The owner of WhatsApp, Instagram and Facebook has been slapped with a record fine of €1.2bn (£1.04bn) by the Irish data protection regulator.
It’s the biggest fine ever levied for breach of the general data protection regulations (GDPR) which require the data holder’s permission before using their personal information.
Meta has incurred the fine for transferring EU citizens data to the United States for processing, despite a 2020 verdict handed down by the highest EU court saying the data was insufficiently protected from US spying agencies.
Facebook has been ordered to halt the practice and has been given at least five months to suspend future transfers and six months to stop unlawful processing and storage of data in the US. Instagram and WhatsApp are not subject to the order.
The issue has been ongoing for a decade after privacy activist Max Schrems instigated legal proceedings in 2013 against Facebook, as the company was called at the time.
The Data Protection Commission (DPC) in Ireland has jurisdiction over Meta, effectively operating as the EU privacy regulator, as Meta’s European headquarters are in Dublin.
Meta said it would appeal the decision and there would be no disruption in service. It said the decision was “unjustified and unnecessary” and sets a “dangerous precedent”. Meta added it is seeking stays of the order through the courts.
Prior to Monday’s fine, the largest penalty EU regulators handed out was €746m to Amazon in 2021.
A new pact is being worked on between the EU and US to facilitate safe and legal data sharing and may be operational by the summer. Meta said in April it expects the pact to be completed before it is compelled to cease the current, illegal data transfer.
Even if the arrangement is not in place services will continue to operate, Meta said. Previously it had said a ban could suspend services in Europe.
Ending the data transfer could cost an estimated 10% of its advertising revenue, Meta said in the past, an amount that is multiples larger than Monday’s £1bn fine.
