Meta’s fine has repercussions on EU-US data flows.

Featured Sponsor

Store	Link	Sample Product
UK Artful Impressions	Premiere Etsy Store

The €1.2bn fine on Meta this week is the largest ever imposed under EU data protection rules. The owner of Facebook hardly has a spotless record, having been fined before for lax privacy protections, including $5 billion by US regulators in 2019 over the Cambridge Analytica scandal. However, in this case, Meta, like many other companies, is caught in a mismatch between EU and US law. decision against it indicates in effect that there is no working legal basis for Meta to do what it has been doing – transfer user data from the EU to the US – unless a new attempt to create a framework for Closing the legal gap, the implications for technology companies, consumers and the Internet are far-reaching.

The fact is that EU law since 1995 has prohibited transfers of personal data to third countries unless they offer “adequate” levels of data protection. But the EU imposes much higher protections than the US, bolstered by its 2018 General Data Protection Regulation and a letter of Fundamental rights. As the Snowden leaks of US intelligence exposed a decade ago, under US law it is easier for law enforcement agencies to access user data, and more difficult for consumers to seek redress.

The European Court of Justice struck down two successive EU and US frameworks designed to facilitate the lawful transfer of personal data (Safe Harbor and Privacy Shield) after an Austrian privacy activist, Max Schrems, question Facebook’s practices.

The court found that the US laws did not meet requirements that were “essentially equivalent” to those required by EU law. Facebook continued with transfers based on contractual clauses backed by the European Commission, although the CJEU also raised questions about these in 2020. After further complaints from Schrems, the Data Protection Commission in Ireland, home to the European headquarters of Goal, found against the use of these clauses. It did not recommend a fine, but other European regulators overturned it in consultation.

Goal it has been given five months to suspend data transfers to the US and six months to stop any processing of EU citizen data previously sent there. Some European activists say regulators should have gone further and removed the data in the US. Meta plans to appeal the ruling. His big hope, along with other tech companies, is that a third EU-US data privacy framework that comes into force in the meantime proves capable of withstanding legal challenges. Schrems says that he can prove it.

President Joe Biden signed a executive order last October that strengthens safeguards around US intelligence gathering and creates a court for citizens to seek redress. Some EU experts are hopeful that the new framework will meet the test of being essentially equivalent to EU standards. Failure to do so would require further reform of US intelligence laws or a dilution of the EU’s GDPR, which seems politically untenable. Tempers already flared when the privacy shield was removed in 2020, with a disgruntled US accusing the EU of hypocrisy given the way security agencies in some member states behave.

Otherwise, companies would be forced to store all EU personal data on EU servers, which they say could complicate or block all sorts of activities, from cross-border social media to sharing personal data. clinical trials. The EU rightly prides itself on world-leading data privacy standards, a legitimate and growing concern of consumers, while the US says it is protecting security activities that allies also benefit from. But the two parties must find a way to ensure that the necessary personal data flows can legally continue. A digital decoupling between the West and China may already be inevitable, but it would be truly unfortunate to see an internet fracture between the world’s major democracies.