A fine mess

The Irish Data Protection Commission announced on 22 May 2023 that Meta must pay EUR1.2bn (about $1.3bn) for sending Facebook users’ data from Europe to America.^{1IAPPMeta fined GDPR-record 1.2 billion euros in data transfer case22 May 2023,2National Law ReviewIrish Regulator Fines Meta 1.2 Billion Euros and Orders it to Cease Data Transfers to the U.S.22 May 2023} It is the largest fine since the General Data Protection Regulation took effect in 2018, and it exceeds the previous record, Amazon’s EUR746m penalty from Luxembourg, by more than 60%.^{1IAPPMeta fined GDPR-record 1.2 billion euros in data transfer case22 May 2023,4SECAmazon.com, Inc. Form 10-Q for the quarter ended 30 June 202130 Jul 2021} Meta can find the money. What it cannot find, however hard it looks, is a change in American surveillance law.

That is the heart of the matter. Meta relied on the EU’s standard contractual clauses to move data across the Atlantic, with extra safeguards on top. The Irish regulator found these did not meet the standard set by the Court of Justice in the “Schrems II” judgment of 2020.^{2National Law ReviewIrish Regulator Fines Meta 1.2 Billion Euros and Orders it to Cease Data Transfers to the U.S.22 May 2023,3gdprfine.comMeta 1.2 billion DPC fine: EU-US data transfer decision explained22 May 2023} The reason lies in Washington, not Menlo Park: American intelligence agencies may demand data under Section 702 of the Foreign Intelligence Surveillance Act, and no contract between two companies can bind them. The regulator accepted that Meta’s encryption and contractual notices did not prevent such access.^{3gdprfine.comMeta 1.2 billion DPC fine: EU-US data transfer decision explained22 May 2023}

Fine print. Largest GDPR fines, EUR m

	Fine
Amazon (2021)	746
Meta (2023)	1200

Source: Amazon Form 10-Q; IAPP¹⁴

We think the ruling is probably correct in law and mistaken in policy. It is correct because the court asked a plain question (does American law protect Europeans’ data as Europe does?) and the answer, for now, is no. It is mistaken because the penalty lands on a firm that used the mechanism Brussels itself offered, in a dispute over a statute Meta did not write.

The order matters more than the fine. Meta has five months to suspend future transfers of European users’ data to America, and six to bring the processing of data already moved into line, including its storage there.^{1IAPPMeta fined GDPR-record 1.2 billion euros in data transfer case22 May 2023,2National Law ReviewIrish Regulator Fines Meta 1.2 Billion Euros and Orders it to Cease Data Transfers to the U.S.22 May 2023} Nobody has explained how a global social network does that without switching off Facebook, or building a European fortress of servers that duplicates its infrastructure at great expense. The company’s president of global affairs, Nick Clegg, and its chief legal officer, Jennifer Newstead, called the decision “unjustified and unnecessary” and said they would appeal.^{1IAPPMeta fined GDPR-record 1.2 billion euros in data transfer case22 May 2023}

The sum was not the Irish regulator’s idea. Its own draft decision imposed no fine at all; the figure came after objections from other European regulators and a binding decision of the European Data Protection Board under Article 65 of the GDPR.^{2National Law ReviewIrish Regulator Fines Meta 1.2 Billion Euros and Orders it to Cease Data Transfers to the U.S.22 May 2023,3gdprfine.comMeta 1.2 billion DPC fine: EU-US data transfer decision explained22 May 2023} The board’s chair, Andrea Jelinek, called it “a strong signal to organisations that serious infringements have far-reaching consequences”.^{1IAPPMeta fined GDPR-record 1.2 billion euros in data transfer case22 May 2023} Ireland, host to much of American tech’s European operations, has long been accused of going soft. This was the rest of the continent making a point, and the bill went to the firm that happened to be in the dock.

The strongest counter-argument is that a rule is a rule. Europeans were promised protection for their data, a court found in 2020 that American law did not supply it, and companies have had nearly three years since to act. If fines this large are not imposed, the argument runs, the law is merely a suggestion. There is something in that. Consistency matters, and a regulator that blinks teaches firms to wait.

But deterrence works only when the deterred can comply. Meta cannot legislate in Washington, and its European regulators cannot either. The remedy is the one already under negotiation: a new EU-US data privacy framework, announced as a political agreement in March 2022, which a Commission spokesperson expects to be fully functional by the summer.^{1IAPPMeta fined GDPR-record 1.2 billion euros in data transfer case22 May 2023} Until it is, every firm that moves European data to America, which is to say nearly every firm, stands on the same legal ground as Meta. One lawyer, reading the decision, observed that any platform subject to Section 702 “may equally fall foul” of the transfer rules.^{1IAPPMeta fined GDPR-record 1.2 billion euros in data transfer case22 May 2023}

Europe should finish the treaty, seek tighter American oversight in exchange, and keep its largest fines for firms that break rules they could have kept. A privacy regime that fines the tenant for the landlord’s policy has mistaken enforcement for diplomacy.

Meta will appeal and Brussels will negotiate; the one party certain to lose in the interim is the user whose data was meant to be protected.