The battle began in 2013 when Schrems brought a complaint against Facebook’s mass data slurping to the commissioner in Ireland, where the company’s European HQ is.
After initially declining to investigate the complaint, the commissioner, Helen Dixon, then referred the case up to the Court of Justice of the European Union. That resulted in the collapse of the Safe Harbor agreement on trans-Atlantic data flows, in 2015.
A subsequent case - aimed at asking whether the standard contractural clauses, used for data transfers since the demise of Safe Harbor, provide adequate protection - was then brought by the commissioner in 2016.
However, she did this in a particularly unusual way, asking the commercial division of the High Court in Ireland to refer the question up to the CJEU - and naming Facebook Ireland and Schrems as defendants in the proceedings.
And it is this case - DPC v Facebook Ireland and Maximillian Schrems - that has reportedly cost the Irish commissioner’s office almost €2m in court costs over the past two years.
According to the Irish Independent, which submitted a Freedom of Information request to the commissioner, €1.928m has been spent on legal and related expert fees in 2016 and 2017.
It reported that €1.28m was paid to the DPC’s lawyers, Philip Lee solicitors, while senior counsels Brian Murray and Michael Collins received €253,774 and €207,962, respectively. A further €179,303 was paid to Catherine Donnelly in counsel fees.
Schrems told The Register that the amount spent on the case was likely to increase, as it was far from over. The Irish High Court did indeed refer it up to the CJEU in October last year, a process that can take 18 months, and after that Facebook could launch a series of appeals.
He also posited that, if the DPC were to lose the case, it might have to stump up for some of the legal costs of the other parties.
However, for Schrems there is a bigger issue than the amount of taxpayers’ money spent on the case, which he said was “the question of who has access to justice in Ireland”.
He argued that the high costs of bringing the cases, exacerbated by a lack of legal aid in Ireland, appealing a decision of the data protection commissioner would be impossible for another individual or a smaller company.
“In essence, if you don’t have a couple of million, you’re out of luck.” ®