What Does The Irish DPC's 1.2 Billion Euro Data Transfer Fine Mean For EU-US Transfers?

On 22 May 2023, the Irish Data Protection Commission ("DPC") fined Facebook parent Meta EUR 1.2 billion for transferring personal data to the U.S. in violation of GDPR. The DPC also ordered Meta to suspend further transfers unless it can bring such transfers into compliance within 5 months. Meta is appealing the decision.

The DPC alleged that Meta transferred personal data based on European Commission standard contractual clauses ("SCCs") and had conducted transfer impact assessments ("TIAs") in line with guidance from EU regulators. If true, Meta's actions were consistent with the actions of many companies.

The DPC – and the European Data Protection Board ("EDPB") – found that the alleged transfers to the US were not lawful because U.S. laws permitted US government authorities to compel access to transferred data without sufficient safeguards.