European Data Protection Board today announced that Meta, the parent company of Facebook, has been fined 1.2 billion euro for violating GDPR in the EU. This fine is the largest GDPR fine ever and was imposed since Facebook service transferred personal data to the U.S. on the basis of standard contractual clauses (SCCs) since 16 July 2020. Along with the huge fine, Meta has been ordered to bring its data transfers into compliance with the GDPR.
The inquiry on Facebook was initially commenced in August 2020. Following a comprehensive investigation, the following was concluded:
- an order, made pursuant to Article 58(2)(j) GDPR, requiring Meta Ireland to suspend any future transfer of personal data to the US within the period of five months from the date of notification of the DPC’s decision to Meta Ireland;
- an administrative fine in the amount of €1.2 billion (reflecting the EDPB’s determination that an administrative fine ought to be imposed, to sanction the infringement that was found to have occurred. The DPC determined the amount of the fine to be imposed by reference to the assessments and determinations that were included in the EDPB’s decision); and
- an order, made pursuant to Article 58(2)(d) GDPR, requiring Meta Ireland to bring its processing operations into compliance with Chapter V of the GDPR, by ceasing the unlawful processing, including storage, in the US of personal data of EU/EEA users transferred in violation of the GDPR, within 6 months following the date of notification of the DPC’s decision to Meta Ireland.
“The EDPB found that Meta IE’s infringement is very serious since it concerns transfers that are systematic, repetitive and continuous. Facebook has millions of users in Europe, so the volume of personal data transferred is massive. The unprecedented fine is a strong signal to organisations that serious infringements have far-reaching consequences,” said Andrea Jelinek, EDPB Chair.
Meta is appealing the decision and provided the following statement today:
We are appealing these decisions and will immediately seek a stay with the courts who can pause the implementation deadlines, given the harm that these orders would cause, including to the millions of people who use Facebook every day.
