Facebook owner Meta fined record €1.2 billion over EU-US data transfers

Meta claims ‘dangerous precedent’

Meta stated that it’ll enchantment the ruling, together with the “unjustified and unnecessary fine”, and can search a keep of the orders by means of the courts.

Writing in a weblog publish, President, Global Affairs at Meta, Nick Clegg, and Chief Legal Officer Jennifer Newstead, stated that the choice would create a harmful precedent for different firms transferring data between the EU and the US.

“This decision is flawed, unjustified and sets a dangerous precedent for the countless other companies transferring data between the EU and US,” they stated.

The DPC discovered that Meta was in breach of a ruling by the European Court of Justice in 2020, which struck down the US-EU data sharing settlement between the US and Europe, Privacy Shield. 

The 2020 choice launched more durable necessities for firms utilizing Standard Contractual Clauses as a authorized foundation to switch data to the US.

The court docket  discovered that folks  should be given “essentially equivalent protection” for his or her data when it’s transferred to the US and different nations, as they’d obtain within the EU below GDPR and the European Charter of Fundamental Rights, which ensures folks the precise for personal communications and the safety of their non-public data.

Standard Contractual Clauses

The case could have a knock-on affect for firms that depend on EU Standard Contractual Clauses as a authorized mechanism to switch data from the EU to the US.

It can be prone to put stress on the EU and the US to finalise a brand new deal on data safety adequacy, generally known as the Trans-Atlantic Data Privacy Framework.

“The DPC’s ruling that the standard contractual clauses are not a valid mechanism to transfer personal data to the US will have a significant impact on the ability of organisations of all shapes and sizes to lawfully share and receive data from Europe,” stated lawyer Edward Machin, at legislation agency Ropes & Gray’s.

“It will also kick off a race against time for lawmakers to finalise the EU-US data transfer framework before the end of the six-month transition period that the DPC has given Meta to bring its transfers into compliance,” he added.

Ten yr authorized battle

The choice is the newest in a ten yr authorized battle between Austrian lawyer Max Schrems and Meta.

 At its root is the discrepancy between EU Privacy legal guidelines and US surveillance legal guidelines, together with the Foreign Intelligence Surveillance Act (FISA), which give US intelligence companies sweeping powers to reap the private data and communications of non-US residents.

 Schrems stated in a press release that US surveillance legal guidelines, together with FISA 702, which allows focusing on of non-US residents outdoors the US, can be an issue for all different massive US cloud suppliers, resembling Microsoft, Google or Amazon.

“Unless US surveillance laws get fixed, Meta will have to fundamentally restructure its systems,” he stated.

“There is an understanding on both sides of the Atlantic that we need probable cause and judicial approval of surveillance. It is time to grant these basic protections to EU customers of US cloud providers,” he added.

 Future of EU-US data safety

The Trans-Atlantic Data Privacy Framework is predicted to return into drive within the Summer, however is extensively anticipated to face additional authorized challenges.

 A authorized problem may consequence within the new framework being over-turned by the European Court, which has beforehand annulled its predecessor Privacy Shield in 2020 and Safe Harbor in 2015.

Eddie Powell, data safety associate at London legislation agency Fladgate stated that the scale of Meta’s wonderful mirrored the truth that Meta’s methods have been structured in order that the data collected on its social media platforms needed to be despatched to the USA “without any kind of firebreak”.

But he stated it that the wonderful, equal to about 1% of Meta’s worldwide turnover, may have been considerably larger, as much as a most of 4% of Meta’s worldwide turnover. 

Meta: ‘serious questions’ 

Clegg and Newstead stated of their blogpost that the DPC “initially acknowledged that Meta had continued its EU-US data transfers in good faith, and that a fine would be unnecessary and disproportionate” however have been over-ruled by the European Data Protection Board,

They argued that the EDPB, the impartial European data safety regulator, had chosen to ignore the progress that coverage makers have been making to resolve the “fundamental conflict” between US authorities entry to European data and the privateness rights of Europeans.

The choice “raises serious questions about a regulatory process that enables the EDPB to overrule a lead regulator in this way, disregarding the findings of its multi-year inquiry without giving the company in question a right to be heard,” they stated.