LAST UPDATE | 22 May 2023
SOCIAL MEDIA GIANT Meta has been hit with a record fine of €1.2 billion by Ireland’s Data Protection Commission (DPC) over the tranfser of European user data to the US.
The DPC levied the fine on behalf of European regulators, saying the European Data Protection Board had ordered it to collect “an administrative fine in the amount of 1.2 billion euros”.
Meta has said it would appeal the decision.
Meta is the owner of Facebook, WhatsApp and Instagram and has its global operations base outside of the US in Dublin’s Sir John Rogerson’s Quay.
The DPC has been investigating Meta Ireland’s transfer of personal data from the EU to the United States since 2020.
It found that Meta, which has its European headquarters in Dublin, failed to “address the risks to the fundamental rights and freedoms of data subjects” that were identified in a previous ruling by the Court of Justice of the European Union (CJEU).
The decision relates to Meta’s Facebook service and the the DPC said today that Meta Ireland infringed GDPR Article 46(1) when it continued to transfer personal data from the EU/EEA to the USA following the delivery of the CJEU’s judgment in the Maximillian Schrems case.
It found that Meta, which has its European headquarters in Dublin, failed to “address the risks to the fundamental rights and freedoms of data subjects” that were identified in a previous ruling by the Court of Justice of the European Union (CJEU).
The CJEU interprets EU law to make sure it is applied in the same way in all member states.
In response, Meta said it was “disappointed to have been singled out” and the ruling was “flawed, unjustified and sets a dangerous precedent for the countless other companies”.
“We intend to appeal both the decision’s substance and its orders including the fine, and will seek a stay through the courts to pause the implementation deadlines,” Meta president of global affairs Nick Clegg and chief legal officer Jennifer Newstead said in a blog post.
“There is no immediate disruption to Facebook in Europe,” they added.
Meta’s President of Global Affairs Nick Clegg said that the “decision is not about one company’s private practices” and that “there is a fundamental conflict of law between the US government’s rules on access to data and European privacy rights, which policy makers are expected to resolve in the summer”.
Following the EDPB’s binding dispute resolution decision, Meta Platforms Ireland Limited was issued a 1.2 billion euro fine as a result of an inquiry into its Facebook service by the Irish DPA - the largest GDPR fine to date! Read all about it here: https://t.co/ti4iFMm73M pic.twitter.com/iJnKZNMp1x
— EDPB (@EU_EDPB) May 22, 2023
Reacting to the fine, Austrian privacy lawyer Max Schrems said it is “actually not that high”.
“The maximum fine would be about €4-5 billion … it’s actually probably on the lower end of what would have been possible,” he told RTÉ’s News at One.
When asked whether he thinks Facebook has been singled out in terms of the fine, Schrems said: “It’s kind of like, the one guy that is speeding gets caught can always cry that five other people were speeding as well, but that doesn’t make your speeding better.
“So to be quite honest, that argument is kind of childish.”
He added that there is “definitely more enforcement necessary by the authorities in other European countries”.
The massive fine eclipses the previous GDPR-linked record of €746 million which was levied on Amazon by Luxembourg’s data watchdog in 2021.
Last September, the DPC fined Instagram €405 million for breaching the privacy rights of children in what was, until today, the largest fine ever handed out by the Irish regulator.
- With reporting by Hayley Halpin and © – AFP 2023
To embed this post, copy the code below on your site
have your say