Meta, the parent company of Facebook and Instagram, has been fined US $1.3 billion by European Union regulators for breaching EU data privacy rules.
The fine comes after the European Data Protection Board (EDPB), which comprises all EU privacy regulators, overruled the Irish Data Protection Commission’s original decision not to fine the company. The EDPB found that Meta’s infringement was “systematic, repetitive and continuous” and that it concerned “massive” volumes of personal data. Meta has warned that the ban, which will take effect in mid-October, could lead it to pull Facebook and Instagram out of the EU, unless a new data-sharing agreement is reached between the EU and US.
The legal basis for Meta’s data transfers was undermined in 2020 when the EU’s highest court struck down the data-sharing agreement between the EU and US, known as Privacy Shield. The court also ruled that Meta’s backup plan of using “standard contractual clauses” failed to protect Europeans’ data in the US. As a result, Meta was left without a legal basis for its transfers, leading to the decision to fine the company. The fine is a strong signal that serious infringements have far-reaching consequences and that organizations must take data privacy seriously.
Meta said it will appeal against the fine.
