Meta Ireland was fined a record €1.2 billion on Monday 22 May for non-compliance with the EU’s General Data Protection Regulation (GDPR) by its social network Facebook. A penalty imposed by the Irish Data Protection Commission (DPC) following a dispute resolution decision adopted by the European Data Protection Board (EDPB) in April (see EUROPE 13161/25).
The US company was convicted of transferring personal data of European users to the US. “The EDPB found that Meta IE’s infringement is very serious since it concerns transfers that are systematic, repetitive and continuous” commented Andrea Jelinek, President of the EDPB.
This is in fact the largest fine ever imposed under the GDPR. Meta IE will also have to suspend all data transfers to the US within five months and comply with the GDPR within six months.
While the company plans to appeal, CCIA Europe, representing the interests of the technology industry, has in turn criticised the sanction. Not only it “effectively makes the way the internet works illegal”, but it also ignores the legal uncertainty created by the lack of a legal framework allowing the transfer of data between the EU and the US. “We call on the 27 Member States to approve the European Commission’s adequacy decision without further delay” it urged (see EUROPE 13180/8).
On the contrary, Nyob, the association of data protection activist Max Schrems, welcomed a “victory” after ten years of proceedings. Indeed, the social network has been the subject of legal proceedings in Ireland since revelations about “the assistance given by major US technology companies to the [US] mass surveillance apparatus”. However, it stressed that “the fine could have been much higher, given that the maximum fine is more than €4 billion and Meta has knowingly broken the law to make a profit for ten years”. (Original version in French by Hélène Seynaeve)