Ireland’s DPC has sent a draft of its final decision to other EU regulators on whether Meta can continue sharing EU data with US companies.
Meta may soon have to halt Facebook and Instagram data transfers between the EU and US based on an updated draft ruling by the Irish Data Protection Commission (DPC) was shared with other EU regulators yesterday (7 July).
This comes a few months after Meta threatened shut down Facebook and Instagram in the EU market because of a legal quagmire around the flow of data across the Atlantic.
The Schrems II case in 2020 struck down Privacy Shield, a data privacy tool that allowed for the transfer of European data to US companies, and said transfers of personal data from the EU could only take place if there is a sufficient level of protection.
Because the EU does not consider US data protection to be adequate, fearing surveillance from the government, data transfers can only take place through mechanisms such as the standard contractual clauses – which are seen as largely incompatible with GDPR.
However, while the temporary measure has allowed for data flow to continue, the Irish DPC has continued its probe behind the scenes, and yesterday, a spokesperson told the media that it has informed its EU counterparts of a draft final decision.
The Irish DPC leads the regulation of big tech companies such as Meta because Ireland is the European base for so many of these companies. Other regulators now have a month’s time to weigh in on the draft ruling before a final decision is made.
In March, the Irish DPC slammed a €17m fine on Meta for not complying with GDPR requirements in the context of a dozen data breaches.
‘Long-term solution on EU-US data transfers needed’
This is not the first draft decision that has been made by the regulator this year. In February, the Irish DPC issued a revised preliminary decision to Meta in relation to its data transfer inquiry.
A Meta spokesperson told SiliconRepublic.com at the time that the Irish DPC has asked for “further legal submissions” after sending the draft decision. They added that this “is not a final decision” and is part of an “ongoing process that has some way to run”.
“Suspending data transfers would be damaging not only to the millions of people, charities and businesses in the EU who use our services, but also to thousands of other companies who rely on EU-US data transfers to provide a global service,” the Meta spokesperson said.
“A long-term solution on EU-US data transfers is needed to keep people, businesses and economies connected.”
Meta is not the only Big Tech company worried about the current lack of a data transfer deal between the EU and US. The Austrian data protection authority, DSB, found earlier this year that the use of Google Analytics by an Austrian website did not comply with EU data protection law.
The DSB concluded that measures put in place to protect personal data transferred to the US via Google Analytics, such as encryption, were not sufficient to address that risk of privacy infringement by US intelligence agencies.
10 things you need to know direct to your inbox every weekday. Sign up for the Daily Brief, Silicon Republic’s digest of essential sci-tech news.
Discussion about this post