Image: © rarrarorro/Stock.adobe.com
Meta recently threatened to pull its services from Europe if regulation around data transfers between Europe and the US is not put in place.
Ireland’s Data Protection Commission (DPC) has issued a draft decision to Facebook’s parent company Meta regarding data transfers from the EU to the US.
This development is the latest in a dispute between the Irish data watchdog and Meta on the company’s transatlantic data-sharing practices.
The DPC confirmed to SiliconRepublic.com that it issued a revised preliminary decision to Meta yesterday (21 February) in relation to its data transfer inquiry.
“Meta has 28 days to make submissions on this preliminary decision, after which we will prepare a draft Article 60 decision for other Concerned Supervisory Authorities,” said DPC deputy commissioner Graham Doyle. “I’d anticipate that this will happen in April.”
While details of the draft decision have not been made public, the DPC previously proposed that the company may have to cease its EU-US transfers as its use of standard contractual clauses in respect of European user data does not comply with GDPR.
A Meta spokesperson confirmed to SiliconRepublic.com that the DPC has asked for “further legal submissions” after sending the draft decision. They added that this “is not a final decision” and is part of an “ongoing process that has some way to run”.
“Suspending data transfers would be damaging not only to the millions of people, charities and businesses in the EU who use our services, but also to thousands of other companies who rely on EU-US data transfers to provide a global service,” the Meta spokesperson added.
“A long-term solution on EU-US data transfers is needed to keep people, businesses and economies connected.”
EU-US data transfer issues
This development comes amid a wider data protection and privacy debate about transatlantic data flows. The Schrems II case in 2020 struck down Privacy Shield, a data privacy tool that allowed for the transfer of European data to US companies, and said transfers of personal data from the EU could only take place if there is a sufficient level of protection.
The European Commission and the US Government started negotiations in 2020 on a successor arrangement to the Privacy Shield. But an agreement has yet to be finalised.
Earlier this month, Meta said that it may have to pull Facebook and Instagram from the EU market if regulation around data transfers between Europe and the US does not come to fruition soon.
Meta is worried that in the absence of a data protection arrangement such as Privacy Shield, or Safe Harbour before it, and if it is unable to rely on standard contractual clauses or alternative means of data transfer, there would be an impact on its data-reliant business.
A ‘collision course’
Meta is not the only Big Tech company worried about the lack of a data transfer deal between the EU and US. The Austrian data protection authority, DSB, recently found that the use of Google Analytics by an Austrian website did not comply with EU data protection law.
The DSB concluded that measures put in place to protect personal data transferred to the US via Google Analytics were not sufficient to address that risk of privacy infringement by US intelligence agencies.
Earlier this month, France’s privacy regulator also concluded that data transfers to the US via Google Analytics breach GDPR rules and ordered a French website manager to stop using the service under certain conditions.
David Cullen, head of technology and data at Irish law firm William Fry, said “this collision course has been inevitable” since Privacy Shield was struck down in 2020.
“Many companies, not just technology platforms, are treading on thin ice with respect to compliance ever since that decision and, without appropriate guidance, unfortunately some are at high risk of falling through,” he told SiliconRepublic.com. “Businesses urgently need a replacement for Privacy Shield but it still seems some way off.”
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
