EU Imposes €1.2 Billion Fine on Meta for GDPR Violations

The Irish Data Protection Authority (IE DPA) has fined Meta 1.2 billion euros after investigating its Facebook service. This is the largest fine ever issued under the GDPR and is a result of Meta's transfer of personal data to the United States using standard contractual clauses (SCCs) since July 16, 2020. In addition to the fine, Meta has been instructed to ensure its data transfers comply with the GDPR.

Reason for the Fine

Meta received the fine because it was found to be transferring the personal data of European users to the United States using standard contractual clauses, which the European Data Protection Board (EDPB) deemed to be illegal. The company has been ordered to cease this practice within six months.

Andrea Jelinek, Chair of the EDPB, commented, "The EDPB determined that Meta IE's violation is very serious as it involves systematic, repetitive, and continuous transfers. With millions of Facebook users in Europe, the amount of personal data being transferred is enormous. This unprecedented fine sends a strong message to organizations that significant infringements have significant consequences."

The Data Protection Commission stated that Meta Ireland violated Article 46(1) of the GDPR. This article allows organizations to transfer data to third countries or international organizations if appropriate safeguards and effective legal remedies for data subjects are in place. The DPC concluded that Meta's measures were insufficient in addressing the risks to the rights and freedoms of data subjects.

Meta's Take on the Fine

Meta has announced its intention to appeal the ruling and the imposed fine. They stated that there will be no immediate disruption to Facebook's operations in Europe.

According to Meta, the core problem arises from a "conflict of law" between the data access regulations in the United States and the privacy rights of individuals in Europe. They mentioned that policymakers from the European Union (EU) and the United States are actively working towards resolving this conflict through the establishment of a new transatlantic Data Privacy Framework.

Source