Facebook’s owner, Meta, has been fined a record €1.2bn (£1bn) and ordered to suspend the transfer of user data from the EU to the US.
The fine – equivalent to $1.3bn – imposed by Ireland’s Data Protection Commission (DPC), which regulates Meta across the EU, is a record for a breach of the bloc’s General Data Protection Regulation (GDPR).
The suspension of Facebook data transfers is not immediate and Meta has been given five months to implement it.
The DPC punishment relates to a legal challenge brought by an Austrian privacy campaigner, Max Schrems, over concerns resulting from the Edward Snowden revelations that European users’ data is not sufficiently protected from US intelligence agencies when it is transferred across the Atlantic.
Meta has also been given six months to stop “the unlawful processing, including storage, in the US” of personal EU data already transferred across the Atlantic, meaning that user data will need to be removed from Facebook servers.
The ruling does not affect data transfers at Meta’s other main platforms, Instagram and WhatsApp. Meta said it would appeal against the decision and seek a stay on the data transfer order.
The DPC said Meta infringed GDPR by continuing to transfer EU user data to the US without proper safeguards in place, despite a ruling by the European court of justice in 2020 requiring robust protection of that information. The CJEU ruled that data leaving the EU must have the same level of protection as it would have under GDPR when it reaches its destination outside the EU.
The regulator said data transferred by Facebook under a legal instrument called standard contractual clauses (SCCs) “did not address the risks to the fundamental rights and freedoms of data subjects that were identified by the [court of justice] in its judgment”.
Meta, whose EU base is in Ireland, said it had been “singled out” by the DPC despite thousands of other businesses using the same data transfer processes.
“We are … disappointed to have been singled out when using the same legal mechanism as thousands of other companies looking to provide services in Europe,” wrote Nick Clegg, the Meta president of global affairs, and Jennifer Newstead, the Meta chief legal officer, in a blog post on Monday.
Clegg and Newstead added: “This decision is flawed, unjustified and sets a dangerous precedent for the countless other companies transferring data between the EU and US.” They said the internet risked being carved up into national and regional silos as a result.
A spokesperson for the European Commission – the EU’s executive arm – said it hoped a new framework for transatlantic data transfers would be “fully functional by the summer” which would provide the “stability and legal certainty” sought by US tech companies. Facebook would be able to resume data transfers under the new data regime, which has been agreed between Washington and Brussels at a political level but still requires agreement on implementation.
The spokesperson said it was “very clear” that the EU had worked with the US on putting “safeguards” protecting consumer data in place and it hoped to restore legal certainty.
The Meta blog said there would be “no immediate disruption” to Facebook’s service in the EU because of the grace period announced by the DPC. However, in Meta’s most recent quarterly results, the company said that without SCCs or “other alternative means of data transfers” it would “likely be unable to offer a number of our most significant products and services, including Facebook and Instagram, in Europe”.
Meta reported net income, a US measure of profit, of $23.2bn last year. Shares in Meta were up 2.2% in midday trading on Monday, valuing the company at more than $640bn.
The DPC said it had disagreed with other EU regulators over Meta’s punishment, which resulted in the European Data Protection Board, comprised of EU data watchdogs, stepping in to decide whether a fine should be imposed. The previous record GDPR fine was €746m imposed on Amazon by Luxembourg in 2021.
Eddie Powell, a data protection partner at UK law firm Fladgate, said an appeal was unlikely to reverse all of the decision. “At the heart of the issue is the US government’s ability under US law to access EU personal data held by US corporations on the grounds of national security, without any effective safeguard or checks,’” he said.
Powell added that the fine reflected the fact that “Meta’s systems were structured so that all data collected on its social media platforms had to be sent to the US, without any kind of firebreak”.
Mark Deem, a partner at the UK law firm Wiggin, said the size of the fine would send a message to other businesses that transfer personal data outside the EU. “One of the purposes of the figure is to serve as a warning to other companies about how they handle international data transfers,” he said.
The UK data watchdog, the Information Commissioner’s Office, said: “We have noted the decision and will review the details in due course.”
