The EU privacy regulator announced earlier today that Meta has been fined 1.2 billion euros because the latter transferred EU user data to the United States, which It is the largest fine ever imposed by the EU for a privacy breach.
Meta Platforms later issued a notice saying it would appeal the EU’s ruling on its transfer of data to the US and what the company called an “unreasonable and unnecessary fine”. Meta said there would be no immediate disruption to Facebook’s operations in Europe and that “there is a fundamental legal conflict between the US government’s data access regulations and European privacy rights, which policymakers are expected to resolve over the summer”.
The European Court of Justice has argued that such data transfers would violate the privacy rights of EU citizens, a complaint stemming from Edward Snowden’s 2013 revelations of a US mass surveillance program. The ruling was made by the Irish Data Protection Commission (DPC), which said the current legal framework for data transfers “does not address the risks to the fundamental rights and freedoms of Facebook’s European users” and violates the General Data Protection Regulation (GDPR).
The fine eclipses the 746 million-euro European Union record-high fine imposed in 2021 for the same privacy breach by Amazon.
The transfer of data to the US is critical to Meta’s vast ad targeting business, which relies on processing a variety of personal data on users. Last year, Meta said it would be forced to consider shutting down Facebook and Instagram in the EU if it couldn’t send data back to the US, which EU politicians saw as a threat.
Previously, these data transfers were covered by a transatlantic agreement known as the “Privacy Shield”. But that framework was invalidated in 2020 after the EU’s top court found it failed to protect data from U.S. surveillance programs.
Although Meta has now been ordered to stop these data transfers, there are some reservations in favor of the American social media giant. For starters, the ruling only applies to Facebook’s data, not to other Meta companies, such as Instagram and WhatsApp. Second, there is a five-month grace period before Meta companies must stop future transfers, and a six-month period before they must stop holding current data in the United States. Third, and most importantly, the EU and the US are currently negotiating a new data transfer agreement, which could be concluded as early as this summer and as late as October.
