Facebook group Meta collects record fines of 1.2 billion euros

On the fifth anniversary of the General Data Protection Regulation (GDPR), US internet giant Meta has felt the strong hand of European data protection rules harder than ever. The group was sentenced in Dublin on Monday by the Irish regulator DPC to a record fine of 1.2 billion euros.

The case concerns Facebook’s involvement in mass surveillance by Anglo-American secret services, which was discovered a decade ago by American whistleblower Edward Snowden. At the time, Austrian data protection activist Max Schrems filed a complaint against Facebook.

The fine imposed by the DPC dwarfs the previous record fine of 746 million euros for Amazon.com in Luxembourg. In addition, Meta must cease any further transfer of European personal data to the United States, as the company remains subject to US surveillance laws.

Does Meta fight back?

Experts now assume that the American group will appeal the decision. The legal process can take years. By then, a new data pact could come into effect between the European Union and the US, regulating transatlantic data traffic. Meta had previously threatened to withdraw completely from the EU if transatlantic data transfers were not permanently possible.

Schrems explains that the fine imposed could have been much higher: “The maximum fine is more than four billion. And Meta has deliberately violated the GDPR for ten years to make a profit.” If US surveillance laws are not changed, Meta will likely have to fundamentally restructure its systems, Schrems explains.

Since the unconditional entry into force of the General Data Protection Regulation five years ago, fines of four billion euros have been imposed so far with the new fine for Meta. Meta is now represented six times in the list of the ten highest fines, the fines now amount to a total of 2.5 billion euros.

Should the currently imposed record fine become due at any time after a lengthy legal dispute, the amount would flow precisely to the Irish state, which Facebook did not want to stand in the way of for years. The Irish data protection authority DPC has long refused to take action against Facebook. Ultimately, the European Data Protection Board (EDPB) forced the DPC to impose a fine on the social network.

Disputed precedent

Meta top executives Nick Clegg (President Global Affairs) and Jennifer Newstead (Chief Legal Officer) described the DPC’s decision as “wrong and unwarranted” in an initial response. It sets a dangerous precedent for the countless other companies that exchange data between the EU and the US.

The decision also raises serious questions about a regulatory process that would allow the European Data Protection Council to overrule a chief supervisor in this way and ignore the findings of its multi-year investigation, without giving the affected company the right to be heard. .”

In fact, this case is not just about what data protection procedures a company like Facebook used, but about a very fundamental legal conflict between the US and Europe. The US governments – whether under Barack Obama, Donald Trump or Joe Biden – are pushing for access to the data to avert danger. However, this has little in common with the data protection views of the EU and the European Court of Justice (ECJ).

It’s more of a coincidence that Facebook and its parent company Meta were the first to get caught up in processing the Snowden revelations. Even Facebook critic Max Schrems says, “Any other major US cloud providers like Amazon, Google or Microsoft could be hit with a similar penalty under EU law.”

A spokesperson for the European Commission stated briefly and concisely on Monday that it had taken note of the decision. Meta should now fix the problem. According to this, there should be an agreement between the EU and the US on data transfer by the summer. According to the spokesperson, this ensures legal certainty for companies, but also strictly for the privacy of citizens.

(oee/sda/awp/dpa)

(sda/awp/dpa)