenan J.) on 14th September, 2020. There was a further exchange of correspondence
between MHC and Philip Lee subsequent to the commencement of the proceedings to which
it will be necessary to refer when dealing with the procedural background.
90.

I should also note that in addition to corresponding with MHC, the DPC was also incorrespondence with ARQ, Mr. Schrems’ solicitors, after the DPC sent its letter of 28th
August, 2020 and the PDD to FBI. I have referred already to the DPC’s letter to Mr. Schrems
dated 31st August, 2020 and to the complaint made by FBI that the DPC informed Mr.
Schrems that it was “anticipated” that the DPC’s “draft decision” would be submitted to the
Article 60 procedure within 21 days of receiving FBI’s submissions. I do not believe that it isnecessary to refer in any detail to the further correspondence exchanged between the DPC
and its solicitors, Philip Lee, and ARQ, as such correspondence is more directly relevant to
Mr. Schrems’ proceedings which have settled. It is fair to say that in that correspondence,
ARQ was pressing the DPC to proceed to deal with Mr. Schrems’ complaint, was taking
issue with the commencement of the own-volition inquiry by the DPC and was contesting theprocedures which the DPC proposed applying to that inquiry which it claimed breached Mr.

43
Schrems’ right to be heard. The DPC rejected those complaints. Mr. Schrems then brought
his own judicial review proceedings.
91.

Meanwhile, as the parties were exchanging correspondence in relation to the PDD, the

EDPB issued a press release on 4th September, 2020 announcing that it had created a task
force to look into complaints filed in the aftermath of the CJEU’s judgment in Schrems II andthat, as a follow-up to the judgment in Schrems II and to the FAQ document, another task
force to “prepare recommendations to assist controllers and processors with their duty toidentify and implement appropriate supplementary measures to ensure adequate protection
when transferring data to third countries”. The Chair of the EDPB was quoted in the press
release as stating that:“…we will prepare recommendations to support controllers and processors
regarding their duty in identifying and implementing appropriate supplementarymeasures of a legal, technical and organizational nature to meet the essential
equivalence standard when transferring personal data to third countries. However,
the implications of the judgment are wide-ranging, and the contexts of data transfers
to third countries very diverse. Therefore, there cannot be a one-size-fits-all, quick fix
solution. Each organisation will need to evaluate its own data processing operations
and transfers and take appropriate measures.”
The announcement of this second task force and the potential timing of the publication of
EDPB guidelines on the issue which the task force was asked to consider is relevant to one of
the grounds of challenge advanced by FBI in the proceedings.
92.

The only further correspondence to which it is necessary to refer at this stage is theexchange of correspondence between MHC and Philip Lee on 9th and 10th November, 2020,
which I touched on earlier. In response to MHC’s letter of 9th November, 2020, Philip Lee
corrected an error in the DPC’s letter to MHC of 31st August, 2020 and clarified that the DPC

44
had not notified the fact of the inquiry, the issues under examination and the fact that a draft
decision would be prepared to the EDPB at that time, but rather it had notified the othersupervisory authorities concerned. Further, in that letter, it was confirmed that John
O’Dwyer, a deputy DPC commissioner, brought the contents of the notice to the attention of
the Chair of the EDPB on 1st September, 2020 in advance of a plenary meeting of that bodyscheduled for the following day and the contents of the notice were in turn brought to theattention of the plenary meeting of EDPB on 2nd September, 2020.
93.

The relevance of this concerns the timing of the issuance by the EDPB of its

guidance, the relevance of that guidance to the DPC’s commencement of the inquiry and the
DPC’s knowledge of the likely timing of the issuance of the guidance. I have referred earlier
to the press release published by the EDPB on 4th September, 2020 in which it announced
that it had established two task forces, one of which was to prepare recommendations to assist
controllers and processors with their duty to identify and implement appropriate
supplementary measures to ensure adequate protection when transferring data to third
countries.
94.

FBI asserted that the DPC is a member of the EDPB and that it is highly likely that

the Commissioner, Ms. Dixon, was aware of the establishment of the task force. In response,
in its statement of opposition (the facts of which were verified by Ms. Dixon in her affidavit),
it was said that no publication date had been fixed for the publication of guidelines by the
EDPB at the time the PDD was issued and that it was “clear to the [DPC] that publication of
the guidelines was not imminent” (para. 123(3) of the DPC’s statement of opposition). It was
further said that the DPC could not await publication of the EDPB guidelines before carryingout its regulatory functions and duties. At para. 131, it was stated that the DPC was aware, atthe time of the issuing of the PDD, that the EDPB would be issuing guidance but that it was
not aware when the EDPB guidelines would be issued. The relevance of all of this will have45
to be considered when dealing with the particular ground of challenge advanced by FBI
concerning the EDPB guidelines. In advance of the hearing, the Court was informed that the
EDPB published recommendations on 10th November, 2020 entitled “Recommendations
01/2020 on measures that supplement transfer tools to ensure compliance with the EU levelof protection of personal data” (the “EDPB recommendations”). The EDPB
recommendations were put out for public consultation on 10th November, 2020. A copy of
the EDPB recommendations were provided to the Court by agreement of the parties. By thetime the hearing took place in December, 2020/January, 2021, it appears that the consultation
process was ongoing and that no guidelines on the question of supplementary measures were
issued by the EDPB by the time of the hearing, at least. I am not aware as to whether any
such guidelines have since been issued by the EDPB.
95.

Finally, in support of a number of its grounds of challenge, FBI has sought to rely oncomments made by Ms. Dixon in a keynote address which she made at the “Privacy &Security Forum 2020” on 23rd October, 2020. Ms. Dixon made certain comments at thatevent on which FBI seeks to rely in the proceedings. The DPC contends that as thosecomments were made some time after the decision to commence the inquiry was made and
the PDD was issued, they are inadmissible and irrelevant. Nonetheless, the DPC did address
the comments in the course of its oral submissions at the hearing. I will refer in more detail tothe comments made and their potential relevance to the issues in the proceedings when
dealing with the relevant ground of challenge later in the judgment.
96.

The DPC sought to rely on comments made by Nick Clegg, Vice-President of Global

Affairs and Communications at Facebook, on Facebook’s website on 9th September, 2020
and at the “European Business Summit” on 22nd September, 2020 in support of its contention
that FBI’s proceedings were an abuse of process or issued with an improper purpose. That
contention was withdrawn in the course of the DPC’s reply at the hearing. As I conclude

46
when dealing with the point later in the judgment, in my view, there was no basis whatsoever
for the allegation of abuse of process or improper purpose.
9. Procedural Background97.

FBI applied to and obtained leave to bring its judicial review proceedings from theHigh Court (Meenan J.) on 14th September, 2020. Its statement of grounds was supported byan affidavit sworn by Ms. Yvonne Cunnane on 10th September, 2020. The Court ordered that
there be a stay in the taking of any further steps in the inquiry pending the determination of
the proceedings.
98.

On the DPC’s application, the proceedings were entered in the Commercial List on

25th September, 2020. The DPC delivered its statement of opposition on 23rd October, 2020.
It was verified by an affidavit sworn by Ms. Dixon on the same date.
99.

In the meantime, Mr. Schrems obtained leave to bring his judicial review proceedings

from the High Court (Barr J.) on 12th October, 2020. Those proceedings were entered in theCommercial List on 19th October, 2020, on Mr. Schrems’ application. Mr. Schrems applied tobe joined as a notice party to FBI’s proceedings on 14th October, 2020. FBI applied to bejoined as a notice party to Mr. Schrems’ proceedings on 22nd October, 2020. Ultimately, it
was agreed that each of FBI and Mr. Schrems would be joined as a notice party to the other’s
proceedings and orders in those terms were made on 29th October, 2020.
100.

Mr. Schrems delivered a statement of opposition in FBI’s proceedings on 3rd

November, 2020 and swore an affidavit verifying that statement on 5th November, 2020.
101.

Ms. Cunnane swore a replying affidavit on behalf of FBI on 11th November, 2020.

That was the last of the affidavits sworn in these proceedings until a number of further
affidavits were sworn at the direction of the court in the break in the proceedings between 21st
December, 2020 and 13th January, 2021. An affidavit was sworn by Colum Walsh on 23rd
December, 2020 on behalf of the DPC which provided information concerning the number of47complaints based and own-volition inquiries in relation to cross-border processing issues. Mr.
Walsh confirmed that the inquiry the subject of these proceedings is the only cross-borderinquiry commenced by the DPC by means of the issuing of a preliminary draft decision in
substitution for a “notice of commencement of inquiry” letter. A further affidavit was sworn
in response by Ms. Cunnane on 11th January, 2021 and a second affidavit was sworn by Mr.
Walsh on 15th January, 2021 in response to a direction made by the Court on 13th January,
2021. It will be necessary to refer to the information contained in those affidavits when
dealing with a number of the grounds of challenge advanced by FBI.
102.

A further significant development in the proceedings occurred with an exchange ofcorrespondence between MHC and Philip Lee in late October/early November, 2020. MHC
wrote to Philip Lee on 29th October, 2020 seeking certain information, having considered the
DPC’s statement of opposition and Ms. Dixon’s affidavit. MHC asserted that the DPC was
required to provide the information on foot of its duty of candour. In a series of questions set
out in the letter, MHC asked the DPC:(1)Whether the DPC had commenced any inquiries pursuant to s. 110 of the 2018
Act since the publication of the DPC’s 2018 Annual Report that did not
involve a commencement/notification phase, an information gathering/inquiry
phase and a decision-making phase;(2)

Whether the DPC had commenced any other inquiries pursuant to s. 110 of the2018 Act since the publication of the 2018 Annual Report by way of apreliminary draft decision that made (even preliminary) findings ofinfringement of the GDPR and/or that proposed corrective measures;(3)

Whether the DPC had commenced any other inquiries pursuant to s. 110 of the2018 Act where a single person conducted the information gathering/inquiry
and the decision-making phases;

48
(4)

Whether the DPC had commenced any own-volition inquiries into otherregulated entities pursuant to s. 110 of the 2018 Act in relation to EU-US datatransfers following the judgment in Schrems II apart from the present inquiry
involving FBI;(5)

The basis on which it was “anticipated” by the DPC that it would be in aposition to consider and take into account FBI’s submissions in response to the
PDD within 21 days and why that anticipated timing was disclosed to Mr.
Schrems but not to FBI; and(6)

Whether the DPC engaged with the EDPB on the proposed guidance to beissued by that body and the nature of that engagement as well as details as to
the DPC’s understanding concerning the timing of such guidance.

103.

Philip Lee replied on behalf of the DPC on 5th November, 2020. It queried the legal

basis on which the questions were raised by MHC and disputed the contention that thequestions arose from the statement of opposition. It further asserted that FBI had alreadysome of the information sought. Philip Lee asserted that the DPC was satisfied that it hadcomplied fully with its duty of candour and that the information sought was irrelevant to the
PDD and to the matters raised in the proceedings. It then purported to respond to thequestions raised but, in reality, in respect of each question, it merely asserted that the
information sought was not relevant to the issues raised in the proceedings or proceeded on
the basis of an incorrect premise. I would observe at this point that had the information
sought in the MHC letter of 29th October, 2020, at least that summarised at (1) to (3) above,
been provided at the time, it may well have obviated the need for the further affidavits which
the Court directed to be sworn in December, 2020/January, 2021. In my view, it would havebeen much better if the DPC had provided the information sought at the time rather thanmaintaining that it was irrelevant or based on an incorrect premise. It seems to me that most,

49
if not all, of the information sought in the MHC letter of 29th October, 2020 was at least
potentially relevant and ought to have been provided by the DPC. That does not, however,mean that the DPC was in breach of its duty of candour and that is an issue which I consider
later in the judgment.
10. Resolution of Mr. Schrems’ Proceedings
104.

FBI’s proceedings were listed for hearing to commence on 15th December, 2020. Mr.

Schrems’ proceedings were listed to commence on 13th January, 2021. Mr. Schrems
participated fully as a notice party at the hearing of FBI’s proceedings. Submissions weremade on his behalf both in support of and against some of the grounds advanced by FBI.
Shortly before the hearing of Mr. Schrems’ proceedings were to start on 13th January, 2021, I
was informed that those proceedings had settled, subject to an outstanding issue between theparties on the question of costs.
105.

The terms of settlement were set out in a letter from Philip Lee to ARQ dated 12th

January, 2021. Although not directly relevant to the issues which I have to decide in FBI’s
proceedings, the terms on which Mr. Schrems’ proceedings were settled are peripherally
relevant and set out how the DPC intends to proceed, depending on the outcome of FBI’s
proceedings. In brief summary, the Philip Lee letter of 12th January, 2021 noted that Mr.
Schrems’ proceedings were resolved, save as to costs, on the following basis:(1)In the event that the Court decides in FBI’s proceedings that the DPC canproceed with its own-volition inquiry and, subject to the terms of such orders
as may be made in FBI’s proceedings, the DPC will “advance its handling of[Mr. Schrems’] complaint and the own-volition inquiry from the point at
which the Court delivers judgment”. It was agreed that each process would be
progressed thereafter “as expeditiously as possible in accordance with [theDPC’s] obligations under relevant provisions of the GDPR and the 2018 Act”.

50
(2)

If the Court rules that the DPC’s own-volition inquiry may not proceed, or if
the Court rules that it can proceed but an appeal is brought and the Court’sorder is stayed pending such appeal, the DPC will nonetheless advance its
handling of Mr. Schrems’ complaint under and by reference to ss. 109 and 113of the 2018 Act.

(3)

If the Court rules that the DPC’s own-volition inquiry may proceed (and thestay on that inquiry is lifted), the DPC will “hear from” Mr. Schrems in thatinquiry on the terms set out in a letter from Philip Lee to ARQ of 4th
December, 2020. The terms of that letter were reproduced in the Philip Lee
letter of 12th January, 2021. Essentially, Mr. Schrems would be afforded an
opportunity to make submissions to the DPC, initially framed by reference tothe issues set out in the PDD but Mr. Schrems would also be invited to set out
his views in relation to FBI’s submissions in response to the PDD. Mr.
Schrems would also separately retain his right to make submissions as part ofhis reformulated complaint. The parties also agreed to certain disclosure
restrictions.

(4)

There was an agreement that certain materials exchanged between the DPC
and FBI would be made available to Mr. Schrems on agreed terms.

(5)

The parties agreed that the Court would be asked to rule on the issue of costs
in Mr. Schrems’ proceedings once it delivered judgment in FBI’s proceedings.

106.

In their written submissions and at the hearing of the proceedings, the DPC and Mr.

Schrems also agreed to reserve their rights to make submissions in response to any arguments
which might be made by FBI at the hearing of Mr. Schrems proceedings concerning“simultaneous regulatory investigations”. In the event, FBI did not make any oral
submissions on this issue on 13th January, 2021. In light of the terms of settlement agreed

51
between the DPC and Mr. Schrems, to which FBI was not a party, I was informed that FBI
was not inviting me to decide this point and that it was reserving its rights in relation to it. As
requested by Mr. Schrems and the DPC, I adjourned Mr. Schrems’ proceedings for mention
to the date of the delivery of judgment in FBI’s proceedings.
11. Structure for Consideration of the Issues Raised
107.

Having reviewed the pleadings, affidavits and submissions (both written and oral), theissues which I must decide on this application are as follows:(1)I must first consider the preliminary issue as to whether the DPC’s decision toissue the PDD and the procedures which the DPC has decided to adopt in
respect of the inquiry are amendable to judicial review. On the basis that I
conclude that the DPC’s decision to issue the PDD and to adopt theprocedures set out in it and communicated in correspondence to FBI are
amenable to judicial review, I must then consider the further issues set out
below (or at least most of them).

(2)

Whether the DPC failed to carry out an investigation/inquiry prior to reachinga decision in breach of the 2018 Act, the GDPR and the judgment of the CJEU
in Schrems II.

(3)

Whether the PDD and the procedure to be adopted by the DPC is a departurefrom the DPC’s published procedures in breach of FBI’s legitimate
expectations.

(4)

Whether the DPC has breached FBI’s right to fair procedures in the inquiry byaffording FBI a period of three weeks (21 days) to provide its submissions to
the DPC.

(5)

Whether the DPC has breached FBI’s right to fair procedures by reaching apremature judgment on the matters the subject of the inquiry.

52
(6)

Whether the DPC has breached FBI’s right to fair procedures by adopting aprocedure in which the Commissioner (Ms. Dixon) is involved in theinvestigation and is also the sole decision-maker.

(7)

Whether the proposed adoption of a single decision to cover infringement andcorrective measures is ultra vires s. 111 of the 2018 Act.

(8)

Whether the DPC was required to await the recommendations/guidance fromthe EPDB before deciding to proceed with the own-volition inquiry and/or
whether the DPC failed to take into account the timing of the EDPB
recommendations/guidance as a relevant factor in its decision to proceed with
the inquiry.

(9)

Whether in deciding to commence an inquiry with respect to FBI and not otherpersons or bodies involved in EU-US data transfers, the DPC unlawfully
discriminated against FBI and/or breached FBI’s right to equality under Irish
and EU law.

(10)

Whether the DPC acted disproportionality in commencing the own-volition
inquiry involving FBI while its consideration of Mr. Schrems’ complaint was
still ongoing.

(11)

Whether the DPC failed to set out adequate reasons for various decisions
which it has taken in connection with the own-volition inquiry involving FBI,
including its decision to adopt the particular procedure which it decided toadopt notwithstanding its published procedures for inquiries.

(12)

Whether the DPC was in breach of its duty of candour and, if so, what theconsequences of any such breach are.

(13)

Whether the proceedings by FBI are an abuse of process as was originallycontended in the DPC’s statement of opposition (and verified by Ms. Dixon’s

53
affidavit) and submitted in the DPC’s written submissions. It should be notedthat during the course of the hearing, the DPC withdrew its allegations ofabuse of process. It will not, therefore, be necessary to consider and rule on
the substance of the allegation, but it will be necessary to make someobservations in relation to the allegation later in the judgment.
12. Whether PDD/DPC’s Procedure is Amenable to Judicial Review(a) Summary of Parties Positions(1) The DPC
108.

In its statement of opposition, the DPC pleaded, essentially by way of a preliminary

objection, that the PDD was not amenable to judicial review as it was a preliminary document
and made clear that no action would be taken by the DPC pursuant to its contents (para. 4).
The DPC further denied that the Court was entitled to “supervise decisions of a regulator,
such as the [DPC], to commence an inquiry, in particular (and without limitation), given thatthe commencement of the said inquiry does not have any legally cognisable consequences”
and given the terms of the PDD itself (para. 11). At para. 12, the DPC pleaded that“discretionary regulatory decisions” of a regulator, such as the DPC, in deciding whichissues or entities to investigate were not amenable to judicial review and, in the alternative, it
denied that the Court was entitled to supervise such “discretionary regulatory decisions”(para. 12). Finally, in this context, the DPC denied that the Court was entitled to supervise“the investigatory activities of a regulator” such as the DPC (para. 14).
109.

The position adopted by the DPC in its written submissions and in its oral

submissions at the hearing was somewhat less ambitious in terms of the amenability to
judicial review of the PDD and the procedures determined by the DPC for the own-volition
inquiry notified to FBI. In its written submissions, the DPC stressed the preliminary nature of
the PDD which it described as a “preliminary statement of views” and “simply an initiating

54
document in an inquiry process” which is “plainly (and correctly) described as apreliminary draft decision” (para. 50). It submitted that it was well established that courts
should exercise caution when challenges are brought to preliminary decisions and relied inthat regard on Re National Irish Bank (No. 2) [1999] 3 IR 190 (“NIB (No. 2)”), Rowland v.
An Post [2017] 1 IR 355 (“Rowland”) and Louth/Meath Education and Training Board v. The
Quality Tribunal [2016] IESC 40 (“Louth/Meath”). The DPC adopted a similar position in its
oral submissions at the hearing. It did not contend that the process put in place by the DPC asa whole was immune to judicial review. It did, however, contend that the PDD was not adecision susceptible to judicial review as it did not affect or alter legal rights. It relied in thatregard on the express terms of the PDD, including para. 1.5, where it was stated that the
document set out a “preliminary view only” and that “no action will be taken by the [DPC]
pursuant to its contents”. The DPC’s position, therefore, was that the PDD itself was not adecision susceptible to judicial review but that the process, in terms of the procedures for theinquiry determined by the DPC, could be subject to judicial review, although the Court
should be cautious, should be alive to the possibility of endless applications to review theprocess and should only interfere where the process had gone “irremediably wrong” (perClarke J. in Rowland).
(2) FBI110.

FBI’s position, as set out in its written submissions and in the oral submissions at thehearing, was that the decision by the DPC to commence the inquiry and its decision to issue
the PDD are amenable to judicial review and that FBI is entitled to challenge that decisionand the procedures set out by the DPC for the inquiry where FBI contends that the inquiry
was commenced and is intended to be conducted in breach of the provisions of the 2018 Act,in breach of FBI’s legitimate expectations and in breach of its right to fair procedures.

55
111.

FBI submitted that the decision by the DPC to commence the inquiry and to issue the

PDD does have legal consequences both for FBI and for the DPC itself. It relied, inparticular, on the fact that commencement of the inquiry entitles the DPC to exercise
statutory powers under the 2018 Act. It further submitted that unless the DPC could be
persuaded to change its preliminary views, whether by FBI’s submissions or by anothersupervisory authority (under the Article 60 procedure), the views set out in the PDD would
become final. It further submitted that even if legal binding consequences did not flow fromthe PDD itself (which it did not accept), the decision to issue the PDD and the PDD itself
would nonetheless be amenable to judicial review. It relied on Goodman International v.
Hamilton (No. 1) [1992] 2 IR 542 (“Goodman”) and on a dictum of O’Donnell J. in theSupreme Court in Shatter v, Guerin [2019] IESC 9 (“Shatter v. Guerin”) which it issubmitted was to the effect that, since the DPC was performing a function “within the field of
public law”, it was “at least in principle, justiciable” and that it was the source of the powers
exercised by the DPC which was critical rather than the object of those powers. FBI relied on
Article 58(4) of the GDPR and several recitals in the GDPR (such as Recitals (104), (108),(118), (129) and (141)) in support of its contention that FBI had a right to “appropriate
safeguards, including effective judicial review and due process” as set out in EU law and in
the law of Member States, in accordance with the Charter.
112.

FBI further submitted that it could not be required to await the conclusion of theinquiry and the preparation by the DPC of a “draft decision” to be submitted to the Article
60 cooperation and consistency procedure before challenging the decision to commence theinquiry and the procedures set out by the DPC for that inquiry, as it could otherwise be foundto have acquiesced in that decision and in those procedures, as was the case for the applicant
in respect of part of his case in Shatter v. Data Protection Commissioner [2007] IEHC 670(“Shatter v. DPC”). FBI relied on a series of cases including Ryanair v. Labour Court [2007]

56
4 IR 199 and Hooper Dolan v. Financial Services Ombudsman [2011] IEHC 296 in supportof its contention that any objection to the jurisdiction of an administrative decision-maker orto that decision-maker embarking on a decision-making process should be raised at the outsetof the process and before the process was embarked upon. In those circumstances, FBI
submitted that the decision of the DPC to commence the inquiry, to issue the PDD and to
adopt the intended procedures for the inquiry were all amenable to judicial review both as amatter of national law and as a matter of EU law.
(3) Mr. Schrems
113.

Mr. Schrems did not advance submissions on this particular issue, although he did

support some of the grounds of challenge advanced by FBI and brought his own proceedings
in respect of the DPC’s decision to commence the inquiry, to issue the PDD and to adopt theprocedures for the inquiry set out in the PDD and in the correspondence.
(b) Discussion and Decision on this Issue
114.

In order to resolve this preliminary objection raised by the DPC, it is necessary first to

outline the statutory context in which the DPC decided to commence the own-volition inquiry
the subject of these proceedings and to issue the PDD. There is no real dispute about these.
115.

The DPC was established under Part 2 of the 2018 Act and, in particular, under s. 10.

Section 11 provides that the DPC is the supervisory authority within the meaning of, and forthe purposes specified in, the GDPR. Under s. 12, in addition to the functions assigned to the
DPC as the supervisory authority for the purposes of the GDPR, the DPC has other generalfunctions, including functions assigned to it by or under the 2018 Act. Section 12(8) provides
that, subject to the provisions of the 2018 Act, the DPC “shall regulate its own procedures”.
Under s. 14, functions that, immediately before the establishment day under the 2018 Act
were vested in the Data Protection Controller, were transferred to the DPC.

57
116.

Part 6 of the 2018 Act contains the provisions concerning enforcement of the GDPR.

Section 110 of the 2018 Act appears under the heading “Commission may conduct inquiry
into suspected infringement of relevant enactment”. Section 110 provides as follows:“(1)The [DPC], whether for the purpose of section 109 (5)(e), section 113 (2), orof its own volition, may, in order to ascertain whether an infringement has
occurred or is occurring, cause such inquiry as it thinks fit to be conducted forthat purpose.

(2)

The [DPC] may, for the purposes of subsection (1), where it considers it
appropriate to do so, in particular do either or both of the following:(a)cause any of its powers under Chapter 4 (other than section 135) to be
exercised;

(b)
117.

cause an investigation under Chapter 5 to be carried out.”

Section 111 of the 2018 Act is under the heading “Decision of Commission whereinquiry under Chapter 2 conducted of own volition”. Section 111 provides as follows:“(1)Where an inquiry has been conducted of the [DPC’s] own volition, the [DPC],
having considered the information obtained in the inquiry, shall—(a)if satisfied that an infringement by the controller or processor to which
the inquiry relates has occurred or is occurring, make a decision tothat effect, and

(b)

(2)

if not so satisfied, make a decision to that effect.

Where the [DPC] makes a decision under subsection (1)(a), it shall, in
addition, make a decision—

58
(a)

as to whether a corrective power should be exercised in respect of thecontroller or processor concerned, and(b)where it decides to so exercise a corrective power, the corrective
power that is to be exercised.

(3)

The [DPC], where it makes a decision referred to in subsection (2)(b), shall
exercise the corrective power concerned.”118.

In this case, the DPC decided of its own volition to cause an inquiry to be conductedunder s. 110 of the 2018 Act to consider the two issues set out in the PDD, namely:(1)Whether FBI is acting unlawfully and, in particular, in a manner compatible
with Article 46(1) of the GDPR in making transfers of personal data relating
to individuals in the EU/EEA who use or otherwise interact with products andservices provided by FBI to Facebook Inc. pursuant to SCCs based on theclauses set out in the Annex to the SCC Decision, following the judgment of
the CJEU in Schrems II; and(2)

Whether and/or which corrective power should be exercised by the DPC
pursuant to Article 58(2) of the GDPR, in the event that the conclusion isreached that FBI is acting unlawfully and infringing Article 46(1) of the
GDPR.

119.

As stated in the PDD itself and in the DPC’s letter to FBI dated 28th August, 2020, thePDD has two purposes. The first is to notify FBI of the commencement of the own-volition
inquiry to consider those two issues. The second is to set out the “background and basis” forthe inquiry and (perhaps this is a third purpose) to present the “preliminary view” of theCommissioner/Ms. Dixon, as the “sole decision-maker” of the DPC, on the issues arisingprior to the formulation of any “draft decision” for the purposes of Article 60 of the GDPR.

59
As noted earlier, the PDD contains numerous references to the effect that the views set out inthe document are “preliminary”, that the document is a “preliminary draft of a draft
decision” and that “no action will be taken” by the DPC pursuant to the contents of the PDD(see, for example, paras. 1.3, 1.5, 1.6, 1.10 and 1.11 of the PDD, quoted earlier).
120.

It is also necessary, in the context of the DPC’s submission that the PDD itself is not

amenable to judicial review and that the court should be cautious in terms of interfering withthe procedures adopted by the DPC for the inquiry, to refer to a small number of provisionsof the GDPR.
121.

Article 58 of the GDPR sets out the powers of each supervisory authority. Article

58(1) lists the “investigative powers” of a supervisory authority which include (at Article
58(1)(d)) the power to notify a controller or processor of an alleged infringement of the
GDPR. Article 58(2) sets out the “corrective powers” of the supervisory authority. They
include (at Article 58(2)(j)) the power to order the suspension of data flows to a recipient in athird country. Article 58(4) provides:“The exercise of the powers conferred on the supervisory authority pursuant to this
Article shall be subject to appropriate safeguards, including effective judicial remedy
and due process, set out in Union and Member State law in accordance with theCharter.”122.

FBI relies heavily on the provisions of Article 58(4) in support of its contention thatthe decisions of the DPC to commence the own-volition inquiry, to issue the PDD and to
adopt the procedures which it decided to adopt are all amenable to judicial review so as toensure that there are “appropriate safeguards” and that FBI has an “effective judicial
remedy” and “due process”, as set out in EU law and in the law of the Member States, inaccordance with the Charter. In addition to relying on Article 58(4), FBI relies on a numberof the recitals in the GDPR which make reference to the rights of controllers or processors.

60
123.

The most relevant of those Recitals, in this context, are Recitals (118), (129) and(141). Recital (118) makes clear that supervisory authorities under the GDPR (which, ofcourse, includes the DPC) are subject to judicial review and that that does not compromise
their independence. Recital (129), which refers to the investigative and corrective powers ofsupervisory authorities, states that such powers “should be exercised in accordance withappropriate procedural safeguards set out in Union and Member State law…” and refers to
the right of every person to be heard before any individual measure affecting the person istaken. That recital also refers to the availability of judicial review in a relevant Member Statein respect of legally binding decisions of the supervisory authority in that state. Finally,
Recital (141) also refers to the possibility of judicial review in respect of the investigation by
a supervisory authority following a complaint.
124.

It can, at the very least, therefore, be inferred from these provisions of the GDPR thatthe possibility of judicial review of decisions taken by national supervisory authorities(including the DPC) is envisaged and may be required in particular circumstances by the
GDPR. As just noted, Article 58(4) of the GDPR makes express reference in the context ofthe need for “appropriate safeguards” in respect of the exercise of powers by supervisory
authorities to the right to “effective judicial remedy and due process” and to the Charter.
Article 47 of the Charter confers a right, within the field of application of the Charter, to an“effective remedy” before an independent and impartial tribunal.
125.

It will also be recalled that the various decisions of the DPC in connection with thecomplaint originally made by Mr. Schrems were the subject of judicial review, a reference to
the CJEU which led to the judgment of that court in Schrems I and an order of the High Court(Hogan J.) quashing the decision of the DPC to refuse to investigate Mr. Schrems’ complaint
and remitting the complaint to the DPC.

61
126.

It seems to me that I must consider the submission advanced on behalf of the DPC tothe effect that the court should not supervise the exercise of powers by the DPC and should
be cautious about interfering with the exercise of those powers in light of these various
statutory provisions and the provisions of the GDPR.
127.

As I have outlined, the PDD is stated to have two purposes. The first is to notify FBIof the commencement of the inquiry to consider the two issues outlined above. The second is
to set out the background and basis for the inquiry, to set out the Commissioner/DPC’s
preliminary view on those issues and to invite submissions from FBI. FBI maintains that the
DPC is not entitled to commence the inquiry in this way and to adopt the procedures which itis purported to adopt for various reasons, including that the DPC has acted in breach of theprovisions of the 2018 Act and the GDPR and of FBI’s legitimate expectations as to theprocedures which would be followed in the case of any inquiry and that the PDD and theprocedures adopted are in breach of FBI’s right to fair procedures for a number of reasons, aswell as being unlawful in other respects.
128.

I am satisfied that FBI must be entitled to challenge the decision to commence theinquiry and to adopt the procedures for the inquiry which have been set out by the DPC.
Since the DPC’s decision to commence the inquiry is comprised in and notified to FBI by the
PDD, I agree that it is open to FBI to seek judicial review in respect of the PDD itself as wellas asking the court to judicially review the procedures adopted by the DPC. I do not accept
that the court is precluded from doing so on any of the grounds advanced by the DPC in its
pleadings or in its written or oral submissions.
129.

The DPC relies on the statements contained in the PDD to the effect that the

document is intended only to set out the preliminary views of the Commissioner, that noaction will be taken by the DPC pursuant to its contents and that the PDD itself does notaffect or alter legal rights In support of its contention that it should not be amenable to62
judicial review. I do not agree. It is true that the PDD does repeatedly state that the document
is a preliminary draft and that the views set out in the PDD are preliminary views only andthat no action will be taken on foot of the PDD. However, that does not mean that thecommencement of the inquiry and the PDD itself (one of the purposes of which was to notify
FBI of the commencement of the inquiry) do not have legal consequences.
130.

First, as noted above, the commencement of an inquiry by the DPC into suspected

infringement of the GDPR does have legal consequences. Once an inquiry is commenced, theDPC may cause any of its powers under Chapter 4 (other than s. 135) to be exercised and/or
an investigation under Chapter 5 to be carried out (s. 110(2)). Chapter 4 (ss. 129 to 136) of
the 2018 Act provides for a range of powers to be exercised by the DPC, including theappointment of authorised officers, who are given a range of powers, including entry, searchand seizure powers, the entitlement to apply for search warrants and to serve an information
notice requiring certain information from a controller or processor. Chapter 4 creates various
criminal offences to support the DPC and its authorised officers in respect of the powers
contained in that chapter. There are other compulsory powers contained in Chapter 5. The
DPC may cause those powers to be exercised for the purposes of an inquiry which it hascaused to be conducted under s. 110(1) of the 2018 Act. The decision by the DPC tocommence an inquiry and the commencement of that inquiry does, therefore, have legal
consequences in that those compulsory powers to which I have just referred may be exercisedby the DPC for the purposes of such inquiry.
131.

Second, while the PDD itself does not amount to a “draft decision” which the DPC

can submit to the Article 60 cooperation and consistency procedure, unless FBI puts in
submissions and persuades the Commissioner/DPC that the preliminary views contained in
the PDD ought not to be adopted, it is likely that the “draft decision” taken by the DPC willreflect those preliminary views which will, therefore, become the DPC’s final views for the

63
purposes of the “draft decision” submitted to the Article 60 procedure. In circumstanceswhere one of the complaints made by FBI is that the procedures provided for in the PDD,
including the time period within which it was required to put in its submissions were unfair, it
would, in my view, be quite wrong to hold that it was not open to FBI to seek judicial review
in respect of the PDD which set out those procedures. As Meenan J. confirmed in National
Maternity Hospital v. Minister for Health [2019] 1 IR 719 (“NMH”) “judicial review
proceedings are directed against the decision-making process rather than the decision itself”(para. 15, at 724). In this case, in order to challenge the “decision-making process”, FBI has
to be entitled to challenge the PDD itself which, not only commenced the inquiry but which
also set out the process which would ultimately lead to the “draft decision” being submitted
by the DPC to the Article 60 procedure.
132.

There are two further reasons why, in my view, not only the procedures adopted by

the DPC for the purpose of its inquiry but the PDD itself must be open to challenge by
judicial review, leaving aside the merits of the challenge itself.
133.

First, FBI’s challenge to the PDD is somewhat analogous (although not identical) to achallenge to a resolution by the Houses of the Oireachtas to establish a tribunal of inquiry
under the Tribunals of Inquiry (Evidence) Acts. Even though the report of a tribunal does not
impose liabilities or affect rights and its conclusions are, in the often-quoted words of
Costello J. in Goodman (No. 1), “devoid of legal consequences” (at 557) and “sterile of legal
effect” (at 562) and even though, in the words of Finlay C.J. in the Supreme Court in thatcase, the tribunal has no power to inflict a penalty and its determinations cannot “form any
basis for the punishment by any other authority of that person” (at 588) and its function is to“make a finding of fact, in effect, in vacuo, and to report it to the legislature” (at 590),
nonetheless the resolution(s) establishing the tribunal can be challenged in the courts (albeit
unsuccessfully in that case). There are, of course, obvious differences between a resolution

64
establishing a tribunal of inquiry and the DPC’s decision to commence the own-volition
inquiry at issue in these proceedings in the form of the PDD. However, in my view, theanalogy fits and supports the conclusion that even if it were the case that the decision tocommence the inquiry and the PDD itself do not themselves, contrary to the conclusions I
have just reached, affect rights and liabilities, nonetheless they are open to challenge by wayof judicial review.
134.

Second, I agree with FBI that in determining whether a particular decision (or report)

is amenable to judicial review, the “critical test is the source, rather than the object, of theexercise of any powers” and that that is what “justifies the conclusion that the Act isamenable to judicial review” (per O’Donnell J. in Shatter v. Guerin at para. 41). Here, thesource of the power of the DPC to commence the inquiry and to issue the PDD is s. 110 of
the 2018 Act (as well as the provisions of the GDPR, including Articles 57 and 58). The
statutory source of the powers exercised in commencing the inquiry and in issuing the PDD
strongly supports the conclusion that the decision to commence the inquiry and the PDD
itself, which notified FBI of that decision and of the procedures to be adopted, are amenable
to judicial review.
135.

I do not believe that the cases relied on by the DPC provide support for its contention

that the PDD is not amenable to judicial review or that the court should not entertain FBI’schallenge to the decision to commence the inquiry, to the PDD and to the procedures adopted
by the DPC. I will deal with each of those cases in turn.
136.

The first case relied on by the DPC is NIB (No. 2). That was an application made in

the context of an investigation by court appointed inspectors under the Companies Act, 1990
into National Irish Bank Ltd and a related company. They were the applicants in theproceedings which sought to restrict the inspectors from investigating certain matters on
various grounds and to compel the inspectors to provide them with transcripts and65
documentation relating to interviews carried out by the inspectors. The High Court (Kelly J.)
refused to grant the orders sought. In the course of his judgment, Kelly J. observed that to
make orders in the terms sought would “give rise to the possibility of endless applications tothe court asking it to in effect second guess decisions made the inspectors as to what steps
they consider necessary in order to report upon the issues” (at 207). Kelly J. then stated thatthe inspectors “should not have to carry out their duties while constantly looking over theirshoulders at the court in anticipation of decisions made by them in the course of theinvestigation being the subject matter of a form of judicial review” (at 207). Thoseobservations were perfectly appropriate in the context of the applications before the court inthat case (which was not a judicial review). However, that is not what is at issue in thepresent case. Here, FBI is seeking to challenge the commencement of the inquiry and theprocedures adopted by the DPC on various grounds. This application and the issues raised by
FBI cannot fairly be described as one of “endless applications” asking the court to “second
guess” decisions of the DPC. FBI has sought to advance a fundamental challenge to thejurisdiction of the DPC to commence the inquiry in the manner in which it is done and to theprocedures which the DPC has adopted in respect of the inquiry. Nor, I believe, could it besaid that the nature of the challenge advanced by FBI is such that the DPC has been put in aposition where it must “constantly look over [its] shoulders at the court” as was the case in
NIB (No. 2). There is, therefore, in my view, nothing in NIB (No. 2) to support the DPC’s
objections to the amenability of the decisions at issue and the procedures under consideration
to judicial review.
137.

The next case relied upon by the DPC is Rowland. That case involved a disciplinary

process commenced by the defendant into the plaintiff’s conduct as a sub-postmaster. The
plaintiff sought to challenge the procedures being followed by the defendant shortly before anoral hearing was due to take place. He failed in his claim before the High Court on the basis

66that the process was still at an investigative stage and that it was premature to seek an
injunction in respect of the process. The Supreme Court dismissed the appeal. In delivering
the judgment of the Supreme Court, Clarke J. noted that generally procedural problems in a
disciplinary process can be corrected, that there “may well be a significant margin of
appreciation as to the precise procedures to be followed” and that, therefore, it would inmany cases be premature for a court to reach any conclusion on the process until the process
had concluded (para. 12, at 360). However, he acknowledged that there may be a limited
number of cases where, by the time the court is asked to review the process, it is “clear thatthe process has gone irremediably wrong” and that, in such a case, it would be appropriate
for the court to stop the process and save the parties from engaging in “what must necessarily
turn out to be the fruitless exercise of continuing a process whose conclusions if adverse arealmost certain to be quashed” (para. 13, at 361). Clarke J. did, however, state that, in such asituation, the court had to be satisfied that “it is clear that the process has gone wrong, that
there is nothing that can be done to rectify it and that it follows that it is more or lessinevitable that any adverse conclusion reached at the end of the process would be bound to
be unsustainable in law” (para. 14, at 361).
138.

While the DPC relies upon these dicta of Clarke J., I do not think that the decision andprocedures under challenge in the present case are similar to the procedures at issue inRowland. The challenge which FBI has sought to mount against the DPC’s decisions andprocedures in the present case is a fundamental one and goes to the commencement of theinquiry itself, as well as to the procedures adopted by the DPC. In light of the breadth of thechallenge, both to the commencement of the inquiry and to the procedures adopted, it seems
to me that this case must inevitably fall within the limited number of cases where it isappropriate for the court to intervene at an early stage. If FBI is correct in the grounds ofchallenge which it has sought to advance, then it would surely be better to have those grounds

67
considered and determined before the process put in place by the DPC concludes and leads toa “draft decision” being submitted to the Article 60 procedure with all that that entails. If
FBI is correct, this would be a case in which the process went “irremediably wrong” fromthe start. There is also the real risk from FBI’s point of view that a failure to challenge thecommencement of the inquiry and the procedures adopted at this point in time could lead to a
subsequent finding that it had acquiesced in the inquiry and in the procedures. I do not,therefore, believe that there is anything in Rowland which supports the DPC’s submissionthat the Court should not intervene by judicial review at this stage of the process.
139.

Similarly, the decision in Louth/Meath can also be readily distinguished. That caseinvolved an attempt to challenge a decision on jurisdiction in an investigation conducted byan equality officer under the Employment Acts, 1998 to 2004. The High Court dismissed thechallenge and that decision was upheld by the Supreme Court on appeal. The Supreme Court
held that similar principles applied to those applicable in the case of challenges during thecourse of a criminal trial. While such challenges by way of judicial review may, in principle,
be available, they should only be permitted “in truly exceptional circumstances”. The
Supreme Court was not satisfied that it had been established as a matter of probability that theequality officer was not acting with jurisdiction or had exceeded her jurisdiction and that thepresumption that the decision-making process and the decision itself would have due regard
to natural justice and fair procedure had not been dislodged. However, I do not accept that theSupreme Court in that case was attempting to lay down a universal principle to the effect thata challenge to an inquiry such as that commenced by the DPC and to the procedures adopted
must always await the conclusion of the inquiry. It must, in an appropriate case, be open to a
party to challenge the commencement of the inquiry and the procedures adopted where it
seeks to make the fundamental case that there is no jurisdiction to embark on the process andthat, if the proposed procedures were followed, the rights of the party would be irreparably

68
adversely damaged. I do not, therefore, accept that the decision of the Supreme Court in
Louth/Meath supports the submission advanced by the DPC as to the amenability of its
decision to commence the inquiry, the PDD and the procedures to judicial review.
140.

In my view, FBI was faced with a dilemma when considering whether to bring anapplication for leave to bring these proceedings. By applying when it did, it ran the risk thatthe DPC would advance the contention which it has, namely, that the PDD is only apreliminary draft decision and is not amenable to judicial review and that any challenge to theprocedures is premature. If FBI had waited and sought to challenge the commencement of theinquiry, the PDD and the procedures adopted at a later stage, such as when the “draft
decision” was ultimately made by the DPC for submission to the Article 60 procedure, FBI
could well have been found to have left its challenge too late and to have acquiesced in theinquiry and in the procedures and to have waived its entitlement to bring its challenge. That isprecisely what happened in respect of the grounds of challenge in Shatter v. DPC. In thatcase, while the High Court (Meenan J.) held that the DPC had prejudged a central issue in its
investigation into whether the appellant had breached the Data Protection Acts, nonetheless,the appellant was found to have acquiesced in the particular procedure and was precluded
from relying on that aspect of his appeal (paras. 38 to 40). If FBI did not bring theseproceedings when it did, there was a real risk that it might be found to have acquiesced in theinquiry and in the procedures and might well, therefore, have been precluded from advancing
its challenge or some of its grounds of challenge as the appellant was in Shatter v. DPC.
141.

In conclusion, I am satisfied that, as a matter of Irish law and as a matter of EU law(in particular, the provisions of the GDPR and Article 47 of the Charter to which I havereferred), the DPC’s decision to commence the own-volition inquiry into the EU/US datatransfers by FBI to Facebook Inc., the DPC’s decision to issue the PDD and its decision to69
adopt the procedures for the inquiry are all amenable to judicial review and the DPC’scontentions to the contrary must be rejected.
142.

I will now turn to consider each of the grounds of challenge advanced by FBI as wellas the contention made and then withdrawn by the DPC that FBI’s proceedings are an abuseof process.
13. Alleged Failure by DPC to Conduct an Investigation/Inquiry Before Reaching a
Decision(a) Summary of the Parties Positions(1) FBI143.

FBI contends that the DPC has acted in breach of and ultra vires its powers under s.

110 of the 2018 Act, in breach of certain provisions of the GDPR and in breach of a clear
requirement in the CJEU’s judgment in Schrems II to carry out an investigation prior toforming a view as to whether or not a data subject is afforded an adequate level of protection
in a third country, by issuing the PDD (containing the “preliminary views” of the DPC)
without carrying out any inquiry or investigation. It relies on the express terms of s. 110(1) of
the 2018 Act which refer to the power of the DPC “in order to ascertain whether an
infringement has occurred or is occurring” to “cause such inquiry as it thinks fit to be
conducted for that purpose”. FBI asserts that the DPC must actually inquire into relevant
factual and legal matters before reaching a decision. It concludes that that necessarily requires
the DPC to carry out a fact-finding exercise and to obtain submissions from FBI before
reaching a decision. It relies on various definitions of the word “inquiry” in The Oxford
English Dictionary (2nd Ed.) (Volume VII), including the definition of “inquiry” as meaning:“the action, or an act or course, of inquiring” and “the action of seeking, spsp. (now always)
for truth, knowledge, or information concerning something; research, investigation,
examination”.

70
144.

It says that the requirement to carry out such an inquiry before reaching a decision isreinforced by s. 111(1) which refers to the decision to be made by the DPC “where an
inquiry has been conducted” of the DPC’s own commission and “having considered theinformation obtained in the inquiry”.
145.

FBI submitted that the DPC omitted the crucial step of inquiring into or investigating

the relevant factual and legal matters before issuing the PDD and that the opportunity
afforded to FBI in the PDD to make “targeted submissions” on the issues arising was not
sufficient. It pointed to the fact that the DPC did not request any information from or ask anyquestions of FBI before issuing the PDD. It submitted, therefore, that the DPC did not carryout any proper inquiry before taking a decision in the form of the PDD. It drew attention topara. 84(3) of the DPC’s statement of opposition in which the DPC admitted that an“inquiry” involves “a process of gathering information”. However, it should be noted thatpara. 84(3) goes on to state that:“In the absence of any prescribed requirements for an ‘inquiry’ under section 110, it
is expressly pleaded that the process of information gathering can take place in manydifferent ways, provided it complies with the requirements of procedural fairness.”
146.

FBI relied on a number of provisions of the GDPR (which it noted the 2018 Act was

intended to give effect to) which makes express reference to the requirement on the part of asupervisory authority to carry out an investigation. In particular, FBI referred to Recital (122)which refers to the powers of and tasks conferred on a supervisory authority under the GDPR
including “handling complaints lodged by a data subject” and “conducting investigations on
the application of [the GDPR]”. It referred to Article 57(1) which lists the following as
among the tasks given to a supervisory authority:“(f)Handle complaints lodged by a data subject…, and investigate, to the extent
appropriate, the subject matter of the complaint…;

71
(h)

Conduct investigations on the application of this regulation, including on thebasis of information received from another supervisory authority or otherpublic authority;”147.

It also referred to Article 58(1) which lists a number of “investigative powers”

conferred on the supervisory authority including:“(d)To notify the controller or the processor of an alleged infringement of thisregulation;”148.

In addition, FBI relied on certain passages in the judgment of the CJEU in Schrems II

which it said demonstrates that the CJEU envisaged that a supervisory authority, such as theDPC, would have to carry out an investigation into all the circumstances of the data transfers
at issue before reaching a decision. It noted that, at para. 111 of its judgment, the CJEU
referred to Article 58(1) of the GDPR conferring “extensive investigative powers on eachsupervisory authority” and to the obligation on a supervisory authority, if it takes the view
“following an investigation” that a data subject whose personal data has been transferred to athird country is not afforded an adequate level of protection, to take appropriate action to
remedy that inadequacy, thereby highlighting the requirement to carry out an “investigation”.
At para. 112, the CJEU referred to a supervisory authority having to take into consideration“all the circumstances” of the data transfers at issue and, at para. 113, the CJEU referred tothe obligation on the supervisory authority to suspend or prohibit certain data transfers where
it formed the view that “in light of all of the circumstances of [the] transfer”, there wasinadequate protection for the data subject. A similar reference to the requirement on asupervisory authority to suspend or prohibit a data transfer “in light of all the circumstances”
of the transfer is contained in para. 147 of the judgment.
149.

FBI relied on all of these references and to the press release issued by the DPC on thedate of the judgment in Schrems II to the effect that the judgment and the case as a whole

72“will require careful consideration in the coming days and weeks” and that the issue as to theapplication of SCCs in the case of transfers of personal data from the EU to the US “willrequire further and careful examination, not least because assessments will need to be madeon a case by case basis”. FBI submitted that an inquiry meeting the requirements of s. 110 of
the 2018 Act and satisfying the provisions of the GDPR and the judgment of the CJEU in
Schrems II would have to address several issues on which the DPC would have to request
information from FBI, which were set out at para. 42 of Ms. Cunnane’s second affidavit, of
11th November, 2020 including:(a)The EU-US data transfers made by FBI;(b)

FBI’s assessment of the relevant US law following the judgment in Schrems
II;

(c)

The nature and extent of US national security requests made to Facebook Inc.
in practice;(d)FBI’s reliance on the SCCs and “any supplementary measures”;(e)

Article 49 derogations on which FBI relies; and(f)

The effects of any suspension order on FBI and others and the proportionalityof any suspension.

150.

FBI’s position is that the steps taken by the DPC to ascertain the factual and legal

position in relation to the data transfers as set out in the PDD (at paras. 1.21 to 1.24) andreferred to para. 85 of the DPC’s statement of opposition were not sufficient and its
conclusions were factually incorrect (for the reasons stated at para. 41 of Ms. Cunnane’s
second affidavit). FBI gave the example of a factual error allegedly made at para. 5.16 of the
PDD in which it was stated that FBI had never sought to invoke any of the derogations
contained in Article 26(1) of the Directive, being the predecessor to Article 49 of the GDPR.

73
FBI submitted that the DPC knew that FBI was, in fact, relying on derogations and it referredto the FBI’s submission of 22nd January, 2016.
(2) The DPC
151.

The DPC disputes the claim that it has reached a decision or formed any conclusions

in relation to the own-volition inquiry it has commenced. It relies on the terms of the PDD on
foot of which the inquiry was commenced and relies on the express description of the PDD asa “preliminary draft of a draft decision” for the purposes of the Article 60 procedure, that it
contains preliminary views only and that it makes clear that no action would be taken by the
DPC on foot of its contents. It notes that a “draft decision” will be made only after
submissions have been received from FBI and considered by the DPC. The DPC also rejects
the contention that it failed to carry out any investigation before deciding to commence theinquiry and to issue the PDD. It relies on the extensive factual background which preceded
the commencement of the inquiry, extending back to the complaint initially made by Mr.
Schrems in 2013 and running from that date right up to, and subsequent to, the judgment of
the CJEU in Schrems II. The DPC contends that it was perfectly reasonable to commence theown-volition inquiry by issuing the PDD and by expressing preliminary views on the relevant
issues in that document.
152.

The DPC relies on the express terms of s. 110 of the 2018 Act and to the reference ins. 110(1) to the entitlement of the DPC to “cause such inquiry as it thinks fit” to be
conducted. It submitted that there is no statutorily prescribed procedure for the inquiries,
including own-volition inquiries carried out by it (leaving aside for present purposes the
dispute between the parties on whether FBI had a legitimate expectation based on the DPC’s
2018 Annual Report). The DPC stressed that it had invited FBI to make submissions on thefacts and on the law and rejected the contention that the reference to “targeted” submissions

74
in the PDD and in the correspondence was intended in some way to diminish or reduce thesignificance of the submissions being sought from FBI.
153.

As regards the claim that information contained in the PDD was incorrect, the DPC

submitted that it was entitled to rely on information made publicly available by FBI and on
the factual matters set out in the CJEU’s judgment in Schrems II. With regard to FBI’s
complaint that the DPC proceeded on the basis that there were no relevant changes to US law
and practice, the DPC submitted that it was entitled to rely on the judgment in Schrems II andthat it had not been said by FBI subsequent to the judgment that US law and practice hadchanged since then (although I note that counsel for FBI in his reply did mention that there
had been recent changes in law and practice and that the US Government had published awhite paper in September, 2020 setting out various changes, although he accepted that that
information was not on affidavit). Insofar as FBI criticised the DPC for stating in the PDD
that it was not aware of any supplementary measures adopted by FBI which would address
the inadequate protection provided by US law, the DPC referred to publicly available
information and noted that there was no reference to any supplemental measures in FBI’s
Data Policy or in the communication which it issued on 17th August, 2020 after the judgment
in Schrems II.
154.

While accepting that there was no reason why the DPC could not have written to FBI

in seeking information before commencing the inquiry by means of the PDD, the DPC
submitted that it was entitled to proceed as it did and that it was open to FBI to makesubmissions in response to the preliminary views expressed in the PDD and to correct
anything which FBI considered to be inaccurate. It stressed the full entitlement of FBI tomake submissions as recorded in the PDD and in the surrounding correspondence.
(3) Mr. Schrems

75
155.

While Mr. Schrems did not expressly address this issue in his submissions, he didstress the obligations on the part of the DPC to proceed expeditiously and with due diligence
to consider his complaint and relied on several provisions of the GDPR and on passages fromthe judgment in Schrems II in support of his submissions in that regard. His essential casewas that the DPC is under a duty to act expeditiously, to proceed with all due diligence and to
make orders (including those suspending or preventing the EU-US data transfers) where
those orders ought to be made. His position is that FBI is not entitled to impose obligations
which unduly hindered or restricted the DPC in complying with those obligations.
(b) Discussion and Decision on This Issue
156.

I do not accept that the DPC acted ultra vires or in breach of the provisions of the2018 Act, in breach of its obligations under the GDPR or otherwise in breach of EU law orcontrary to the requirements or expectations of the CJEU in Schrems II in terms of theinvestigation or inquiry carried out by the DPC prior to issuing the PDD or in terms of thefurther investigation and inquiry envisaged by the terms of the PDD. I deal separately withthe allegations of breach of fair procedures which have been advanced by FBI and confine
this section of my judgment to a consideration of the investigation or inquiry issue.
157.

In considering this ground of challenge, it is necessary to consider (1) the status andterms of the PDD and (2) the procedures adopted by the DPC, in order to determine whether
there is any basis for the contention that the DPC proceeded to make a decision withoutcarrying out an inquiry.
158.

I have looked earlier at the provisions of ss. 110 and 111 of the 2018 Act. It is clearthat under s. 110(1), the DPC is entitled to commence an inquiry and that it has a wide
discretion in terms of the nature and extent of that inquiry. It is entitled to “cause suchinquiry as it thinks fit to be conducted” for the purpose envisaged by the section. Section
12(8) makes clear that subject to the 2018 Act, the DPC is entitled to “regulate its own

76procedures”. Leaving aside the grounds of challenge advanced by FBI on the basis oflegitimate expectation and breach of fair procedures, and assuming that the inquiry does notbreach any legitimate expectation of FBI or its right to fair procedures, then the DPC isentitled to carry out the inquiry as it thinks fit. I agree with FBI that an inquiry envisages thesearch for truth and involves the taking of steps to ascertain the facts and, where relevant (ashere), the law. I also agree that an inquiry involves a process of gathering information.
However, I accept the DPC’s submission that in the absence of prescribed requirements for
an inquiry under s. 110 (and leaving aside for the moment any question of an alleged breachof FBI’s legitimate expectations in relation to the procedure to be adopted), it is open to the
DPC to gather information in a variety of ways, subject at all times to the overriding
requirement of fair procedures as well as the other requirements contained in the GDPR
concerning the need for expedition and due diligence. It must also be the case that the
information gathering and evaluation process which must be inherent in any inquiry musttake place before the decision which is the end point of the inquiry is made. In this case,leaving aside any possible changes which may take place under the Article 60 procedure, theend point of the inquiry is a decision under s. 111 of the 2018 Act on infringement andpossible corrective power. Even then, since it involves cross border processing, the decision
is properly classified as a “draft decision” which must then be submitted to the Article 60
procedure.
159.

I do not accept FBI’s contention that the PDD amounts to the decision under s. 111 of

the 2018 Act or the “draft decision” for submission to the Article 60 procedure. In order todetermine the status of the PDD, it is necessary to consider the terms of the document and toread the document as a whole together with the surrounding correspondence. To treat the
PDD as the decision under s. 111 or the “draft decision” for the purposes of Article 60 is toignore completely the terms of the PDD and the correspondence. The PDD itself makes clear

77
what its purposes are, namely, to notify the commencement of the inquiry, to set out thebackground and basis for the inquiry and to present the Commissioner’s preliminary views on
the issues arising. The PDD makes clear that insofar as it sets out views, those views are
preliminary views and are subject to submissions to be made by FBI on the issues arising.
The PDD also makes clear that no action will be taken by the DPC on foot of its contents. Allof that is clear from the introductory paragraphs of the PDD. It is, of course, necessary to read
not only those introductory paragraphs but the entirety of the document, which I have done. I
have attempted to set out the relevant terms of the PDD in an earlier part of this judgment andit is unnecessary to do so again here. It is made repeatedly clear in the PDD that the
preliminary views of the DPC are subject to such submissions as FBI may make in respect ofvarious matters set out in the document. The DPC’s letter of 28th August, 2020 makes thatclear as well and, insofar as it refers to the invitation to FBI to submit its written submissions,the letter states that FBI may make submissions in relation to “any of the factual and legal
matters addressed in the document, and in relation to the [DPC’s] preliminary view on boththe lawfulness of the actions of FBI” in respect of the EU-US data transfers and on thequestion as to whether any one or more of the corrective powers in Article 58(2) of the
GDPR should be exercised. The letter makes clear that the response will be carefully
considered by the DPC following which a draft decision will be prepared for the purposes of
the Article 60 procedure. That position was confirmed in the DPC’s letter of 3rd September,2020 where the DPC confirmed that the preliminary views expressed in the PDD were not“conclusions”, that no conclusions at that point had been drawn by the DPC and that, on thecontrary, the PDD made clear that the preliminary views expressed in the document wereintended to provide FBI with “a reference point against which it may make targeted
submissions on all such matters of fact and/or law as it considers relevant to the issues under
examination in the inquiry” and that those submissions would be carefully considered by the

78
DPC prior to the preparation of a “draft decision” for submission to the Article 60 process.
Similarly, at the end of that letter, the DPC stated that, in the context of the submissions
which FBI was invited to make:“…It will be open to [FBI] to set out its position on all of those matters of fact and/or
law it considers relevant to the issues under examination in the inquiry. Equally, andfor the avoidance of doubt, it may address such other matters that it believes bear (orought to bear) on the [DPC’s] analysis, including issues relating to… ‘the potential
for a significant disruption [FBI’s] business that a suspension may cause’.”160.

I am satisfied that the DPC has not reached a decision in the inquiry (or a “draft

decision” for submission to the Article 60 process) other than a decision to commence theinquiry in the manner set out and explained in the PDD and in the surrounding
correspondence. I also accept that, in deciding to commence the inquiry, the DPC was clearlyin possession of a vast amount of information, having regard to its involvement, and the
involvement of its predecessor, in the complaint originally made by Mr. Schrems in 2013 andin all of the various events which occurred since that complaint was made and extending up
to and, indeed, after the CJEU gave judgment in Schrems II in July, 2020. I accept too thatthe DPC did carry out some further investigation before deciding to commence the inquiry bysending the PDD to FBI on 28th August, 2020, by considering the publicly available
information summarised at paras. 1.21 to 1.25 of the PDD to which I have referred earlier.
Insofar as reference was made to the affidavits sworn in the context of the DPC proceedings,
it was noted at para. 1.25 of the PDD that FBI would have the opportunity of referring to any
additional or updated factual material to which the DPC ought to have regard and that any
such updated material would be considered by the DPC.
161.

While FBI may legitimately disagree with the extent of the investigation or inquiries

conducted by the DPC prior to the commencement of the inquiry by issuing the PDD on 28th

79
August, 2020, in my view, the DPC does have a wide discretion as to how to proceed with its
inquiry (leaving aside for the moment FBI’s legitimate expectation) provided that it complies
with fair procedures and with its obligations under the GDPR.
162.

It is perhaps unfortunate that the DPC used the word “targeted” in the context of thesubmissions which were invited by FBI in the PDD and in the surrounding correspondence.
That term has been seized upon by FBI to suggest that the DPC was not inviting FBI to makedetailed submissions or was in some way downplaying the role of those submissions.
However, I do not believe that the criticisms made concerning the use of that term are
justified. I accept the explanation given by counsel for the DPC that the DPC’s letter of 3rd
September, 2020 made clear that the DPC did not intend to limit the extent of thesubmissions which were being invited from FBI. On the contrary, that letter made clear invarious places that FBI was being invited to furnish submissions on any matters of fact or law
which it considered relevant, including on the issue as to the effect of any suspension of datatransfers on FBI and its business. That was also clear from the PDD and from the DPC’s
letter of 28th August, 2020.
163.

FBI contends that the DPC was factually mistaken in respect of various matters set

out in the PDD, such as whether FBI relies or has relied on Article 49 derogations in respectof the relevant data transfers or whether it relies on any supplementary measures in addition
to the SCCs to ensure protection for data subjects or whether there have been any relevantchanges to US law and practice. However, it was open to FBI and (in light of the position
taken by the DPC at the hearing) remains open to FBI to make full submissions on the facts
and on the law in relation to all of those matters and on any other matters it feels are relevant.
The DPC has confirmed in correspondence, in the PDD, in the statement of opposition(which was verified on affidavit) and in its written submissions and oral submissions at thehearing that the Commissioner/the DPC will consider those submissions. I am entitled to80
proceed on the basis that the Commissioner/DPC will do so. If, having considered any
submissions which FBI may make, the DPC proceeds to make a decision, or rather a “draft
decision” for the purposes of Article 60, which FBI contends is wrong in law (and possibly
wrong in fact on the basis of the case law referred to at para. 59 of FBI’s written submissions,on which I express no concluded view in this judgment), it will be open to FBI to commence
fresh proceedings in respect of that decision.
164.

In conclusion, I am satisfied that at the time the inquiry was commenced by means of

the PDD the DPC was in possession of a vast amount of information by reason of its
involvement and the involvement of its predecessor dating back to Mr. Schrems’ originalcomplaint in 2013, that further investigations were conducted prior to the DPC’s decision tocommence the inquiry by issuing the PDD, that its investigations are continuing, that FBI was
and is entitled to make submissions on all relevant matters of fact and law and on any othermatter it considers relevant, and that the Commissioner/DPC will consider those submissions
before reaching her/its decision in the form of the “draft decision” to be submitted to the
Article 60 procedure. I am satisfied that the DPC had not reached a decision or drawn
conclusions in the inquiry at the time the PDD was issued. Therefore, I reject this ground ofchallenge advanced by FBI.
14. Alleged Departure by DPC from Published Procedures/Breach of Legitimate
Expectation(a) Summary of the Parties’ Positions(1) FBI165.

FBI contends that the procedure adopted by the DPC for the own-volition inquiry

notified to FBI and described in the PDD and in the surrounding correspondence differs
significantly from the procedures which were published by the DPC in the DPC’s Annual
Report for the period 25th May, 2018 to 31st December, 2018 (the “2018 Annual Report”) and81
which were also published on the DPC’s website (on 16th April, 2019). FBI accepts that the
DPC has a discretion to regulate its own procedures (under s. 12(8) of the 2018 Act) and that,
subject to complying with the requirement to ensure fair procedures, the DPC was at large interms of the procedures which it adopted. However, FBI contends that the DPC proceeded toadopt a procedure for inquiries which it then published in the 2018 Annual Report and on its
website. The DPC has, therefore, disseminated the information in relation to its proceduresfor the purposes of s. 12(6) of the 2018 Act. FBI stresses the fact that the procedures were
published in the DPC’s 2018 Annual Report and that the report is a formal document whichmust be prepared on an annual basis by the DPC and copies of which must be laid before
each House of the Oireachtas. FBI contends, therefore, that it had and has a legitimate
expectation that the DPC would follow those published procedures in the inquiry which the
DPC has commenced into FBI’s data transfers.
166.

FBI referred to the specific terms of the published procedures in the 2018 Annual

Report (pp. 28-29) and on the DPC’s website. It draws attention to several aspects of thosepublished procedures:(1) Statutory inquiries conducted by the DPC are stated “essentially” to consist of“two distinct processes”, namely, the “investigatory process, which is carried out
by an investigator of the DPC” and the “decision-making process” which is“carried out by a separate senior decision-maker in the DPC who has had no rolein the investigatory process, usually the Commissioner for Data Protection”.
(2) The objectives of any inquiry conducted by the DPC are set out and include
establishing the facts, applying the facts as found to the provisions of the GDPR
and/or the 2018 Act in order to determine whether there has been any
infringement, making a formal decision on the question of infringement and,

82
where an infringement has been identified, making a formal decision as to whether
or not to exercise a corrective power, and if so, which power.
(3) Reference is made to the appointment of authorised officers by the DPC during
the “investigatory process” who have a broad range of investigatory powers.
167.

All of the above material, on which FBI relies, is contained in the left-hand column ofp. 28 of the 2018 Annual Report. On the right-hand column, under the heading “Generaldescription of the phases of a statutory inquiry”, FBI relies on the 12 inquiry phases which
are set out on the right-hand column and over into p. 29. In summary, those phases are:(1)The commencement/notification phase.

(2)

The information gathering phase.

(3)

The draft inquiry report preparation phase.

(4)

The submissions phase (with draft inquiry report).

(5)

The DPC draft decision-making phase (dealing with the question of
infringement).

(6) to (8)Phases under the Article 60 procedure.

(9)

The DPC final decision making (infringement) phase.

(10)

The notification of final decision (infringement) phase(11)

The decision-making phase (corrective power) — if applicable.

(12)

The court confirmation phase — if applicable (in the case of an
administrative fine only).

168.

While acknowledging that there is some qualifying wording in respect of the righthand column on p. 28 and in respect of the inquiry phases set out, FBI contends that there are
no qualifications in respect of the identification of the two distinct processes for inquiries
carried out by the DPC, namely, the investigatory process and the decision-making process.
FBI submitted that the qualifying words in the right-hand column referable to the phases of a83
statutory inquiry do not undermine the requirement on the part of the DPC to apply thephases referred to.
169.

In her second affidavit sworn on 11th November, 2020, Ms. Cunnane states that apartfrom the present inquiry, the DPC has commenced ten other inquiries in respect of FBI unders. 110 of the 2018 Act (five of which are own-volition inquiries, two of which werecommenced subsequent to the commencement of the present inquiry). Ms. Cunnane statesthat in those other inquiries, the procedures set out in the 2018 Annual Report have been
followed. In particular, she states (at para. 37 of that affidavit) that in each of those otherinquiries, there has been (a) a “commencement/notification” phase which involved theissuing of preliminary questions (phase (1)); (b) an “information gathering/inquiry” phase by
a DPC investigator or inquiry team which made requests for information in relation to thesubject matter of the inquiry (phase (2)); and (c) to the extent that the other inquiries haveprogressed, the DPC investigator or inquiry team prepared an inquiry report in which FBI
was given the opportunity of commenting before a final inquiry report is produced (phases(3) – (4)). As I outline below, further information in relation to the inquiries carried out todate by the DPC was provided by the DPC in affidavits sworn following the hearing.
170.

FBI also referred to the description given to the procedures referred to in the 2018

Annual Report by the Commissioner in her keynote address to the “Privacy and Security
Forum, 2020” on 23rd October, 2020. FBI drew attention to the Commissioner’s reference tothe published procedures as being “a typical set of fair procedures and due process” and “aset of processes that describes a basic outline of fair procedures” in which “the right to beheard is central in it and that will always be present in the process” (transcript of keynote
address, pp. 40-41). FBI submitted that the procedures adopted by the DPC in the present
inquiry very significantly depart from the published procedures in that (1) there is no
distinction between the investigatory or investigation stage and the decision-making stage,

84
with the Commissioner herself being involved in both stages; (2) there has been a conflationof phases (1) to (4) of the published procedures; and (3) there has been a conflation of thedecision on infringement and the decision on corrective powers.
171.

FBI contends that this amounts to a breach of its legitimate expectations and a breachof its right to fair procedures (including its right to be heard and its right to provide relevant
information for the purposes of the inquiry). It submitted that there is a significant difference
between making submissions and providing information to a decision maker at thecommencement of an inquiry and doing so after the decision maker has made a decision,even if that decision is a preliminary provisional one.
172.

FBI submitted that, on the evidence, this is the only inquiry in which the DPC has

departed to such an extent from the published procedures in commencing the inquiry by
issuing a PDD setting out preliminary views and inviting targeted submissions in response to
the preliminary views. It submitted that no reasons have been given by the DPC for departingfrom the published procedures.
173.

FBI relied on a number of authorities in support of this ground of challenge including

Fakih v. Minister for Justice [1993] 2 IR 406 (“Fakih”), Garda Representative Association v.
Minister for Public Expenditure and Reform [2018] IESC 4 (“GRA (No. 1)”) and Cromane
Seafoods Ltd v. Minister for Agriculture [2017] 1 IR 119 (“Cromane”). FBI sought todistinguish Cromane on the basis that no clear commitment was given in that case and,
therefore, the legitimate expectation claim failed.
174.

In addition to relying on what it says was a clear express representation as to theprocedures to be followed in the 2018 Annual Report and on the DPC’s website, FBI alsorelies on what it contends has been the regular practice and course of conduct by the DPC in
applying the published procedures to the statutory inquiries which it has carried out to date.
FBI further submitted that the DPC’s statutory discretion would not be interfered with by

85
enforcing FBI’s legitimate expectation on the facts of this case. In that regard, it relied on the
judgment of the High Court (McDonald J.) in Perrigo Pharma International DesignatedActivity Company v. McNamara & ors [2020] IEHC 552 (“Perrigo”).
175.

Finally, in support of its claim that the DPC did not provide reasons for departingfrom its published procedure, FBI relied on the judgments of the Supreme Court in Connelly
v. An Bord Pleanála [2018] IESC 31, [2018] 2 ILRM 453 (“Connelly”) and Mallak v.
Minister for Justice [2012] 3 IR 297 (“Mallak”).
(2) The DPC
176.

The DPC does not accept that there has been any breach of any legitimate expectationon the part of FBI that the present inquiry commenced by the DPC would be conducted inany particular way. The DPC rejects the contention that the 2018 Annual Report or thematerial published on the website (which is identical) created any legitimate expectation on
the part of FBI that the DPC would conduct the inquiry in the manner described.
177.

The DPC submitted that this aspect of FBI’s challenge is based on the false premisethat the DPC did not carry out any investigation before commencing the inquiry. The DPC’s
position is that it did carry out an investigation prior to commencing the inquiry and that it
would be continuing to carry out its investigation, if the inquiry is permitted to continue. The
DPC submitted that no precise commitment or unequivocal representation was made by it in
the published material that it would, in all cases, carry out an inquiry by following the precise
steps referred to in that material. The DPC relied on the express terms of the relevant sectionof the 2018 Annual Report and drew attention to the qualifying terms used. It noted, forexample, that the phases of the inquiry were set out in “high level terms”, that the descriptionof those phases was stated to be “not binding” on the DPC, that the description was provided“for general illustrative purposes only”, that it showed the “provisional sequencing ofphases in an inquiry”, that it was “not determinative of the precise steps which will be86followed in each inquiry” and that those steps would depend on the “nature, circumstances,
scope and subject matter of the inquiry”. The DPC further drew attention to the fact that it
was stated that the “provisional sequencing” set out in the 2018 Annual Report was stated tobe “subject to changes”.
178.

The DPC’s position is that the description provided in the 2018 Annual Report andthe inquiry phases set out there were provided on an illustrative basis, were not intended tobind the DPC in all inquiries and could not, in light of the DPC’s discretion under s. 110(1) of
the 2018 Act, bind the DPC in the manner alleged by FBI.
179.

The DPC further submitted that the relevant section in the 2018 Annual Report could

not be interpreted as rigidly binding the DPC to a particular form of procedure for a statutory
inquiry, including a strict division between an investigation stage and a decision-making
stage and that the precise form of inquiry would have to depend on the particular
circumstances. It submitted that the material contained on the left-hand column of p. 28 wasintended to set out the statutory background and the types of powers available to the DPC in
relation to inquiries. The DPC submitted that the description given was not intended to andcould not bind the DPC in all cases to adopt a rigid distinction between the investigation
stage and the decision-making stage. It submitted that it retained a statutory discretion as to
how to conduct the inquiry and that the procedures adopted for the present inquiry wereappropriate in light of the history of the matter dating back to Mr. Schrems’ originalcomplaint and in light of all of the information which the DPC already had up to andsubsequent to the judgment of the CJEU in Schrems II.
180.

The DPC submitted that the real complaint by FBI concerned the information

gathering stage and the failure by the DPC rigidly to adopt phases (1) to (3) as set out in the2018 Annual Report. The DPC’s position is that the procedure adopted for the present inquiry
is appropriate in the circumstances and that that procedure envisaged that investigations

87
would continue in the course of the inquiry and would include the submissions invited from
FBI.
181.

The DPC explained that a different approach was taken to the present inquiry whencompared to the approach taken in 2015/2016 prior to the adoption of the draft decision in
May, 2016 and the commencement of the DPC Proceedings shortly thereafter. The DPC
explained that that was because the present inquiry has been tailored to the particular
circumstances of this case and that those circumstances explain why the DPC did not regard
itself as being rigidly bound as between the investigation and decision-making stages. The
DPC further submitted that it would be totally unreal to suggest that the DPC was required tostart with a “blank sheet” after the CJEU’s judgment in Schrems II.
182.

The DPC submitted that no express or implied representation was made in the

published material such as would confer on FBI a legitimate expectation that the present
inquiry would be conducted in a particular manner which reflected the inquiry phases set out
in the 2018 Annual Report. The DPC further contended that there is no course of conduct orregular practice which could confer such a legitimate expectation on FBI. While the DPC
provided very limited information as to the procedures applied in other inquiries prior to thepresent inquiry in its statement of opposition and in Ms. Dixon’s affidavit, and while that
information was not provided in response to MHC’s letter of 29th October, 2020, further
information was provided in affidavits sworn on behalf of the DPC after the hearing. I willrefer to that affidavit evidence and to the information contained in it below.
183.

In resisting this aspect of FBI’s case, the DPC sought to distinguish Fakih and reliedon Glencar Exploration Plc v. Mayo County Council (No. 2) [2002] 1 IR 84 (“Glencar”),
Cromane and Perrigo. It also relied on extracts from Hogan, Gwynn Morgan and Daly
“Administrative Law in Ireland” (5th Ed.)(“Hogan and Morgan”)

88
184.

Finally, in the event that the court were to find that the 2018 Annual Report and thematerial on the DPC website did contain a clear representation that a particular form ofprocedure would be adopted in all statutory inquiries conducted by the DPC, it was submitted
that it was open to the DPC to depart from that process and to resile from the representations
made where the circumstances objectively justified it. In that context, the DPC relied on the
judgment of Clarke J. in the High Court in Glenkerrin Homes v. Dun Laoghaire Rathdown
County Council [2011] 1 IR 417 (“Glenkerrin”). It should be noted that in reply, FBIdisputed the entitlement of the DPC to resile from the representation which it says the DPC
made in the 2018 Annual Report without reasonable notice being given.
(3) Mr. Schrems
185.

Mr. Schrems made written and oral submissions on this point. He submitted that the

DPC had a wide discretion in terms of the manner in which the inquiry was conducted unders. 110 of the 2018 Act and under the GDPR. He noted that the GDPR does not provide forany particular type of or form of inquiry or investigation subject to the overriding
requirement that the investigation be carried out expeditiously and with due diligence. He
further submitted that the DPC could not have fettered its discretion by adopting a set ofprocedures to be applied in the case of all investigations or inquiries into breaches of GDPR
and that since the nature, complexity and subject matter of inquiries will vary from inquiry toinquiry, the DPC could not adopt a set of procedures for all inquiries as some procedures
might not be suitable for some inquiries and might lead to impermissible delays in the inquiry
or in the adoption of corrective measures.
186.

Mr. Schrems submitted that if the DPC purported to adopt a fixed set of procedures

which would apply to all investigations or inquiries, it would be unlawful under EU law andcould, therefore, not give rise to any legitimate expectation. He relied on the decision of the
CJEU in Case 316/86 Hauptzollamt Hamburg-Jonas v. Firma P Krücken Case [1988] ECR

892233 (“Krücken”). He submitted that that case is authority for the proposition that theprotection of legitimate expectations could not be relied upon against “a precise provision ofCommunity law” and that this would extend to the obligation on the DPC to carry out its
investigations and inquiries expeditiously and with due diligence. Mr. Schrems submitted,
therefore, that the alleged legitimate expectation relied upon by FBI would be animpermissible one as it would unlawfully fetter the DPC’s discretion in a manner which
would impede the exercise of its functions and powers under the GDPR.
187.

Mr. Schrems submitted that, in any event, the 2018 Annual Report did not give rise to

any legitimate expectation that the particular procedures set out would be followed in allcases and noted that the procedures referred to were stated to be “illustrative”. He too cited
Glencar and Perrigo in support of his submission that no legitimate expectation arose.
(b) Discussion and Decision on this Issue(1) Assessment of Relevant Facts
188.

In considering this ground of challenge, I should first examine in more detail thefactual basis on which FBI claims that it had and has a legitimate expectation that the DPC
would carry out any statutory inquiry in the manner set out in the DPC’s 2018 Annual Reportand in the material published on its website, which is the principal basis on which FBI claims
to have such a legitimate expectation. The second basis on which FBI claims to have such alegitimate expectation is the procedure adopted in other inquiries carried out by the DPC(paras. 27 and 33 of FBI’s statement of grounds). It will, therefore, be necessary to also
consider the evidence in relation to those other inquiries in order to determine whether they
can provide a basis for the legitimate expectation claimed by FBI.
189.

Before turning to consider the relevant part of the DPC’s 2018 Annual Report onwhich FBI relies, I should briefly refer to the relevant statutory context. As previously noted,
s. 110(1) of the 2018 Act confers a statutory discretion on the DPC as to the manner in which

90
it carries out inquiries into suspected infringements of the 2018 Act or of the GDPR (it may“cause such inquiry as it thinks fit to be conducted…”). In terms of the procedures to be
adopted, s. 12(8) provides that, subject to the 2018 Act, the DPC “shall regulate its own
procedures”. Under s. 12(6), the DPC is required to “disseminate, to such extent and in suchmanner as it considers appropriate, information in relation to the functions performed by it”.
The information contained in the 2018 Annual Report concerning procedures for inquiries
conducted by the DPC was presumably published pursuant to that provision as well as
pursuant to the DPC’s obligation under s. 24 to prepare an Annual Report, copies of whichmust be laid before each House of the Oireachtas. The 2018 Annual Report covered theperiod from the date on which the 2018 Act came into force, on 25th May, 2018, to 31st
December, 2018.
190.

Having regard to the principal basis on which FBI asserts a legitimate expectation thata particular procedure would be adopted, based on the 2018 Annual Report and the materialon the website, it is necessary closely to examine the contents of the relevant part of theReport on which FBI relies.
191.

At pp. 28 to 29 of the Report, there is a section headed “Statutory Inquiries by the

DPC”. Identical material was placed on the DPC’s website on 16th April, 2019 and it isunnecessary separately to consider that material. In the relevant section of the 2018 Annual
Report, it is stated that the DPC may conduct two different types of statutory inquiry under s.
110 in order to establish whether an infringement of the GDPR or of the 2018 Act has
occurred, namely, complaints-based inquiries and own-volition inquiries. The Report thenstates that a statutory inquiry “essentially consists of two distinct processes — theinvestigatory process, which is carried out by an investigator of the DPC, and the decisionmaking process” which “is carried out by a separate senior decision-maker in the DPC who
has had no role in the investigatory process, usually the Commissioner for Data Protection”.

91
The Report then sets out the objective of any inquiry which it says is to (a) establish the facts,(b) apply the facts to the relevant provisions of the GDPR and/or the 2018 Act, (c) make aformal decision of the DPC in relation to infringement, and (d) where an infringement has
been identified, make a formal decision in relation to any corrective power. The Report thenrefers to the range of investigatory powers open to the DPC and any authorised officer which
may be appointed by the DPC in carrying out “the investigatory process of an inquiry”. Allof that material is contained on the left-hand column of p. 28 of the report.
192.

The right-hand column on p. 28 is headed “General description of the phases of astatutory inquiry”. The Report states that what is set out below “in high level terms” is a
description of various phases of a statutory inquiry carried out by the DPC where the DPC isthe lead supervisory authority in relation to a cross-border processing issue in the case of acomplaint-based inquiry or where it is carrying out an own-volition inquiry. I note here theuse of the term “general description” in the heading and the reference to matters being set
out in “high level terms”. The Report continues:“This description is not binding on the DPC but is for general illustrative purposes
only, showing the provisional sequencing of phases in an inquiry. It is notdeterminative of the precise steps which will be followed in each inquiry, which will
depend on the nature, circumstances, scope and subject matter of the inquiry.”(emphasis added)
193.

The report then refers to the “first wave” of inquiries carried out by the DPC whichwere expected to be completed during 2019. It then says:“As such, the provisional sequencing set out below, may be subject to changes arisingfrom the crystallisation of the inquiry process, at both national and EU level, in thosecases.”

92
194.

I stress, as the DPC did, the reference to the description being “not binding” on the

DPC and being “for general illustrative purposes only”. I also highlight the reference to thesequencing of phases in the inquiry being “provisional” and that it is “not determinative of
the precise steps” of each inquiry. The Report makes clear that the precise steps to befollowed will depend on the particular inquiry. It also makes clear that the “provisionalsequencing” may be subject to changes.
195.

The Report then makes the point that in carrying out an inquiry, the DPC must act inaccordance with “due process and fair procedures”.
196.

The Report then sets out the “inquiry phases” (which stated to be “provisional” andfor “general illustration purposes”) and which the Report again states are for “illustration
purposes”. The Report sets out twelve such phases. The most relevant ones for present
purposes are phases (1) to (5). Phase (1) is described as the “Commencement/notification
phase” and is stated to include notification to the controller/processor of commencement of
the inquiry and the issuing of preliminary questions. Phase (2) is described as the“Information gathering phase” in which it is said the DPC investigator gathers relevant
information, documents and materials from the parties and notes that it may be “iterative”.
Phase (3) is described as the “Draft inquiry report preparation phase” in which the DPC
investigator completes consideration of the information, documents and materials, conducts afactual and legal analysis and drafts an inquiry report setting out findings of fact, theapplication of the GDPR and/or the 2018 Act to the findings of fact, and draft findings (withreasons) as to whether there has been any infringement. It is said that the draft inquiry reportwill not deal with the question of corrective powers. Phase (4) is described as the“Submissions phase (draft inquiry report)”. In this phase, it is said that the DPC investigator
will issue the draft inquiry report to the parties, that the parties can make submissions on it
and that the investigator will consider those submissions and prepare a “finalised inquiry

93
report” for the “DPC decision-maker”. Phase (5) is described as the “DPC draft decisionmaking phase (infringement)”. In this phase, it is stated that the “DPC decision-maker” willconsider the inquiry report, will remedy any deficiencies in the investigation procedure or any
outstanding issues and will make a “draft decision” as to whether there have been any
infringements of the GDPR or 2018 Act. Phases (6) to (8) concern the Article 60 procedure
which it is unnecessary to dwell on at this point. Phase (9) is the “DPC final decision making(infringement) phase” in which the DPC’s decision is finalised (following the Article 60
procedure). It is then notified to the parties under phase (10). Phase (11) is the “Decisionmaking phase (corrective power)”, if applicable, where the DPC decision-maker decides
what corrective powers apply, may invite submission and then notify its decision to theparties with a right of appeal. Phase (12) concerns court confirmation in the case ofadministrative fines and is not relevant here.
197.

In my view, it is quite clear from the terms of the 2018 Annual Report that the inquiry

phases set out on pp. 28 and 29 are illustrative only and are not binding on the DPC. In
maintaining that they are, FBI has sought to airbrush out completely the qualifying language
contained in the Report. The Report is crammed with qualifications which cannot be
overlooked. In my view, the qualifications apply not just to the phases set out on the righthand column of p. 28 and into p. 29, but to the entirety of the section dealing with statutory
inquiries. The section of the Report must be read in its entirety and it would be entirely
artificial, in circumstances where so many qualifications and statements of the non-binding
and illustrative nature of the phases are set out in the right-hand column, to ignore thosequalifications and statements when considering the material contained on the left handcolumn of p. 28. I believe that a fair reading of the section of the Report requires thequalifying words to be read across the entire section of the Report and not merely to thedescription of the phases set out in the right hand column of p. 28 and over into p. 29.

94
198.

If I am wrong about that, then it seems to me that the only part of the description set

out in the left hand column of p. 28 on which FBI could conceivably rely is the description of
the statutory inquiry as “essentially” consisting of “two distinct processes”, namely, theinvestigatory process and the decision-making process in which both processes are carriedout by separate persons. I do not believe that those words can be read as representing orcommitting the DPC to follow that procedure consisting of two distinct processes with two
separate persons involved in all cases. That is particularly so when it is clear from thequalifying language used in the right-hand column that the qualifications apply to the“illustrative phases” in which the separation of the investigatory process and the decisionmaking process is fleshed out. Since it is clear from the express terms used in the right handcolumn that those phases are illustrative only, not binding on the DPC, not determinative of
the precise steps to be used and subject to change, I cannot see how a fair reading of therelevant section of the report could take the words used in the left hand column as committing
the DPC in all cases to ensure that the inquiry had the two rigidly separate processes, as FBI
contends. I reject FBI’s submission that the words used in the left-hand column amount to aclear representation that in all cases the DPC would ensure that an inquiry carried out by it
will have separate investigation and decision-making processes in which different persons are
involved. I am reinforced in that conclusion by the acknowledgement by FBI in its written
submissions (at para. 83) that it is not its case that it is “always unlawful for one decision
maker to conclude all stages of a decision making process”.
199.

As noted earlier, FBI has drawn attention to some observations made by theCommissioner in her keynote address at the Privacy and Security Forum, 2020 on 23rd
October, 2020 in relation to the procedure referred to in the 2018 Annual Report. I haveoutlined earlier the passages on which FBI relies. However, it is important to note that whenintroducing her reference to the 2018 Annual Report, that Ms. Dixon expressly stated that the95
procedure referred to in the Report was “an indicative process relating to inquiries orinvestigations” and that it was “simply describing… a typical set of fair procedures and due
process”. She then referred, in very general terms, to phases of an inquiry in which questions
would be posed, facts would be collected and analysed and there would be a right to be heard
with submissions being invited before any draft submission is submitted to the Article 60
procedure. Ms. Dixon described the procedure as “really a set of processes that describes abasic outline of fair procedures” with the right to be heard being “central in it and…
always… present in the process” (pp. 40-41 of the transcript of the keynote address). I do not
accept that any of the statements made by Ms. Dixon in relation to the procedure referred toin the 2018 Annual Report cut across or contradict what is said in the Report or in any way
affect what I believe to be a fair reading of the relevant section of the Report. Nor do I
believe that those statements by Ms. Dixon provide any support for FBI’s legitimate
expectations claim.
200.

The next relevant factual issue to consider in the context of FBI’s legitimate

expectations claim is the evidence in relation to the other statutory inquiries carried out by the
DPC under the 2018 Act. FBI submitted that it has and had a legitimate expectation that theprocedure adopted in respect of those other inquiries would be followed in the case of thepresent inquiry. Ms. Cunnane provided evidence in relation to the other inquiries in her
second affidavit of 11th November, 2020 to which I referred earlier when outlining FBI’s
submissions on this issue. She asserted (at para. 37 of that affidavit) that in each of the otherten inquiries in which FBI was and is involved (aside from the present inquiry), the DPC has
adopted a procedure encompassing phases (1), (2), (3) and (4) of the phases or stages set out
in the 2018 Annual Report. That evidence was not contradicted by the DPC in response to
Ms. Cunnane’s affidavit.

96
201.

Further, in their letter of 29th October, 2020, MHC, on behalf of FBI, asked a numberof questions seeking to ascertain whether the DPC had commenced any inquiries which did
not include the phases set out in the 2018 Annual Report, including phases (1), (2) – (4) and(5) and/or (11). MHC also asked whether the DPC had commenced any other inquiries unders. 110 since the 2018 Annual Report by means of a preliminary draft decision such as the
PDD in the present case or which involved the conducting of the “information
gathering/inquiry” and “decision-making” phases by a single person.
202.

In its letter of 5th November, 2020, Philip Lee, on behalf of the DPC, declined toanswer those questions on the basis that the information sought was not relevant or wassought on an incorrect premise. As I have indicated earlier, I believe that those questions
ought to have been answered and the information ought to have been given to FBI at thatstage. Had that been done, it may well have obviated the need for further affidavits to besworn on behalf of the DPC in late December, 2020/January, 2021. The circumstances inwhich those further affidavits came to be sworn were that, in his responding submissions onbehalf of the DPC, counsel made reference to the numbers of other own-volition andcomplaints-based inquiry involving FBI which had been commenced by the DPC prior to thecommencement of the present inquiry. It became necessary, however, to clarify the precise
number and details of those other inquiries and it was agreed on Day 4 of the hearing on 18th
December, 2020 that a further affidavit would be sworn on behalf of the DPC setting out that
information. There followed a further exchange of affidavits to which I will now briefly turn.
203.

Colum Walsh swore an affidavit on behalf of the DPC on 23rd December, 2020. Ms.

Cunnane responded on behalf of FBI on 11th January, 2021. Mr. Walsh swore a further
affidavit on behalf of the DPC on 15th January, 2021. The relevant information is presented
most clearly in Mr. Walsh’s final affidavit. Before turning to the material set out in that
affidavit, I should point out that in his first affidavit Mr. Walsh explained that at some time

97
prior to the CJEU’s judgment in Schrems II, the DPC “had come to the view that elements ofthe processes by which it had typically conducted inquiries under section 110 up to that point
required adjustment” in light of the increasing number of those inquiries and the need toprogress them expeditiously. Mr. Walsh explained that the DPC “began a process ofrevisiting its procedures generally” prior to the judgment in Schrems II and that “that review
process remains ongoing” (para. 28 of Mr. Walsh’s affidavit of 23rd December, 2020). Mr.
Walsh also confirmed in that affidavit that, when considering the form of procedure to be
adopted in respect of the present inquiry, the DPC considered and came to the view that “inlight of the particular and unique circumstances of that case, a bespoke procedure should
properly be adopted” (para. 30). Mr. Walsh confirmed that the present inquiry is the only
cross-border inquiry commenced by the DPC by means of the issuing of a preliminary draft
decision in substitution for the “notice of commencement of inquiry” letter referred to in theillustrative procedures set out in the 2018 Annual Report (para. 30). In his second affidavit(of 15th January, 2021), Mr. Walsh drew together the information contained in his earlier
affidavit (and in Ms. Cunnane’s affidavits of 11th November, 2020 and 11th January, 2021)
and confirmed the following:(1)The DPC commenced 83 inquiries under s. 110 of the 2018 Act in the period
from 25th May, 2018 to the date of that affidavit. 27 of those 83 inquiries
involve cross-border processing.

(2)

21 of those 27 inquiries have been progressed using a procedure “broadly
reflective of the illustrative process” set out in the 2018 Annual Report.

(3)

Of the six remaining inquiries from the 27 inquiries, FBI is involved in threeof those inquiries including the present inquiry. It is involved in two further
own-volition inquiries which were both commenced on 21st September, 2020
(after the commencement of the present inquiry) and concern FBI’s Instagram

98
service. In respect of those two own-volition inquiries, the procedure adopted
by the DPC is as set out at para. 29 of Mr. Walsh’s first affidavit. In each of
those two inquiries, the DPC adopted a number of “significant departures”
from the procedures set out in the 2018 Annual Report. Instead of issuing draft
and final inquiry reports, the DPC informed FBI of its intention to circulate
issues lists and statements of facts in response to which FBI would be invited
to submit material, following which preliminary draft decisions would be
prepared and FBI would be invited to make submissions in response before
draft decisions are prepared and submitted to the Article 60 procedure. In
respect of both of those inquiries, the Commissioner, Ms. Dixon, is involvedin the investigative and decision-making phases.
(4)

Of the other three of the remaining six inquiries in which FBI is not involved,
the procedure adopted was initially “broadly reflective” of the process set out
in the 2018 Annual Report. However, the procedure was revised along similarlines to the procedure adopted in the case of the two Instagram inquiries justreferred to. The relevant parties were informed of the changes in procedure on
various dates in September, October and December, 2020. Those revisions
were made in the context of the review by the DPC of its procedures which
was described in Mr. Walsh’s first affidavit.

(5)

Mr. Walsh provided a table identifying the 11 s. 110 inquiries commenced by
the DPC since 25th May, 2018 involving FBI which concern cross-borderprocessing. From that table, it can be seen that prior to the commencement of
the present inquiry, FBI was involved in eight such inquiries of which four
were complaints-based and four were own-volition.

99
204.

FBI’s claims to legitimate expectation based on procedures adopted in earlier

inquiries must be viewed in the context of those numbers of inquiries, four complaints-based
and four own-volition, in which the procedures consistent with the procedures set out in the2018 Annual Report were adopted. While noting the point made by Ms. Cunnane in her
affidavit of 11th January, 2021 that FBI had not been notified of any review of the DPC’s
procedures, and acknowledging that that information was provided very late in the day by the
DPC, I have no reason to doubt that the DPC had put in place such a review and that it was
decided that, on the basis of the particular circumstances leading to its decision to commence
the present inquiry, the particular procedure decided on should be adopted. Equally, it is clear
on the evidence that the present inquiry was the only inquiry commenced by the issuing of a
PDD and in which the Commissioner was involved in the investigative stage and will be
involved in the decision-making stage. Whether or not all of that is sufficient to give rise to aregular practice or course of conduct to support a claim of legitimate expectation is anotherissue which I have to decide, having considered the relevant legal principles to which I now
turn.
(2) Discussion and Decision on this Issue
205.

The starting point in any consideration of the legal principles applicable to legitimate

expectation is the following description of the test given by Fennelly J. in the Supreme Court
in Glencar. He stated that three preconditions had to be satisfied in order to sustain alegitimate expectations claim:“Firstly, the public authority must have made a statement or adopted a position
amounting to a promise or representation, express or implied as to how it will act inrespect of an identifiable area of its activity. I will call this the representation.
Secondly, the representation must be addressed or conveyed either directly or
indirectly to an identifiable person or group of persons, affected actually or

100potentially, in such a way that it forms part of a transaction definitively entered intoor a relationship between that person and group and the public authority or that theperson or group has acted on the faith of the representation. Thirdly, it must be suchas to create an expectation reasonably entertained by the person or group that the
public authority will abide by the representation to the extent that it would be unjust
to permit the public authority to resile from it. Refinements or extensions of these
propositions are obviously possible. Equally they are qualified by considerations of
the public interest including the principle that freedom to exercise properly astatutory power is to be respected. However, the propositions I have endeavoured toformulate seem to me to be preconditions for the right to invoke the doctrine.” (Per
Fennelly J. at pp. 162-163)
206.

That description of the various preconditions of the test was expressly adopted by theSupreme Court in Lett & Co Ltd v. Wexford Borough Council [2014] 2 IR 198 (“Lett”) and in
Cromane. As noted by Clarke J. in the Supreme Court in Cromane, in addition to the three“positive elements” which have to be present in order for a legitimate expectation to arise,
there are also “negative factors” which, if present, might preclude a legitimate expectation
arising. Clarke J. referred in that context to his earlier judgment in the High Court in Lett. The“negative factors” include the “need to preserve the entitlement of a decision maker toexercise a statutory discretion within the parameters provided for in the statute concerned or,alternatively, may be necessary to enable… legitimate changes in executive policy to takeplace” (per Clarke J. at para. 29, p. 212).
207.

In Cromane, Clarke J. summarised the criteria for establishing a legitimate

expectation as follows:“In summary, those criteria are first that there must be an appropriate promise or
representation, second, that it must be addressed to an identifiable group of persons

101creating a relationship between that group of persons and the public authority
concerned, and third, that the expectation created by the promise or representation inquestion must be such that it would be ‘unjust to permit the public authority to resile
from it’. It is hardly a surprise that Fennelly J. started with the question of thepromise or representation itself, for it is necessary to identify what it is that the publicauthority said or did (or, perhaps, in an appropriate case, refrained from doing orsaying) that amounted to what Fennelly J. described as a ‘promise or representation’as to how it would ‘act in respect of an identifiable area of its activity’. Therefore thestarting point must be an analysis of the actions or statements attributed to
the Minister in those circumstances…” (para. 53, p. 142)
208.

The Supreme Court in Cromane considered the criteria which would have to be met inorder for a statement or representation to satisfy the first of the preconditions identified by
Fennelly J. in Glencar. The representation relied upon in that case was a notice issued onbehalf of the Minister to the effect that “it is not envisaged” that certain fishing activities
would be restricted as a result of the designation of the harbour as a Special Protection Area
under the EU Birds Directive. In his judgment, Clarke J. stated that that could not be said toamount to a “clear commitment” on the part of the Minister that there “could never be any
adverse consequences” as a result of the designation. Those consequences (if any) would, ofcourse, be determined as a matter of European law. Clarke J. stated that such an indication by
the Minister did not amount to the type of representation which satisfied the criteria identified
by Fennelly J. in Glencar. He stated that it was “neither precise” nor of a nature which could
be delivered by the Minister. Clarke J. stated, therefore, that in order to constitute a
representation satisfying the first of the preconditions set out by Fennelly J. in Glencar, thestatement or representation had to involve a “clear commitment” and had to be “precise”.

102
209.

In his judgment on the legitimate expectations issue in Cromane, Charleton J. stated

that:“In no case is there any warrant for analysing any expectation as legitimate where it
is not based upon an unambiguous and unequivocal declaration.”(per Charleton J. at para. 248, p. 223)
210.

I might add that in his characteristically impressive and analytical judgment,

McDonald J. in the High Court in Perrigo drew specific attention to those comments of
Clarke J. and Charleton J. in Cromane (para. 13, pp. 10-11). He noted that both Clarke J. andCharleton J. had emphasised that “some degree of precision” is required in order to establish
a representation to the purposes of the first precondition.
211.

In Hogan and Morgan, the authors state (at para. 21-63)(p. 1529) that a representation

qualifying under the first of the preconditions in Glencar, “must be unqualified andunambiguous…”. They cite Devitt v. Minister for Education [1989] ILRM 636 (Lardner J.)
and MacDonncha v. Minister for Education and Skills [2013] IEHC 226 (Hogan J.). The
authors sum-up, at para. 21-64, by stating:“The simple point here is that an agreement subject to heavy qualifications will noteasily give rise to a legitimate expectation.”
212.

In light of these clear authorities, I reject the submission made by FBI that the

representation relied upon must be unequivocal. I am satisfied that on the authorities, therepresentation must be clear, precise, unqualified, unambiguous and unequivocal. In light ofthe conclusions I have reached in relation to a fair reading of the relevant section of the 2018
Annual Report, I do not believe that the statements contained in that section of the Reportpossess these essential characteristics. In those circumstances, I do not accept that any
legitimate expectation can arise or did arise from the statements contained in the 2018 Annual
Report (or from the same material on the DPC website).

103
213.

FBI relied strongly on the judgment of O’Hanlon J. in the High Court in Fakih in

support of its legitimate expectations case. In that case, applicants for refugee status claimed
that they had a legitimate expectation to have their applications determined in accordancewith the procedures set out in a letter from the Minister for Justice to a representative of theUnited Nations High Commissioner for Refugees (referred to as the “Von Arnim” letter”).
The applicants were unable to make the case that they had altered their position in reliance on
the Minister’s letter. However, it was held that they had a legitimate expectation that theirapplications would be considered in accordance with the procedures set out in the letter.
O’Hanlon J. approved and adopted the views of Lord Fraser who delivered the advice of the
Privy Council in Attorney General of Hong Kong v. Ng Yuen Shiu [1983] 2 AC 629(“Attorney General of Hong Kong”). Lord Fraser referred to the case of R v. Liverpool
Corporation, ex p. Liverpool Taxi Fleet Operators’ Association [1972] 2 QB 299 which hesaid illustrated the principle that:“The expectations may be based upon some statement or undertaking by, or on behalfof, the public authority which has the duty of making the decision, if the authority has,through its officers, acted in a way that would make it unfair or inconsistent withgood administration for him to be denied such an inquiry.” (at 637)
214.

Lord Fraser continued:“The justification for [the principle of legitimate expectations] is primarily that, whena public authority has promised to follow a certain procedure, it is in the interest ofgood administration that it should act fairly and should implement its promise, solong as the implementation does not interfere with its statutory duty. The principle isalso justified by the further consideration that, when the promise was made, theauthority must have considered that it would be assisted in discharging its duty fairly
by any representations from interested parties and as a general rule that is correct.

104…the principle that a public authority is bound by its undertakings as to theprocedure it will follow, provided they do not conflict with its duty, is applicable tothe undertaking given by the Government of Hong Kong to the applicant… that eachcase would be considered on its merits.” (at 638)
215.

O’Hanlon J. also adopted the view of Lord Fraser in Council for Civil Service Unions

v. The Minister for the Civil Service [1985] 1 AC 374 (“CCSU”) on the possibility of alegitimate expectation arising from the existence of a “regular practice which the claimant
can reasonably expect to continue” (at 401). I will return to this aspect of FBI’s legitimate
expectations’ case in a moment. O’Hanlon J. held that the applicants were entitled to havetheir applications for refugee status determined in accordance with the procedures set out inthe Minister’s letter. I note that in the subsequent decision of the Supreme Court in Gutrani v.
Minister for Justice [1993] 2 IR 427, McCarthy J. was of the view that while there was an
obligation to consider the applications for refugee status in accordance with Minister’s
letter,:“It does not appear… to depend upon any principle of legitimate or reasonable
expectation; it is, simply, the procedure which the Minister has undertaken to
enforce.” (at 435-436)
216.

This difference of opinion was subsequently referred to by Keane C.J. in his judgment

for the Supreme Court in Keogh v. Criminal Assets Bureau [2004] 2 IR 159 where hecommented that the divergence of view may reflect the fact that the doctrine of legitimate
expectation was a developing one and that its legal parameters could not be regarded ashaving been “definitively established as yet” (para. 39, p. 175), reflecting what Fennelly J.
had stated in Glencar. In Keogh, the Supreme Court held that a specific undertaking
contained in the Taxpayers’ Charter of Rights issued by the Revenue Commissioners to give

105
taxpayers full, timely and accurate information about Revenue law and their entitlements andobligations under it ought to have been, but had not been, observed.
217.

In GRA (No.1), another judgment on which FBI relied, Clarke C.J., having referred to

Fakih as one of the first Irish cases on legitimate expectation, stated:“Thus a legitimate expectation that a public authority will not resile from a procedure
to which it has committed is a well recognised type of expectation which can, in
appropriate cases, be enforced by the Courts.” (para 8.4)
Later in his judgment, Clarke C.J. contrasted the interactions relied upon in that case as
giving rise to a legitimate expectation that there would be consultation or an opportunity tomake representations or observations before a new sick pay regime for An Garda Síochána
would be introduced with the statements contained in the Minister’s letter in Fakih. Clarke
C.J. stated that in Fakih, the Minister’s letter specified “with some precision the procedures
which were intended to be followed” (para. 9.2). There was no such representation orstatement made in GRA (No. 1).
218.

It seems to me that the statements referred to in the 2018 Annual Report (and on the

DPC’s website) in relation to the illustrative procedure for statutory inquiries conducted by
the DPC under s. 110 of the 2018 Act fall far short of the type of statement or representation
required to give rise to a legitimate expectation considered in Fakih, Cromane and in GRA(no. 1). As I have already concluded, it is not possible to read the relevant section of the 2018
Annual Report (and the website) without fully taking into account the qualifying language
used. That qualifying language, it seems to me, means that it cannot be said that thestatements contained in the Report (and on the website) set out with “some precision” theprocedures intended to be followed (as Clarke C.J. in GRA (No. 1) said was the case inrelation to the statements in the Minister’s letter in Fakih). Nor could it be said that the DPC
had “committed” to the procedures set out in the Report (and on the website) as Clarke C.J.

106
suggested in GRA (No. 1) was necessary to support a legitimate expectation. To characterise
what was said as a commitment by the DPC to follow the illustrative procedures referred towould be to ignore all of the qualifying language used. Moreover, the fact that suchqualifying language was used and was there for all to see, in my view, means that it could not
be said to be “unfair or inconsistent with good administration” (in the words of Lord Fraser
in Attorney General of Hong Kong) or that is would be “unjust to permit the public authority
to resile from it” (in the words of Fennelly J. in Glencar which were followed and approvedin several of the subsequent cases, including Cromane). This is so, in my view, as it was clear
from the terms of the material contained in the Report (and on the website) that theprocedures described were not binding, were for “general illustrative purposes only”, were“not determinative of the precise steps” which would be taken in every inquiry and wereopen to change depending on the circumstances. I do not accept that it could be said to be
unfair, unjust or inconsistent with good administration for the DPC to be permitted to departfrom the illustrative procedures should the circumstances of a particular inquiry require it
when that is precisely what the DPC said in the published material that it could do.
219.

The second basis on which FBI contends that it has a legitimate expectation that theprocedures set out in the 2018 Annual Report (and on the DPC website) would be followed instatutory inquiries conducted by the DPC and, in particular, in the present inquiry, is that
there was a course of conduct or regular practice by the DPC of adopting such procedures ininquiries carried out up to the present inquiry. That claim is expressly pleaded at para. 33 of
the statement of grounds. I do note, however, that it is not said anywhere on affidavit on
behalf of FBI that it arranged its affairs or took any steps whatsoever on the basis that the
published procedures would be followed in any inquiry involving FBI. While that may not be
determinative of the issue or a critical component of a legitimate expectation claim (and I am,of course, aware that the applicants in Fakih had no knowledge of the Minister’s letter and107
did not rely upon it before seeking to invoke its contents in the proceedings), however, it is ofsome relevance to the question of whether it would be unfair or unjust for the DPC to departfrom the published procedures were it the case that FBI had not arranged its affairs or alteredits position in any way on the basis that the published procedures would be applied in any
inquiry involving it.
220.

While Fennelly J.’s formulation of the preconditions for a successful claim in

legitimate expectation in Glencar does not expressly include the existence of a course of
conduct or regular practice as sufficing for the purposes of the representation, Fennelly J.
does refer to an implied representation which may be sufficient, depending on the facts, toencompass a course of conduct or regular practice. Lord Fraser in CCSU did expressly statethat a legitimate expectation could arise from “the existence of a regular practice which theclaimant can reasonably expect to continue” (at 401), a passage cited with approval by
O’Hanlon J. in Fakih.
221.

The issue is addressed by the authors of Hogan and Morgan at paras. 21-51 to 21-53(pp. 1255-1256) and subsequent paragraphs deal with the entitlement of a public body toresile from an established practice, which is an issue to which I will shortly turn. The authors
refer to Webb v. Ireland [1988] IR 353 (“Webb”), Egan v. Minister for Defence (Unreported,
High Court, 24th November, 1988, Barr J.)(“Egan”) and O’Donoghue v. South Kerry
Development Partnership [2016] IEHC 259 (Barrett J.) and [2018] IECA 10 (Court ofAppeal, Hogan J.) (“O’Donoghue”). In Webb, the Supreme Court did not find it necessary to
decide whether a longstanding practice adopted by the National Museum of making ex gratia
payments to the finders of treasure trove could itself give rise to a legitimate expectation
which would be enforceable against the State. In Egan, the High Court (Barr J.) held that alongstanding practice, even one which was “firmly entrenched”, was not sufficient to giverise to a legitimate expectation that permission to take early retirement would in every case108
be granted as a matter of course. In O’Donoghue, both the High Court and the Court ofAppeal rejected a legitimate expectations claim based on settled practice. The authors of
Hogan and Morgan note that this was primarily because the respondent’s change of approach
was objectively justified by changed conditions. However, Hogan J. in the Court of Appeal
went further and held, based on Egan, that past practice was not capable of giving rise to alegitimate expectation. He stated:“Generally speaking, a practice - even if it is established and inveterate - cannot
amount to an implied promise or representation such as might ground a legitimate
expectation…

Even if it could be said that the prior practice of the [respondent] to decideapplications by reference to chronological order was well established and inveterate,
this in itself did not give rise to a legitimate expectation because – just as in Egan –that practice did not in itself amount to an implied promise or a representation to an
applicant.” (at paras. 51 and 53)
The authors of Hogan and Morgan note (at para. 21-53, p. 1255-1256) that Hogan J. held thata practice was to be distinguished from a decision of a public body to commit itself tofollowing a particular procedure and that the practice in O’Donoghue was “an internal,
almost accidental, practice”.
222.

I accept (as the authors of Hogan and Morgan do at para 21-56, p. 1256-1257) that it

is possible for a well-established practice by a public authority to follow a particular
procedure to give rise to a legitimate expectation that the procedure would be followed in allcases unless there was an objective reason for departing from the practice and unless it would
be unfair or unjust to a particular person for the practice to be departed from in his or her
case.

109
223.

However, I do not accept that the facts of this case support FBI’s claim to a legitimate

expectation based on the procedures adopted by the DPC in statutory inquiries under s. 110 of
the 2018 Act prior to the present inquiry. I am doubtful that the relatively limited number ofinquiries referred to in the affidavit sworn by Ms. Cunnane on behalf of FBI and by Mr.
Walsh on behalf of the DPC are sufficient to constitute the sort of established procedure or
regular practice which could give rise to a legitimate expectation that that practice would in
all cases be followed. I have referred to and summarised the relevant evidence earlier. In myview, the numbers of inquiries involved are relatively small and probably insufficient to giverise to anything like an established or a regular practice which could support a legitimate
expectation claim. However, I do not have to decide the issue on that point as it would bewrong to focus entirely on the practice in those other inquiries which preceded the present
inquiry and to ignore the content of the material published in the 2018 Annual Report (and on
the DPC’s website) and the qualifying language used. It would, in my view, be entirely
unreasonable for a person (such as FBI) to focus on the procedures followed in otherinquiries without, at the same time, paying heed to the language used in the Report (and on
the website). I do not accept that anyone, still less an entity such as FBI, could reasonably
believe that just because particular procedures were adopted in other inquiries, the procedures
would be adopted in the present inquiry. Any such belief would, in my view, be entirely
unreasonable. In light of the language used in the published material, a body such as FBI
could not reasonably expect that the procedure used in those other inquiries, even if they
could be described as amounting to a “regular practice” by the DPC, would necessarily
continue in all cases, including in the present inquiry.
224.

Another reason why I have concluded that FBI’s legitimate expectation case must failis that to tie the DPC to having to adopt particular procedures in all inquiries would, in myview, amount to a significant and impermissible interference with the DPC’s discretion in

110
terms of the type of inquiry (and the procedures to be followed) which is expressly provided
for in s. 110(1) of the 2018 Act. A legitimate expectation of the type which FBI has sought tohave recognised and enforced would, in my view, be inconsistent with the DPC’s “freedom
to exercise properly a statutory power” (being the phrase used by Fennelly J. in his statementof the test in Glencar). That is one of the “negative factors” which might exclude a legitimate
expectation referred to by Clarke J. in the Supreme Court in Cromane (at para. 52, pp. 141142) and prior to that by Clarke J. in the High Court in Lett at (para. 29, p. 212) and by
McDonald J. in Perrigo (at paras. 14-15).
225.

I do not need to go further and to rule specifically on the additional argument

advanced by Mr. Schrems that the legitimate expectation for which FBI contends would be
impermissible as a matter of European law by operating against a “precise provision” of EU
law (as stated by the CJEU in Krucken at para. 24). While the legitimate expectation asserted
by FBI might potentially adversely affect the DPC’s obligations to investigate alleged
infringements of GDPR expeditiously and with due diligence, it would not necessarily do soin all cases. In any event, in light of the other conclusions I have reached, it is not necessary
for me to reach a definite conclusion on that argument.
226.

Finally, in this context, I am satisfied that even if FBI had established a legitimate

expectation, based on the published procedures and/or the practice followed by the DPC inother inquiries prior to the present inquiry, it would be open to the DPC to depart from theprocedures referred to and to adopt a different procedure for its inquiry, provided, of course,that in doing so it complied with fair procedures and with the DPC’s obligations under the2018 Act and the GDPR. Ultimately, the question is whether to depart from the publishedprocedures or practice would be unfair or unjust for those affected (see: Fennelly J. in
Glencar at 162-163 and Clarke J. in Cromane at para. 53, p. 142). As I have alreadyconcluded, having regard to the qualifying language used in the published procedures, and111
having regard to the fact that FBI has not asserted that it made arrangements or altered its
position in any way on the basis that the published procedures would be followed in any
inquiry involving it, I do not believe that it would be unfair or unjust or inconsistent withgood administration for the DPC to depart from the published procedures for the purposes ofthe present inquiry.
227.

In Glenkerrin, Clarke J. in the High Court held that it was open to the local authority

to change a practice which had existed for a prolonged period of time and that a legitimate
expectation could not arise to the effect that a policy would never be changed. The local
authority had changed a long-established practice of issuing “letter of compliance” in relation
to the payment of financial contributions required under planning permissions granted todevelopers. The local authority maintained that in the absence of an agreement on various
other matters, it was under no obligation to provide letters of compliance. The plaintiff
contended that it had a legitimate expectation that such letters would issue. The plaintiff
succeeded in part in its claim. However, Clarke J. held that “the existence of a longstanding
practice does not give rise to any legitimate expectation that that practice will not change”(para. 22, p. 426). He went on to state:“However where third parties reasonably arrange their affairs by reference to such apractice it seems to me that such third parties are entitled to rely upon an expectationthat the practice will not be changed without reasonable notice being given. The
notice that would be required is such as would reasonably allow those who haveconducted their affairs in accordance with the practice to consider and implement analternative means for dealing with the issues arising…” (para. 22, p. 426)
228.

The DPC relied on this case as entitling it to adopt a different procedure for thepresent inquiry. FBI contended that the DPC could not do so without giving reasonable notice
to FBI and that no notice was given. It learned of the different procedure when it received the112
PDD. However, it seems to me that the circumstances of Glenkerrin were fundamentallydifferent to those at issue in the present case. In Glenkerrin, there was evidence that parties
had arranged their affairs by reference to the long-established pre-existing practice of thelocal authority of issuing letters of compliance. There is no such evidence in the present case.
FBI did not say that it had arranged its affairs by reference to anything stated in the publishedprocedures or by reference to the procedures adopted by the DPC in previous inquiries.
Furthermore, I do not see how FBI could reasonably have arranged its affairs or altered its
position in any way by reference to the published material or by reference to the procedures
adopted in earlier inquiries, having regard to the clear qualifying language contained in the
published material. In my view, therefore, there is no basis for FBI’s contention that the DPC
was required to provide some form of notice before putting in place a different procedure forthe present inquiry to those referred to in illustrative terms in the published material and to
the procedures adopted in previous inquiries. Glenkerrin is clear authority for the principlethat the existence of a longstanding practice does not give rise to any legitimate expectationthat the practice will not change and that it is only where parties have reasonably arranged
their affairs by reference to that practice that the question of notice may arise. That is not soin the present case.
229.

For all of these reasons, I am satisfied that FBI’s case based on legitimate

expectations must fail.
230.

As regards FBI’s contention that the DPC gave no reasons for its decision to departfrom the published procedures and from the practice adopted in respect of other inquiries
prior to the commencement of the present inquiry, I address the question of reasons
separately later in this judgment but will deal with this point here. I have concluded that the
DPC did reserve to itself the right to adopt different procedures to the illustrative procedures
set out in the published material and that it adequately explained the procedures which it had

113
decided to adopt in respect of the inquiry in the PDD itself and in the surrounding
correspondence and, in particular, in the letters of 28th August, 2020 and 3rd September, 2020.
I do not accept that the DPC was required to set out reasons as to why it chose not to adopt
the illustrative procedures set out in the published material in circumstances where thelanguage used in that published material made clear that it was reserving an entitlement toadopt different procedures depending on the nature, circumstances, scope and subject matterof the particular inquiry. Further, while it would have been much better if the DPC had,through its solicitors, responded to the queries raised in MHC’s letter of 29th October, 2020and made the point that it had decided, as it was entitled to do, to adopt the procedures for thepresent inquiry set out in the PDD and to have explained (as Mr. Walsh did at para. 28 of his
first affidavit of 23rd December, 2020) that the DPC had begun a process of reviewing its
procedures in relation to inquiries in light of its experience, which review was ongoing, I do
not accept that the failure to do so amounted to any breach by the DPC to provide reasons in
respect of its decision to adopt the procedures set out in the PDD for the present inquiry. The
PDD and the surrounding correspondence enabled FBI to know the nature of the inquiry andthe procedures being applied by the DPC and enabled FBI to decide whether to seek ajudicial review of the decision to commence the inquiry, of the PDD itself and of theprocedures adopted and enabled the court to engage properly in that review, those being theessential requirements for adequate reasoning set out in Connelly and Mallak (see also:
Crekav Trading GP Ltd v. An Bord Pleanála [2020] IEHC 400 (“Crekav”) (at paras. 156 to165) and Cork Harbour Alliance for a Safe Environment v. An Bord Pleanála [2021] IEHC
203 (“CHASE (No. 2)”)(at paras. 394 to 408)). I am not, therefore, satisfied that there is any
basis for the claims advanced by the applicant with respect to the reasoning for the DPC’s
decision to proceed on the basis of the PDD and to adopt the procedures which it has done forthe present inquiry. Accordingly, I reject this aspect of FBI’s claim also.

114
15. Alleged Breach of Fair Procedures: 21-Day Period for Submissions(a) Summary of Parties’ Positions(1) FBI231.

FBI contends that the DPC failed to comply with its obligation to provide fair

procedures to FBI (including its rights to be heard, to make representations and for those
representations to be considered and taken into account by the DPC) by affording an
inadequate time to FBI to make submissions in response to the PDD.
232.

FBI submitted that the DPC was obliged to provide fair procedures in the conduct of

the inquiry under s. 110 of the 2018 Act and relied in that regard on the obvious cases such as
East Donegal Cooperative Ltd v. Attorney General [1970] IR 317 (“East Donegal”) and
Dellway Investments v. NAMA [2011] 4 IR 1 (“Dellway”). It maintained that the obligation toafford fair procedures to FBI stems not only from Irish law, but also generally under EU law
and, particularly, under the GDPR. It relies on the judgment of the CJEU in Case C-46/16
Valsts ieņēmumu dienests v. LS Customs Services, 9th November, 2017,
ECLI:EU:C:2017:839 (“Valsts”) in which the CJEU referred to the “right to goodadministration” being a general principle of EU law which must be complied with by
Member States when implementing EU law. It also relied on Case C-349/07 Sopropé v.
Fazenda Puplica [2008] ECR I-10369 (“Sopropé”) and case C-277/11 MM v. Minister for
Justice, judgment of 22nd November, 2012, ECLI:EU:C:2012:744 (“MM”) in which the
CJEU referred to the rights of defence and the right to be heard as fundamental principles ofEU law.
233.

FBI also relied on the provisions of Recital (129) and Article 58(4) of the GDPR

which refer specifically to the right to be heard and to due process and makes specificreference to the Charter. FBI relied on Article 47 of the Charter and the right to an effective
remedy in the case of a breach of its rights under EU law.

115
234.

FBI’s position is that the DPC’s decision to afford it only 21 days to makesubmissions (described as “targeted” submissions) in response to the PDD breaches its rights
to fair procedures in that the time period afforded was manifestly inadequate in light of thecomplexity of the issues involved and the areas which FBI would have to address in its
submissions. FBI relied on the fact that, in correspondence with ARQ, Mr. Schrems’
solicitors, the DPC more than once described the judgment of the CJEU in Schrems II as
being “transformative” of the law relating to EU-US data transfers. It also relied on thecomments made by the DPC in the press release issued immediately following the CJEU’s
judgment in which a number of references were made to the issues arising from the judgment
requiring “careful consideration”.
235.

Counsel for FBI listed several areas relevant to the question of infringement which

FBI would have to address in its submissions, in order to demonstrate the alleged inadequacyof the time period allowed. Those issues included the following:(i)The data transfers which are in fact being made by FBI;(ii)

The legal bases in Chapter V of the GDPR on which FBI relies for those datatransfers;(iii)

The implications of the judgment of the CJEU in Schrems II for those legal
bases;(iv)

Any changes to US law and practice since 2016/2017 to enable FBI tocomplete an updated equivalent assessment in terms of the protection for data
subjects;(v)

The particular facts and circumstances of the transfers by FBI;(vi)

Whether, in accordance with Article 46 of the GDPR, FBI has provided
appropriate safeguards;

116
(vii)

Whether the SCCs in themselves constitute adequate safeguards within themeaning of Article 46 of the GDPR, when relied on by FBI;(viii)

The alleged differences in the adequacy assessment between Article 45 andArticle 46 of the GDPR having regard to the alleged differences between
Recital (104) and Recital (108);(ix)

Whether the SCCs have been supplemented by additional measures considerednecessary by FBI or whether additional adequate measures can be identified
over and above those already implemented which could provide adequate
safeguards; and(x)Whether FBI relies on any of the derogations contained in Article 49 of the
GDPR and how those derogations are said to arise.

236.

Counsel for FBI submitted that the submissions would also have to address issues of

the appropriateness and proportionality of the data transfers in light of what was said by the
CJEU in Schrems I and in Schrems II and in light of various provisions of the GDPR
referring to proportionality, such as Recitals (4) and (129) as well as the effects of thesuspension of data transfers on FBI and its business and on the users of its services.
237.

These matters were relied on in order to demonstrate the extent and breadth of thesubmissions which FBI would have to make in response to the PDD in order to support FBI’scontention that the period allowed was manifestly inadequate.
238.

FBI submitted that it made clear to the DPC that the period of time allowed wasinadequate and that it sought an extension of time which was refused by the DPC, in that the
DPC made clear in its letter to MHC of 3rd September, 2020 that it was its “firm view” that
FBI should be in a position to furnish its submissions within the three-week period. FBI alsorelied on the fact that, unbeknownst to FBI, the DPC informed ARQ, Mr. Schrems’ solicitors,
on 31st August, 2020 that it anticipated that it would be in a position to submit a “draft

117
decision” to the Article 60 procedure within 21 days of receipt of FBI’s submissions. As thislast point was made primarily with reference to the premature judgment ground advanced by
FBI, I will consider it in the context of that ground in the next section.
(2) The DPC
239.

While understandably the DPC accepts that it is obliged to comply with therequirements of fair procedures both in Irish law and under EU law, it submitted that theparticular requirements of fair procedures must depend on the circumstances of the case:International Fishing Vessels Ltd v. Minister for Marine (No. 2) [1991] 2 IR 93 (perMcCarthy J. at 102) (“International Fishing Vessels”); Keady v. Commissioner of An Garda
Síochána [1992] 2 IR 197 (“Keady”) (per O’Flaherty J. at 213); and Mooney v. An Post
[1988] 4 IR 288 (“Mooney”) (per Barrington J. at 298). The DPC further submitted that it
would be wrong to focus on one part of the procedure which it had adopted and that theentirety of that procedure had to be considered: Rowland (per Clarke J. at para. 11, p. 360);
and Crayden Fishing Co v. Sea Fisheries Protection Authority [2017] 3 IR 785 (perO’Donnell J. at paras. 33-44, pp. 805-806) (“Crayden”).
240.

The DPC’s position is that the court must look at all of the circumstances leading up

to the commencement of the inquiry and the entirety of the procedures afforded to FBI,
including the procedural background to the commencement of the inquiry (dating back to Mr.
Schrems’ original complaint in 2013), the involvement of FBI since then, the terms of the
PDD itself and the fact that it was afforded a full opportunity to make submissions in
response. The DPC also suggested that the court should take into account the Article 60
procedure when considering the fairness or otherwise of the procedures afforded to FBI in theinquiry.
241.

The DPC submitted that a 21-day period was an adequate period of time for FBI tomake its submissions in light of its extensive involvement prior to the commencement of the

118
inquiry and that the DPC’s view that that period was adequate was a reasonable one to holdin the circumstances. The DPC noted that while MHC in its letter of 1st September, 2020
contended that FBI could not reasonably be expected to make meaningful submissions withinthat time period, it did not specify any period within which it would be in a position toprovide its submissions and did not request any specific extension of time. The DPC
maintained that the request contained in the MHC letter of 1st September, 2020 was, in effect,a request for an indefinite postponement of the requirement to make submissions until
regulatory guidance was issued by the EDPB or by the DPC. The DPC asserted that that was
not a reasoned request for an extension of time and that, in its response of 3rd September,
2020, the DPC made it clear that its “firm view” was that FBI should be in a position toprovide its submissions within the three-week period and that it was not necessary to await
publication of guidance by the EDPB or by the DPC.
242.

The DPC submitted that no reasoned application for any extension of time was sought

by FBI and that there had, therefore, been no refusal of any such application. Although the
DPC’s letter of 3rd September, 2020 referred to its “firm view” that FBI should be in aposition to furnish its submissions within the three-week period, that view was expressed in
response to what was, in effect, an application for an indefinite postponement of the inquiry
pending the adoption of guidelines by the EDPB or by the DPC. The DPC was not asked toextend the time for FBI’s submissions on the basis of any reasoned request.
243.

The DPC further submitted that it was open to FBI to make submissions on all of theissues referred to by Ms. Cunnane in her second affidavit of 11th November, 2020 (at para.
42) and on any of the additional matters referred to in FBI’s counsel’s list of issues. The DPC
submitted that FBI did not make any argument for an extension of time based on the need toaddress all of these issues and did not specify how much longer it would need to do so.

119
244.

The DPC confirmed, through its counsel, that in the event that the court were preparedto permit the inquiry to resume, the 20 days would start afresh from that resumption and that,
if FBI put forward a reasoned basis on which further time was required, the DPC would
consider such a request. It was contended, therefore, that the issue has become moot in thatseveral months have passed from the date of the PDD with further time now being affordedby the DPC for FBI’s submissions, in the event that the inquiry is permitted to resume.
245.

In contending that the 21-day period was adequate to allow FBI to provide its

submissions the DPC relied on the extent of FBI’s involvement in the issues dating backseveral years and on the extensive resources available to FBI.
246.

The DPC also relied on the extracts from the judgment of Kelly J. in NIB (No. 2) andfrom the judgment of Clarke J. in the Supreme Court in Rowland to which reference has been
made earlier. The DPC’s submission appeared to be that the Court should be reluctant tointerfere with the time period afforded by the DPC for FBI’s submissions on the basis that
this would encourage “endless applications” to the court, asking it “in effect to second guess
decisions” made by the DPC in relation to the steps to be taken in the inquiry and that the
DPC should not have carry out its duties “whilst constantly looking over [its] shoulders at the
court” in anticipation of its decisions being challenged by way of judicial review (the words
in quotation being those of Kelly J. in NIB (No. 2)). It further urged caution on the part of the
Court in interfering with the time period afforded to FBI for its submissions on the basis thatit could not be said that the process had gone “irremediably wrong” (in the words of Clarke
J. in Rowland).
(3) Mr. Schrems
247.

In his submissions to the court, Mr. Schrems contended that the 21-day period

afforded by the DPC was sufficient. He contended that it was open to the DPC to set tighttimelines for the steps in the inquiry and that this was consistent with the emphasis given in

120
the judgment of the CJEU in Schrems II and in the GDPR on the need for expedition in the
conduct of investigations into alleged infringement of the GDPR by supervisory authorities,
such as the DPC. He relied, in particular, on paras. 109 and 112 of the CJEU’s judgment in
Schrems II and on Article 57(1) and Recitals (129) and (141) of the GDPR to support that
submission. He further drew attention to correspondence exchanged between his solicitors,
ARQ, and FBI’s solicitors, MHC, in August, 2020 to make the point that FBI was in aposition to set out the legal bases on which it was relying for the data transfers and did so by
reference to its Data Policy and the SCCs and not by reference to additional or supplementarymeasures. Mr. Schrems submitted that the court should take with a “pinch of salt” FBI’scontention that the 21-day period was inadequate to enable it to make its submissions.
(b) Discussion and Decision on this Issue
248.

In considering FBI’s ground of challenge based on the alleged inadequacy in the time

period within which FBI’s submissions were invited, the following principles are relevant.
249.

There is no doubt (and the parties were agreed) that the DPC is obliged to afford fair

procedures to those affected by the exercise of its statutory powers. The right to fair
procedures necessarily involves a right on the part of those who are the subject of an inquiry
conducted by the DPC under s. 110 of the 2018 Act to make submissions and for thosesubmissions to be taken into account by the DPC before reaching any concluded view in theinquiry. The DPC’s obligation to comply with fair procedures and the corresponding rights of
those involved in the inquiry arises under (a) Irish law: East Donegal, Dellway and Perrigo;(b) generally under EU law, as the rights of the defence, including the right to be effectively
heard are fundamental principles of EU law: Case C-7/98 Krombach [2000] ECR I-1935,
para. 42, Sopropé, para. 36, and MM, para. 81. So too is the right to good administration:
Valsts, para. 39; and (c) under the GDPR, as interpreted by the CJEU in Schrems II.

121
250.

I will return in a moment to consider some aspects of the right to fair procedures

under Irish law. Before doing so, I should refer briefly to the principles set out in thejurisprudence of the CJEU to which I have just referred.
251.

In Sopropé, the issue was whether the period of time afforded to an importer who wassuspected of having committed a customs offence to submit observations complied with therequirements of Community law. The period of time allowed was between 8 and 15 days.
The CJEU held that that period did comply in principle with the requirements of Community
law. However, it held that it was for the national court to ascertain, having regard to thespecific circumstances of the case, whether the period allowed to the particular importermade it possible for it to be given a proper hearing by the customs authorities. It was also forthe national court to ascertain whether, in light of the period which had elapsed between thetime when the customs authorities concerned received the importer’s observations and thedate on which they took their decision, they could be deemed to have taken due account of
the observations sent to them. In the course of its judgment, the CJEU stated that:“Observance of the rights of the defence is a general principle of Community law
which applies where the authorities are minded to adopt a measure which will
adversely affect an individual.” (para. 36)
252.

The court continued:“In accordance with that principle, the addressees of decisions which significantly
affect their interests must be placed in a position in which they can effectively makeknown their views as regards the information on which the authorities intend to basetheir decision. They must be given a sufficient period of time in which to do so…”
(para. 37)

253.

Later in its judgment, the CJEU held that it was for the Member States to establish theperiods within which particular steps had to be taken:-122“…in the light of, inter alia, the significance for the parties concerned of the decisions
to be taken, the complexities of the procedures and of the legislation to be applied, thenumber of persons who may be affected and any other public or private interests
which must be taken into consideration.” (para. 40)
254.

As regards the period provided for in the Portuguese legislation at issue (which, as

was noted earlier, was between 8 days and 15 days), the CJEU held that that period did not“as a matter of principle, make it impossible in practice or excessively difficult to exercise
the rights of defence conferred by the Community legal order” (para. 41). Among the matterstaken into account by the CJEU was that the undertakings which may be affected by theprocedure at issue were “professionals which have recourse to importation on a regularbasis” (para. 41).
255.

Two further paragraphs of the judgment in Sopropé are relevant. At para. 49, theCJEU stated:“The purpose of the rule that the addressee of an adverse decision must be placed ina position to submit his observations before that decision is adopted is to enable thecompetent authority effectively to take into account all relevant information. In orderto ensure that the person or undertaking concerned is in fact protected, the purpose ofthat rule is, inter alia, to enable them to correct an error or submit such information
relating to their personal circumstances as will argue in favour of the adoption or
non-adoption of the decision, or in favour of its having a specific content.”
256.

At para. 50, the CJEU stated:“Accordingly, respect for the rights of the defence implies that, in order that theperson entitled to those rights can be regarded as having been placed in a position inwhich he may effectively make known his views, the authorities must take note, with123
all requisite attention, of the observations made by the person or undertaking
concerned.”
257.

These were all stated to be part of the general principle of Community law requiring

observance of the rights of the defence. It seems to me that they are entirely consistent with
Irish law on fair procedures.
258.

In MM, the CJEU reiterated its earlier finding that the observance of the rights of the

defence as a fundamental principle of EU law (citing, inter alia, Sopropé). The court noted(at para. 82) that the right to be heard is “inherent in that fundamental principle” and isaffirmed not only in Articles 47 and 48 of the Charter, but also in Article 41 (whichguarantees the right to good administration) (para. 82). It was noted that the CJEU “hasalways affirmed the importance of the right to be heard and its very broad scope in the EU
legal order, considering that that right must apply in all proceedings which are liable toculminate in a measure adversely affecting a person…” (para. 85), citing, among other cases,
Sopropé. The CJEU also reaffirmed that:“The right to be heard guarantees every person the opportunity to make known his
views effectively during an administrative procedure and before the adoption of any
decision liable to affect his interests adversely…” (para. 87)
259.

At para. 88, the CJEU confirmed that:“That right also requires the authorities to pay due attention to the observations thus
submitted by the person concerned, examining carefully and impartially all the
relevant aspects of the individual case and giving a detailed statement of reasons fortheir decision…; the obligation to state reasons for a decision which are sufficiently
specific and concrete to allow the person to understand why his application is being
rejected is thus a corollary of the principle of respect for the rights of the defence.”(para. 88)

124
Again, these principles are entirely consistent with Irish law on fair procedures.
260.

Both MM and Valsts make reference to the right of good administration as a generalprinciple of EU law as well as being guaranteed under Article 41 of the Charter. However, it
does not seem to me that as least as far as the facts of this case are concerned, the right togood administration is any more extensive than the rights of the defence to which I have justreferred. I do not believe, therefore, that it requires any separate examination or analysis inconsidering this ground of challenge advanced by FBI.
261.

As already noted, both the GDPR itself and the CJEU’s judgment in Schrems II arealso relevant in terms of FBI’s rights as the subject of the DPC’s inquiry. I have referred
earlier to the most relevant provisions of the GDPR itself which are Article 58(4) andRecitals (129) and (141). It is unnecessary to repeat the contents of those provisions, save tonote that Article 58(4) expressly provides for “appropriate safeguards” including “effective
judicial review and due process”, as set out in EU law and in the law of Member States inaccordance with the Charter, as being necessary where the supervisory authority seeks toexercise its investigative and/or corrective powers under Article 58. Recital (129) expresslyrefers to the right of persons to be heard before adverse decisions are taken by the relevantsupervisory authority. These provisions give effect to the general principles of EU law towhich I have just referred.
262.

It must, however, also be borne in mind, as Mr. Schrems submitted, that in addition toits obligation to respect the rights of the defence and to afford fair procedures, including theright to be heard, to those who are subject to an inquiry commenced by the DPC, the DPC
also has significant obligations under the GDPR to act expeditiously in the exercise of its
powers. A number of the recitals (for example, Recitals (129) and (141)) require thesupervisory authority to act “within a reasonable time”. Article 57 imposes such arequirement on the supervisory authority in terms of handling complaints (and it is hard to125
see how that obligation would not also apply to investigations carried out by the supervisory
authority of its own volition which are envisaged under Article 57(1)(h), although no express
reference is made to the obligation to conduct those investigations “within a reasonabletime”). The CJEU in Schrems II made a number of references to the obligation on the
supervisory authority to handle complaints “with all due diligence” (for example, at paras.
109 and 112). At para. 112, the CJEU stated:“Although the supervisory authority must determine which action is appropriate andnecessary and take into consideration all the circumstances of the transfer of personal
data in question in that determination, the supervisory authority is neverthelessrequired to execute its responsibility for ensuring that the GDPR is fully enforced
with all due diligence.”
That requirement was stressed by the DPC and by Mr. Schrems.
263.

It is clear from the GDPR and from the judgment of the CJEU in Schrems II that it isnecessary for the supervisory authority to balance and attempt to reconcile the right to beheard and to fair procedures on the part of those who are the subject of an investigation or
inquiry conducted by a supervisory authority against the obligations on the supervisory
authority to act within a reasonable time and with due diligence in determining whether the
GDPR has been infringed and in determining what, if any, corrective powers should be
exercised. That can be a difficult balance for the supervisory authority and, in this case, theDPC, to achieve, but both rights and obligations must be properly taken into account by thesupervisory authority in terms of the procedures which it applies. One does not necessarily
trump the other and individual assessment will be required to be made by the supervisory
authority in each case.
264.

The precise content and extent of the fair procedures, including the right to be heard,

which must be afforded to a person, such as FBI, who is the subject of an inquiry commenced

126
by the DPC will depend on the particular circumstances and context of the process at issue. In
International Fishing Vessels, McCarthy J. in the Supreme Court stated:“The requirements of natural justice must depend on the circumstances of the case,the nature of the inquiry, the rules under which the tribunal is acting, the subjectmatter that is being dealt with, and so forth.” (at 102)
Similar observations were made by O’Flaherty J. in Keady (at 213) and by Barrington J. in
Mooney. (at 298)
265.

It is also necessary, in considering an allegation of a breach of fair procedures in thecourse of a statutory process, to look at the entirety of the procedure and to consider theprocess as a whole. That principle has been expressly confirmed recently on a number ofoccasions by the Supreme Court.
266.

In Rowland, Clarke J. stated that when considering the fairness of a particular process,the proper approach for a court to take is:“…to look at the entirety of the procedure and determine whether, taken as a whole,the ultimate conclusion can be sustained having regard to the principles of
constitutional justice.” (at 360)
267.

The principle was succinctly stated by O’Donnell J. in the Supreme Court in Crayden

where, in considering the fairness of a procedure in an inquiry, he stated:“… it is critical to consider if the procedure as a whole has been fair to the individual
concerned.” (para. 33, p. 806)
He observed that it is necessary to analyse “the entirety of the process” and to consider “theoverall fairness of a process” (para. 34, p. 806).
In considering FBI’s complaints as to the fairness of the procedures adopted by the DPC in its
inquiry and, in particular, in relation to the time period allowed for FBI’s submissions, I must
consider the particular context and circumstances of the inquiry and do so by reference to the127entirety of the process. The object of this exercise must be to assess the “overall fairness” ofthe process, as stated by O’Donnell J. in Crayden.
268.

While at one point during the hearing it appeared to FBI, at least, that the DPC was

advocating that the court should adopt a rationality standard in considering the DPC’s
assessment of the 21-day period as affording adequate time for FBI’s submissions, the DPC’s
counsel expressly disavowed any such submission following FBI’s reply. Counsel clarified
that the DPC was not maintaining that the court should adopt a rationality standard but wascontending that the Court should not supervise the precise steps in the procedure adopted by
the DPC for the inquiry. In that regard, the DPC was relying on NIB (No. 2) and Rowland.
FBI is correct that it is not appropriate to apply the rationality standard in considering FBI’s
complaint of a lack of fair procedures. The court does not consider a complaint of lack of fair
procedures by reference to the standard of rationality set out in O’Keeffe v. An Bord Pleanála[1993] 1 IR 39. That is very clear. Examples of cases where courts have rejected a
submission to the effect that deference should be afforded to a decision-maker in terms of thefairness of the procedures afforded in a process or that a margin of appreciation should apply
include Hyde v. Financial Services Ombudsman [2011] IEHC 422 (Cross J.) and Somague
Engenharia SA v. Transport Infrastructure Ireland [2016] IEHC 435 (Baker J.). The court’s
assessment as to the fairness of the procedures adopted as part of a statutory process does notdepend on a rationality assessment of the decision-maker’s decision as to those procedures.
However that said, the fairness of the procedures at issue must be considered by reference tothe context and circumstances in which they are applied. The court must determine theoverall fairness of the process, albeit that it does not do so by reference to a rationality
standard. While the court should be astute in weeding out frivolous or insignificant
applications of the type to which Kelly J. was referring in NIB (No. 2) and which would havethe DPC “constantly looking over [its] shoulders” at the court, I do not see the case made by

128
FBI on this ground as being such an application. Nor do I believe that the Court should
decline to consider the issue on the basis that it has not been demonstrated that the process
before the DPC has “gone irremediably wrong”. FBI is and was entitled to challenge theappropriateness of the time period within which its submissions were required and a failure to
do so when it did could well have left it without recourse at a later stage, either on the basisthat it was simply too late and the damage was done or on the basis that it might be seen tohave acquiesced in the procedures adopted.
269.

While the DPC sought to rely on the Article 60 process, and the opportunity whichmight be afforded to FBI to make submissions in that process, as part of the context which
the Court should take account in assessing the overall fairness of the procedures adopted by
the DPC, I do not believe that much, if any, weight can be afforded to the procedures
available in that process. It is fair to say that while the point was made in the DPC’s
statement of opposition and in its written submissions, it was not pressed strongly in oral
submissions at the hearing. The main reason why I do not believe that it is particularly
relevant to an assessment of the fairness of the procedures adopted by the DPC for the inquiry
is that FBI would only have the opportunity of making further submissions under thatprocedure in very limited circumstances. Those arrangements are where the other supervisory
authorities concerned, to whom the draft decision is furnished, express “a relevant andreasoned objection” to the draft decision and the DPC agrees with that objection andprepares a revised draft of a draft decision on which FBI would be afforded the opportunityof making submissions, but only in relation to the revisions or amendments in question. That
seems to me to be a very limited and restricted opportunity for FBI to make further
submissions and even then it would only allow it to make very limited and confinedsubmissions. In the circumstances, very limited, if any, weight could be afforded to any
entitlement by FBI to make further submissions in the course of the Article 60 process. Its

129
real opportunity to make submissions is in the course of the inquiry and prior to the
preparation by the DPC of the “draft decision” for submission to the Article 60 procedure.
270.

Applying those principles to the particular context and circumstances of the present

inquiry, I am not persuaded that the 21-day time period for FBI’s submissions was inadequate
or amounted to a breach of FBI’s right to fair procedures under Irish law, under EU law(whether under the general principles of Community law or under Article 47 or any otherprovision of the Charter) or under the provisions requiring fair procedures in the GDPR itself.
While I accept that the judgment of the CJEU in Schrems II was, as the DPC stated to Mr.
Schrems on more than one occasion, “transformative” of the law in relation to EU-US datatransfers, I must take into account the central involvement which FBI had with the DPC
following Mr. Schrems’ reformulated complaint in December, 2015, including its central
involvement in the procedures leading up to the decision by the DPC to commence
proceedings in late May, 2016, in the DPC Proceedings before the High Court and before theSupreme Court and in the reference to the CJEU in Schrems II. I accept the evidence given by
the DPC as to the extent of the FBI’s central involvement over that entire period. I must also
have regard to the knowledge which FBI must have about its own business and about thelegal bases on which the EU-US data transfers are made and the means of protection
available for data subjects, as well as the substantial resources undoubtedly available to FBI
to deal with the inquiry commenced by the DPC in late August, 2020. Taking all of that into
consideration, I am not satisfied that the time period provided for in the PDD was inadequate.
271.

I do not accept that FBI could not have dealt with all of the issues referred to at para.

42 of Ms. Cunnane’s second affidavit of 11th November, 2020 or in FBI’s counsel’s list ofissues in its submissions within the required timeframe. If anyone has the necessary
information to deal with those issues, it is FBI and its parent, Facebook Inc. I am not130persuaded that FBI could not have made a very extensive submission on those issues within
the prescribed time period.
272.

FBI has referred to a number of errors in the PDD and was extremely critical as to

how those errors were made by the DPC in light of the information available to it. However,it was open to FBI to point all of that out in its submissions (and, as a result of what has
transpired since August/September, 2020, it will still have the opportunity of doing so). If
FBI was of the view that it would not be able to deal with all of those issues in its
submissions within the prescribed time period, it was open to it to make a reasoned request
for an extension of the time period and if such a request was made and not properly
considered by the DPC, it would have been open to FBI to challenge the DPC’s decision onthat basis. However, I am not satisfied that MHC’s letter of 1st September, 2020 was aproperly reasoned request for an extension of time for FBI to make its submissions. I agreewith the DPC that the letter was more in the nature of a request for an indefinite
postponement of the time limit for putting in submissions until guidance was published by the
EDPB or by the DPC. While MHC did make the point in that letter that the judgment in
Schrems II made a number of “novel and complex findings” on which guidance had not, tothat point, been provided by the EDPB or by the DPC in terms of the supplementarymeasures which should be adopted to support data transfers pursuant to SCCs and while it did
refer to the very significant implications for FBI if the PDD was adopted as a final decisionby the DPC, it was not said on behalf of FBI that it required any particular extended period oftime to deal with the particular issues referred to by Ms. Cunnane in her later affidavit and by
FBI’s counsel in its submissions.
273.

I do not read the MHC letter of 1st September, 2020 as a reasoned request for an

extension of time for FBI to put in its submissions in order to deal with all of those issues.
Nor do I read the DPC’s letter of 3rd September, 2020 as a rejection of a properly reasoned

131
request for an extension of time. In my view, the DPC was entitled to interpret FBI’s request
as in effect a request for a postponement of the inquiry until guidance was issued by the
EDPB or by the DPC. While the DPC did state in that letter that it remained of the “firmview” that FBI should be in a position to furnish its submissions within the three-weekperiod, it did so in the context of the request contained in the MHC letter of 1st September,2020 and not in the context of a reasoned request for an extension of time to deal with theseveral issues which FBI has said it would have to address in its submissions. It seems to me
to be likely that no request for a specific extension of time was made as FBI did not accept
that the DPC had any entitlement to commence the inquiry at all, or at least in the way inwhich the DPC sought to do so. In my view, the DPC quite properly explained that it could
not await publication of the EDPB guidance (or guidance from the DPC itself) before seeking
to comply with the obligations on it under the GDPR as interpreted by the CJEU in Schrems
II. I am satisfied that that was a proper approach for the DPC to adopt in light of theobligations upon it in conducting an investigation into an alleged infringement of the GDPR
and that the refusal to extend time for FBI to put in its submissions until after the EDPB
guidance was issued was not in breach of FBI’s right to fair procedures, in the very particular
circumstances of this case and having regard to the various factors to which I have referred.
In those circumstances, I reject the ground of challenge advanced by FBI based on an alleged
breach of fair procedures by the DPC in terms of the time period within which submissions
were required from FBI.
274.

It is, of course, the case that having regard to the existence of these proceedings and to

the time which it has taken for the preparation of this judgment, FBI has now had several
months to work on its submissions. I acknowledge the DPC’s confirmation, in the course of
the hearing, that in the event that it is permitted to resume the inquiry, the 21-day period will
run from the date of the resumption of the inquiry and that any reasoned request for an

132
extension of time will be considered by the DPC (obviously, taking into account the
obligations on the DPC under the GDPR, as discussed above).
16. Alleged Breach of Fair Procedures: Premature Judgment(a) Summary of Parties Positions’(1) FBI275.

FBI contends that although the PDD is stated to be a “preliminary” decision andalthough many of the views expressed in it are stated to be “preliminary”, a reasonable
observer would reasonably conclude that the DPC had reached a premature judgment on allof the important issues and that it did not have an open mind as to the ultimate conclusion to
be reached on those issues. FBI submitted that that was the conclusion a reasonable observer
would reach having read the entirety of the PDD. It submitted that the process started with a“decision” which was made by the DPC before FBI was even aware that the process hadcommenced. The procedure adopted by the DPC put the onus on FBI to attempt to persuade
the DPC to change the views which it had already expressed on all of the important issues.
276.

FBI relied not only on the terms of the PDD itself, but also on various other matters

including (a) the previous views expressed by the DPC in its draft decision in May, 2016 andin the DPC Proceedings; (b) the fact that the DPC only afforded FBI a period of 21-days to
put in its submissions in response to the PDD; (c) the fact that the DPC was seeking“targeted” submissions only from FBI; and (d) the fact that the DPC had informed ARQ, Mr.
Schrems’ solicitors, that it anticipated that it would be submitting a “draft decision” to the
Article 60 procedure within 21-days of receipt of FBI’s submissions.
277.

While relying on the entirety of the PDD, FBI did refer to particular provisions of the

document in support of its case under this ground. By way of example, it referred to themanner in which the PDD referred to certain of the findings of the CJEU in Schrems II andstated that those findings were binding on the DPC (s. 7 of the PDD). It also relied on the133contents of s. 6 of the PDD which addresses the DPC’s view as to the current factual position
relating to the relevant data transfers. FBI made the point that the PDD did not take into
account changes in US law and procedures since the findings of the High Court (Costello J.)
in 2017. It also contended that the PDD failed to take into account any difference between theadequacy assessment required to be carried out by the European Commission in making anadequacy decision under Article 45 and the adequacy assessment by a controller or processor
under Article 46, in light of what FBI described as significant differences between the termsof Recitals (104) and (108) of the GDPR. FBI noted the reference at para. 7.61 of the PDD
that the DPC was not aware of any supplementary measures adopted by FBI but pointed outthat the DPC never asked FBI for that information (see also para. 7.65(3)). FBI also criticised
the references in the PDD to the effect that it did not appear to the DPC that Article 49 of the
GDPR (which provides for derogations) did not appear to be relevant or applicable incircumstances where FBI had not sought, in the course of the DPC Proceedings, to invoke
Article 26(1) of the Directive which contained a broadly equivalent set of derogations. As
noted earlier, FBI asserted that the DPC was aware that FBI was relying on derogations (andreferred to its submissions of 22nd January, 2016 in the process leading up to the draft
decision which was adopted by the DPC in May, 2016).
278.

FBI relied on a number of the leading cases which establish that the test to be adopted

in determining objective bias and, in this case, premature judgment, is an objective test
viewed from the perspective of the reasonable objective person: including, Goode Concrete v.
CRH Plc [2015] 3 IR 493 (“Goode Concrete”) and Commissioner of An Garda Síochána v.
Penfield Enterprises Ltd [2016] IECA 141 (“Penfield Enterprises”). On the specific issue ofpremature judgment, FBI relied principally on the judgment of Clarke J. in the High Court in
A.P. v. McDonagh [2009] IEHC 316 (“A.P.”) and the judgment of Meenan J. in the High
Court in Shatter v. DPC. FBI submitted that, in light of the principles discussed and applied

134
in those cases, this was a very clear case of premature judgment. Counsel went so far as todescribe the process as being a “parody of justice”.
279.

In terms of what a reasonable objective person would be aware of in considering

whether such a person would have a reasonable apprehension that the DPC had reached apremature decision on the issues, counsel relied on ten factors which I do not propose to list
here. However, they included the contention that FBI was “singled out” by the DPC in termsof this inquiry, that the DPC had departed from published procedures, that it had not sought
any information from the FBI, that it had refused an extension of time and that theCommissioner herself had made certain comments in the keynote address in October, 2020 tothe effect that, in her view, the judgment of the CJEU in Schrems II gave her no room formanoeuvre in terms of the steps required to be taken in relation to EU-US data transfers.
Finally, FBI relied on a passage from the judgment of O’Donnell J. in the Supreme Court inBalz v. An Bord Pleanála [2020] 1 ILRM 367 (“Balz”) where he stated:“However, some aspects of the decision [of An Bord Pleanála] give the impression of
being drafted with defence in mind, and to best repel any assault by way of judicial
review, rather than to explain to interested parties, and members of the public, thereasons for a particular decision.” (at 385)
FBI submitted that the qualifying language used throughout the PDD should be seen in asimilar light, as having been drafted with the likely future defence of these judicial review
proceedings in mind.
(2) The DPC
280.

The DPC rejects the contention that it has prematurely judged any of the relevant

issues. It maintained that the PDD contains:(a)The areas or issues of concern identified by the DPC;(b)

The DPC’s preliminary views on those areas of concern;

135
(c)

A request for submissions from FBI; and(d)A commitment that those submissions will be carefully considered before any
decision is made.

281.

The DPC submitted that the words used in the PDD and in the surrounding

correspondence are critical and that, in contending that the PDD amounts, in effect, to a final
decision prematurely taken by the DPC, FBI has sought to airbrush out important words usedin the PDD. The DPC submitted that the PDD makes clear that no decision has been made by
the DPC and that any decision which will be made will be subject to and will take account of
the submissions made by FBI. As regards the criticism of the term “targeted” in terms of thesubmissions requested by the DPC from FBI, it was submitted that this term was not used to
downplay the significance of the submissions being requested by the DPC and that thecorrespondence made clear what FBI was being asked for in terms of submissions. Reference
was made, in particular, to the DPC’s letter of 3rd September, 2020 (referred to earlier).
282.

Counsel for the DPC drew attention to several references in the PDD to thepreliminary views of the DPC being subject to any submissions received from FBI, that thosesubmissions would be carefully considered and that no action would be taken on foot of the
PDD. The DPC stressed the qualifying language used throughout the PDD, such as therepeated references to the views of the DPC being “preliminary” and subject to submissions
from FBI.
283.

There was no real difference between the DPC and FBI in terms of the relevant caselaw on objective bias or on the particular species of objective bias relied on by FBI, namely,
premature judgment. The DPC also relied on the judgment of Clarke J. in A.P.. It sought todistinguish Shatter v. DPC on the basis that that case did not involve the expression of any
preliminary view by the DPC, but rather what the Court held was the expression of a final
view on a critical issue the subject of the complaint. The DPC relied on the judgment of

136
Collins J. in the Court of Appeal in Permanent TSB Group Holdings Plc v. Skoczylas [2020]
IECA 1 (“Permanent TSB”) where the Court of Appeal held that the views expressed by theHigh Court judge, which were alleged to give rise to a reasonable apprehension that the judge
had prejudged the relevant issue, were held to be “merely preliminary or provisional innature” as was clear from the terms in which they were expressed (para. 63). The DPC alsorelied on NIB (No. 2) (which was not an objective bias or premature judgment case) todemonstrate the weight to be attached to the words used by the decision-maker (in that casethe High Court inspectors).
284.

In terms of what a reasonable person would be aware of in assessing whether areasonable apprehension of bias exists, counsel for the DPC took issue with the ten points put
forward by FBI and contended that many of those points were not pleaded and were, in any
event, in dispute between the parties. It further submitted in that context that the court should
not have regard to the comments made by the Commissioner in her keynote address in
October, 2020 as those comments were made after the decision to commence the inquiry was
made and the PDD issued by the DPC. In any event, the DPC submitted that the words used
had to be seen in their context and did not give rise to any reasonable apprehension ofpremature judgment.
285.

Finally, the DPC disputed the relevance of the observations made by O’Donnell J. in

Balz on which FBI relied. The DPC pointed out that that case was not an objective bias caseand concerned a review of a final decision of An Bord Pleanála. The DPC strongly disputed
the contention that the PDD was worded with the principal purpose of repelling a judicial
review. The DPC stood over the wording of the PDD as demonstrating what it said, namely,that no decision had been taken by the DPC, that submissions were requested from FBI, thatthose submissions would be carefully considered and that, having done so, the DPC would
make a “draft decision” for submission to the Article 60 process.

137(3) Mr. Schrems
286.

Mr. Schrems did not advance any specific submissions on this issue. I have referred

earlier to the overall tenor of the submissions he made in writing and at the hearing. They did
not specifically address the question of premature judgment.
(b) Discussion and Decision on this Issue
287.

In considering this ground of challenge, I will refer first to the now well-establishedgeneral legal principles on objective bias. I will then consider the specific principles
applicable to premature judgment. Premature judgment is a form of objective bias and a close
relation of prejudgment.
288.

There is no dispute between the parties as to the general legal principles on objective

bias. I recently had cause to summarise those principles in my judgment in CHASE (No. 2) (atparas. 95 to 143). In Bula Ltd v. Tara Mines Ltd (No. 6) [2004] 4 IR 412 (“Bula”), Denham J.
said that the well-settled test for objective bias was “whether a reasonable person in thecircumstances would have a reasonable apprehension that the applicants would not receive afair trial of the issues” (at 439). In O’Callaghan v. Mahon [2008] 2 IR 514, Fennelly J. in theSupreme Court stated that “objective bias is established, if a reasonable and fair-minded
objective observer, who is not unduly sensitive, but who is in possession of all the relevantfacts, reasonably apprehends that there is a risk that the decision-maker will not be fair andimpartial” (at para. 551). Fennelly J. described the “hypothetical reasonable person” asbeing someone who is not “either over-sensitive or careless of his own position” (para. 532).
As I noted in CHASE (No. 2):“O’Callaghan makes clear, therefore, that the reasonable fair-minded objective
person is someone who is not ‘unduly sensitive’ and who is in possession of ‘all the
relevant facts’. It is the reasonable apprehension of that reasonable and fair-minded

138
objective observer that is relevant. The reasonable apprehension must be that there isa ‘risk that the decision-maker will not be fair and impartial’.” (para. 119)289.

In Kenny v. Trinity College Dublin [2008] 2 IR 40 (“Kenny”), Fennelly J. again

considered the hypothetical reasonable person. He stated:“The hypothetical reasonable person is an independent observer, who is not oversensitive, and who has knowledge of the facts. He would know both those which
tended in favour and against the possible apprehension of a risk of bias.” (para. 20)
290.

The principles discussed in Bula and O’Callaghan were again considered and appliedby the Supreme Court in Goode Concrete and by the Court of Appeal in Penfield Enterprises.
In Goode Concrete, Denham C.J. stated:“The test to be applied when considering the issue of perceived bias is objective. It iswhether a reasonable person, in all the circumstances of the case, would have areasonable apprehension that there would not be a fair trial from an impartial
judge. As it is an objective test, it does not invoke the apprehension of a judge, or any
party; it invokes the reasonable apprehension of a reasonable person, who is inpossession of all the relevant facts.” (para. 54)
291.

In Penfield Enterprises, Irvine J., commenting on the attributes of the hypotheticalobjective reasonable person, stated:“I am, of course, conscious of the fact that a judge faced with the recusal application
does not treat the ‘reasonable person’ as somebody who is over-sensitive or overscrupulous. The apprehension relied upon by the applicant must be reasonable andrealistic rather than fanciful or vague…” (para. 66)
292.

These are the principles which I will apply, together with the principle discussed

specifically in the context of that sub-species of objective bias at issue in this case, namely,
premature judgment. That issue was considered by Clarke J. in the High Court in A.P. As in139
all cases concerning alleged objective bias, the facts are of critical importance and theexercise of assessing objective bias is very much fact dependant. The case arose out of family
law proceedings in which it was contended that the interventions of the Circuit Court judge
gave rise to a reasonable apprehension of bias in the form of prejudgment or premature
judgment. On the facts, Clarke J. held that they did and made an order precluding the Circuit
judge from further hearing the family law proceedings. Having considered the generalprinciples applicable to objective bias, Clarke J. then turned to consider the principles
applicable to the form of pre-judgment known as premature judgment “where the adjudicator
indicates that the adjudicator has reached a conclusion on a question in controversy between
the parties, at a time prior to it being proper for such adjudicator to reach such a
decision…” (para. 7.4). He said that a reasonable apprehension of bias in the form of prejudgment could arise where:“…comments were made by the adjudicator which made it clear that the adjudicator
had reached a decision on some important point in the case at a time when no
reasonable adjudicator could have, while complying with the principles of natural
justice, reached such a conclusion.” (para. 7.4)
293.

Clarke J. stressed that nothing which he said should be considered as presenting abarrier to adjudicators (including judges) “giving indications as to questions, whether of factor law, which are causing concern to the adjudicator even though such indications may be
given in the course of a hearing” (para. 7.5). He noted that if such were not permitted, parties
would be in a difficult position of not being able to address any issues which were causing
concern to the adjudicator. Clarke J. continued:“There is a difference, however, between a judge or adjudicator indicating mattersthat may be causing concern, on the one hand, and using language which, on theother hand, might cause a reasonable and informed observer to believe that the judge

140
or adjudicator concerned had excluded any realistic possibility of coming to anythingother than one conclusion at a time when, in the context of the process being
followed, further evidence or argument was to be expected in relation to the issue
concerned.” (para. 7.5)
294.

It is clear from this passage that the language used by the adjudicator, or otherdecision-maker, is highly relevant to the assessment of premature judgment. The language
used must have given the reasonable impression to the reasonable and informed observer thatthe decision-maker “had excluded any realistic possibility” of coming to any otherconclusion, even though the process was ongoing.
295.

Using the phrase “rush to judgment”, Clarke J. elaborated as follows:“The form of pre-judgment which I have sought analyse can only happen at a hearing
and arises from the adjudicator creating, in the minds of reasonable and informed
people, an impression that a premature rush to judgment has occurred. Such a rush to
judgment does not necessarily depend on the adjudicator having a particular animus
towards one of the parties concerned, but rather stems from the fact that a reasonableapprehension has been created that the adjudicator has not considered all
appropriate matters before reaching what appears to be a final view on the issue.”(para. 7.6)

It is clear, therefore, that in order for there to be an impermissible premature judgment or“rush to judgment”, there has to be a reasonable apprehension that the decision-maker has
not considered everything before reaching what appears to be a “final view” on the relevant
issue. The reference here to “final view” seems to me to be particularly relevant in thecontext of the present case.
296.

In Shatter v. DPC, Meenan J. discussed and applied the principles on premature

judgment outlined in A.P. He held that in making statements in correspondence and by way

141of a public statement to the media, the DPC had prejudged a central issue in the complaint
before it, namely, that the Data Protection Acts applied to the circumstances of the complaint.
Meenan J. held that that amounted to pre-judgment in the form of premature judgment of acentral issue. This is very much consistent with Clarke J.’s reference to the decision-makerprematurely coming to a “final view” in A.P.
297.

In Permanent TSB, one of the appeals before the court was an appeal from thedecision of the High Court judge refusing to recuse himself from dealing with the substantive
application. The appellant was indisposed when the substantive application before the court
was listed for hearing and was not present in court for the hearing. The respondent waspressing for the matter to be heard, notwithstanding his absence. The High Court judge madecertain observations in relation to the appellant’s case on the substantive application to theeffect that the arguments he was relying on had been rejected previously by the High Court
and by the CJEU that “on paper” the appellant’s objections did not seem to be “ones thatwill find favour with the court”, that if the appellant was present, he would or “might wellhave something to say about it” and that that was “the view that [the judge] presently took”.
In dismissing the appellant’s appeal from the judge’s refusal to recuse himself, Collins J.
extensively considered the principles applicable to pre-judgment by reference to Irish andinternational authorities. Included in the authorities discussed were O’Callaghan and Penfield
Enterprises. In O’Callaghan, the applicant had contended that the Mahon Tribunal had prejudged an issue as to the credibility of a witness by reason of the manner in which it had dealt
with a disclosure of documents. Fennelly J. (Geoghegan J. and Finnegan J. agreeing)
considered “the quality or extent of prejudicial statements required to satisfy the test for prejudgment”. As noted by Collins J. in Permanent TSB (at para. 46), Fennelly J. referred toseveral common law authorities which emphasised the value of judicial interventions “evenwhere expressed in strong terms, provided that any views expressed were understood to142be ‘provisional’ and did not suggest that the judge had formed a ‘settled view’” (per Collins
J. at para. 46). Then at para. 47, Collins J. quoted in full from what Fennelly J. had stated atpara. 548 of his judgment in O’Callaghan on this issue. Fennelly J. said the following:“…It is an inherent and invaluable part of the common-law system of justice that
open sometimes even vigorous argument takes place between bar and bench. Judges,
on a daily basis, express opinions in the form of questions, statements or argument in
the course of a hearing. The whole purpose of these exchanges is to enable the parties
to address doubts or difficulties raised by the judge. Arguments are tested andcontested. This can, and frequently does, enable counsel to change the judge’s mind.
On other occasions, the weakness of an argument is exposed. If judges did not cometo the process with some clear, even strongly-held, views, based on the experience
they bring to the judicial process, they would be of little value as judges… Of course,
a judge may so behave that he steps outside his judicial role. If he does, it will beobvious. In my view, that is what is required, something quite outside the bounds ofproper judicial behaviour to establish objective bias, based on judicial statements.”(per Fennelly J. at para. 548 of O’Callaghan)
As noted by Collins J., O’Callaghan was considered by the Court of Appeal in Penfield
Enterprises where, in her judgment, Irvine J. had expressed some concerns about the impact
which “strongly worded criticism” or the “forceful expression of [an] opinion” on issues tobe decided may have on litigants (paras. 44 and 48).
298.

Having considered several other Irish and international authorities, Collins J.

dismissed the appellant’s appeal on the recusal issue. In a paragraph that has particular
relevance to the present case, he said:“That the views formed by the Judge were merely preliminary or provisional innature is, in my opinion, evident from the terms in which they were expressed.

143
Furthermore, the Judge clearly indicated that he understood that [the appellant]
would have arguments to make to the contrary effect and made it clear that he would
hear those arguments and, against the opposition of the Company, adjourned theConfirmation Hearing to a later date so as to enable [the appellant] to attend. He also
gave him liberty to deliver a further affidavit in advance of the adjourned hearing. A
reasonable observer would, in my opinion, attach importance both to the terms of theJudge’s statements and also to the concrete steps that the Judge took to ensure that[the appellant] would have an opportunity to be heard, steps which would have had no
purpose if the Judge had made up his mind.” (para. 63)
299.

The cases on pre-judgment or premature judgment all stress the importance of thelanguage used by the decision-maker and the stage of the process at which the premature
judgment is said to arise. The relevance of the precise words used by the decision-maker andthe time at which those words were used can also be seen in NIB (No. 2). In that case, there
was an allegation that the inspectors may have pre-judged the conduct of members of thebank’s staff without providing them with an opportunity to defend themselves. That
allegation was rejected by Kelly J. He found that the words used by the inspectors in theirsecond interim report to the court were “highly relevant”. In the final paragraph of thatreport, the inspectors stated that, in setting out details of the evidence given to them, they
wished to emphasise “that we have not yet formed any concluded view on these matters” andthat they could not do so until officials of the bank had been given an opportunity of giving
evidence. Until that was done, the inspector stated that it was not possible even to commence
the process of considering whether the evidence should be accepted or not (pp. 198-199).
Kelly J. reiterated the relevance of the words used on various occasions later in his judgment.
He stated that that paragraph “makes it clear that the inspectors emphasised that they had not
yet formed any concluded view… nor could they do so” until the relevant officials were given

144
an opportunity of giving evidence (at 211). He further stated that the allegations of prejudgment and lack of fair procedures appeared to be written as though that paragraph of thereport “did not exist” (at 212). Later, Kelly J. stated that he could find “no conclusions
drawn in the inspectors’ report” and that “the contrary is the case” since the inspectors were“careful to indicate that they have not even yet made a decision on whether the evidence
outlined… should be accepted or not” (at 213). He could see no justification for the
allegation of pre-judgment “having regard to the clear statements contained” in the relevant
paragraph of the inspectors’ report (at 213). He found that there was no basis for the
allegations of pre-judgment and lack of balance and objectivity in the report and that suchallegations could only have been made if the relevant paragraph of the inspector’s report was“ignored in its totality” (at 213).
300.

It seems to me that these principles and the consistent reliance by the courts in thecase discussed on the words actually used by the decision-maker who is alleged to have
improperly prematurely judged an issue are the principles by which I must assess FBI’s
allegations of premature judgment in this case.
301.

In those circumstances, the words used in the PDD are highly relevant. In my view, it

is clear for a number of reasons that the PDD is not the final decision or “draft decision” forthe purpose of the Article 60 process of the DPC. It is expressly stated to be a “preliminary
draft decision” and to be a “preliminary draft of a draft decision” (at para. 1.3 of the PDD).
The views expressed by the DPC in the PDD are almost invariably qualified by the word
“preliminary”: see, for example, paras. 1.3, 1.5, 1.9, 1.10, 1.12, 1.13 and 1.26. A similar
pattern can be seen throughout the PDD, including in s. 7 (paras. 7.1 to 7.66) where the DPC
sets out the “preliminary view on the lawfulness of the data transfers” and in s. 8 where the
DPC sets out its “preliminary view on appropriate corrective power”: see, for example,
paras. 7.65, 8.7 and 8.15. If all of that was not clear enough, it is reiterated at para. 9.1 that145
the PDD “involves a preliminary view only and is subject to such submissions as FBI may
make”.
302.

As well as repeatedly stating that the views expressed in the PDD are “preliminary

views”, the PDD also makes clear on countless occasions that the “preliminary views” aresubject to the submissions being invited from FBI which it is stated will be considered or“carefully” considered by the DPC: see, for example, paras. 1.3, 1.6, 1.8, 1.10, 1.11, 1.12 and1.25. Similar references are contained throughout the document: see, for example, para. 4.1,
5.16, 7.18, 7.60, 7.65, 8.6, 8.7, 9.1 and 9.3.
303.

It is also clear from the PDD that it has a number of purposes: first, to commence theown-volition inquiry; second, to set out the background and basis for the inquiry; and,perhaps third, to set out the DPC’s preliminary view on the issues. It is made clear (at para.
1.5) that “no action will be taken” by the DPC pursuant to the contents of the PDD. It seems
to me that the language used throughout the PDD makes very clear that the PDD does notcontain the DPC’s final views on the issues raised and that the preliminary views set out inthe document are subject to submissions from FBI which will be considered by the DPC. The
PDD is the opposite to the type of decision which Clarke J. in A.P., Meenan J. in Shatter v.
DPC and Collins J. in Permanent TSB were considering could amount to premature
judgment. The PDD does not contain the “final view” of the DPC on the various issues, as
envisaged by Clarke J. in A.P. It does not amount to a decision on the “central issue”
amounting to pre-judgment, as was the case in Shatter v. DPC. It is much more like theexpression of preliminary and provisional views which was considered by Collins J. in
Permanent TSB.
304.

The PDD does contain some statements which might suggest that the view expressedby the DPC is more than merely a provisional view. Examples of this can be seen in s. 7 of
the PDD where the DPC makes reference to certain findings of the CJEU in its judgment in

146
Schrems II. However, it does so in a section which is expressly headed “Preliminary View”
of the DPC on the lawfulness of the data transfers. Where the PDD refers to findings of the
CJEU, it expressly refers to particular paragraphs in the judgment. Having done so, whensummarising the issues which must be considered by the DPC arising from the judgment of
the CJEU, it is made clear (at para. 7.18) that this is all subject to such submissions as FBI
may make. At para. 7.18, the PDD states:“In summary, therefore, arising from these findings in the judgment, it appears to me– subject to such submissions as FBI may make – that I must consider…”305.

In making reference to further findings of the CJEU which the PDD says are bindingon the DPC, it does so by reference to particular paragraphs of the judgment. At paras. 7.48
and 7.49, it stated that the DPC is bound by the relevant findings of the CJEU and bound toconclude that US law does not provide protection which is essentially equivalent to thatprovided by EU law. Similar conclusions are drawn with reference to the question as towhether SCCs can remedy the alleged inadequate protection afforded by US law. The DPC’s
conclusions on that issue are expressly stated to be “preliminary” and subject to submissions
from FBI. Similarly, in relation to the issue of whether there are supplementary measures
which could address the alleged inadequate protection provided by US law, the PDD statesthat the DPC is not aware of any such measures (paras. 7.61). The PDD then goes on to set
out a summary of the DPC’s “preliminary” view on those issues subject to FBI’s
submissions (paras. 7.65 and 7.66).
306.

In my view, reading the PDD in its entirety, as a reasonable objective observer would

do, I am satisfied that it makes sufficiently clear that it is open to FBI to make such
submissions as it wishes on any of the views set out in the PDD, including on what the PDD
says are the relevant findings of the CJEU. It is open to FBI to make submissions to the effectthat the DPC is wrong in relation to its views including its views on the findings of the CJEU

147
and on the implications of those findings for the issues addressed in the PDD. I do not agreewith FBI that this was an impermissible way for the DPC to proceed by putting the onus on
FBI to persuade the DPC that it is wrong in the views which it has expressed in the PDD.
307.

In light of the entire procedural history extending back as far as Mr. Schrems’ originalcomplaint in 2013 and in light of the extensive involvement of FBI up to and including in theproceedings before the CJEU in Schrems II, it was permissible for the DPC to structure theprocess as it did and it was, and is, open to FBI to make submissions to the effect that the
DPC has got it wrong in the PDD in all of the areas on which it wishes to so contend. This
would include all of the areas referred to in submissions by FBI including whether or notthere have been any relevant changes in US law and practice since the findings of the High
Court in 2017/2018 and/or since the hearing before, and the judgment of, the CJEU in
Schrems II in July, 2019 and July, 2020; whether or not FBI has adopted or does adopt any
supplementary measures addressing the alleged inadequate protection provided by US law
and practice; whether or not FBI has relied, or does rely, on any derogations under Article 49of the GDPR; whether or not there is any difference between the adequacy assessment which
the European Commission is required to carry out compared to that which a controller orprocessor must carry out in light of the difference in the terms of Recitals (104) and (108)(and I note in that regard that the DPC contends that the CJEU, at para. 92 of its judgment in
Schrems II, did not appear to accept any such difference in the required level of protection – I
express no view on the correctness or otherwise of that contention) and on any other issues on
which it wishes to make submissions.
308.

As I have already concluded, the issue as to whether premature judgment arises must

be assessed objectively by reference to the reasonable hypothetical objective person and notby reference to the subjective views of any of the protagonists, whether FBI or the DPC.
However, I do not accept the submission made by counsel for the DPC that the evidence

148
given by Ms. Dixon that the views expressed in the PDD are “preliminary”, subject to such
submissions as FBI may make and that she would give careful and full consideration to thosesubmissions is irrelevant. Ms. Dixon gave that evidence on affidavit (at para. 7 and inverifying the matters set out in the statement of opposition). She was not cross-examined onher evidence. I accept that as a matter of fact that it was the intention of the DPC/theCommissioner that the views set out in the PDD were preliminary views only and were
subject to submissions from FBI which would be carefully considered before any final
decision was taken. However, what is irrelevant is the view of the DPC/the Commissioner
that, notwithstanding those facts, premature judgment does not arise. Whether it does or does
not is a matter to be determined in accordance with the well-established objective test.
309.

In my view, the reasonable objective person would be aware not only of the terms of

the PDD itself but also of most, if not all, of the other facts listed by counsel for FBI. I do not
accept that those facts were not properly pleaded or put in evidence in the course of theproceedings, as was argued by the DPC. However, I am not satisfied that a reasonableobjective person with knowledge of the facts (many of which are contested), being those infavour of and against the possible apprehension of premature judgment, would reasonably
apprehend that there is a risk that the DPC would not be fair and impartial in the preparationof the “draft decision” for submission to the Article 60 process. I have touched on some ofthose facts when referring to the FBI’s submissions on this issue. I do not propose to go
through them separately here. It is sufficient to note that some of the facts relied on by FBI
are contested. Indeed, I have found against FBI on some of them, including that the DPC was
not entitled to depart from its published procedures, and that it refused an extension of time(none was sought). I have, however, considered each of the alleged facts relied on by FBI andhave concluded that, read with the terms of the PDD, none of the facts relied on by FBI, in149
my view, gives rise to a reasonable apprehension of objective bias in the form of premature
judgment on the part of a reasonable person.
310.

I should now refer to the dispute between the parties as to the relevance or otherwiseof what was said by Ms. Dixon in her keynote address on 23rd October, 2020. I do not agreewith the DPC that the evidence of what Ms. Dixon said in that keynote address isinadmissible or irrelevant to the question of premature judgment. It is potentially relevant as
being something which a reasonable objective observer might factor into his or her
assessment as to whether a reasonable apprehension of premature judgment could arise.
However, while I accept that what Ms. Dixon said may be relevant, and while it might havebeen wiser to be more circumspect in what she said during the currency of these proceedings(although I can appreciate that the issues are of such significant international interest that it
may not have been possible to avoid comment on the issue), I do not believe that what she
said affords support to FBI’s case on premature judgment. Her comments must be read incontext (and, in particular, in the context of what was said at pp. 17-19 and 21-22 of thetranscript of the keynote address). The Commissioner did express the view in that addressthat the CJEU required a “case by case analysis” to be carried out and she noted that theinquiry which she conducted was stayed as a result of these proceedings and that another“litigation chapter” had been opened up. While it is possible to read what she said at p. 22 asmeaning that it is an “inevitable” consequence of the CJEU’s judgment in Schrems II that
EU-US data transfers would have to be halted, it is not clear that she was talking about the
PDD at issue in this case or that she was attempting to row back from anything said in the
PDD or in the surrounding correspondence or in her affidavit (which was sworn on the samedate). I am satisfied that a reasonable person would conclude that it remains open to FBI tomake submissions on the effect of the CJEU judgment in Schrems II and that the DPC/the150
Commissioner has not closed its or her mind to the issues or rowed back from what was saidin the PDD, in the surrounding correspondence and in Ms. Dixon’s affidavit.
311.

It is necessary finally and briefly to address a number of other points made by FBI in

support of its case on this ground. First, I do not accept that the timeframe of 21 days for FBI
to put in its submissions is supportive of a case on pre-judgment, for all of the reasons
addressed earlier in relation to the 21-day period. Second, I do not accept that the reference to“targeted” submissions can reasonably be read as downplaying the scope of thosesubmissions or the weight which would be attached to them by the DPC. While the use of theterm “targeted” may have given rise to some scope for argument as to its meaning, it seems
to me, for the reasons outlined earlier, that the PDD itself and the surrounding
correspondence make clear that FBI is not limited in any way in terms of the submissions
which it makes and that the reference to “targeted” was not intended to limit the scope of thesubmissions. That is particularly clear from the terms of the DPC’s letter to MHC of 3rd
September, 2020. Finally, I do not accept that the fact that the DPC informed ARQ, Mr.
Schrems’ solicitors, in its letter of 31st August, 2020 that it was “anticipated” that a “draft
decision” would be submitted to the Article 60 procedure within 21 days of receipt of FBI’s
submissions supports FBI’s case on premature judgment. While I believe that it was unwiseof the DPC to make such a statement to Mr. Schrems’ solicitors without drawing that to theattention of FBI and its solicitors, and that ought to have been done, it does not suggest or
support the allegation of premature judgment. The DPC was stating that it “anticipated” thata “draft decision” would be submitted within 21 days. It was not giving a commitment thatthat would be done. It is hard to see how it could have given such a commitment when it had
not, at that stage, seen any submissions give any such commitment from FBI and I do not
accept that it did. It could be said that its statement was a recognition of its obligation toproceed expeditiously and with due diligence in relation to an investigation into alleged

151
infringements of GDPR. In any event, it was not a commitment to submit the “draft
decision” within 21 days of receipt of FBI’s submissions. Nor do I believe that the statement
can reasonably be read as such or as suggesting that the DPC would not do what it said it
would do in the PDD and in the correspondence, and subsequently in Ms. Dixon’s affidavit,
namely, carefully consider the submissions made by FBI. Of course, if FBI does now avail ofthe opportunity to make submissions in response to the PDD and if the DPC does notcarefully consider and take those submissions into account when deciding on the “draft
decision” for the Article 60 process, or if FBI believes that any such “draft decision” isincorrect as a matter of law or perhaps even as a matter of fact, the possibility of further
judicial review proceedings does arise.
312.

In conclusion, therefore, I do not accept that a reasonable person would reasonably

apprehend premature judgment on the part of the DPC in deciding to commence the inquiry
and in issuing the PDD. Therefore, I reject this ground of challenge.
17. Alleged Breach of Fair Procedures: Involvement of Commissioner at Investigation
and Decision-Making Stages(1) Summary of Parties’ Positions(1) FBI313.

FBI contends that under the procedure adopted by the DPC in the PDD, theCommissioner, as the sole member of the DPC, will be involved in all stages of the inquiry
and, in particular, in the investigative and decision-making stages. It noted that the PDD wasmade by the Commissioner, as the sole member of the DPC, and that that is apparent fromthe use of the first person throughout the document and from the statement at para. 1.3 of the
PDD that the Commissioner, as the “sole decision-maker of the [DPC]” was presenting “mypreliminary view on the issues arising…” (para. 1.3). It further noted that the DPC’s letter of
28th August, 2020 enclosing the PDD was signed by the Commissioner. FBI contends that the152involvement of the DPC at all stages of the process is not in accordance with the procedures
published in the 2018 Annual Report (and on the DPC website) or with FBI’s previous
experience of DPC inquiries, in which provision is made for a careful division of the role ofthe investigator from the role of the decision-maker. The DPC investigator/inquiry team is
responsible for information gathering, considering the information, preparing a draft inquiry
report and inviting submissions. Once the draft inquiry report is finalised, it is passed to the
DPC decision-maker for the decision-making phase on infringement and, if applicable, formaking a decision on corrective powers. It is contended that not only is the procedure
adopted in this inquiry inconsistent with the DPC’s published procedures and FBI’s
experience with previous inquiries and, therefore, in breach of FBI’s legitimate expectations,but also that it is in breach of FBI’s right to fair procedures and gives the appearance of prejudgment.
314.

In its letter of 29th October, 2020, one of the questions raised by MHC was whether

the DPC had commenced any other inquiries pursuant to s. 110 of the 2018 Act where theinvestigative and decision-making phases of the inquiry were conducted by a single person(Question 3). As noted earlier, Philip Lee, on behalf of the DPC, declined to provide that
information contending that the question was not relevant for the reasons set out in its letterof 5th November, 2020. In her second affidavit of 11th November, 2020, Ms. Cunnane
confirmed that FBI’s experience in all other inquiries prior to the present inquiry involved adivision between the investigation and decision-making stages of the inquiry with thedecision-making process being carried out by a decision-maker in the DPC who had had norole in the investigatory process.
315.

In its written submissions, FBI made clear that it was not submitting that it is always

unlawful for one decision-maker to conclude all stages of a decision-making process,although it did note that the courts have expressed concern where one decision-maker “is153seen to dominate all stages of a process” and referred in that context to the decision of theHigh Court (Carroll J.) in Heneghan v. Western Regional Fisheries Board [1986] ILRM 225(“Heneghan”) (para. 83 of FBI’s written submissions).
316.

FBI did not advance oral submissions on the involvement of the Commissioner in theinvestigative and decision-making stages as being in breach of its rights to fair procedures but
dealt with it as part of its legitimate expectations case by reason of the departure by the DPC
from its published procedures. FBI did not, however, drop its case under this ground based on
an alleged breach of its rights to fair procedures and so I must address it.
(2) The DPC
317.

In response, the DPC pointed out that the Commissioner is the sole decision-maker ofthe DPC on the basis that no other Commissioner has been appointed. It asserted that
following the judgment of the CJEU in Schrems II, and, having considered the contents of thejudgment, the inquiry was proposed and scoped and the steps to be taken in the inquiry wereadopted in the course of deliberations by the DPC’s senior executive team with other
employees of the DPC assisting with the relevant information. It was not disputed that theCommissioner, as the sole decision-maker of the DPC, set out her preliminary views onbehalf of the DPC in the PDD. Nor was it disputed that the Commissioner herself was andwill be involved in the investigative stage of the inquiry. On the contrary, the DPC contended
that it is appropriate that she be involved having regard to the knowledge acquired in thecourse of the history of the issue concerning EU-US data transfers.
318.

I have noted earlier the DPC’s response to the contention that the procedure provided

for in the present inquiry is a breach of FBI’s legitimate expectations as to the procedures tobe followed and have expressed my conclusions on that ground of challenge.
319.

The DPC also denied that the procedure adopted, including the involvement of theCommissioner at the investigative and decision-making stages, amounts to a breach of FBI’s154right to fair procedures. The DPC did, however, in its statement of opposition and in Ms.
Dixon’s affidavit of 23rd October, 2020 sidestep that part of FBI’s case under this ground ofchallenge based on FBI’s experience in previous inquiries conducted by the DPC. In its
statement of opposition, the DPC asserted that FBI’s reference to its previous experience of
DPC inquiries was not adequately pleaded or particularised. The DPC did not address thatissue in Ms. Dixon’s affidavit.
320.

As part of its response to this ground of challenge, the DPC relied on the Article 60

process and noted that a decision on the issues the subject of the inquiry will never bereached by the DPC alone but will be taken collectively with other national supervisory
authorities as part of the cooperation provisions contained in Article 60 of the GDPR.
321.

The DPC did not respond to Ms. Cunnane’s second affidavit of 11th November, 2020

until it did so in the affidavits sworn by Mr. Walsh in December, 2020 and January, 2021, in
circumstances described earlier. Nor, as I have indicated, did the DPC provide information in
response to the relevant question contained in the MHC letter of 29th October, 2020
concerning any other inquiries in which the investigative and decision-making stages wereconducted by a single person (Question 3). However, Mr. Walsh’s affidavits of December,2020 and January, 2021 make clear that the present inquiry was the first inquiry in relation tocross-border data processing in which the investigative and decision-making stages were notdistinct stages and in which the Commissioner was involved in both stages. She is involved inboth stages in the present inquiry and in two other inquiries involving Facebook and threeother inquiries involving unrelated controllers since the present inquiry was commenced. The
procedure being followed in those other five inquiries are not the same as the procedure
adopted in the present inquiry although the Commissioner is involved in the investigative anddecision-making stages of those inquiries (para. 29 of Mr. Walsh’s affidavit of 23rd
December, 2020 and paras. 6 to 9 of Mr. Walsh’s affidavit of 15th January, 2021).

155(3) Mr. Schrems
322.

Mr. Schrems did not advance separate submissions directed to this specific ground ofchallenge. He did, however, advance submissions on the case made by FBI arising from thedeparture by the DPC from the procedures published in the 2018 Annual Report (and on the
DPC website). I have referred to Mr. Schrems’ submissions on that issue earlier.
(b) Discussion and Decision on this Issue
323.

Insofar as this ground is primarily based on the departure by the DPC from thepublished procedures, I have already fully dealt with that aspect of FBI’s case when
considering its case based on legitimate expectations.
324.

Insofar as a part of this ground of challenge alleges objective bias in the form of an

appearance of pre-judgment or premature judgment on the part of the DPC, I have addressed
FBI’s case on that issue earlier.
325.

The balance of FBI’s case under this ground of challenge is that it is a breach of its

rights to fair procedures for the Commissioner to be involved at the investigative anddecision-making stages of the inquiry. I do not accept that that is the case. There is no generalprinciple that the same person cannot be involved at different stages of an inquiry or
adjudicative process. Whether or not that is unacceptable as being a breach of a person’s rightto fair procedures will very much depend on the circumstances and will be very factdependent. As I have found earlier, it will be necessary to look at the entirety of theprocedure followed or to be followed in the particular inquiry and to consider the overall
fairness of the process: Rowland and Crayden and the other cases discussed earlier. There areundoubtedly some cases in which it is inappropriate and would be a breach of fair proceduresfor one person to be involved at all stages of a particular inquiry or adjudicative process. One
example of that is Heneghan. In that case, Carroll J. held that the purported dismissal of theplaintiff was in breach of natural justice. A particular person was the “prosecutor in the

156
dismissal” of the plaintiff. That person sought to dismiss the plaintiff as a result of thealleged behaviour of the plaintiff to him personally. The person concerned was also himself
responsible for gathering the evidence. He heard representations from the plaintiff and then“acted as judge on the allegations which he himself made and he then decided to dismiss”(per Carroll J. at 228). Carroll J. held that that person was “the prime mover in the dismissal
process, one of the main reasons for which was the element of personal antagonism andwhose version of facts was challenged by [the plaintiff]”. The court held that the person
concerned should have disqualified himself and referred the matter back to the defendant todecide in another way in another way. Carroll J. described the person concerned as being the“witness, prosecutor, judge, jury and appeal court”. The facts of that case rendered the result
very clear. However, those facts are radically different from the facts at issue in the present
case. FBI correctly accepted that it is not always unlawful for the same person to be involved
at all stages of a decision-making process. Heneghan was an example of a case where it was
unlawful. However, it seems to me that that case turned very much on its facts. Those facts
are radically different from the present case. In no sense could the position of theCommissioner be equated or seen as similar to the person whose conduct was at issue in
Heneghan.
326.

I have concluded that where there is no question of any breach of any legitimate

expectation and where no issue of objective bias in the form of pre-judgment or premature
judgment arises, it is not a breach of FBI’s right to fair procedures for the Commissioner tobe involved in the investigative and decision-making stages of the DPC’s inquiry. Her
involvement in those different stages makes sense and seems to me to be entirely reasonablegiven the history of the issues concerning EU-US data transfers which are the subject of theinquiry. It would be unreal and entirely unrealistic to maintain that the Commissioner should
step back from any involvement in the investigative stage of the inquiry bearing in mind her

157
involvement and the involvement of her office in the EU-US data transfer issues over the past
several years and the knowledge and experience built up in this area over that period. I do not
accept that fair procedures require that she do so.
327.

For these reasons, I reject the ground of challenge advanced by FBI under thisheading.
18. Single Decision to Cover Infringement and Corrective Measures: Ultra Vires Section
111 of 2018 Act
328.

FBI initially contended that the DPC was acting ultra vires its powers under s. 111 of

the 2018 Act by proposing in the PDD that the “draft decision” which would be made,following receipt and consideration of FBI’s submissions in response to the PDD, would set
out the DPC’s provisional view as to whether or not an infringement has occurred or is
occurring and as to any action which should be taken including whether any corrective
powers should be exercised. It was contended that ss. 111(1) and (2) require separate
decisions by the DPC, one as to infringement of the GDPR and the other as to corrective
measures and that that was the approach which the DPC had previously stated it would adopt
in other own-volition inquiries.
329.

This ground of challenge was opposed by the DPC. The parties exchanged written

submissions addressing this ground. However, this ground of challenge was dropped by FBI
during the course of its application at the hearing. It is, therefore, unnecessary to address thisground any further.
19. Failure to Await Guidance from EDPB and/or Failure to Take Timing of EDPB
Guidance into Account(a) Summary of the Parties’ Positions(1) FBI158
330.

FBI contends that the DPC acted unlawfully in commencing and maintaining thepresent inquiry in circumstances where the EDPB had indicated, following the judgment of
the CJEU in Schrems II, that it would be issuing guidance arising from the judgment,
including guidance on supplementary measures. FBI maintains, in the alternative, that inmaintaining the inquiry, the DPC failed to take into account a relevant consideration, namely,that the EDPB was examining the judgment in Schrems II and would be issuing guidance. Asa further alternative, FBI contends that the DPC failed to provide adequate reasons as to why
the inquiry was being maintained or was not paused in light of the guidance which was to beissued by the EDPD.
331.

In support of this ground, FBI relied on various matters including: the press release

issued by the DPC on 16th July, 2020 following the judgment in Schrems II and, in particular,
on the reference in that statement to the fact that it was looking forward to developing a“common position” with other European supervisory authorities to give effect to the
judgment; the EDPB’s FAQ document issued on 23rd July, 2020 in which reference wasmade to the fact that the EDPB was analysing the judgment in Schrems II and considering thetype of supplementary measures that may be required and that it would be providing moreguidance on these issues; the announcement by the EDPB on 4th September, 2020 that two
task forces had been created by the EDPB following the Schrems II judgment and that one ofthose task forces would prepare recommendations to assist controllers and processes onappropriate supplementary measures to ensure adequate protection in the case of datatransfers to third countries and the statement by the chair of the EDPB that such
recommendations would be issued; and the DPC’s membership of the board of the EDPB and
its alleged knowledge of the timeframe for the publication of guidance by the EDPB.

159
332.

FBI also drew attention to the establishment of the EDPB under Article 68 of the

GDPR and the tasks entrusted to it under Article 70, including the issuing of guidelines andrecommendations to ensure “consistent application” of the GDPR (Article 70(1)(e)).
333.

FBI submitted that at the time of the issuance of the PDD and the commencement of

the proceedings, it was understood that the EDPB taskforce would be making
recommendations concerning the use of SCCs and providing guidance on supplementarymeasures. After the commencement of the proceedings and before the hearing, the EDPB
adopted recommendations on 10th November, 2020 on supplementary measures which werethen made available for public consultation. No submissions were addressed at the hearing in
relation to the content of those recommendations.
334.

FBI submitted that it was contrary to the purpose and intent of the GDPR and, inparticular, Article 64(2) for the DPC to pursue the inquiry in circumstances where the EDPB
was going to publish guidance on the issues covered by the inquiry. It submitted that theinevitable effect of the inquiry would be to undermine the consistent application of the
GDPR. It further maintained that, to the extent that the DPC was aware, prior to the issue ofthe PDD, that EDPD guidance would be forthcoming, the decision to commence andmaintain the inquiry amounted to an improper exercise by the DPC of its discretion and a
failure to take into account relevant considerations, namely, the forthcoming EDPB guidance.
FBI further maintained that in proceeding with the inquiry, the DPC has acted unfairly anddisproportionately by singling out FBI for investigation where other regulated entities will
have the benefit of the guidance issued by the EDPB and will be able to assess their activities
and ensure that they are conducted in light of that guidance. While maintaining the case thatthe DPC was precluded from proceeding with the inquiry until the EDPB issued its guidance,
the primary focus of FBI’s submissions on this ground was directed to the alleged failure by

160
the DPC to take into account as a relevant consideration, in deciding whether or not toproceed with the inquiry, the fact that the EDPB would be issuing guidance.
335.

FBI contended that there was an inconsistency between what the DPC said in its letterof 3rd September, 2020 to MHC (that the DPC did not consider the timing of the publicationof guidance by the EDPB to be of relevance) and what was said by the Commissioner in her
keynote address on 23rd October, 2020 (that “the area where the EDPB can be very effective
in harmonising… is in producing that harmonised guidance…”) and in the DPC’s written
submissions that the DPC would “obviously” consider the EDPB guidance and have regard
to any observations which FBI may wish to make concerning it prior to adopting a “draft
decision” (para. 131).
336.

FBI was critical of the absence of evidence from the DPC as to its knowledge of thetimeframe within which the EDPB was to issue its guidance and also referred to the fact that,
although MHC’s letter of 29th October, 2020 had asked (at Question 6) about the extent of
any engagement between the DPC and EDPB in relation to the proposed guidance and the
DPC’s understanding concerning the timing of such guidance. Such information was notprovided by the DPC in Philip Lee’s letter of 5th November, 2020. It should, however, be
noted that the DPC did address the question of timing at paras. 123(3) and 131 of thestatement of opposition and in Philip Lee’s letter of 10th November, 2020 (to which reference
will be made below).
337.

FBI also relied on the description by Philip Lee (on behalf of the DPC) of the CJEU’s

judgment in Schrems II as being “transformative” of the law in relation to EU-US datatransfers, making it all the more important for the DPC to await EDPB guidance on the issue.
338.

It also submitted that, having regard to the attendance of a Deputy Commissioner ofthe DPC at the plenary meeting of the EDPB on 2nd September, 2020, following which theestablishment of the two task forces referred to earlier was announced by the EDPB, it was161difficult to see how the DPC could maintain (as it did in its letter of 3rd September, 2020) thatthe timing of the publication of the EDPB guidance was not relevant. FBI contended that thetiming of when the EDPB would be publishing its guidance was clearly relevant to any
decision taken by the DPC to commence an inquiry when it did on 28th August, 2020. It
contended, therefore, that the DPC had failed to consider a relevant consideration. FBI also
contended that the DPC did not provide any reason for not awaiting publication of the EDPB
guidance and contrasted the way other regulated entities were treated by the DPC.
(2) The DPC
339.

The DPC maintains that it was not obliged to await publication of the EDPB guidance

before deciding to commence and proceed with the inquiry or that it failed to take into
account any relevant consideration in that regard. The DPC confirmed (in its written
submissions) that since the EDPB recommendations were issued for public consultation, theDPC would take them into account as well as any submissions which FBI made in relation to
them.
340.

The DPC referred to its obligation to enforce the requirements of the GDPR as

referred to throughout the judgment of the CJEU in Schrems II. It made express reference topara. 108 of the judgment where the CJEU made reference to the “supervisory authorities’
primary responsibility [being] to monitor the application of the GDPR and to ensure its
enforcement”. The DPC maintained that it could not delay in commencing and proceedingwith the inquiry and that it was under no obligation to do so. It maintained that it was obliged
to proceed to give effect to the judgment of the CJEU.
341.

The DPC further relied on (i) the fact that EDPB guidelines are not binding on the

DPC and address data transfers not by reference to any specified third country but in the
abstract; (ii) the fact that no date for publication of the EDPB guidance had been fixed at thetime the PDD was issued, that the DPC was aware at that time the EDPB would be issuing

162
guidance but not when that guidance would be issued and that it was clear that publication of
the guidelines was not imminent (paras. 123(3) and 131 of the DPC’s statement of
opposition); (iii) that the DPC was required to act independently and free from “external
influence” under Article 52(1) and 52(2) of the GDPR; and that (iv) the absence of guidance
does not mean that supervisory authorities cannot perform their regulatory functions andduties.
342.

The DPC relied on the terms of its letter of 3rd September, 2020 to MHC in which it

explained why it disagreed with FBI that it was necessary to await publication of guidance by
the EDPB before proceeding with the inquiry. It submitted that that letter set out clearly thereasons for the DPC’s decision to proceed. It further referred to the Philip Lee letter of 10th
November, 2020 which put in context the timing of the plenary meeting on 2nd September,2020 and the establishment of the task forces which was announced on 4th September, 2020.
It noted that the EDPB recommendations were only published and put out for public
consultation on 10th November, 2020. It rejected the contention that there was anything
illogical or inconsistent about the DPC’s confirmation that it would take into account the
EPDB recommendations and FBI’s submissions on them as those recommendations were
now in existence.
343.

Finally, the DPC drew attention to the fact that supervisory authorities in otherjurisdictions had taken action in respect of EU data transfers following the CJEU’s judgment
in Schrems II, notwithstanding the absence of EDPB guidance. It relied in particular on
actions taken by the supervisory authorities in France and Finland.
(3) Mr. Schrems
344.

Submissions were made on behalf of Mr. Schrems in respect of this ground. He

submitted that the DPC was obliged to proceed with the inquiry and was not obliged orentitled to await publication of guidance by the EDPB. He relied on the obligations imposed

163
on the DPC under the GDPR to proceed expeditiously and with due diligence and on thefindings of the CJEU in Schrems II, including the finding made at para. 121 which hecontended meant that, in the particular circumstances, the DPC was required to suspend or
prohibit the relevant data transfers. Not only was the DPC not obliged to await the EDPB
guidance, it was obliged to proceed with the inquiry, in Mr. Schrems’ submission.
(b) Discussion and Decision on this Issue
345.

I have concluded that FBI must also fail on this ground of challenge. I do not accept

that the DPC was obliged to await the publication of guidance by the EDPB before deciding
to commence and to proceed with the inquiry or that it was precluded from doing so until the
EDPB guidance was published. FBI has advanced no good legal basis for the existence of any
such obligation. On the contrary, in my view, it was at the very least reasonable for the DPC
to take the view that it was obliged to proceed with an inquiry consequent upon the judgmentof the CJEU in Schrems II.
346.

There is nothing in the GDPR concerning the establishment and functions of the

EDPB which would impose such an obligation upon the DPC or preclude it from proceedingwith the inquiry. On the contrary, I am satisfied that there is nothing in the GDPR which
would support the contention that the absence of guidance from the EDPB amounted to a baron the DPC commencing and proceeding with the inquiry. There is nothing in s. 2 of Chapter
VII of the GDPR under which the EDPB was established and which sets out its functions
which could be read as imposing such an obligation on the DPC. Article 70(1) of the GDPR
provides that the EDPB “shall ensure the consistent application” of the GDPR. To that end,
it has the power under Article 70(1)(e) to issue “guidelines, recommendations and bestpractices in order to encourage consistent application” of the GDPR. Article 70 does notprovide that a supervisory authority must refrain from acting under the GDPR pending theissuance of any such guidelines, recommendations or best practices. Nor does it provide that

164
those guidelines, recommendations and best practices are binding on the supervisory
authority. While the EDPB clearly has a very important role in seeking to ensure theconsistent application of the GPDR and while the guidelines and recommendations which it
issues are undoubtedly extremely influential, they are not binding on supervisory authorities.
347.

Chapter VI of the GDPR deals with “independent supervisory authorities”. Section 1of that chapter provides for the “independent status” of those authorities. Article 51 makes
express reference to the independence of the supervisory authorities provided for by Member
States which are responsible for monitoring the application of the GDPR “in order to protect
the fundamental rights and freedoms of natural persons in relation to processing and to
facilitate the free flow of personal data within the Union”. Article 52(1) provides that “eachsupervisory authority shall act with complete independence in performing its tasks andexercising its powers in accordance with [the GDPR]”. Article 52(2) requires members ofsupervisory authorities to “remain free from external influence, whether direct or indirect”
and “[to] neither seek nor take instructions from anybody” in performing their tasks andexercising their powers under the GDPR. An obligation to await EDPB guidance before
proceeding to exercise powers under the GDPR (or under the 2018 Act), where it believes it
is required to act, would not be consistent with the independence of the DPC under the GDPR
or with the non-binding nature of the guidance which the EDPB is empowered to issue inaccordance with its provisions.
348.

I am also satisfied that any requirement to await EDPB guidance before proceeding

would be inconsistent with the obligations imposed on the DPC by the GDPR to act within areasonable period of time and with due diligence and to take action where required under the
GDPR, as provided for in the provisions of the GDPR and as discussed in the CJEU’s
judgment in Schrems II in provisions and passages referred to earlier in this judgment

165(including Recitals (129) and (141) and Article 57 of the GDPR and paras. 109, 112 and 121of the judgment in Schrems).
349.

I am satisfied that there is no basis for FBI’s contention that the DPC was obliged to

await EDPB guidance before commencing and proceeding with the inquiry or that it was
precluded from so acting until that guidance was issued.
350.

Nor am I satisfied that the DPC failed to take into account, as a relevant

consideration, in its decision to commence and proceed with the inquiry the fact that the
EDPB would be issuing guidance arising from the judgment in Schrems II. It is, of course,
the case that the DPC was obliged to take into account relevant considerations and todisregard irrelevant considerations and that a failure to do so would leave its decision toproceed with the inquiry open to challenge: see, for example, State (Lynch) v. Cooney [1982]
IR 337 (per Henchy J. at 381); P&F Sharpe Ltd v. Dublin City and County Manager [1989]
IR 701 (per Finlay C.J. at 717-718); and F.D. v. Minister for Education and Skills [2019]
IEHC 643 (per Allen J. at para. 38). However, I do not believe that the DPC failed to take
into account any relevant considerations.
351.

I accept the position set out in the DPC’s statement of opposition and verified in Ms.

Dixon’s affidavit that at the time the PDD was issued, the DPC was aware that the EDPB
would be issuing guidance but that it was not aware of when such guidance would be issued
although it was clear that this was not imminent.
352.

In its letter to MHC of 3rd September, 2020, the DPC explained why it wasproceeding with the inquiry and why it was not required to await publication of guidancefrom the EDPB. The DPC was of the view that it was obliged to proceed by reason of thejudgment of the CJEU in Schrems II and that compliance with its obligations was notcontingent on the publication of guidance by the EDPB. I am satisfied that it was reasonable
for the DPC to take the view that it was obliged to act on foot of the CJEU’s judgment. It is,166
however, somewhat unfortunate that on two occasions in the letter, it was stated that the DPC
did not consider that the “timing” of the publication of guidance by the EDPB was relevant
either to the decision to proceed with the inquiry or as to the time period for receipt ofsubmissions from FBI. The timing of the publication of the guidance was relevant in thesense that, while the DPC was not aware of the timeframe within which the guidance would
be issued, it was aware that this was not imminent. It would have been better if the DPC had
made that clear in the letter. However, the letter was clear in stating that the DPC felt obliged,by virtue of the CJEU’s judgment, to proceed with the inquiry and that it was not obliged to
await guidance from the EDPB. The position might well have been different if publication of
the guidance was imminent when the PDD was issued. However, that was not the case. The
DPC has now confirmed that it will take into account the recommendations issued by the
EDPB in November, 2020 and any submissions from FBI based upon thoserecommendations. Despite the somewhat confusing wording used in the letter, I am satisfied
that the DPC did not fail to take into account any relevant consideration and its belief that itwas not only entitled but obliged to proceed with the inquiry was a reasonable one.
353.

I am also satisfied that the DPC’s letter of 3rd September, 2020 set out the reasons

why it decided to proceed with the inquiry at that stage, notwithstanding that the EDPB had
indicated that it would be publishing guidance. I reject the contention by FBI that no reasons
were given by the DPC for its decision to proceed with the inquiry in those circumstances.
354.

As I have indicated elsewhere, I believe that it would have been preferable for the

DPC to have responded to the information sought at Question 6 of the MHC letter of 29th
October, 2020, although I accept that some further information was provided in thesubsequent letter from Philip Lee of 10th November, 2020. It was, in my view, unnecessarily
defensive of the DPC not to have provided the information sought concerning the extent of its
engagement with the EDPB in relation to the EDPB’s guidelines or recommendations.

167
355.

As regards the argument made by FBI that it was unlawful and disproportionate toinquire into FBI prior to the publication of the EDPB guidance in circumstances where otherregulated entities would be assessed by reference to that guidance and could conduct theiractivities by reference to it, I do not accept that that is so. I will consider this argument further
under the separate ground of challenge advanced on this basis by FBI based on alleged
inequality and discrimination.
356.

Finally, I should say that I do not attach much, if any, weight to the actions taken by

the supervisory authorities in France or Finland on which the DPC relied. I accept what Ms.
Cunnane said about this at para. 51 of her second affidavit of 11th November, 2020. The
French supervisory authority did not commence any inquiry but rather was invited by theConseil d’État (Council of State) to submit observations in the context of proceedings
brought by other parties. I also accept that the DPC provided very little information
concerning the action of the supervisory authority in Finland. Although Ms. Cunnane madethat point at para. 5.1 of her affidavit, the DPC did not provide any further information in any
further affidavit. However, I have been in a position to consider this ground without reference
to what may have happened in France or in Finland.
357.

For the reasons set out above, I have concluded that FBI is not entitled to succeed on

this ground of challenge.
20. Alleged Discrimination/Breach of FBI’s Right to Equality: Inquiry into FBI Only(a) Summary of the Parties’ Positions(1) FBI358.

In its statement of grounds, FBI pleaded that as the PDD and the relevantcorrespondence from the DPC to FBI did not indicate that an inquiry had been commenced
by the DPC into EU-US data transfers by any other entities within its jurisdiction, it was abreach by the DPC of FBI’s rights to equality and non-discrimination arising from various

168
sources for the DPC to commence an inquiry into FBI’s transfers and to do so by means of
the PDD. Reference was made to Article 20 of the Charter, the principle of equality as a
general principle of EU law, Article 40.1 of the Constitution of Ireland and Article 14 of theEuropean Convention on Human Rights (ECHR). It was also alleged that the commencementof the inquiry into FBI, but not into other similar entities, was disproportionate, ultra vires
and a misuse by the DPC of its discretion. FBI contended that the proposed suspension of its
data transfers (by means of the proposed corrective measure set out in the PDD) would giverise to an unfair distortion of free competition breach of the Treaty on the Functioning of the
EU (TFEU).
359.

In its replying submissions at the hearing, it was clarified by FBI’s counsel that its

case is not that DPC is under an obligation to inquire into all similar companies and that, if it
does not, it is precluded from carrying out the inquiry in respect of FBI. Counsel clarified that
FBI’s case is that, having regard to the potential outcome of the inquiry which may lead tothe proposed suspension of its EU-US data transfers, the DPC ought not to have commenced
an own volition inquiry into FBI’s data transfers as it could lead to unfair distortion ofcompetition but that, in any event, the commencement of such an inquiry in respect of FBI
only required an explanation. It was said that that was particularly so in light of the positionpreviously adopted by the DPC (prior to the CJEU’s judgment in Schrems II).
360.

FBI submitted that the DPC was obliged to give reasons for the prima facie inequalityof treatment of FBI and for the absence of consistency in the enforcement of the GDPR by
the DPC. It submitted that by proceeding as it has done, the DPC has infringed FBI’s rights
under Irish law and EU law in relation to equality and non-discrimination and that it has done
so without providing any explanation. FBI noted that Question 4 in the MHC letter of 29th
October, 2020 enquired as to whether the DPC had commenced any own volition inquiry into
other regulated entities pursuant to s. 110 of the 2018 Act in relation to EU-US data transfers

169
following the judgment in Schrems II and that the DPC failed to answer that question in thePhilip Lee letter of 5th November, 2020. The answer given was that the question did not arise
from the pleadings and was not relevant.
361.

In support of this ground of challenge, FBI relied principally on cases which it

contended demonstrated that administrative decision makers have an obligation to maintainconsistency in their decisions in similar situations. In that regard it referred to cases such as
Cassidy v. Minister for Industry and Commerce [1978] IR297 (“Cassidy”): PPA v. RefugeeAppeals Tribunals [2007] 4 IR 924 (“PPA”); COI v. Minister for Justice [2007] 2 ILRM 471(“COI”) and Udaras Uchtala v. M. & Ors [2020] IESC 64 (“Udaras Uchtala”). While
accepting that it might be possible for a decision maker to depart from consistency in aparticular case, it had to give reasons for doing so: J.N. v. Minister for Justice [2009] 1 IR
146 (“J.N.”). The main case on which FBI relied in its oral submissions was the decision of
Meenan J. in NMH. FBI also sought to distinguish the European cases on which the DPC
relied in support of its entitlement to proceed against FBI (to which I will refer below).
(2) The DPC
362.

In response, the DPC maintains that it is entitled to carry out an own volition inquiry

in respect of FBI’s EU-US data transfers and that it has explained why it has proceeded in
respect of FBI. The DPC pleaded in its statement of opposition (para. 133) and stated in Ms.
Dixon’s affidavit (para. 26) that it has ongoing investigations into EU-US data transfers
involving four other controllers following receipt of complaints (from NOIB-European
Centre for Digital Rights, an organisation in which Mr. Schrems is involved). The DPC
submitted, therefore, that it was not the case that it was only investigating FBI’s transfers.
However, it submitted that even if that was the case, there would nonetheless be no breach of
any of the equality or non-discrimination provisions relied upon by FBI (to the extent that itwas entitled to rely on such provisions).

170
363.

The DPC characterised FBI’s case as being that it was not permissible for the DPC tocarry out an inquiry in respect of FBI, in circumstances where it did not carry out an inquiry
into other entities in a similar position which are subject to its jurisdiction. However, as noted
earlier, FBI refined its case somewhat in the course of the oral argument at the hearing andconfirmed that it was not making that case.
364.

The DPC relied on a number of decisions of the CJEU in support of its entitlement toproceed against one but not all similar entities: such as, for example, Case C-89/85 Ahlström
v. Commission [1993] ECR I-01307 (“Ahlström”); Case 247/87 Star Fruit Company SA v.
Commission [1989] ECR 291 (“Star Fruit”); Case T-24/90 Automec srl v. Commission Case
[1992] ECR II-02223 (“Automec II”); and Case C-119/97 Ufex v. Commission [1999] ECR I01341(“Ufex”).
365.

The DPC sought to distinguish the Irish cases on which FBI relied and contended thatthey did not concern cases involving the exercise of regulatory functions. The DPC relied on
the judgment of Donnelly J. in the High Court in Coleman v. The Revenue Commissioners[2014] IEHC 662 (“Coleman”). The DPC sought to distinguish NMH on the basis of the facts
and statutory provisions at issue in that case.
366.

The DPC contended that the fact that other entities might be in a similar position to

FBI did not preclude the DPC from commencing an inquiry in respect of FBI and that it was
not required to commence an own volition inquiry into every entity in a similar position.
Finally, insofar as it was contended that the DPC had not given reasons as to why it had only
decided to commence an own volition inquiry in respect of FBI’s transfers, the DPC
contended that it was not required to explain why it had not commenced own volition
inquiries into other entities and that it had adequately explained why it had decided tocommence such an inquiry in respect of FBI.
(3) Mr. Schrems

171
367.

Mr. Schrems did not address specific submissions on this issue.
(b) Discussion and Decision on this Issue

368.

The essential issue raised by this ground is whether it is open to the DPC tocommence and proceed with an own-volition inquiry in respect of FBI’s EU-US datatransfers in circumstances where there are other entities which fall within the jurisdiction of
the DPC and which are continuing to make EU-US data transfers using SCCs in respect ofwhich the DPC has not commenced any own-volition inquiry. At a basic level, this issue
raises the question as to whether for the DPC to proceed in this way breaches any right toequality or to non-discrimination which may be enjoyed by FBI under Irish or EU law,
including Article 40.1 of the Constitution, Article 20 of the Charter, the principle of equality
as a general principle of EU law and Article 14 of the ECHR. In truth, as the hearing of thecase evolved, it became clear that FBI’s case had become more refined and did not reallyfocus on these legal sources for equality and non-discrimination. FBI’s case really boiled
down to the contention that if the DPC decided to “single out” FBI by commencing an ownvolition inquiry into FBI’s relevant data transfers, with the potentially very serious
consequences at the end of the process for FBI’s business, without doing so in respect ofother entities, then the DPC had to explain why it had chosen to so proceed.
369.

I have concluded that it is very clear why the DPC has decided to proceed in respectof FBI at this stage and that it has adequately explained in the PDD and in its correspondencewith FBI and its solicitors, MHC, why it has decided to commence and proceed with an ownvolition inquiry in respect of FBI. I do not accept that there is any legal obligation, whether
arising under any of the equality provisions on which FBI relies or by virtue of any principleof consistency in decision-making or of good administration, to explain why it has notcommenced any own-volition inquiry against other entities who are also involved in making
or directing EU-US data transfers using SCCs. Nonetheless, it appears to me to be very

172
obvious why the DPC has chosen to proceed in respect of FBI at this stage. FBI was the
subject of Mr. Schrems’ complaint and his reformulated complaint, was named as adefendant and fully participated in the DPC Proceedings and was a party to and fully
participated in the Article 267 reference to the CJEU in Schrems II. While the findings of the
CJEU in Schrems II extend beyond the individual facts of the case and its conclusions apply
in the case of all controllers or processors who are involved in EU-US data transfers using
SCCs, it is, however, understandable that since the judgment was given in a case involving
FBI, the DPC would initially, at least, consider the obligations imposed on it by the judgmentwith respect to FBI’s EU-US data transfers.
370.

The evidence does establish that, as of the hearing of the case in December,

2020/January, 2021, the DPC had not commenced an own-volition inquiry into any otherentity in respect of EU-US data transfers, it had received complaints in respect of four othercontrollers who are involved in such transfers and its investigations on foot of thosecomplaints were at that time ongoing. The fact that those complaints were made by NOYBEuropean Centre for Digital Rights, a body in which Mr. Schrems is involved, does not seemto me to be relevant or to undermine the fact that other investigations and potential regulatory
action is ongoing in respect of other controllers engaged in such transfers. That in itself
would, in my view, be sufficient to dispose of any alleged breach of FBI’s right to equality
under any of the provisions on which it relies.
371.

If there is a duty on a decision-maker, such as the DPC, to act consistently (and such aduty appears to be in its infancy as appears from Hogan and Morgan at para. 17-50, pp. 899900, by reference to the judgment of McGovern J. in the High Court in COI), such a duty
cannot mean that a regulator such as the DPC is obliged to act against all entities involved insimilar conduct at the same time, unless, of course, the statutory provisions under which theregulator acts so require. Again, subject to any statutory provisions to the contrary, regulators

173
must be entitled to prioritise their actions and will generally have to do so, in any event, by
reason of resource constraints. I accept that a regulator or decision-maker who decides tocommence regulatory action, such as by issuing the PDD in the present case, should explain
why it has decided to proceed against the relevant entity but I do not agree that it is necessary
to explain why it is not proceeding against all other similar entities who may be in the sameor in a similar position. I have considered all of the cases on which FBI relies and I cannot
find support in any of those case for the existence of any such obligation. It may, of course,
be the case, as Birmingham J. noted in J.N., that if a decision in a particular case differs fromdecisions in “apparently like cases” fairness requires the decision-maker to explain where
the point of departure was and that an applicant “should not be left perplexed as to why he or
she failed, and someone else succeeded on the same facts” (per Birmingham J. at para. 16, p.
152). However, that is not what is at issue here. The DPC has not made any decision which
differs from decisions made in “apparently like cases” as in J.N. It has decided to commence
an own-volition inquiry and to proceed against one entity, FBI, at this stage in circumstances
which are understandable in light of the history of its engagements with FBI and their joint
travels through the Irish Courts and the CJEU and which have been adequately explained, in
my view, in the PDD and in the surrounding correspondence. Nor is this an equivalentsituation to that which arose in Udaras Uchtala, where the Supreme Court was considering
the apparently different treatment in terms of recognition of identical foreign adoptions andwhere real issues of equality under Article 40.1 of the Constitution arose. That is radicallydifferent to the present case, as is implicitly acknowledged by FBI in the more refined casewhich it made in respect of this ground of challenge at the hearing.
372.

I am satisfied that the PDD and the surrounding correspondence (and, in particular,

the DPC’s letters of 28th August, 2020 and 3rd September, 2020) did explain why the DPC
had decided to commence the own-volition inquiry in respect of FBI’s transatlantic data174transfers. For the reasons discussed in respect of a number of the earlier grounds of challenge,
it is open to FBI to make full and detailed submissions in respect of what is said in the PDD
and to attempt to persuade the DPC that it should not proceed to make a draft decision in theform proposed on a preliminary basis in the PDD for whatever reasons FBI considers
relevant. I do not accept that the DPC was obliged to go further and to explain in the PDD orin the surrounding correspondence why it had chosen not to commence an own-volition
inquiry into other controllers or processors engaged in similar transfers.
373.

It is, I believe, only necessary briefly to address some of the cases relied on by theparties in respect of this ground. The judgments of the CJEU on which the DPC rely do, in
my view, support the DPC’s entitlement to proceed as it has done.
374.

In Ahlström, a number of groups of applicants sought to challenge a decision of theEuropean Commission which found that several wood pulp producers and their tradeassociations had infringed the competition provisions of the Treaty by engaging in concerted
action on pricing. One of the grounds of challenge to a part of the contested decision broughtby one of the groups of applicants was that they had been discriminated against bycomparison with another entity which they contended had engaged in more egregious
conduct which had not been sanctioned in the contested decision. That argument was rejectedby the CJEU. It stated:“The fact that a trader who was in a position similar to that of an applicant was notfound by the Commission to have committed any infringement cannot in any event
constitute a ground for setting aside the finding of an infringement by that applicant,provided it was properly established.” (para. 146)
375.

A similar conclusion was reached in an Irish context by Donnelly J. in the High Courtin Coleman. In addressing an argument based on the Taxpayers’ Charter under which the175
Revenue Commissioners have agreed to administer the law fairly, reasonably andconsistently, Donnelly J. stated:“Undoubtedly the Revenue Commissioners should apply the law in a fair, reasonable
and consistent manner. That will be the result of applying the relevant statutory
provisions as to tax due or exemption payable. In my opinion, a commitment to fair,reasonable and consistent application of the law does not permit the clear provisionsof a statute to be disregarded in favour of perceived consistency. Thus, the focus must
always be on the implementation of the statutory code rather than a comparative
analysis of cases.” (at para. 33)
376.

Therefore, the proper focus should be on whether the relevant decision-maker hascorrectly applied the relevant statutory provisions in respect of the person in question rather
than how it has done so with respect to other persons who may be in a similar position. I
accept that that is not a universal principle and there may be nuances to it. However, it does
seem to me that both Ahlström and Coleman are of some relevance to even the more refinedcase made by FBI at the hearing on this ground.
377.

Another CJEU judgment relied on by the DPC was Star Fruit. FBI submitted that thatcase had no relevance to the issue here. I disagree. In Star Fruit, the applicant was a Belgiancompany involved in the importation and exportation of bananas. It made a complaint to theEuropean Commission that the system for supplying the banana market in France wasincompatible with the Treaty. It requested the Commission to commence infringement
proceedings against France. The Commission did not do so and the applicant then broughtproceedings before the CJEU seeking a declaration that the Commission had acted unlawfullyin failing to commence proceedings against France. The Court held that the application was
inadmissible in its entirety on various grounds. However, in the course of its short judgment,

176
the Court stated that it was clear from the scheme of (what was then) Article 169 of theTreaty:“…that the Commission is not bound to commence the proceedings provided for inthat provision but in this regard has a discretion which excludes the right forindividuals to require that institution to adopt a specific position.” (para. 11)
378.

The CJEU reached a similar conclusion Case C-87/89 Sonito v. Commission [1990]

ECR I-01981 (“Sonito”) (at paras. 6-7). The CJEU again concluded that the European
Commission had no obligation to commence proceedings under that provision of the Treaty
and had a discretionary power to do so.
379.

The CJEU reached a similar conclusion in Automec II, holding that the European

Commission was not bound to commence infringement proceedings. In that case, theapplicant had made a complaint to the Commission arising from the non-renewal of a motor
vehicle distribution agreement. The applicant alleged that the non-renewal was a breach of
the competition provisions of the Treaty. It requested the Commission to take a decisionordering the manufacturer to bring the alleged infringement to an end and to continue
supplying the distributor. The Commission declined to do so. The applicant sought annulmentof that decision before the CJEU. In rejecting the application, in addition to holding that theCommission was not bound to commence infringement proceedings, the CJEU held thatneither the Treaty nor the relevant secondary legislation required the Commission to make adecision as regards alleged infringement. The Court held that the Commission was under noobligation to do so and could not be compelled to carry out an investigation (para. 75 and 76).
The Court further observed that:“In the case of an authority entrusted with a public service task, the power to take all
the organizational measures necessary for the performance of that task, including
setting priorities within the limits prescribed by the law - where those priorities have

177
not been determined by the legislature - is an inherent feature of administrative
activity. This must be the case in particular where an authority has been entrustedwith a supervisory and regulatory task as extensive and general as that which has
been assigned to the Commission in the field of competition. Consequently, the factthat the Commission applies different degrees of priority to the cases submitted to it
in the field of competition is compatible with the obligations imposed on it by
Community law.” (para. 77)
380.

While accepting the facts and the legal provisions at issue in Automec II weredifferent to those at issue in the present case, the observations of the CJEU set out in theparagraph just quoted are relevant and of assistance in considering this ground of challenge
by FBI. The judgment does provide support for my earlier comment that it must be open to aregulatory and decision making body, such as the DPC, to prioritise the exercise of its
investigative and decision making functions, unless its governing legislation provides
otherwise (which is not the case here). As I have already indicated, I do not believe that anyof the Irish cases relied upon by FBI provide support for the proposition that if decision
makers are subject to an obligation to act in accordance with the principle of consistency (andthey may well be, in certain circumstances, the precise parameters of which it is unnecessary
for me to decide in this case), that does not preclude the DPC from deciding to proceed, at
this point, against one entity but not against others, provided that it explains why it isproceeding against that entity. The cases relied on by FBI do not suggest otherwise.
381.

To take one example, NMH does not provide support for FBI’s case under thisground. In that case the Minister for Health directed the Health Information and Quality
Authority (the “Authority”) to commence an investigation under s. 9 of the Health Acts, 2007
into the safety of the services provided by the applicant hospital. Under that section, theMinister was empowered to require the Authority to carry out such an investigation if he or

178
she believed “on reasonable grounds” that there was a “serious risk” to the “health or
welfare” of a person receiving services at the hospital. The court had to consider the basis forthe decision of the Minister in order to determine whether he had reasonable grounds forbelieving that there was a serious risk to the health or welfare of persons receiving services at
the hospital. The Minister accepted that the risk which he claimed to have identified also
existed in other hospitals across the health service. Meenan J. held that it was irrational andunreasonable for the Minister to direct an investigation under that section into a hospital incircumstances where the practices the subject of the investigation exist in many otherhospitals. In other words, the court held that the belief which the Minister was required tohold under the relevant section was not a reasonable one. That case, therefore, turned on aconsideration of the statutory precondition which had to be established before the Minister
could require the Authority to carry out the investigation, i.e. that the Minister held aparticular belief on reasonable grounds. The court held that the belief held by the Minister
was not a reasonable one. Therefore, the Minister was not entitled to require the investigation
to be undertaken.
382.

While FBI relied on the decision in NMH to support its contention that it was unfair

and unlawful for the DPC to commence an inquiry into FBI but not into other entities
engaged in transatlantic data transfer or, at least, to do so without some explanation, thedecision does not afford support for that proposition. The decision in NMH turned on thereasonableness of the Minister’s opinion to direct an inquiry into the services in the applicant
hospital, notwithstanding that the same practices were in existence in other hospitals, becausethat was what was required by the relevant section. There is no equivalent statutory provision
at issue in this case. Nor did FBI actually make the case that the decision of the DPC tocommence the inquiry at issue was unreasonable or irrational in the sense considered in

179
O’Keeffe v. An Bord Pleanála [1993] 1 IR 39 and Meadows v. Minister for Justice [2010] 2
IR 701.
383.

In summary, therefore, I do not accept that FBI has established that in commencing

the inquiry at issue, the DPC acted in breach of FBI’s rights to equality under any of the legal
basis relied upon by FBI. The DPC was entitled to commence and proceed with the inquiry inrespect of FBI’s data transfers without having to carry out inquiries into other entities
involved in similar transfers. The reason why the DPC commenced the inquiry in respect ofFBI’s data transfers is clear from the context in which the decision was made (including
obviously the judgment of the CJEU in Schrems II in proceedings to which FBI was a party)
as well as from the contents of the PDD itself and from the surrounding correspondence. I am
satisfied that the PDD and that correspondence clearly set out the reasons why the DPC
decided to conduct an inquiry in respect of FBI’s data transfers. I do not accept that principlesof equality or of consistency or good administration, whatever their source, required the DPC
to explain why it had decided to commence an inquiry in respect of FBI and not in respect ofother entities. DPC was entitled to do so and provided that it explained why it had decided tocommence an inquiry in respect of FBI, it did not have to provide an explanation as to why it
was not commencing inquiries into other entities.
384.

I have concluded that the case law of the CJEU on which the DPC relied provides

support, by way of analogy, for the approach taken by the DPC. I do not accept that any of
the cases on which FBI relies provides support for the case originally made or for the refinedcase which FBI made in respect of this ground of challenge. It remains open to FBI to makesuch submissions as it feels are appropriate in response to the matters addressed in the PDD.
Nothing in my judgment is intended to operate as a constraint on the content and extent of
those submissions.
385.

For these reasons, I reject this ground of challenge advanced by FBI.

180
21. Alleged Disproportionality of Simultaneous Inquiries:
386.

FBI originally contended that it was disproportionate for FBI to be subjected to two

simultaneous inquiries in relation to substantially the same subject matter, namely, the DPC’s
own volition inquiry and its ongoing consideration of Mr. Schrems’ reformulated complaint.
While raised as an issue in these proceedings in respect of which specific grounds werepleaded in the statement of grounds and addressed in Ms. Cunnane’s first affidavit of 10th
September, 2020, FBI took the position in its written submissions that this issue should be
addressed in the context of Mr. Schrems’ proceedings.
387.

The DPC rejected the contention that there was any disproportionality in the approachtaken by the DPC. It did not accept that being subjected to parallel processes, one acomplaints-based process and the other an own volition inquiry, in itself, gave rise to any
disproportionality. It noted that the GDPR and the 2018 Act envisaged that both forms ofinquiry were available to the DPC. However, it was also satisfied to deal with the issue in thecontext of Mr. Schrems proceedings.
388.

Mr. Schrems did not object to this issue being addressed in the context of his

proceedings.
389.

At the hearing of these proceedings it was agreed that the issue would be left over tobe addressed in Mr. Schrems’ proceedings. However, in the period between the conclusion of
the hearing of these proceedings and the date on which Mr. Schrems’ proceedings were due
to commence, Mr. Schrems’ proceedings were compromised as between the DPC and Mr.
Schrems. FBI was not a party to the arrangements agreed between the DPC and Mr. Schrems.
FBI informed me that it was reserving its rights and that it was not asking me to decide thisoutstanding issue. In the circumstances, I do not propose to address this issue any further.

181
22. Adequacy of DPC’s Reasons(a) Summary of the Parties’ Positions(1) FBI390.

One of the reliefs which FBI seeks is a declaration that the DPC did not provide

adequate or sufficient reasons in respect of the commencement of the own volition inquiry inrespect of FBI’s EU-US data transfers, the PDD, the inquiry process and the progressing of
the inquiry (relief 10 in s. D of the statement of grounds). At para. 81 of the statement ofgrounds, FBI pleaded that no reasons, or inadequate reasons, were provided by the DPC for anumber of decisions of or proposed courses of action by the DPC. Many of the issues referred
to in that paragraph overlap with earlier substantive grounds of challenge advanced by theFBI. They include issues such as why the inquiry was commenced while the investigation
into Mr. Schrems’ reformulated complaint was ongoing, why the inquiry was commenced
into FBI’s transfers only, why the DPC chose not to await guidance from the EDPB, why theprocedures published in the 2018 Annual Report were not followed, why FBI was only
afforded three weeks for its submissions and why an extension was refused and why the DPC
had an undisclosed intention to invoke the Article 60 procedure within three weeks of receipt
of FBI’s submissions.
391.

FBI relied on the well-known judgments of the Supreme Court Connelly and Mallakin support of its case that the DPC’s decision to commence the inquiry and to issue the PDD
was not supported by adequate reasons. It also relied on Mallak in support of its contention
that the DPC failed adequately to explain the decision making process itself.
(2) The DPC
392.

The DPC did not dispute that it was obliged to provide reasons but contended that thereasons for the DPC’s decision to commence the inquiry were apparent from the PDD andfrom its letter of 28th August, 2020. It submitted that at no stage did FBI raise any complaint

182
that it did not know why the DPC was proceeding as it was or seek an explanation for the
DPC’s approach.
(3) Mr. Schrems
393.

Mr. Schrems did not make any discreet submissions on this issue.
(b) Discussion and Decision on this Issue

394.

This ground of challenge can be addressed briefly. Insofar as FBI made complaints

concerning the adequacy of the reasons given by the DPC for its decision to commence theinquiry and to adopt the procedure which it did, I have addressed those arguments in thecontext of earlier grounds of challenge advanced by FBI. I am not satisfied that there is any
deficiency in terms of the reasoning given by the DPC for its decision to commence theinquiry, to adopt the procedure which it adopted and to take the various procedural steps anddecisions which it took up until the inquiry was stayed by the order of Meenan J. on 14th
September, 2020.
395.

I can deal very briefly with the relevant legal principles concerning reasoning. As

noted earlier, they were summarised recently in Crekav and CHASE (No. 2) in which theleading cases, including Connelly and Mallak, were discussed in some detail. I summarised
earlier the essential requirements to be considered in determining the adequacy of reasons
given for a decision. To recap, they are: first, the person affected by the decision must be able
to know, at least in general terms, why the decision was made; second, that person should be
provided with enough information to consider whether he or she could appeal or seek tojudicially review the decision; and, third, the reasons given for the decision must allow the
court or other body hearing the appeal or conducting a review of the decision to do soproperly. Those are the principles which I have applied in considering FBI’s case on reasons.
396.

I am satisfied that the DPC has complied with its obligation to give reasons for (1) its

decision to commence the inquiry and (2) the decision to adopt the particular procedure

183
which it adopted and the decisions taken in the course of that procedure until the inquiry wasstayed.
397.

I am satisfied that the PDD and the surrounding correspondence and, in particular, the

DPC’s letter of 28th August, 2020 and 3rd September, 2020 provide adequate reasons for the
DPC’s decision to commence the inquiry and to do so by means of the PDD. While FBI may
be unhappy with the substance of the reasons, in considering this ground of challenge, thecourt is only concerned with the adequacy of the reasons given and not with the merits
underlying those reasons. I am satisfied that in its letters of 28th August, 2020 and 3rd
September, 2020 and in the PDD itself, the DPC did explain why it had decided to commence
the own volition inquiry in respect of FBI’s EU-US data transfers and why it had adopted theprocedure which it adopted.
398.

I am satisfied that the correspondence explains why, for example, the DPC decided

not to await guidance from the EDPB and why it felt that twenty-one days was a sufficient
time for FBI’s submissions. I have already concluded that the DPC was entitled to adopt theprocedure it adopted and the published procedures were illustrative only and envisaged the
DPC departing from them in an appropriate case and I am satisfied that the correspondence
and the PDD adequately explained the particular procedure which it had decided to adopt in
respect of this inquiry.
399.

As regards the contention that if the DPC did not disclose its intention to invoke theArticle 60 procedure within three weeks of FBI’s submissions, I have addressed this point
earlier. The DPC ought to have informed FBI that it had indicated to Mr. Schrems’ solicitorsthat it anticipated being in a position to invoke the Article 60 procedure within three weeks of
the receipt of the receipt of FBI’s submissions. However, I do not see this as an issue ofreasons. Nor do I believe that it invalidates the decision to commence the inquiry or to adopt
the particular procedure adopted.

184
400.

I accept that FBI raised a series of relevant questions in the MHC letter of 29th

October, 2020 which ought to have been answered more fully at the time by the DPC.
However, again, I do not see that as a reasons issue. In my view, the failure to respond more
fully to the questions raised in the MHC letter of 29th October, 2020 does not detract from theadequacy of the reasons given in the earlier correspondence and in the PDD itself.
401.

As regards the requirement to give reasons for the decision making process, in myview the DPC complied with its obligation to do so. In Mallak, Fennelly J. stated:“In the present state of evolution of our law, it is not easy to conceive of a decision
maker being dispensed from giving an explanation either of the decision or of thedecision making process at some stage. The most obvious means of achieving fairness
is for reasons to accompany the decision.” (para. 68, p. 322)
I am satisfied that the letters of 28th August, 2020 and 3rd September, 2020 and the PDD itself
did adequately explain the decision making process and that FBI was in no doubt about whatthat process was.
402.

In summary, therefore, I am satisfied that the DPC did provide adequate reasons for

its decision and for the decision making process. In those circumstances, I reject this groundof challenge.
23. Duty of Candour(a) Summary of the Parties’ Positions(1) FBI
403.

While it was not a pleaded issue in the case and while no relief was sought in respectof it, FBI contended in correspondence and in its written submissions and in the oral
submissions at the hearing that the DPC was in breach of its duty of candour in refusing toanswer the questions raised in the MHC letter of 29th June, 2020. I have referred earlier to thequestions raised in that letter and to the response to the letter provided by Philip Lee on

185behalf of the DPC on 5th November, 2020. FBI submitted that the questions raised in theletter of 29th October, 2020 were relevant and sought information which the DPC was
required to provide as a public body whose decision was being challenged in these judicial
review proceedings.
404.

While not seeking any relief arising from the alleged breach by the DPC of the duty ofcandour, FBI submitted that it was relevant in two respects. First, it contended that thealleged breach of candour “fed into” and contributed to the alleged unfairness of the process
put in place by the DPC for its inquiry in respect of FBI, to the alleged appearance of prejudgment/premature judgment, to the departure by the DPC from published procedures, to theknowledge possessed by the DPC as to the imminence or otherwise of the EDPB guidance
when the PDD was issued and to the issue as to why FBI was “singled out” by the DPC bymeans of this inquiry. Second, FBI contended that the failure by the DPC to provide theinformation sought in the letter of 29th October, 2020 provided a basis for the court to draw
certain inferences, such as that the present inquiry is the only inquiry which has beencommenced by the DPC by adopting a provisional draft decision and by adopting theprocedure set out in the PDD. It should be noted that this latter submission was advanced byFBI’s counsel prior to the exchange of further affidavits in the course of late December,
2020/early January, 2021 which dealt with this issue.
405.

In support of its submissions based on the alleged breach of the duty of candour, FBIrelied on the judgment of Barrett J. in Murtagh v. Judge Kilrane [2017] IEHC 384(“Murtagh”) and the ruling on costs given by the Supreme Court in GRA v. Minister for
Public Expenditure and Reform (No. 2)(ruling delivered 10th May, 2018 by Clarke C.J.)(“GRA No. 2”). FBI also relied on the dictum of O’Donnell J. in the Supreme Court in Balzwhich I referred to earlier.

186(2) The DPC
406.

In response, the DPC denied that it had breached its duty of candour. It referred to thedetailed and extensive statement of opposition served by the DPC in the proceedings as wellas Ms. Dixon’s affidavit which exhibited all of the relevant correspondence between FBI, Mr.
Schrems and the DPC. With regard to the Philip Lee letter of 5th November, 2020 in responseto the MHC letter of 29th October, 2020, the DPC submitted that the questions raised and theinformation sought did not arise from the statement of grounds and were not relevant to theissues in the proceedings, as explained in that correspondence.
407.

The DPC further queried the basis on which and the purpose for which FBI had raised

the alleged breach of the duty of candour. It submitted that this was not a case like GRA (No.
2), where the decision at issue had not been properly explained by the decision maker. The
DPC did fully explain its decision to commence the inquiry in the PDD and in thesurrounding correspondence. It further submitted that the correspondence relied by FBI in
support of its allegation of a breach of the duty of candour was sent after the DPC’s statementof opposition and Ms. Dixon’s affidavit were served. It further noted that while theinformation sought in the letter might have provided a basis for seeking discovery of
documents from the DPC, no discovery was sought by FBI. It further contended that all of theissues on which FBI was relying in the proceedings were addressed in the correspondence
and all of that correspondence was exhibited. It submitted that no adverse consequences
should arise or inferences drawn on foot of the matters alleged under this heading.
(3) Mr. Schrems
408.

Mr. Schrems did not advance any submissions on the issue of the alleged breach by

the DPC of the duty of candour.

187(b) Discussion and Decision on this Issue
409.

While I do not accept that there was any breach by the DPC of the duty of candour, I

do have some misgivings about the failure by the DPC to respond more fully to theinformation sought in the MHC letter of 29th October, 2020. Before outlining my reasons forthat conclusion and for those misgivings, I will refer briefly to the legal principles referable tothe duty of candour.
410.

Public bodies whose decisions are subject to judicial review have a duty of candour inthe manner in which they defend those proceedings. They are required to be upfront in themanner in which they do so. In RAS Medical Limited T/A Parkwest Clinic v. Royal College ofSurgeons in Ireland [2019] IESC 4, Clarke C.J. stated:“As was noted by Lord Donaldson M.R. in R. v. Lancashire County Council Ex p.
Huddleston [1986] 2 All E.R. 941, such parties (i.e. public authorities) should
conduct public law litigation ‘with all cards face upwards on the table’.” (para. 6.9)
411.

In Cork Harbour Alliance for a Safe Environment v. An Bord Pleanála [2019] IEHC

85 (“Chase (No. 1)”), I considered the duty of candour on public authorities in defending
judicial review proceedings and noted that Barrett J. had helpfully summarised the principles
derived from the Irish and English cases on the issue in Murtagh. I agreed with the principles
set out at para. 25 of Barrett J.’s judgment in that case and do so again here.
412.

The Supreme Court did not expressly refer to the duty of candour in the costs ruling in

GRA (No. 2) but the ruling did cover very similar territory. The Supreme Court was dealing
with a costs application arising from the dismissal of the appeal in its judgment in GRA (No.
1). The Court had to consider the extent to which it would have been appropriate for the State
parties, when giving a narrative of the circumstances leading to the decision which waschallenged, to have made reference to the central role played by a particular senior tradeunion official. The Court ultimately concluded that the State parties ought to have given a

188
more complete account and that the account initially given on its behalf “fell short of thestandard required” and that, therefore, it was open to the trial judge to take the view that theaccount of the decision making process given in the initial affidavits filed by the State wasincomplete. The Supreme Court upheld the decision of the High Court awarding the costs ofthe proceedings to the GRA and the decision of the Court of Appeal dismissing the State’s
appeal from that decision and also awarded the GRA its costs of resisting the further crossappeal to the Supreme Court. In the course of its ruling, the Supreme Court made someobservations which are relevant to the issue which I am now considering. Clarke C.J. stated:“However, it seems to the court that there is an obligation on a respondent public law
decision maker to give to the court an account of at least the central features of thedecision making process under challenge so as to enable the court to be properly
informed about that process. While there may be a particular onus in respect of issues
specifically raised in the challenge, it must be acknowledged that a challenger will
not necessarily be aware of everything that occurred within the decision making
process. It might well be otherwise where the decision under challenge took place asa result of a formal process resulting in a reasoned determination. But that was not
the case here.

It should be recalled that there is an obligation on the part of a decision maker toprovide the court with a reasonable account of the decision and the decision making
process. The decision maker must, of course, be entitled to take into account the
precise nature of the challenge made. However, the decision maker should err on theside of caution in giving the court any information which might reasonably beconsidered as being potentially relevant…” (pp. 5-6) (emphasis added)

189
413.

I should also refer here to the comments of O’Donnell J. in the Supreme Court Balzon which FBI relied. It should be immediately noted that the Supreme Court was notconcerned in that case with any alleged breach of a duty of candour in that case. It was
dealing with an appeal from the High Court in judicial review proceedings on an issue
relating to the proper approach to be taken by the Board to ministerial guidelines issued under
the Planning and Development Act, 2000. In the course of this judgment, O’Donnell J.
commented on the form of the Board’s decision. He stated:“…some aspects of the decision give the impression of being drafted with defence in
mind, and to best repel any assault by way of judicial review, rather than to explain tointerested parties, and members of the public, the reasons for a particular decision.”(at 385).
414.

FBI relied on these comments in support of an earlier substantive ground of challenge.

It is also relied on them in support of its contention that there has been a breach of the duty ofcandour by the DPC. However, I do not believe that they provide any support for such asuggestion. I have already concluded that the PDD and the surrounding correspondence didadequately explain the reasons for the decision to commence the inquiry and the decision
making process. I have also rejected the suggestion that the PDD was drafted in a boiler plate
form and in an overly defensive format. But that is not what I am directly concerned with in
this part of my judgment, namely, that is whether the DPC has breached its duty of candour.
O’Donnell J.’s observations in Balz were not directed to the issue of whether any breach of aduty of candour arose. That was not an issue in that case.
415.

I accept that the DPC provided a great deal of information relevant to its decision andto the decision making process in the PDD and in the correspondence, including the letters of
28th August, 2020 and 3rd September, 2020. I also accept that the statement of opposition wasa lengthy and detailed document which set out the facts relevant to the decision and the190
decision making process which were verified by Ms. Dixon in her affidavit. This was not acase where the statement of opposition served by the DPC was a mere denial of theallegations contained in the statement of grounds. Further, all of the relevant correspondence
between the DPC, FBI and Mr. Schrems was exhibited by Ms. Dixon, including the DPC’s
letter to Mr. Schrems of 31st August, 2020 which contained the reference to the DPC’s
anticipation that a “draft decision” would be submitted to the Article 60 procedure withintwenty-one days of receipt of FBI’s submissions, to which issue has been taken by FBI. Quite
properly that letter and all of the relevant correspondence was exhibited by the DPC to Ms.
Dixon’s affidavit.
416.

The directions agreed between the parties following the entry of the proceedings in

the Commercial List did not include any provision for discovery. The parties wereundoubtedly keen to have the proceedings determined as expeditiously as possible. However,there was nothing to prevent the FBI from seeking discovery from the DPC in the event thatit felt that there were other documents which might be relevant to the issues raised in theproceedings and which ought, therefore, to be provided by the DPC. There was no question,
therefore, of the DPC refusing to provide documents requested by FBI by way of discovery.
417.

In light of all of this, I do not believe that it could reasonably be concluded that the

DPC was in breach of a duty of candour in the manner in which it has defended theseproceedings. However, that is not the end of the matter. As the Supreme Court made clear in
the costs ruling in GRA (No. 2), a decision maker “should err on the side of caution” ingiving to the court (and to the party who has challenged the decision) “any information whichmight reasonably be considered as being potentially relevant” (per Clarke C.J. at p. 6). In myview, the questions raised in the MHC letter of 29th October, 2020 were reasonable questions
to ask and sought information which, at the very least, “might reasonably be considered as
being potentially relevant” to the issues in the proceedings. That is the case, in my view, with

191
respect to Questions 1-4 and Question 6 in that letter. I do not necessarily share the sameview with respect to Question 5 which seems to me to have been more in the nature of aninterrogation or an attempt to cross-examine the DPC on what it had said in the letter to Mr.
Schrems of 31st August, 2020. However, with respect to the other questions, they did seek, atthe very least, potentially relevant information. In its letter in response of 5th November,
2020, Philip Lee, on behalf of the DPC, refused to provide the information sought contendingthat the information was not relevant to the grounds of challenge advanced by FBI. I regard
that response on behalf of the DPC as being unnecessarily overly defensive. It was a very
rigid and inflexible approach. The information sought in all but one of the questions was, as I
have indicated, at the very least potentially relevant to the issues in the proceedings and it
was only by adopting a very strict analysis of the pleadings that the DPC refused to provide
the information sought on the grounds that it was not relevant. However, in my view, theDPC ought to have erred on the side of caution, as stated by the Supreme Court in GRA (No.
2) by providing the information and ought not to have acted in an overly defensive manner byrefusing to do so. Had the answers been given to at least some of those questions (and inparticular, Questions 1-4), it may well have obviated the need for the further exchange ofaffidavits between the parties in late December, 2020/early January, 2021, after theconclusion of the hearing. Two further affidavits were sworn by Mr. Walsh on behalf of the
DPC and one by Ms. Cunnane on behalf of FBI. Those affidavits may well not have beenrequired had answers and information been provided by the DPC in response to the questions
raised.
418.

Having said that, it was open to FBI to follow up with the DPC after the Philip Lee

letter of 5th November, 2020. It could, for example, have sought discovery of documents
referable to the issues raised. It could have sought further directions from the court as to how
best to proceed in the event that the information was truly required by FBI rather than merely

192
being used as a stick to beat the DPC at the hearing. FBI did none of those things. It does noteven appear to have pursued the issue in further correspondence.
419.

Having carefully considered the position, I am satisfied that there was no breach by

the DPC of its duty of candour in the defence of these proceedings. I do, however, believe
that, acting within the spirit of what the Supreme Court stated in GRA (No. 2), all but one of
the questions raised in the MHC letter of 29th October, 2020 should have been answered by
the DPC. Its failure to so do, however, did not amount to a breach of the duty of candour. It
was open to FBI to take further steps arising from the failure of the DPC to answer thequestion. Those further steps were not taken. Had the questions been answered and theinformation been provided, it may well have avoided the need for further affidavits to beexchanged after the hearing.
420.

It follows that I am not satisfied that there was any breach of a duty of candour andthat the failure to provide the information requested does not feed into or contribute in any
way to the allegations of pre-judgment or premature judgment or any of the other grounds ofchallenge advanced by FBI. Nor is it necessary for me to draw any inferences from the failure
to provide the information in response to the questions raised as the further affidavits
exchanged between the parties after the hearing did yield that further information and I haveset out my findings and conclusions arising from that information earlier in this judgment. I
will hear further submissions from counsel as to what, if any consequences should follow
from the findings and conclusions reached in this section of my judgment.
24. Abuse of Process/Improper Purpose
421.

In its statement of opposition, the DPC pleaded that FBI’s proceedings were an abuseof process and were issued for an improper purpose (para. 19). The DPC provided particularsof that plea and referred to comments made by Mr. Clegg, Vice President for Global Affairs
for Facebook Inc., at a European Business Summit debate/webinar on 22nd September, 2020

193
and in a statement published on Facebook’s website on 9th September, 2020. It was pleaded(at para. 19(6)) that it appeared that FBI had brought the proceedings “for the purpose of
preventing any decision being taken regarding its EU-US data transfers until such time as theEuropean Commission and the US” had negotiated a replacement for the Privacy Shield
Decision which had been invalidated by the CJEU in its judgment Schrems II. The facts
underlying that serious allegation were verified by Ms. Dixon in her affidavit of 23rd October,2020. She exhibited the documents on which the DPC relied in making the allegation.
422.

FBI responded to the allegation in Ms. Cunnane’s second affidavit of 11th November,

2020. She made clear that FBI was rejecting, as unfounded, the allegation of abuse of process
and improper purpose. She disputed the contention that Mr. Clegg had indicated that theapplication was aimed at “buying time” and asserted that at all times FBI had and has an“entirely proper purpose” in bringing the proceedings, namely, to secure “the vindication of
its rights to fair and proper procedures and ensuring that it is not subjected to an unlawful
inquiry” (para. 77). Ms. Cunnane then set out a number of matters on which FBI relied todispute the allegation of abuse of process and improper purpose. She noted, for example, thata number of the concerns raised by FBI in the proceedings were shared by Mr. Schrems who
had brought his own proceedings. She also asserted that FBI’s conduct in the proceedings
was inconsistent with the allegation made and pointed out that FBI consented to the entry of
the proceedings in the Commercial List and agreed to an accelerated timetable for theproceedings.
423.

As the allegation of abuse of process and improper purpose remained in issue between

the parties until the hearing, the written submissions exchanged between FBI and the DPC
each dealt with the allegation and set out the parties’ respective positions on the issue andreferred to the legal principles and cases on which they would be relying.

194
424.

Mr. Schrems did not make any submissions on this issue and, as already noted,

brought his own proceedings which have since been compromised on terms alreadymentioned.
425.

As the DPC maintained the allegation up to the hearing, it had to be addressed byFBI’s counsel in his opening submissions. It was not until the end of the third day of thehearing that the DPC, through its counsel, informed FBI and the Court that the allegation of
abuse of process and improper purpose was not being “pressed” and that the DPC was notrelying on Mr. Clegg’s comments in support of any defence based on abuse of process or
improper purpose. The allegation was, therefore, abandoned at that point and it was
unnecessary for FBI to deal with it any further in its reply. It was, however, submitted by the
DPC that the court could take a “more jaundiced view of the arguments” made by FBI in lightof the comments of Mr. Clegg which were relied on by the DPC. I have already addressed thearguments made by FBI on their merits and have not considered it appropriate to take a“jaundiced view” of those arguments by reference to the comments made by Mr. Clegg on
the Facebook website or at the webinar referred to.
426.

In light of the effective withdrawal of the DPC of the allegation of abuse of process

and improper purpose by FBI in bringing the proceedings, it is not necessary for me to deal inany detail with the substance of the allegation. However, it is necessary for me to saysomething more about this.
427.

The allegation that the proceedings were an abuse of process or brought for an

improper purpose was a serious allegation to make. It was squarely made in the DPC’s
statement of opposition and had to be dealt with by FBI in a replying affidavit, in its written
submissions and in oral submissions made in opening the case at the hearing. It was only atthe end of the third day of the hearing that FBI and the Court were informed that theallegation was not being maintained.

195
428.

I should make clear that, in my view, there is and was no basis for the allegation thatthe proceedings amounted to an abuse of process or that they were brought for an improper
purpose. The relevant legal principles applicable to determining whether there is an abuse ofprocess, or whether proceedings have been brought for an improper purpose, are summarisedin Biehler, McGrath and Egan McGrath “Delany and McGrath on Civil Procedure” (4th Ed.)
(paras. 16-43–16-58, pp. 692-696). The principles derived from the leading cases such as
Grant v. Roche Products (Ireland) Ltd [2008] 4 IR 679 and Sean Quinn Group Ltd v. An
Bord Pleanála [2001] 1 IR 505 were very helpfully summarised by Barrett J. in Dunnes
Stores v. An Bord Pleanála [2015] IEHC 716 (“Dunnes Stores”) at paras. 64 to 80. I agreewith the judge’s summary of those principles. Applying them here, even if there were acollateral purpose for FBI’s proceedings (and I do not have to so decide), I am perfectly
satisfied that there was a proper purpose for bringing the proceedings, in that the proceedings
were brought with a view to enforcing and vindicating what FBI believed were its rights andrestraining what FBI believed were the unlawful actions of the DPC. I have found against
FBI on all of the substantive grounds of challenge advanced by it. However, I am quitesatisfied that the proceedings were brought for a proper purpose. FBI raised weighty anddifficult legal issues on which very extensive written and oral submissions were exchangedby the parties. FBI undoubtedly raised arguable grounds of challenge and that was recognisedby the High Court (Meenan J.) in giving leave to FBI to bring the proceedings. Some of thegrounds relied on by FBI were supported by Mr. Schrems who brought his own proceedings,
making some of the same arguments (as well as a number of other arguments). I have no
doubt that even if FBI had a collateral purpose in bringing the proceedings (and I am not so
deciding), it had a proper purpose and objective in bringing the proceedings. Moreover, it
cooperated in the expeditious and efficient conduct of the proceedings by consenting to theentry of the proceedings in the Commercial List, to an expedited timetable for the exchange

196
of evidence and submissions and to the joinder of Mr. Schrems as a notice party to theproceedings. Had it been necessary for me to decide the issue as to whether FBI’s
proceedings were an abuse of process or brought for an improper purpose, I would certainly
have decided that they were not.
429.

I would go so far as to say that the allegation (which was not a mere tactical plea inthe statement of opposition but was verified on affidavit, addressed in the written submissions
and maintained up to and until the end of the third day of the hearing) ought not to have been
made and, having been made, ought to have been withdrawn much sooner than it was. I am,of course, not blind to the pressures of complex litigation such as this and to the greatly
abbreviated timeframe within which pleadings, affidavits and submissions had to beexchanged. I am prepared to accept that this may well have been a contributory factor to thelate withdrawal of the allegation. I will hear further from counsel as to what, if any,
consequences should follow from the making and withdrawal of this allegation and from thefindings and conclusions set out in this section of my judgment.
25. Summary of Conclusions
430.

In summary, I have reached the following conclusions in this judgment:(1)I have concluded that the decisions of the DPC on 28th August, 2020 tocommence the own volition inquiry under s. 110 of the Data Protection Act,2018 in respect of FBI’s EU-US data transfers, to issue the Preliminary Draft
Decision and to adopt the procedures set out in that document and in thesurrounding correspondence are all amenable to judicial review.

(2)

Having reached that conclusion, I have then considered each of the grounds ofchallenge advanced by FBI in respect of the DPC’s decision and in respect ofthe procedures adopted by it. FBI did not maintain two of the grounds ofchallenge. Of the remaining grounds of challenge, I have concluded that those

197
grounds must be rejected and that FBI has not established any basis for
impugning the DPC’s decision or the PDD or the procedures for the inquiry
adopted by the DPC.
(3)

I have considered and rejected FBI’s allegation that the DPC was in breach ofits duty of candour in the manner in which it defended these proceedings. I
have, however, concluded that the DPC ought to have answered a number ofthe questions raised on behalf of FBI in correspondence sent on 29th October,2020 which was responded to on behalf of the DPC on 5th November, 2020.

(4)

I have considered the allegation of abuse of process and improper purpose
made by the DPC but withdrawn in the course of the hearing. I haveconcluded that there is and was no basis for the allegation, that it ought not tohave been made and that, having been made, it ought to have been withdrawn
much sooner than it was.

(5)

For the reasons set out in this judgment, I refuse all of the reliefs sought by
FBI and dismiss the claims made by it in the proceedings.

431.

I will list the proceedings for mention shortly after I have circulated this judgment to

the parties. I will then hear from counsel on any issues arising from the judgment and on the
final orders to be made, including costs. If necessary, I will give further directions for any
further hearings which may be necessary to deal with those issues.
432.

Finally, I would like to record my thanks and appreciation to the counsel andsolicitors acting for FBI, the DPC and Mr. Schrems for their cooperation in ensuring an
expeditious hearing of the proceedings and for their clear, concise and extremely helpful
submissions on the numerous difficult legal issues which were required to be determined in
the proceedings.