That Meta GDPR fine is €1.2B. Plus biz must stop sending EU data to US
- Reference: 1684777591
- News link: https://www.theregister.co.uk/2023/05/22/dpc_fines_meta_12b_tells/
- Source link:
The [1]record €1.2 billion ($1.3b) fine comes along with a [2]decision that Meta will have to suspend data transfers from EU countries to the US within five months, and that it'll have six months to ensure processing and storage of EU citizens' data is in compliance with the GDPR.
Irish officials, who led the investigation and made the final decision, weren't actually keen on fining Facebook, and instead wanted to suspend data transfers to the US. Upon consultation with other concerned supervisory authorities (CSA), however, the DPC said it found a few that objected to the fine-free draft decision.
[3]
"Following an informal consultation process, it became clear that consensus could not be reached," the DPC said. According to the Irish authority, it's obligated under the GDPR to consult with the European Data Protection Board (EDPB) when a consensus between CSAs can't be reached, and the EDPB [4]decided last month after reviewing the case that a fine was in order.
[5]
[6]
"The EDPB found that Meta IE's infringement is very serious since it concerns transfers that are systematic, repetitive and continuous. Facebook has millions of users in Europe, so the volume of personal data transferred is massive. The unprecedented fine is a strong signal to organisations that serious infringements have far-reaching consequences," said EDPR chair Andrea Jelinek.
For those curious, Meta [7]earned $5.709 billion in the first three months of 2023.
Meta says we're not the only ones
In a response to the DPC's final decision, Meta [8]said it was following the same rules as all the other US companies doing business in the EU and was "disappointed to have been singled out when using the [9]same legal mechanism as thousands of other companies looking to provide services in Europe."
Despite what the DPC said was its legal obligations to confer with the EDPB, Meta called the Board's move a "disregard [for] the clear progress that policymakers are making to resolve this underlying issue," referring to ongoing discussions about the EU-US Data Protection Framework (DPF), another [10]attempt at a shared transatlantic definition of data protection [11]adequacy between the two governments.
[12]
While the European Commission has began the process of adopting an adequacy decision regarding the DPF, European lawmakers have been vocal about their [13]opposition to the adequacy decision. Most recently, the EU's Committee on Civil Liberties, Justice and Home Affairs issued a [14]resolution describing the DPF as an improvement over the prior EU-US Privacy Shield, but still insufficient to protect EU citizens' data from being snooped by Uncle Sam. The EDPB expressed a [15]similar position in February.
Conform to international law? Us?
While it might not be happy about the fine, Meta doesn't seem overly concerned about the DPC's suspension order. In its response to the decision, Meta said it was happy "that there will be no suspension of the transfers or other action required of Meta, such as a requirement to delete EU data subjects' data once the underlying conflict of law has been resolved," again referring to the DPF.
When asked how that jibes with the DPC having actually imposed a suspension order, a Meta spokesperson only referred us back to the company's statement and added that the suspension won't take effect if the DPF is enacted before the five-month deadline is up.
The DPC for its part only said in its ruling that it has to make decisions based on current EU law; with the DPF not currently an active EU law, "it does not bear on the issues addressed in this Decision," the DPC said.
Meta didn't answer questions about whether it's still making plans to conform to the suspension in case a DPF decision doesn't arrive on time. We asked similar questions about the implementation of the transfer suspension, and Meta's response to the decision, to the DPC but have yet to hear back.
[16]
In a statement sent to The Register, Eddie Powell, data protection partner at London law firm Fladgate, said the suspension order was the "first big use" of EU authorities' ability to order such data transfer pauses, and is likely to be a headache for Meta, who "will be hoping that the US/EU deal version 3 – the 'Data Privacy Framework' gets approved and implemented quickly," Powell said.
Meta said it will "appeal both the decision's substance and its orders including the fine, and will seek a stay through the courts to pause the implementation deadlines."
Max Schrems, leader of EU privacy advocacy group noyb and [17]arguably the man responsible for killing prior EU-US data transfer frameworks, said that Meta's appeals and the pinning of its hopes on the DPF put it on shaky ground. After all, it's [18]likely Schrems and company will file a complaint as soon as the framework is ratified.
[19]Meta facing third fine of 2023 for mishandling EU user data under GDPR
[20]Ireland's privacy watchdog fines WhatsApp €5.5 million
[21]Long data privacy notices aren't foolproof, Euro watchdog tells Meta
[22]Ireland fines Meta $414m for using personal data without asking
Schrems, who is [23]no fan of the Irish DPC, said in a statement responding to its ruling against Meta that its past actions can't be overlooked when a new law goes into effect. Beyond that, Schrems said, he doesn't think the DPF will hold up to its all-but-inevitable judicial scrutiny.
"In my view, the [DPF] has maybe a ten percent chance of not being killed by the CJEU. Unless US surveillance laws gets fixed, Meta will likely have to keep EU data in the EU," Schrems said. ®
Get our [24]Tech Resources
[1] https://www.theregister.com/2023/05/18/meta_facing_third_gdpr_fine/
[2] https://www.dataprotection.ie/en/news-media/press-releases/Data-Protection-Commission-announces-conclusion-of-inquiry-into-Meta-Ireland
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZGvmDBk3LUQ8EfRrguu6jQAAAEc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://edpb.europa.eu/news/news/2023/12-billion-euro-fine-facebook-result-edpb-binding-decision_en
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZGvmDBk3LUQ8EfRrguu6jQAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZGvmDBk3LUQ8EfRrguu6jQAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://investor.fb.com/investor-news/press-release-details/2023/Meta-Reports-First-Quarter-2023-Results/
[8] https://about.fb.com/news/2023/05/our-response-to-the-decision-on-facebooks-eu-us-data-transfers/
[9] https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
[10] https://www.theregister.com/2021/06/21/final_guidance_on_schrems_ii/
[11] https://ec.europa.eu/commission/presscorner/detail/en/ip_22_7631
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZGvmDBk3LUQ8EfRrguu6jQAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2023/02/17/adequacy_decision_us_data_transfer/
[14] https://techcrunch.com/2023/04/14/dpf-libe-committee-concerns/
[15] https://edpb.europa.eu/news/news/2023/edpb-welcomes-improvements-under-eu-us-data-privacy-framework-concerns-remain_en
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZGvmDBk3LUQ8EfRrguu6jQAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://www.theregister.com/Tag/Schrems%20I%20and%20Schrems%20II/
[18] https://www.theregister.com/2022/10/10/privacy_shield/
[19] https://www.theregister.com/2023/05/18/meta_facing_third_gdpr_fine/
[20] https://www.theregister.com/2023/01/20/irelands_data_protection_watchdog_fines/
[21] https://www.theregister.com/2023/01/13/long_data_privacy_meta/
[22] https://www.theregister.com/2023/01/04/meta_fined_390_for_using/
[23] https://www.theregister.com/2021/11/24/max_schrems_files_corruption_complaint/
[24] https://whitepapers.theregister.com/
Re: Honest question
"You now cannot process EU credit cards, bank transfers, process EU salaries, accept advertising from the EU, do business inside the EU, nor claim to do so."
If you think they'll just shrug that off, I assure you that you don't understand how they make that money.
Their assets in the EU are neither here nor there when 50%+ of their income is literally barred overnight.
Not even Microsoft (convicted) or other large companies were dumb enough to just bow out of the EU entirely. They all end up complying. Because the alternative is that you literally cannot accept money from the EU because the EU banks will refuse all such transactions. A bit like trying to buy Bitcoin using certain UK bank accounts... ever tried to do so? It just gets blocked.
Re: Honest question
> how can they be stopped
Good question. Let me answer with another one: Can Meta afford to lose all users in the EU?
Because, the Union absolutely has the power to simply block services if they want to: https://gizmodo.com/chatgpt-ai-openai-italy-bans-chatgpt-investigate-openai-1850287210
Now, that would suck for the users, sure. But I have a hunch that it would suck even more for the people who have to explain to the board at Meta, why they suddenly lost every single user in the 3rd largest economy in the world.
Re: Honest question
What makes you think that their assets are less than the fine? Here's one problem related to that: they've put most of their assets into their Irish company so they aren't paying tax in the U.S. for revenue from users outside North America. That's not just their EU customers, but everybody outside the U.S. and Canada (I'm not really sure why Canada isn't included, but I'm no tax lawyer). That's a large chunk of their revenue stored in an EU member state. Unless they quickly move all of it away and find a new place to incorporate, they have plenty of assets there. They also have [1]three DCs built inside the EU, and their investment figures for a single one is higher than their fine. While it's certainly possible that there's been some depreciation of those, if those three were liquidated, it would come to more than their fine amount.
Even without considering that they earn plenty from having customers in the EU and they don't want to lose it, they have plenty of assets that could be taken if it came to it. Your question may be based on faulty assumptions.
[1] https://datacenters.atmeta.com/europe/
Re: Honest question
Indict their board members and directors (including international search warrants), confiscate assets, forbid services in the EU.
That's more costly and annoying than paying a lousy billion (which is just a percentage of their profit)
Data is a bit like money laundering.
Government A gets Government B to collect the data then pass it back to Government A all nice and clean because they haven't broken any laws in their own countries. This was the whole idea behind prism.
So my question is who is actually going to pay these fines? I can't really see it being the companies working for governments so will it be extracted from us one way or another?
Just thinking out loud on this.
The sheer arrogance of their statement is proof (if any more was needed) of the bunch of utter sleazeballs (I’m trying not to get carried away here) they are.
So glad I ditched them almost 10 years ago, I can’t wait to see them join MySpace.
Imagine if Facebook was a Chinese app/platform
These spies, everything is going back to Beijing. Facebook is a tentacle of American spying in Europe and should be banned immediately.
Re: Imagine if Facebook was a Chinese app/platform
I have to agree with that.
Anything that has been said about Wuawei/TikTok beholden to Beijing could not have those elements replaced by Cisco and the NSA and retain 100% of its threat level.
The USA has National Security Letters, with the legal obligations for companies being subject to one to shut up about it.
How's that for being beholden to the NSA ?
Why is that any better ? Because Beijing is not a democracy ?
You think the USA is ?
Grrr. There's a "not" too many in my previous post.
Round and round the mulberry bush
" the suspension won't take effect if the DPF is enacted before the five-month deadline is up "
The DPF is likely to suffer the same fate as Privacy Shield and its predecessor, as it can not in principle override extant US federal law that allows privacy intrusion. I suspect any adequacy decision based on it will be very short lived.
However the basic position that the GDPR can be ignored in the interest of commercial advantage is so well established that I also suspect that little will actually change from the perspective of data subjects' rights regardless of what happens to the DPF.
There's no way the new agreement should be put in place
There's no way the new agreement should be put in place because NOTHING has changed in the U.S.A. Nothing at all.
Honest question
So if meta decide to fsck the EU, how can they be stopped? "Our assets in the EU are less than the fine. Easier to let them go and leave the EU go figure how to deprive its citizens of the freedom to stick with us."
Now, I know the "honest question" phrase draws downvotes like a rotting skunk draws maggots, but hey, an apt simile is an apt simile so let's go with it.