European Union: Issued DPC ruling in investigation into Meta over personal data transfers to US including an EUR 1.2 billion fine

Description

Issued DPC ruling in investigation into Meta over personal data transfers to US including an EUR 1.2 billion fine

On 12 May 2023, Ireland's Data Protection Commission (DPC) issued its ruling in the investigation into Meta over data personal data transfers to the United States for its Facebook service, issuing a fine of EUR 1.2 billion and requiring Meta to suspend personal data transfers to the United States for 5 months after receiving the notification on the ruling. The DTC found that the Meta violated Article 46.1 on transfers subject to appropriate safeguards of the General Data Protection Regulation (GDPR) by continuing to transfer data to the US following the Court of Justice of the European Union (CJEU) Schrems II judgement invalidating the EU-US Privacy Shield. Furthermore, the DPC stated that the updated Standard Contractual Clauses (SCC) used by Meta, incorporating additional safeguards to the European Commission 2021 SCC, provided insufficient protections for the data transferred to the US and failed to resolve the risks to the fundamental rights and freedoms of data subjects that the CJEU raised in its decision. Based on the ruling, Meta must amend its data processing practices within 6 months to comply with Chapter V on transfers of personal data to third countries or international organisations of the GDPR by stopping transferring and storing data in the US.

Original source

Scope

Policy Area
Data governance
Policy Instrument
Cross-border data transfer regulation
Regulated Economic Activity
platform intermediary: user-generated content
Implementation Level
supranational
Government Branch
executive
Government Body
data protection authority

Complete timeline of this policy change

Hide details
2020-08-28
under deliberation

On 28 August 2020, the Irish Data Protection Commission (DPC) opened an investigation into Meta ove…

2023-04-13
under investigation

On 13 April 2023, the European Data Protection Board (EDPB) announced that it adopted a binding dis…

2023-05-12
in force

On 12 May 2023, Ireland's Data Protection Commission (DPC) issued its ruling in the investigation i…

2023-06-13
under appeal

On 13 June 2023, Meta Platforms Ireland (Meta) filed an annulment action regarding the European Dat…

We use cookies and other technologies to perform analytics on our website. By opting in, you consent to the use by us and our third-party partners of cookies and data gathered from your use of our platform. See our Privacy Policy to learn more about the use of data and your rights.