Following the binding decision of the European Data Protection Board (EDPB) in April 2023[i], the Irish Data Protection Commission (DPC) has announced on 22 May[ii] a fine of EUR 1.2 bn against Meta Platforms Ireland Limited on the grounds of the company’s unlawful transfer of personal data from the EU/EEA to the USA, effectively from July 2020 to date, within the context of provision of its Facebook related services. A 6-month deadline is imposed for suspension of any future transfers, and for either deletion or moving of the already transferred data back to the EU.

The subject matter transfers have been carried out on a systematic, repetitive and continuous manner on the basis of standard contractual clauses (SCC).

The infringement essentially relates to Article 46(1) of the GDPR, whereby “…a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.”

Following the European Commission’s draft adequacy decision in December 2022, the political agenda is already put in place for a new EU – US data privacy framework which is set to enter into force by the end of 2023. In this context, the question remains as to the actual effectiveness of the DPC decision in favour of data privacy given that the set 6-month deadline could in principle be seen as a leeway for the company to delay compliance until the new framework becomes operative.

[i] See here https://edpb.europa.eu/our-work-tools/our-documents/binding-decision-board-art-65/binding-decision-12023-dispute-submitted_en.

[ii] See here https://www.dataprotection.ie/en/news-media/press-releases/Data-Protection-Commission-announces-conclusion-of-inquiry-into-Meta-Irelan