Facebook’s owner Meta has been fined €1.2bn ($1.3bn) by EU regulators for mishandling Facebook user’s data when transferring it between Europe and the United States.
Issued by Ireland’s Data Protection Commission (DPC), it is the largest fine imposed under the EU’s General Data Protection Regulation privacy law.
The Irish watchdog claimed that Meta’s transfers of personal data to the US on the basis of standard contractual clauses (SCCs) since 16 July 2020 violate GDPR.
In 2020, the European Court of Justice revoked the Privacy Shield, an EU-US data flows agreement, over fears of US surveillance practices and restricted the use of SCCs.
While the EU and the US are working on a new data flow deal expected later this year, Meta and other multinational companies have continued to rely on the previous agreement illegally.
The suspension of Facebook data transfers is not immediate and Meta has been given until October 12, 2023, to stop relying on SCCs for their transfers.
The ruling does not impact data transfers at Meta’s other main platforms, Instagram and WhatsApp. Meta said it would appeal against the decision and seek a stay on the data transfer order.
Being the largest fine imposed under GDPR, it amounts to nearly twice the previous record of €746m ($808m) issued to Amazon by Luxembourg’s data protection authority (CNPD) in July 2021.
Andrea Jelinek, chair of the European Data Protection Board (EDPB), stated that Facebook has millions of users in Europe, so the volume of personal data transferred is massive. The unprecedented fine is a strong signal to organizations that serious infringements have far-reaching consequences.
Comments