Record EUR 1.2 Billion Fine: Facebook Data Transfers to the US Declared Illegal

The Irish Data Protection Commission imposed a record-breaking EUR 1.2 billion fine on Meta for illegally transferring European Facebook user data to the United States. The decision also included an order to suspend transatlantic data transfers, marking the most consequential GDPR enforcement action to date.

The Decision

The DPC found that Meta's transfers of European user data to the US violated the GDPR's requirements for international data transfers. Despite Meta's use of standard contractual clauses, the DPC determined that these measures were insufficient to protect data from US surveillance.

Why the Fine Is Historic

The EUR 1.2 billion penalty is the largest GDPR fine ever issued. Combined with the suspension order, it demonstrates that even the world's largest technology companies face real consequences for GDPR violations. The decision was years in the making, following complaints from privacy advocates and the Schrems II ruling.

The Suspension Order

Beyond the financial penalty, the order to suspend data transfers poses a more fundamental threat to Meta's European operations. Compliance would require restructuring how Facebook processes European user data, potentially necessitating significant infrastructure changes.

Broader Impact

This enforcement action sent a clear signal to all organizations transferring European data to the United States. If Meta -- with its vast legal and technical resources -- cannot achieve compliance, smaller organizations have even less basis for believing their transfers are adequate.