Meta Slapped with $1.3 Billion Fine Over Data Transfers, Urging Surveillance Changes for Europe

Meta, formerly known as Facebook, has been slapped with a staggering 1.2 billion euro ($1.3 billion) fine by Ireland’s Data Protection Commissioner (DPC) for its mishandling of user information. The DPC, acting as the lead European Union privacy regulator, has also given Meta a five-month deadline to cease transferring users’ data to the United States.

This hefty fine was imposed after Meta continued to transfer data despite a 2020 European Court ruling that invalidated the EU-U.S. data transfer agreement. The previous record for an EU privacy fine stood at 746 million euros, levied against Amazon.com Inc. by Luxembourg in 2021.

The long-standing dispute over where Meta stores its data traces back a decade when Austrian privacy campaigner Max Schrems raised concerns about the risk of U.S. surveillance, citing disclosures by former U.S. National Security Agency contractor Edward Snowden.

In response to the fine, Meta expressed its intention to appeal the ruling, condemning the “unjustified and unnecessary fine” and warning of the dangerous precedent it sets for other companies. The social media giant plans to challenge the suspension orders through the courts and seeks a stay of the enforcement while it pursues the appeal. Meta remains hopeful that a new data transfer pact between the EU and the U.S., facilitating the safe transfer of EU citizens’ personal data, will be implemented before it is forced to suspend transfers.

The company has previously warned that a suspension of data transfers could lead to the suspension of Facebook services in Europe. Meta emphasizes the importance of cross-border data transfers, arguing that without this ability, the internet could be fragmented into national or regional silos.

The DPC stated in March that EU and U.S. officials were working toward finalizing a new data protection framework, agreed upon by Brussels and Washington in March , which could be ready by July. However, skepticism looms over the effectiveness and durability of the new agreement. Max Schrems, the Austrian privacy campaigner, expressed doubts about its viability, stating that unless U.S. surveillance laws are adequately addressed, Meta might be compelled to keep EU data within the EU.

As the lead EU regulator for many top technology companies due to their European headquarters being located in Ireland, the DPC’s actions in this case could set a precedent for other firms. Meta has now been fined a total of 2.5 billion euros for breaching the General Data Protection Regulation (GDPR) introduced by the EU in 2018.

Initially, the DPC did not propose adding a fine to the suspension order. However, four other EU supervising authorities disagreed, and the record-breaking fine was imposed following a ruling by the European Data Protection Board (EDPB).

The Irish regulator has been particularly stringent with Meta, levying more fines against the tech giant than any other company. Additionally, the DPC has ten ongoing inquiries into various platforms operated by Meta.

The outcome of Meta’s appeal and the subsequent developments in data transfer regulations will undoubtedly have far-reaching implications for the tech industry and the privacy of users’ personal data. The case serves as a reminder of the ongoing tension between European and U.S. authorities regarding surveillance practices and the protection of personal information.