On 7 July 2022, the Data Protection Commission in Ireland (“DPC”) circulated its noteworthy draft decision in respect of its investigation into tech giant Meta (the parent company of Facebook) to other European Supervisory Authorities for their consideration, in line with the GDPR’s Article 60 co-operation procedure.
The DPC’s draft decision proposes preventing Meta from transferring personal data from the EU to the US on the basis that Meta cannot rely on Standard Contractual Clauses (“SCCs”) to do so. Meta has claimed that if approved by the DPC’s EU data protection counterparts, the decision could result in Meta no longer making its social media platforms, including Instagram and Facebook, available in the EU.
The draft decision follows the Court of Justice of the European Union’s decision in July 2020 to invalidate the EU-US Privacy Shield (a mechanism previously used by companies such as Meta to transfer personal data to the US). When the Privacy Shield was invalidated, many companies, including Meta, resorted to using SCCs (another permitted data transfer mechanism under the GDPR) to complete their US data transfers.
Following the Schrems II decision and recommendations from the European Data Protection Board, SCCs can only be used following a case-by-case analysis of the third country’s laws and practices known as a ‘Transfer Impact Assessment’. Where those laws and practices risk impinging on the effectiveness of the protections in the SCCs, the implementation of ‘supplementary measures’ to protect personal data are required.
However, recent enforcement decisions by EU Supervisory Authorities have raised concerns regarding whether, in some situations, there are any supplementary measures which would be deemed sufficient.
Under Article 60 of the GDPR, EU data regulators now have 4 weeks to comment on the DPC’s draft decision. If the regulators do not object to the decision within 4 weeks, it becomes binding. However, if there are objections (which, it has been suggested, are likely), the DPC can submit a revised draft decision dealing with those objections, or submit the matter to the EDPB for a binding decision under the GDPR Article 66 consistency mechanism if it doesn’t believe the objections are appropriate. It is likely therefore that it could be several months before we have clarity on the outcome of the DPC’s draft decision and its implications for Meta. In any event, the final decision is likely to have a significant impact on data transfers from the EU to the US, unless or at least until a detailed agreement is reached between the EU and US on the proposed new trans-Atlantic data transfer deal.
