Record GDPR fine and order issued over data transfers

According to the DPC, Meta Ireland breached EU data protection laws in relation to the data transfers despite the fact the company used standard contractual clauses (SCCs) issued by the European Commission in 2021, in tandem with other supplementary measures, to underpin those transfers.

Meta described the decision as flawed and unjustified, and confirmed the company’s intention to appeal.

The action announced by the DPC follows intervention by other data protection authorities based across the EU and reflects a binding decision imposed on the Irish authority by the European Data Protection Board (EDPB).

The DPC found that the arrangements Meta Ireland put in place to underpin the data transfers “did not address the risks to the fundamental rights and freedoms of data subjects” that the Court of Justice of the EU (CJEU) had identified in its so-called ‘Schrems II’ ruling in 2020.

In that case, the CJEU highlighted shortcomings with the safeguards in place to counteract US legislation that gives US law enforcement and intelligence agencies powers to request and access data, and outlined what businesses need to do to comply with EU data protection laws when transferring personal data outside of the EEA – including to the US.

Initially, the DPA proposed to impose a suspension order only against Meta Ireland, but its draft decision was open to input by other national DPAs from across Europe because the issues concerned data about Facebook users from across the European Economic Area (EEA).

Meta Ireland has been given six months to ensure that its processing operations concerning the data of Facebook users based in the European Economic Area (EEA) complies with the GDPR’s rules governing the international transfer of personal data.

In a blog, Nick Clegg, president of global affairs at Meta, and Jennifer Newstead, the company’s chief legal officer, confirmed Meta Ireland’s intention to appeal against the decision and ask the courts to delay the effect of the DPC’s orders. They said they feel the company has been “singled out when using the same legal mechanism as thousands of other companies looking to provide services in Europe”. 

“We are appealing these decisions and will immediately seek a stay with the courts who can pause the implementation deadlines, given the harm that these orders would cause, including to the millions of people who use Facebook every day,” they said.

“This decision is flawed, unjustified and sets a dangerous precedent for the countless other companies transferring data between the EU and US. It also raises serious questions about a regulatory process that enables the EDPB to overrule a lead regulator in this way, disregarding the findings of its multi-year inquiry without giving the company in question a right to be heard,” they added.

Clegg and Newstead also looked ahead to the prospect of the new ‘Privacy Shield 2.0’ – formally, the EU-US Data Privacy Framework (DPF) – taking effect. The proposed new framework has been negotiated by EU and US officials with a view to it facilitating EU-US data flows in future in a way that provides for adequate data protection in respect of EU citizens’ data exported to the US, as required under the GDPR. If the Privacy Shield 2.0 takes effect before the suspension order issued in this case takes effect, and providing Meta Ireland conforms to the requirements for making data transfers under the new framework, the suspension order would have no practical impact.

“If the DPF comes into effect before the implementation deadlines expire, our services can continue as they do today without any disruption or impact on users,” said Clegg and Newstead.