Meta Fined Record €1.2 Billion in EU Over US Data Transfers

According to the Irish Data Protection Commission, the social media giant's continuous transfer of data to the United States does not adequately address the potential threats to the fundamental rights and freedoms of individuals whose data is being transferred across the Atlantic. As a result, Meta (formerly Facebook) has been fined, surpassing a previous €746 million penalty imposed on Amazon.com Inc. Meta has been given a five-month deadline to halt any future transfer of personal data to the US and a six-month deadline to cease the unlawful processing and storage of transferred personal data from the European Union in the US.

The stock value of Meta Platforms rose by 2.8% following the announcement, outperforming the Russell 3000 Index Computer Services Subsector by more than four times.

The prohibition on data transfers was widely anticipated and had previously led the US company to threaten a complete withdrawal from the European Union. However, the impact has been lessened due to a transition phase and the possibility of a new EU-US data flows agreement, which could be operational as early as the middle of this year.

This decision marks the latest development in an ongoing saga that has resulted in Facebook and numerous other companies operating in a legal gray area. In 2020, the European Union's highest court invalidated an EU-US agreement governing transatlantic data transfers due to concerns about the security of citizens' data once it reaches US servers. This situation posed a risk to businesses of all sizes that rely on the movement of vast amounts of information for various purposes, including sales, marketing, and payroll processing, potentially disrupting commerce between the EU and the US.

Although the judges did not invalidate an alternative mechanism based on contractual clauses, their doubts regarding data protection in the US quickly led to a preliminary order from the Irish authority, instructing Facebook to cease using this alternative method for data transfers to the US.

In December, EU regulators introduced proposals to replace the previous "Privacy Shield" agreement that had been invalidated by the European Court of Justice. These proposals followed months of negotiations with the US, which resulted in an executive order from President Joe Biden and US commitments to ensure the safety of EU citizens' data during transatlantic transfers.

Meta has announced its intention to appeal the Irish decision, criticizing it as flawed and unjustified. The company also expressed its immediate plan to seek a suspension of the banning orders, citing potential harm to the millions of users who rely on Facebook daily.

The restrictions on data transfers risk fragmenting the internet into national and regional compartments, hindering the global economy and preventing citizens in different countries from accessing shared services that have become essential. Meta's President of Global Affairs, Nick Clegg, and Chief Legal Officer, Jennifer Newstead, stated in a blog post that this development could have significant implications.

The company will need to file its appeal in Ireland, and a final decision could take several months, or even years. Amazon's appeal of its previous record GDPR fine is still pending in the Luxembourg courts.

The crackdown on Meta coincides with the fifth anniversary of the European Union's General Data Protection Regulation (GDPR), which is widely regarded as a global standard. Since 2018, regulators within the EU have been authorized to impose fines of up to 4% of a company's annual revenue for severe violations. The Irish Data Protection Commission has become the lead privacy regulator for major tech companies with an EU presence, including Meta and Apple.

This has led to tensions over the years, with Ireland's privacy chief, Helen Dixon, facing ongoing criticism regarding the perceived slowness or leniency of her office. Initially, the Irish regulator did not intend to levy a fine, considering it disproportionate.