Introduction
On 22 May 2023, the Irish Data Protection Commission (DPC) announced the conclusion of its inquiry into Meta Platforms Ireland Limited (Meta). This inquiry concerned the manner in which Meta transferred personal data out of the EU to the US. The DCP found that Meta infringed the General Data Protection Regulation (“GDPR”) by transferring personal data to the US under a mechanism knows as standard contractual clauses. The DPC imposed a record fine of €1.2 billion on Meta and ordered it to bring its transfer of personal data from the EU to the US into compliance within 6 months.
Transferring Data outside the EEA
In order to transfer personal data outside of the EEA, organizations must comply with Chapter V of the GDPR, which requires that certain transfer mechanisms be put in place to ensure the any personal data transferred is protected to a level that is essentially equivalent to that guaranteed by the GDPR. The two most common transfer mechanisms used by organizations are EU Commission Adequacy Decisions and Standard Contractual Clauses (SCCs).
An adequacy decision means that the European Commission has decided that a non-EEA country, known in data protection law as a third country, ensures an adequate level of data protection. The effect of such a decision is that personal data can flow from the EEA to a third country without any further safeguard being necessary. In other words, the transfer is the same as if it was carried out within the EU.
In the absence of an adequacy decision, the GDPR does allow a transfer outside the EEA if the organization transferring the data has appropriate safeguards in place. The majority of organizations adopt SCCs, where there is no adequacy decision in place. These are model data protection clauses that have been approved by the European Commission. SCCs contain specific data protection safeguards to ensure that personal data continues to benefit from a high level of protection when transferred outside the EEA.
Meta Inquiry
In July 2020, in the Schrems II decision the Court of Justice of the European Union struck down the adequacy decision which the Commission had adopted in relation to personal data transfers to the US, known as the EU-US Privacy Shield. The Court held that EU-US Privacy Shield could not ensure a level of protection essentially equivalent to that guaranteed by the GDPR. In its judgment the Court also held that SCCs remain a valid transfer mechanism, however, when using SCCs an organization must verify that the personal data being transferred will be adequately protected in the destination country in line with the requirements of EU law. That level of protection must be essentially equivalent to that guaranteed within the European Union by the GDPR.
Following the judgment in Schrems II, given that there was no longer an adequacy decision in place for the US, Meta began to transfer personal data to the US under SCCs.
In examining whether or not Meta’s transfer of data from EU to the US was in compliance with the GDPR, the DPC considered whether or not, given the use of SCCs, the transferred personal data had an equivalent level of protection to that provided by EU law and if it did not whether any additional measures taken by Meta could remedy that defect.
Following a detailed inquiry the DPC concluded that:
- US law does not provide a level of protection that is essentially equivalent to that provided by EU law;
- SCCs cannot compensate for the inadequate protection provided by US law; and
- Meta did not have in place any supplemental measures which would compensate for the inadequate protection provided by US law.
On the basis of the above DPC held that Meta’s transfer of data from the EU to the US was unlawful and in breach of the GDPR. Accordingly the DPC ordered Meta to suspend any future transfer of personal data to the US within the period of five months and imposed an administrative fine in the amount of €1.2 billion. The DPC also ordered Meta to bring its processing operations into compliance with Chapter V of the GDPR, by ceasing the unlawful processing, including storage, in the US of personal data of EU users transferred in violation of the GDPR, within 6 months.
Implications of this Decision
While the fine against Meta is noteworthy, this decision will have a significant impact on businesses who transfer personal data to the US. This decision makes it clear that in light of US law, the use of SCCs alone is not sufficient to ensure GDPR compliance, when transferring personal data to the US and organizations must put in place additional controls and measures to ensure that any data transferred to the US has a level of protection that is essentially equivalent to that provided by EU law.It is hoped, however, that the impact of this decision will be short lived as a new adequacy decision in relation to the transfer of data to the US may be agreed by the EU Commission shortly, which will alleviate any of these concerns. If a new adequacy decision is in place organizations can transfer data to the US, without taking any additional measures and the transfer will be the same as it was carried out within the EU.
Article provided by INPLP member: Laura Fannin (Hayes solicitors LLP, Ireland)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
