Meta record-breaking $1.3 billion fine over US data transfer

Meta has been fined a record-breaking $1.3 billion (€1.2 billion) by EU data regulators, and ordered to stop transferring EU citizens’ Facebook data to the US. EU courts hold that such data transfers expose EU citizens to privacy breaches – a complaint that dates back to 2013 and was raised by whistleblower Edward Snowden about US mass surveillance programs. has been disclosed.

The decision was made by Ireland’s Data Protection Commission (DPC), which stated that the current legal framework for data transfers to the US “does not address the risks to the fundamental rights and freedoms” of EU users of Facebook and Violates the GDPR. The fine exceeds the previous EU record of €746 million against Amazon in 2021 for a similar privacy breach.

The data transfer in the US is critical to Meta’s vast ad-targeting operations, which depend on processing multiple streams of personal data from its users. Last year, Meta said it would be forced consider closing Facebook and Instagram were not able to send data back to the US in the EU; A warning EU politicians saw as a clear threat. “META cannot blackmail the EU into giving up its data protection standards,” answered EU lawmaker Axel Voss for news. “Leaving the EU would be their loss.”

Previously, these data transfers were protected by a transatlantic treaty known as the Privacy Shield. But the framework was declared invalid in 2020 after the EU’s top court found it did not protect data from being scraped by US surveillance programs. The decision was made in response to a claim by Max Schrems, an Austrian lawyer whose legal battle against Facebook dates back to 2013 and the origins of US surveillance Snowden’s revelations.

Although Meta has now been ordered to stop these data transfers, there are several caveats that benefit the US social media giant. First, the rule only applies to Facebook’s data, not other meta companies like Instagram and WhatsApp. Second, Meta has a five-month grace period before stopping future transfers and a six-month deadline to stop current data in the US. Third, and most important, the EU and the US are currently negotiating New data transfer deal Which could be as early as this summer and as late as October.

Despite the record-breaking size of the fine, experts expressed skepticism that it would fundamentally change anything about Meta’s privacy practices. Jonny Ryan, a senior fellow at the Irish Council for Civil Liberties, said, “A billion-euro parking ticket is of no value to a company that makes many billions by parking illegally.” Said Guardian this weekend.

Others were more victorious. “We are pleased to see this decision after ten years of litigation,” said Schrems, whose 2013 legal challenge is the core of today’s decision. Press release, “The fine could have been much higher, given that the maximum fine is over 4 billion and that Meta knowingly broke the law to make a profit for ten years.”

Meta itself described the fine as “unfair and unnecessary”. blog post Written by Nick Clegg, Meta’s President of Global Affairs, and Jennifer Newsted, the company’s Chief Legal Officer. The company stressed that it is only one of “thousands” of companies that use a similar legal framework to transfer data.

Clegg and Newsted write, “We are appealing these decisions and will immediately seek a stay with the courts, which could block the implementation deadline, given the harm these orders have caused, to the millions of people who live every year.” days use Facebook,”.

Schrems predicts that Meta’s troubles don’t end here. They anticipate that any legal appeal by the company to today’s decision will be unsuccessful. And that the upcoming EU-US Data Transfer Protocol will still not meet the EU’s privacy rules in court. “Meta plans to rely on the new deal for transfers going forward, but this is likely not a permanent solution,” Schrems said. “Until US surveillance laws are settled, Meta will likely keep EU data in the EU.”

Update, Monday May 22nd, 05:26AM ET: The story was updated to add more details from the DPC’s decision and response from Max Schrems and Meta.