Facebook owner Meta fined record €1.2bn for GDPR breach

Facebook owner Meta has been fined €1.2 billion (£1 billion) by Ireland’s Data Protection Commission (DPC) for breaching part of the European GDPR rules. The company has also been ordered to stop transferring user data from European users to its US servers.

After a three-year probe into the social media giant, the DPC said that Meta had breached part of the European General Data Protection Regulation (GDPR) rules by moving data of Facebook users across borders.

It ordered Meta Ireland to ‘suspend any future transfer of personal data to the US within five months’ and also levied a record fine on the business ‘to sanction the infringement that was found to have occurred’.

Meta has called the fine ‘unjustified’. The company said the issue was larger than simply the practices of one company, as the US and EU rules are in ‘fundamental conflict’.

In a statement on Monday, Sir Nick Clegg, Meta’s President of Global Affairs, and Chief Legal Officer Jennifer Newstead said: “It is a conflict that neither Meta nor any other business could resolve on its own. We are therefore disappointed to have been singled out when using the same legal mechanism as thousands of other companies looking to provide services in Europe.”

Meta expects no ‘immediate distruption’ to Facebook, as the company said it will appeal the decision.

“Without the ability to transfer data across borders, the internet risks being carved up into national and regional silos, restricting the global economy and leaving citizens in different countries unable to access many of the shared services we have come to rely on,” added Clegg and Newstead.

How did Facebook get hit with the GDPR fine?

The multi-year process which led to the fine was kicked off by Edward Snowden in 2013 when the National Security Agency (NSA) whistleblower revealed that US authorities were surveilling systems run by several US companies.

Companies had long been allowed to transfer EU customers’ data to the US to help them run their business, but only on a promise that they were protecting this data and that it was being stored in the EU.

The Snowden revelations put a question mark over the whole system, which sparked a request for Ireland’s Data Protection Commission to investigate how Facebook data was shared across continents and whether it breached GDPR rules.

The DPC originally refused, thinking that the complaint was not sustainable and a fine was unjustified, but this was overruled years later by the Court of Justice of the European Union. Meta criticised this overruling, with the company stating it had acted in good faith.

Policymakers on both sides of the Atlantic are currently scrambling to find a new agreement on how data can be shared across borders. Clegg and Newstead said that if this is put in place before Meta’s deadline to stop using the current system, there will be no disruption to Facebook.

They added: “No country has done more than the US to align with European rules via their latest reforms, while transfers continue largely unchallenged to countries such as China.”

> Read more: EU-US data pact set to govern future of data flows

Hungry for more tech news?

Sign up for your weekly tech briefings!