A decision by the Data Protection Commissioner that Facebook should suspend the transfer of personal data to its US parent company would have devastating consequences for the business and jeopardise the service for hundreds of millions of users, the High Court has heard.
Lawyers for Facebook Ireland said there was total absence of an investigatory stage before the DPC "jumped the gun" and issued a preliminary draft decision earlier this year.
In August the DPC informed Facebook it had opened an inquiry of its own volition under the provisions of GDPR in light of a judgment from the Court of Justice of the European Union handed down last July.
The DPC said it had arrived at a draft preliminary decision that data transfers outside of the EU should be suspended in the absence of a guaranteed level of protection to data subjects equivalent to those provided for in EU law.
Facebook says Ireland's Data Protection Commissioner was the only commissioner in Europe on the basis of the European judgment to commence such an inquiry.
The company said it had "singled out" Facebook for such corrective action.
On the opening day of a High Court challenge to that decision, senior counsel for Facebook Paul Sreenan said the decision came as a "bolt from the blue" and was extraordinary.
Mr Sreenan said the decision to launch an inquiry might suggest there was to be a process which would allow Facebook to partake in an inquiry but at the same time the DPC had issued a preliminary decision, giving Facebook 21 days to reply.
He said there was no regard given to the consequences of the corrective measure proposed by the DPC.
He said Facebook Ireland was "a reluctant litigator" against its own regulator but all it was looking for was fair procedures.
The decision to suspend data transfer would have devastating consequences for the plaintiffs business, he said, adding that it was not clear how Facebook Ireland and Instagram could continue to provide services to users in the EU if it was allowed to stand.
The company had 410 million monthly active users including individuals, businesses, charities, NGOs and political persons and was an important platform in terms of freedom of expression, access to information and a platform to trade in goods and services, Mr Sreenan said.
The economic impact of such corrective measures could be quite significant, he said, adding that in a recent survey of 7,500 businesses in Europe the respondents said the service helped them generate revenue of 208 billion dollars in 2019.
He said the argument had been made by the the DPC that its draft decision and current process was not subject to judicial scrutiny until the very end of the process. He said that was not a position that adequately recognises the rights of the company under the constitution or GDPR.
"We say the powers of the DPC must be exercised with appropriate safeguards and impartially, fairly and within a reasonable time and they are not being exercised in a fair way in this case," he said.
Earlier, Mr Sreenan said while the decision of the European Court of Justice earlier this year did invalidate the so called Privacy Shield - which had been used as a mechanism to transfer data - it did uphold Single Contractual Clauses (SCCs) as a means of protecting the rights of data subjects.
He argued that the judgment from the ECJ said SCCs may be relied upon but it depends on the law in practice and in force in the third country. SCCs along with additional measures may be sufficient, he said.
He said the DPC's letter to Facebook in August was a "curious way of saying we have commenced an inquiry... instead it catapulted straight ahead and said we have preliminary draft decision and here it is."
He said it was hard to think of another situation where an investigation with such potentially catastrophic consequences for a business and for so many people who use the services of that business might be launched in this way.
Mr Sreenan said it was Facebook's position that US law is adequate to guarantee the rights of data subjects and any additional safeguards are a secondary alternative to that primary position.
He said since the Privacy Shield judgment Facebook Ireland has been working to put in place additional safeguards. However, it was doing so in the absence of any guidance from the European Data Protection Board.
Since 10 November the European Data Protection Board had issued recommendations which were out for consultation.
"Given the fact that EDPB was exercising its function under GDPR in providing guidelines one would expect the DPC to await the guidelines. The commissioner is on that board and would have been well aware of the timeline," he said.
He said following the CJEU judgment the DPC had issued a statement saying she looked forward to adopting a common position with European colleagues to give meaningful and practical effect to the judgment.
"She did not wait, in fact, and instead issued the PDD," Mr Sreenan said.
He said the EDPR had publicly stated and everyone knew that guidance was coming.
There was an inconsistency to the approach by the DPC who was investigating only Facebook and not other companies, Mr Sreenan said. He said no reason had been given why the own volition inquiry had been opened into Facebook Ireland alone and why it had been targeted for this investigation.
He said the DPC's contention that her preliminary decision was not subject to scrutiny by a court "runs completely counter to Article 58.4 of GDPR" and to the recitals in the GDPR all of which recognise the possibility and importance of judicial supervision and the availability of judicial remedy.
The courts have recognised that many decisions even if they do not have legal consequences, nevertheless are amenable to judicial review. If Facebook did not raise these issues at this point it would been seen to have acquiesced in the process.
Facebook will argue that the decision by the DPC to issue it preliminary draft decision and the procedure it has employed constitute a number of wrongs including a breach of legitimate expectation, a breach of fair procedures, failure to carry out an inquiry, premature judgment and an abuse of process.
The case is expected to last at least four days.