The Irish Data Protection Commission (DPC) has been investigating Meta Ireland’s transfer of personal data from the EU to the United States since 2020. As a result of breaching a previous court ruling, Meta, the owner of Facebook, has been fined a record EUR 1.2 billion (approximately Rs. 10,750 crore) by Ireland’s regulator. The European Data Protection Board (EDPB) ordered the DPC to collect the administrative fine.
The DPC found that Meta, with its European headquarters in Dublin, failed to address the risks to the fundamental rights and freedoms of data subjects, which were identified in a previous ruling by the Court of Justice of the European Union (CJEU). The CJEU ensures consistent application of EU law across member states.
Meta expressed disappointment with being singled out and described the ruling as flawed, unjustified, and setting a dangerous precedent. They intend to appeal the decision and seek a stay through the courts to pause implementation deadlines. Meta emphasized that there is no immediate disruption to Facebook in Europe.
Initially, the DPC wanted to suspend the data transfers, but its peer regulators, known as Concerned Supervisory Authorities (CSAs), disagreed. The CSAs, including the DPC, concluded that Meta Ireland should be subject to an administrative fine. The matter was referred to the EDPB, which ruled that Meta Ireland should suspend future data transfers to the United States and pay a fine.
Meta’s response highlighted concerns regarding the EDPB’s decision to overrule the DPC, stating that it raises serious questions. They also emphasized that the US has made significant efforts to align with European rules, while transfers to other countries continue largely unchallenged.
It is worth noting that EU regulators have previously fined Meta for data breaches in relation to its Instagram, WhatsApp, and Facebook services. Additionally, in 2021, Amazon was fined EUR 746 million (approximately Rs. 6,685 crore) in Luxembourg for violating the EU’s General Data Protection Regulation.
