Transfers of personal data outside of the EU have been subject to significant scrutiny by EU regulators in recent years. Most notably, in 2015, the CJEU struck down the Safe Harbor EC adequacy decision which allowed for the transfer of data from EU to the US (known as the “Schrems I” decision), followed by the Privacy Shield (intended to replace Safe Harbor) in 2020 (the “Schrems II” decision). These mechanisms were invalidated by the CJEU on the basis that the potential for indiscriminate or bulk surveillance of EU data subjects’ data by the US was incompatible with the GDPR.
Post Schrems II, Ireland’s data regulator, the Data Protection Commission (“DPC”) has been keeping a close eye on US- third country data transfers. While there has been no enforcement decisions to date by the DPC in this regard, a significant decision suspending data transfers to the US by social media giant Meta is expected to be issued in the next week or so.
In the wake of Schrems II, Meta has relied on Standard Contractual Clauses (“SCCs”) (standardised, pre- approved contractual clauses that allow controllers to transfer data to non-EU countries) to carry out EU-US data transfers. The DPC began an inquiry into Meta regarding the legality of this mechanism and published its preliminary draft decision in relation in this regard in 2022. In its draft decision, the DPC found that the SCCs relied on by Meta did not provide sufficient protection for EU data subjects and indicated it would require Meta to suspend its EU-US data flows. Consensus on the DPC’s draft decision could not be reached with the other concerned EU supervisory authorities, and the European Data Protection Board (“EDPB”) subsequently delivered a binding decision in this regard pursuant to Article 65 of the GDPR. The DPC’s decision, which will incorporate the EDPB’s findings is expected very shortly.
It appears that the DPC’s decision will have very serious consequences for Meta and may call a halt (albeit temporarily) to its operations within the EU. It is not clear as yet when that suspension will take effect. It also appears Meta may be subject to a significant fine.
Ultimately, it is likely that the DPC’s decision will have a lasting effect on EU-based organisations and EU customers. There is speculation that the decision may be the first step towards organisations being compelled to store, and customers expecting that their data is stored, within the EU. In those circumstances, EU companies will awaiting the publication of the DPC’s decision with interest.
