Ireland fines Meta €1.2bn for failing to protect European users’ data

The Irish Personal Data Protection Commission (DPC) has published a decision (.pdf) to recover from the Meta company (recognized as extremist and banned in the Russian Federation) a fine of €1.2 billion. In addition, the regulator ordered the company to stop sending data about European users to the United States for five months.

The Irish regulator, which has been investigating the American company since August 2020, has concluded that Meta violated a July 2020 European Union court ruling in a case against Austrian activist Maximilian Schrems. Then Mr. Schrems achieved the recognition of the illegal agreement between the EU and the US, which allowed Internet companies to move data between the two regions. The EU court then substantiated its decision by the fact that the data of European users could too easily be at the disposal of American intelligence services.

Despite the fact that the US and the EU continued to work on developing mechanisms to protect users’ personal data, a new agreement between the parties has not yet been signed. And Ireland back in September 2020 demanded from Meta (then Facebook) to stop forwarding data from European users to servers in the US. The company refused to comply with this requirement.

The current DPC regulation is aligned with the European Data Protection Council. It only applies to Facebook and does not affect other Meta services. Meta itself called the DPC decision unfair, as thousands of companies continue to send user data between the US and the EU in the same way.

“Without the ability to transfer data across borders, the Internet risks being divided into national and regional segments, which will limit the global economy and deprive citizens of different countries of access to many common services that we have come to rely on,” Nick Clegg, president of Meta on Global Relations, and Jennifer Newsted, General Counsel of the company. Meta representatives also said that the company intends to appeal the decision of the Irish regulator.

Kirill Sarkhanyants