Meta fined record $1.3 bn, asked to stop sending European user data to US

Facebook owner Meta Platforms Inc. has been fined a record USD 1.3 billion for transferring EU user data to the United States in breach of a previous court ruling, Ireland’s regulator announced on Monday. Besides, Meta has been ordered to stop transferring user data across the Atlantic by October.

The Irish Data Protection Commission (DPC), which acts on behalf of the European Union, said the European Data Protection Board (EDPB) had ordered it to collect “an administrative fine in the amount of 1.2 billion euros (USD 1.3 billion)”. The DPC has been investigating Meta Ireland’s transfer of personal data from the EU to the United States since 2020.

The penalty of 1.2 billion euros is the biggest since the EU’s strict data privacy regime took effect five years ago, surpassing Amazon’s 746 million euro fine in 2021 for data protection violations.

Also read: Meta plans to cut thousands of jobs in fresh round of layoffs

Meta, which had previously warned that services for its users in Europe could be cut off, vowed to appeal and ask courts to immediately put the decision on hold. There is no immediate disruption to Facebook in Europe, the company said.

Decision flawed, unjustified, says Meta

“This decision is flawed, unjustified and sets a dangerous precedent for the countless other companies transferring data between the EU and US,” Meta’s Chief Legal Officer Jennifer Newstead said in a statement.

It’s yet another twist in a legal battle that began in 2013 when Austrian lawyer and privacy activist Max Schrems filed a complaint about Facebook’s handling of his data following former National Security Agency contractor Edward Snowden’s revelations of electronic surveillance by US security agencies. It included the disclosure that Facebook gave the agencies access to the personal data of Europeans.

The saga has highlighted the clash between Washington and Brussels over the differences between Europe’s strict view on data privacy and the comparatively lax regime in the US, which lacks a federal privacy law.

The EU has been a global leader in reining in the power of Big Tech with a series of regulations forcing them police their platforms more strictly and protect users’ personal information.

New pact awaiting decision from EU

An agreement covering EU-US data transfers known as the Privacy Shield was struck down in 2020 by the EU’s top court, which said it didn’t do enough to protect residents from the US governments electronic prying.

Monday’s decision confirmed that another tool to govern data transfers stock legal contracts was also invalid. Brussels and Washington signed a deal last year on a reworked Privacy Shield that Meta could use, but the pact is awaiting a decision from European officials on whether it adequately protects data privacy.

Also read: India among top three sources for active users growth on Facebook: Meta

EU institutions have been reviewing the agreement, and the bloc’s lawmakers this month called for improvements, saying the safeguards aren’t strong enough.

Meta given 6 months for compliance

The Ireland’s Data Protection Commission handed down the fine as Meta’s lead privacy regulator in the 27-nation bloc because the Silicon Valley tech giant’s European headquarters is based in Dublin.

The Irish watchdog said it gave Meta five months to stop sending European user data to the US and six months to bring its data operations into compliance by ceasing the unlawful processing. If the new transatlantic privacy agreement takes effect before these deadlines, “our services can continue as they do today without any disruption or impact on users”, Meta said.

Schrems predicted that Meta has no real chance of getting the decision materially overturned. And a new privacy pact might not mean the end of Meta’s troubles, because there’s a good chance it could be tossed out by the EU’s top court, he said.

Meta to bank on new deal for transfers

“Meta plans to rely on the new deal for transfers going forward, but this is likely not a permanent fix,” Schrems said in a statement. “Unless US surveillance laws gets fixed, Meta will likely have to keep EU data in the EU.”

Also read: Meta hires ex-Tata CLiQ CEO Vikas Purohit to head Global Business Group in India

Meta warned in its latest earnings report that without a legal basis for data transfers, it will be forced to stop offering its products and services in Europe, which would materially and adversely affect our business, financial condition, and results of operations.

The social media company might have to carry out a costly and complex revamp of its operations if it is forced to stop shipping user data across the Atlantic. Meta has a fleet of 21 data centres, according to its website, but 17 of them are in the United States. Three others are in the European nations of Denmark, Ireland and Sweden. Another is in Singapore.

Other social media giants are facing pressure over their data practices. TikTok has tried to soothe Western fears about the Chinese-owned short video sharing apps potential cybersecurity risks with a USD 1.5 billion project to store US user data on Oracle servers.

(With agency inputs)