Meta, the parent company of Facebook, has received a historic fine of $1.3 billion from European Union data protection.
regulators for transferring users’ personal data from the region to the United States.
In a binding decision by the European Data Protection Board (EDPB), the social media giant has been.
instructed to ensure compliance with the GDPR (General Data Protection Regulation) and delete unlawfully stored and processed data within six months.
Additionally, Meta has been given five months to halt any future transfer of Facebook users’ data to the U.S.
However, this ruling does not apply to Instagram and WhatsApp, which are also owned by the company.
According to Andrea Jelinek, Chair of the EDPB, the infringement by Meta IE (formerly Facebook).
is deemed very serious due to the systematic, repetitive, and continuous nature of the data transfers.
Jelinek stated, “Facebook has millions of users in Europe, so the volume of personal data transferred is massive.
The unprecedented fine sends a strong message to organizations that serious infringements have significant consequences.”
European data protection authorities have repeatedly highlighted the lack of privacy protections in the U.S.
equivalent to those provided by the GDPR. This raises concerns about potential access to European data by American intelligence agencies, as the data is stored on servers located in the U.S.
The ruling stems from a legal complaint filed almost a decade ago in June 2013 by Austrian privacy activist Maximilian Schrems, the founder of NOYB (None Of Your Business).
Schrems raised concerns that European user data was not adequately safeguarded from U.S.
mass surveillance programs when transferred across the Atlantic.
Schrems suggested that reasonable limitations in U.S. surveillance laws would be the simplest solution.
He emphasized the need for probable cause and judicial approval of surveillance, urging the provision of these basic protections to EU customers of U.S.
cloud providers. Schrems also warned that other major U.S.
cloud providers such as Amazon, Google, or Microsoft could face similar decisions under EU law.
Meta plans to rely on a new data transfer deal moving forward, but Schrems expressed skepticism about its long-term viability.
He believed that the new deal has a low chance of being upheld by the Court of Justice of the European Union (CJEU).
Schrems stated that unless U.S. surveillance laws are amended, Meta will likely need to keep EU data within the EU.
Schrems also accused the Irish Data Protection Commission (DPC) of consistently attempting to impede the case and protect Meta from fines and data deletion. The EDPB has overturned these actions by the DPC.
In response to the ruling, Meta announced its intention to appeal, arguing that the fine is unjustified and unnecessary.
The company highlighted a fundamental conflict between the U.S. government’s data access rules and European privacy rights.
Meta’s representatives, Nick Clegg and Jennifer Newstead, cautioned that without the ability to transfer data across borders.
the internet could become fragmented, hindering the global economy and limiting access to shared services for citizens in different countries.
Last year, Meta warned that if required to suspend transfers to the U.S., it may have to discontinue some of its significant products and services in the EU.
A new trans-Atlantic data transfer agreement is expected to replace the Privacy Shield later this year, according to the Wall Street Journal.
This fine is the largest ever imposed under the GDPR privacy laws in the EU, surpassing the previous.
record of €746 million ($886.6 million at the time) imposed on Amazon in July 2021 for similar privacy violations.
The penalty marks the third monetary fine issued by the DPC this year.
In January, the watchdog fined Meta €390 million for mishandling user information for targeted ads on Facebook and Instagram. Two weeks later,
