Meta hit with record $1.3bn fine by EU regulator over data transfers
DUBLIN: Meta was hit with a record 1.2 billion euro ($1.3 billion) fine by its lead European Union privacy regulator over its handling of user information and given five months to stop transferring users’ data to the United States. The fine, imposed by Ireland’s Data Protection Commissioner (DPC), came after Meta continued to transfer data beyond a 2020 EU court ruling that invalidated an EU-US data transfer pact. It tops the previous record EU privacy fine of 746 million euros handed by Luxembourg to Amazon.com Inc in 2021.
The battle over where Meta’s Facebook stores its data began a decade ago after Austrian privacy campaigner Max Schrems brought a legal challenge over the risk of US snooping in light of disclosures by former US National Security Agency contractor Edward Snowden.
Meta said in a statement that it will appeal the ruling, including the “unjustified and unnecessary fine that sets a dangerous precedent for countless other companies”. It will also seek a stay of the suspension orders.
The social media giant reiterated that it expected a new pact facilitating the safe transfer of EU citizens’ personal data to the United States would be fully implemented before it has to suspend transfers.
That would mean its previous warning that a stoppage could force it to suspend Facebook services in Europe would not come to pass.
“Without the ability to transfer data across borders, the internet risks being carved up into national and regional silos,” Meta said.
The DPC said in March that EU and US officials hoped that the new data protection framework – agreed by Brussels and Washington in March 2022 — may be ready by July.
Europe’s top court, the European Court of Justice, threw out the two previous pacts over concerns about US surveillance.
Schrems, the Austrian privacy campaigner, said Meta’s plans to rely on the new deal for transfers going forward was unlikely to be a permanent fix.
“In my view, the new deal has maybe a 10% chance of not being killed by the CJEU (EU Court of Justice). Unless US surveillance laws gets fixed, Meta will likely have to keep EU data in the EU.”
The Irish watchdog, which is the lead EU regulator for many of the world’s top technology companies, said the suspension order could create a precedent for other firms.
The DPC said it did not initially propose adding a fine to the suspension order, but that four other EU supervising authorities disagreed and the record fine was included.
The Irish regulator has fined Meta more than any other tech firm and has 10 other inquiries open into the social media group’s platforms.