It is the largest fine that has been imposed in the EU on a tech company for data protection violations: The Facebook group Meta is to pay a fine of 1.2 billion euros. This was announced by the Irish data protection authority in Dublin on Monday. The Data Protection Commission (DPC) explainedthat the US group has violated the European General Data Protection Regulation (GDPR) and is therefore no longer allowed to transmit personal data of European users to the USA. For the time being, the sentence ends a procedure in which Facebook’s participation in mass surveillance by American secret services is involved, which was uncovered ten years ago by US whistleblower Edward Snowden.
In your Decision The Irish data protection authority explains that Facebook did not provide adequate security measures for data transfers from Europe to the USA. The company did not take into account “the risks to the fundamental rights and freedoms” of users, although the European Court of Justice (ECJ) called for better protection of personal data from US surveillance programs. According to the Irish data protection authority, the US group now has five months to suspend “any future transfer of personal data to the USA”. In addition, Facebook must stop processing all personal data of European citizens in the USA within six months, including storing this data.
Nick Clegg, former leader of the British Liberal Democrats and now Meta’s “President Global Affairs”, criticized the decision of the Irish data protection authority as “flawed and unjustified”. This will set a dangerous precedent for countless other companies transferring data between the EU and the US, he said. Experts assume that the US group will take legal action against the decision. However, court proceedings are likely to drag on for years.
The US has been pushing for access to personal data for years
During this time, a new pact between the EU and the US could come into force that would regulate transatlantic data traffic. It was only in October that US President Joe Biden had a so-called Executive order signed, detailing the steps the US will take to secure a possible new data protection agreement with the EU. Negotiations are currently underway. According to EU diplomats, an agreement could be reached by the end of July. It won’t be easy, because the dispute between Brussels and Washington is about a fundamental legal conflict. For years, the USA has been pushing for access to personal data in order to be able to ward off dangers. However, this has little in common with the EU’s understanding of data protection.
From the point of view of companies and data protection experts, however, a new agreement is urgently needed after the ECJ ruled in 2020that a previous data protection pact – the so-called Privacy Shield – does not adequately protect the data of European users from US surveillance. The Austrian data protection activist Max Schrems filed a complaint against Facebook at the time. As far as the fine now imposed is concerned, he believes it could have been much higher: “The maximum fine is over four billion.” Meta knowingly violated GDPR for years to make a profit.
Since the General Data Protection Regulation came into force in May 2018, fines totaling four billion euros have already been imposed. Meta is now represented six times in the list of the ten highest fines, the penalties now total 2.5 billion euros. In the case of the US group, the Irish Data Protection Authority is responsible for any fines, as Meta’s EU headquarters are in Ireland. From the point of view of data protection activists, however, this is a problem: They accuse the Irish authorities of being too hesitant in dealing with large US tech companies that have their European headquarters in Ireland. Ultimately, the Irish Data Protection Authority responded to pressure from Brussels. The resident there European Data Protection Board (EDPB) de facto ensured that the Irish Data Protection Commission imposed the 1.2 billion fine on Facebook.
From Meta’s point of view, the fine does not come at a good time. The US group still has a market value of $630 billion, but is finding it increasingly difficult to compensate for the collapse in advertising revenue. There have already been several rounds of layoffs. Meta boss Mark Zuckerberg has probably not without reason announced a “year of efficiency”.