Meta Slapped with €1.2 Billion Fine and Data Transfer Ban for EU Data Privacy Violations
Meta faced a historic fine of €1.2 billion ($1.3 billion) and was instructed to cease the transfer of data obtained from Facebook users in Europe to the United States. This landmark ruling was made against the social media giant for its infringement of European Union data protection regulations.
The penalty, disclosed by Ireland’s Data Protection Commission, holds significant weight as one of the most significant repercussions since the implementation of the General Data Protection Regulation (GDPR) five years ago. Regulators emphasized that the company had failed to adhere to a 2020 verdict from the highest court of the EU, which declared that the data transmitted by Facebook across the Atlantic did not receive adequate protection from American intelligence agencies.
Uncertainty Looms Over Meta’s Obligation to Segregate European Facebook User Data
The future requirement for Meta to isolate the data of Facebook users in Europe remains uncertain, as the company has expressed intentions to challenge the decision, triggering a potentially protracted legal procedure.
Simultaneously, officials from the European Union and the United States are engaged in negotiations to establish a new data-sharing agreement. This agreement aims to offer legal safeguards to Meta and numerous other companies, enabling the uninterrupted flow of information between the two regions. If finalized, this pact has the potential to undermine a significant portion of the European Union’s ruling issued on Monday. A preliminary agreement was announced in the previous year.
Advertisement
Meta Granted Grace Period as E.U. Ruling Targets Facebook Exclusively
The recent ruling, which allows Meta a grace period of at least five months for compliance, specifically pertains to Facebook and does not extend to its subsidiaries Instagram and WhatsApp. Meta assured that Facebook’s services in the European Union would not face immediate disruption.
Nevertheless, this decision by the European Union highlights how government policies are disrupting the previously borderless movement of data. Companies are increasingly compelled by data protection regulations, national security laws, and other measures to store data within the country of collection rather than allowing unrestricted transfer to global data centers.
The case against Meta originated from U.S. policies granting intelligence agencies the authority to intercept overseas communications, including digital correspondences. In 2020, an Austrian privacy activist named Max Schrems successfully challenged the U.S.-E.U. Privacy Shield agreement, which had permitted the movement of data between the two regions. The European Court of Justice ruled that the risk of U.S. surveillance infringed upon the fundamental rights of European users.
In response to todays ruling, Mr. Schrems stated that unless U.S. surveillance laws were rectified, Meta would need to undertake significant restructuring of its systems. He proposed a potential solution known as a “federated social network,” wherein most personal data would remain within the E.U., with only “necessary” transfers occurring, such as when a European user sends a direct message to someone in the United States.
Meta argued that it was unfairly singled out for data-sharing practices that are commonplace among thousands of companies.
Meta Executives Express Concerns over Fragmentation of the Internet Amid Data Transfer Restrictions
In response to the ruling, Meta’s President of Global Affairs, Nick Clegg, and Chief Legal Officer, Jennifer G. Newstead, emphasized the potential consequences of data transfer restrictions on the internet. They stated that without the ability to transfer data across borders, there is a risk of fragmenting the internet into national and regional silos. This fragmentation could impede the global economy and limit citizens’ access to shared services that have become integral to their daily lives.
The ruling, which imposes a record fine under the General Data Protection Regulation (G.D.P.R.), has the potential to impact various types of data stored by Meta, including photos, friend connections, and direct messages. It could significantly impact Facebook’s operations in Europe, particularly if it hampers the company’s ability to target advertisements. Meta’s Chief Financial Officer, Susan Li, disclosed to investors last month that approximately 10 percent of its global ad revenue came from ads delivered to Facebook users in E.U. countries. In 2022, Meta reported revenue of nearly $117 billion.
Meta, along with other companies, is relying on a new data agreement between the United States and the European Union to replace the invalidated agreement of 2020. While the outlines of a potential deal were announced by President Biden and European Commission President Ursula von der Leyen in Brussels last year, the specific details are still under negotiation.
In the absence of a new agreement, the ruling against Meta underscores the legal risks that companies face when transferring data between the European Union and the United States.
Johnny Ryan, a Senior Fellow at the Irish Council for Civil Liberties, highlighted the potential challenge Meta could face in deleting vast amounts of data pertaining to Facebook users in the European Union. Such an undertaking would be technically complex due to the interconnected nature of internet companies.
Advertisement
“It is challenging to envision how Meta can comply with this order,” expressed Mr. Ryan, a proponent of more robust data protection policies.
The decision against Meta coincides almost precisely with the fifth anniversary of the G.D.P.R. Initially hailed as an exemplary data privacy law, it has been criticized by numerous civil society groups and privacy activists for falling short of its potential due to insufficient enforcement.
A significant portion of the criticism has centered around a provision that assigns responsibility to regulators in the country where a company’s European Union headquarters are located for enforcing this comprehensive privacy law. Ireland, which hosts the regional headquarters of Meta, TikTok, Twitter, Apple, and Microsoft, has faced heightened scrutiny in this regard.
On Monday, Irish authorities revealed that they had been overruled by a board composed of representatives from E.U. member states. The board insisted on imposing a €1.2 billion fine and requiring Meta to address past data collected about users, which may involve deletion.
“The unprecedented fine sends a powerful message to organizations that severe infringements come with far-reaching consequences,” stated Andrea Jelinek, Chairwoman of the European Data Protection Board, the E.U. entity responsible for determining the fine.
Meta has frequently been targeted by regulators under the G.D.P.R. In January, the company was fined €390 million for compelling users to accept personalized ads as a condition of using Facebook. In November, it received an additional €265 million fine for a data leak.
