The European Union has imposed a record-breaking €1.2 billion ($1.3 billion) fine on Facebook parent company Meta for breaching data protection regulations. The case centred on the transfer of personal data belonging to Facebook's EU-based users to servers located in the United States. The ruling was made following an investigation by the Irish Data Protection Commission, which is the chief regulatory body for Meta's operations in Europe.
The European Data Protection Board announced the verdict on Monday, stating that the infringement was "systematic, repetitive and continuous," given Facebook's massive user base in Europe; the volume of transferred personal data is enormous. The fine is the highest ever imposed under the General Data Protection Regulation, or GDPR. The previous record was €746 million ($805.7 million), which was imposed on Amazon last year.
In addition to the monetary penalty, Meta has been ordered to halt the processing of EU user data in the United States within six months. Meta, which also owns Instagram and WhatsApp, has stated that it will appeal the verdict, including the fine. Facebook's operations in Europe are not expected to be immediately disrupted.
Meta has claimed that the root cause of the issue is a "conflict of law" between US rules governing data access and Europeans' privacy rights. It has argued that EU and US policymakers are resolving this conflict under a new transatlantic Data Privacy Framework. This framework seeks to resolve the uncertainty facing companies since 2020 when the European Union's highest court struck down the Privacy Shield agreement with the United States, which nearly 5,000 firms relied on to transfer information across borders. Nick Clegg, Meta's president of global affairs, and Jennifer Newstead, the company's chief legal officer, stated that the European Data Protection Board "chose to disregard the clear progress that policymakers are making to resolve this underlying issue," and called the ruling "flawed, unjustified and a dangerous precedent."
Before this ruling, the Irish Data Protection Commission had levied nearly $1 billion in fines on Meta for GDPR violations since late 2021. Still, in this instance, it did not favour fining Meta, judging that doing so would go beyond what could be considered "proportionate" in addressing the infringement.
The Irish regulator said in a statement on Monday that it had to base its final ruling on the European Data Protection Board's decision. Ireland has a delicate balance to maintain between retaining top US tech firms and aligning itself with the European Union's hard-line approach to technology regulation.
Apple, Facebook, Google, and Twitter's European headquarters are all based in Dublin, creating thousands of jobs and boosting the country's economic growth. Ireland's low corporate tax rate of 12.5% is a significant factor in attracting these companies. In 2021, the country was among the last in the Organisation for Economic Co-operation and Development to join a global pact to tax multinational corporations at a minimum rate of 15%.
In 2020, Apple successfully appealed a European Commission ruling that it owed Ireland €13 billion ($14.9 billion) in taxes, claiming that the EU executive had not shown that the corporation had gained illegal state aid in the form of favourable tax arrangements with the Irish government. On that occasion, the Irish government supported Apple in its dispute with the European Union.