Today is the deadline for the Irish Data Protection Commission (DPC) to adopt a final decision on a long-standing complaint against Facebook’s transfers of personal data from the EU to the U.S. The decision could potentially lead to an order for the company to halt the flow of data. However, the public release of the decision is expected to be delayed by just over a week until May 22, assuming no details leak before then.
The delay in publishing the decision is due to Meta (formerly Facebook) being given time to review the document and identify any confidential or commercially sensitive information that may need to be redacted. Additionally, a public holiday affecting another EU regulator has also contributed to the delay.
The European Data Protection Board (EDPB) had previously intervened to settle disagreements between various EU regulators over the decision, and it gave the DPC one month to implement the binding decision on Meta’s transfers. The details of the EDPB’s resolution have not been made public yet, pending the final decision of the DPC. The fate of Facebook’s data flows in Europe remains uncertain.
However, it is widely expected that Meta will be ordered to suspend data flows, as it had already received a preliminary suspension order from the DPC in the fall of 2020. Meta is likely to challenge any suspension order in the Irish courts.
Meta has attempted to downplay the situation, stating that it relates to a historic conflict between EU and US law, which is being resolved through a draft agreement for a new high-level transatlantic data transfer framework. However, this agreement is still under review by EU institutions, and concerns have been raised about its safeguards. European lawmakers have called for more time to improve the proposal, suggesting further delays in adoption.
Apart from the data suspension issue, other significant elements to watch for in Ireland’s final decision include whether Meta will be ordered to delete European users’ data if it was unlawfully transferred to the US. Internal documents leaked last year indicated issues with Meta’s data management practices, raising questions about its ability to identify and isolate European users’ data for deletion.
If found to have unlawfully transferred data, Meta could also face a fine of up to 4% of its global annual turnover under the General Data Protection Regulation (GDPR). However, Meta has historically managed to secure lower fines than the maximum penalty.
While financial penalties are noteworthy, operational orders that force changes to business models are often more impactful. Meta was compelled to offer an opt-out for behavioral ad targeting as a result of GDPR enforcement. It remains to be seen how Meta might have to amend its business model to rectify unlawful transatlantic data transfers.
Meta is expected to fight any order to suspend data flows in court and may seek to delay action until a new US data adequacy agreement is established. However, critics, such as privacy rights advocacy group noyb, suggest that the new framework is likely to be challenged and struck down by the EU’s top court, just as previous arrangements were. This means Meta may only gain a temporary reprieve before the issue resurfaces.
