“This decision is flawed, unjustified and sets a dangerous precedent for the countless other companies transferring data between the EU and US.” “We are therefore disappointed to have been singled out when using the same legal mechanism as thousands of other companies looking to provide services in Europe. Its President of Global Affairs, Sir Nick Clegg, said: Meta has said that it will appeal the decision and seek a stay of the ruling, before the Irish courts. Bring its processing operations in line with the requirements of GDPR, within five months of the date of the DPC’s decision, by ceasing the unlawful processing, including storage, in the US of personal data of EEA users transferred in violation of GDPR.Pay an administrative fine of €1.2 billion and,.Suspend any future transfer of personal data to the US within five months of the date of the DPC’s decision.It found that the measures used by Meta did not address the risks to the fundamental rights and freedoms of data subjects that were identified in Schrems namely the risk of access to the data by US law enforcement. The DPC ruled that Meta infringed Article 46(1) of GDPR when it continued to transfer personal data from the EU/EEA to the US following the ECJ’s ruling in Schrems II. Meta’s use of the new EU SCC’s and its “additional supplementary measures” were the focus of the DPC’s attention when issuing its decision. The European Data Protection Board has also published its guidance on the aforementioned required assessment entitled “Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data”. In the light of the above, the new EU SCCs were published in June 2021. Therefore any additional measures must address this possibility and build in safeguards to protect data subjects. The problem with the US is that it has stringent surveillance laws which give law enforcement agencies access to personal data without adequate safeguards (according to the ECJ in Schrems). If using the latter, whether for transfers to the US or other countries, the ECJ placed the onus on the data exporters to make a complex assessment about the recipient country’s data protection and surveillance legislation, and to put in place “additional supplementary measures” to those included in the SCCs. They must consider using the Article 49 derogations or SCCs. In 2020, in a case commonly known as “ Schrems II, the European Court of Justice (ECJ) concluded that organisations that transfer personal data to the US can no longer rely on the Privacy Shield Framework as a legal mechanism to ensure GDPR compliance. The former need to be included in a contract between the parties (data exporter and importer) and impose certain data protection obligations on both. These include standard contractual clauses (SCCs) and binding corporate rules. This means that, if there is no adequacy decision in respect of the receiving country, one of the safeguards set out in Article 46 must be built into the arrangement. There is a general prohibition on organisations transferring personal data to a country outside the EU, unless they ensure that data subjects’ rights are protected. The DPC ruled that Meta infringed Article 46 of the EU GDPR in the way it transferred personal data of its users from Europe to the US.Ĭhapter 5 of the EU GDPR mirrors the international transfer arrangements of the UK GDPR.

The latest development is yesterday’s largest ever GDPR fine of €1.2bn (£1bn) issued by Ireland’s Data Protection Commission (DPC) to Facebook’s owner, Meta Ireland. Personal data transfers between the EU and US is an ongoing legal and political saga.

Meta breach