Transfers To The USA Raise Highest GDPR Fine To Date

What happened?

On 12 May 2023, the Irish Data Protection Commission ("Irish DPC") imposed a EUR 1.2 billion record fine on Meta Platforms Ireland ("Meta IE") and ordered compliance measures to be taken by the latter as a result of infringements of the General Data Protection Regulation ("GDPR"). Based on the EDPB's binding dispute resolution decision 1/2023 of 13 April 2023, the Irish DPC imposed sanctions on Meta IE because of the massive transfers of personal data from the EEA to the United States related to the management of its Facebook platform, such transfers being considered as infringing the GDPR.

Beyond the record fine (highest fine to date under the GDPR), this decision has brought the issue of data transfers from the EEA to the USA back into the spotlight.