The Austrian privacy activist Max Schrems has sent complaints to the data protection agencies in three EU countries—Ireland, Germany, and Belgium—asking them to suspend the flow of personal data from Facebook's operations in Ireland to the US. This follows his earlier success at the Court of Justice of the European Union (CJEU), which ruled that the Safe Harbour framework under which personal data was being transferred was no longer valid because of mass surveillance of EU citizens by the NSA. Subsequently, the Irish High Court said that the Irish data protection commissioner (DPC) was obliged to investigate Schrems' earlier complaints.

His letter to the authorities in Ireland, where Facebook has its European headquarters, asks the Irish data protection agency "to suspend all data flows from 'Facebook Ireland Ltd' to 'Facebook Inc'." Schrems makes the same request to the data protection agencies in Germany and Belgium. In a release accompanying his complaints, Schrems explains why he has taken this unusual approach of involving several data protection agencies (DPAs): "My personal experience with the Irish DPC are rather mixed, which is why I felt involving more active DPAs make proper enforcement actions more likely. I hope the DPAs will cooperate in this case."

Schrems' unhappiness with the way the Irish DPC has dealt with his earlier complaints, and his fear that it still might not implement the CJEU ruling, is evident in a section of his new submission that is headed "Misconduct in public office." It contains the following extraordinary passage:

Given the very clear guidance by the High Court and the Court of Justice in C-362/14 [the CJEU Facebook ruling], and given my previous experiences, combined with very recent information I received about your offices’ thoughts on this issue, it seems to be appropriate as a matter of fairness to inform you at the earliest possible stage of the possibility that your actions (or inactions) in this procedure may also have personal consequences for the relevant officeholder that go far beyond a mere appeal or judicial review against the decision of the office.

Recognising the major ramifications that suspending all data flows from Facebook's operations in Europe back to the US would have, Schrems suggests granting "a reasonable implementation period, to allow the relevant companies to take all necessary technical and organizational steps to comply with the CJEU judgement." He even offers some helpful advice on how Facebook could respond to a ban on transatlantic data flows: "options may range from moving data to Europe, encrypting data that is stored in the United States or reviewing the corporate structure. "

Schrems notes that his latest complaint is only about Facebook, and that most of the 4,000 or so US companies that lost the ability to transfer data from the EU to the US using the Safe Harbour framework are not directly affected. However, he did warn that others participating in the the NSA's PRISM spying programme, such as Apple, Google, Microsoft and Yahoo, may face similar complaints in the future. “We are reviewing the situation in relation to all PRISM companies right now,” Schrems said.