Meta hit with record €1.2bn EU fine for transferring Facebook data to US

Meta hit with record €1.2bn EU fine for transferring Facebook data to US.

Meta was fined a record $1.3 billion (€1.2 billion) by EU data regulators and ordered to stop transferring EU citizens’ Facebook data to the US, Bloomberg and Politico reported.

The EU Court of Justice has argued that such transfers of data violate the privacy of EU citizens – a matter dating back to 2013 and whistleblower Edward Snowden’s revelations of US mass surveillance programs.

The ruling was handed down by the Irish Data Protection Commission (DPC), which said the current legal framework for data transfers to the US “does not address risks to the fundamental rights and freedoms of Facebook’s EU users,” Politico reported. The fine tops the EU’s previous record of 746 million euros levied on Amazon in 2021 for similar privacy breaches.

Moving the data to the U.S. is critical to Meta’s sprawling ad-targeting business, which relies on processing multiple streams of users’ personal data.

Last year, Meta said it would consider shutting down Facebook and Instagram in the EU if it couldn’t send data back to the US;

EU politicians saw the warning as a clear threat. “Meta cannot just blackmail the EU into abandoning its data protection standards,” MEP Axel Voss responded to the news. “Leaving the EU will be their loss.”

Previously, these data transfers were covered by a transatlantic agreement called the Privacy Shield. But that framework was invalidated in 2020 after the European Union’s top court found it failed to protect data from being collected by U.S. surveillance programs.

The ruling came in response to claims by Austrian lawyer Max Schrems, whose legal battle with Facebook dates back to 2013 and the original Snowden revelations about U.S. surveillance.

While Meta has now been ordered to stop these data transfers, there are a few caveats in favor of the US social media giant.

First, the ruling only applies to data from Facebook, not other meta companies like Instagram and WhatsApp.
Second, there is a five-month grace period before Meta must stop future transfers, with a deadline of October 22.
Third, the EU and the US are currently negotiating a new agreement to transfer data that could be in place as early as this summer and as late as October.

Despite the record size of the fine, experts expressed doubts that it would fundamentally change Meta’s privacy practices. Johnny Ryan, a senior fellow at the Irish Council for Civil Liberties, told the Guardian this weekend: “A €1bn parking ticket is a huge blow to a company that is making billions more by parking illegally. It doesn’t make any sense for companies with wealth”.