On 26 June 2023, Meta Platforms Ireland Limited (Meta), the owner of Facebook, appealed a recent decision of the Data Protection Commission of Ireland (DPC) in the Irish High Court.
While not central to the appeal, submissions made to the High Court indicate that certainty for EU-US data transfers may come by mid-July 2023 when the European Commission is expected to determine "US adequacy" under the EU-US Data Privacy Framework (DPF).
Background
On 22 May 2023, the DPC issued a decision against Meta. The DPC's decision had three parts:
- An administrative fine of €1.2 billion (as directed by the European Data Protection Board (EDPB));
- An order for Meta to suspend all transfers of European-based Facebook user data from Europe to the US to take effect 12 weeks after the period of appeals was allowed; and
- An order for Meta to bring its transfers of European-based Facebook user data into compliance with the General Data Protection Regulation (GDPR) within six months from the date of the decision (as directed by the EDPB).
Context of Decision for EU-US Data Transfers
The context of the second and third limb to the DPC's decision is important for businesses transferring personal data from the European Union (EU) to the US who eagerly await a solution to EU-US transfers (see our previous article here).
The European Commission's draft US adequacy decision under the DPF was expected by the end of the Summer – meaning that Meta's EU-US transfers of European Facebook user data could be brought into compliance from the date the DPF takes effect.
Decision on DPF Expected in July 2023
Meta appealed the DPC's decision in the Irish High Court on various grounds under Section 150 of the Irish Data Protection Act 2018. On 26 June 2023, Meta was granted an extension of an interim stay on the decision until 31 July 2023.
This period of extension is significant because counsel for the DPC submitted to the Court that the European Commission would make its decision regarding the DPF in mid-July, indicating that:
- A decision about the DPF will be issued before 31 July 2023; and
- Meta's appeal to this element of the DPC's decision may be unnecessary for the Court to hear.
Impact for Businesses
While Meta's appeal remains on hold, the update about the possible timing of the European Commission's draft US decision under the DPF is a welcome development. For many European businesses doing business in and through the US, the long-standing complexity and uncertainty for EU-US transfers have resulted in elevated compliance obligations to transfer personal data from Europe to the US. The impact of the DPF, if passed, is hoped to bring business-critical certainty (once it is fully operational), at least for a time.
In the meantime, European businesses must continue to rely on the GDPR's other transfer mechanisms for EU-US data transfers (such as the standard contractual clauses).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
