Facebook owner Meta has been fined €1.2bn (£1bn) for mishandling data when transferring it between Europe and the US. The Ireland-based Data Protection Commission found that the company’s actions effectively breached GDPR regulations.
The punishment follows a legal challenge brought by Max Schrems, an Austrian privacy campaigner, over concerns that European Facebook users’ data is not sufficiently protected from US intelligence agencies when it is transferred to the US.
The DPC ruling gives Meta six months to stop “the unlawful processing, including storage in the US” of personal data from the EU already transferred. The measure does not affect data transfers at Meta’s other key platforms, Instagram and WhatsApp.
Meta plans to appeal. In a blog post, Nick Clegg, Meta’s president of global affairs and Jennifer Newstead, Meta’s chief legal officer, said: “This decision is flawed, unjustified, and sets a dangerous precedent for the countless other companies transferring data between the EU and US.” They said such a ruling risked carving the internet up into national and regional silos.
Tim Bowes, associate director at the consultancy Dufrain, said: “In a fitting lead up to the anniversary of GDPR, this record-breaking fine for Meta should signal to all companies that no-one is immune from regulatory scrutiny. It’s simply not enough for companies to consider themselves compliant where they are headquartered – the transfer of data to regions with different privacy laws needs due consideration and pleading ignorance or blaming how data is stored or used won’t fly.
“Aside from legal measures such as implementing standard contractual clauses, practical measures companies can take to avoid non-compliance include completing a stringent data audit to identify what personal data is collected, where it is stored and how it is used. It is equally vital that appropriate security measures such as encryption and regular audits take place to ensure ongoing compliance. Companies also need to make sure they have clear and transparent processes in place for obtaining valid consent from individuals for the collection and use of their personal data.”
