As the DPC informed journalists yesterday, it has issued a draft decision under Article 60 of the GDPR regarding Facebook's EU-US data transfers (Meta) in light of FISA 702 and the Snowden disclosures. The draft decision is part of the "voluntary" procedure initiated by the DPC in parallel with Max Schrems's original complaint.
Europeans are at risk of seeing social media services Facebook and Instagram shut down this summer, as the Irish privacy regulator doubled the order to stop the company's data flows to the United States.
The Irish Data Protection Commission informed its counterparts in Europe on Thursday that it will prevent Facebook owner Meta from sending user data from Europe to the US Irish regulator's draft decision cracking down on last resort of Meta to transfer large amounts of data to the United States, after years of bitter judicial battles between the US tech giant and European privacy activists.
In 2020, the European Court of Justice struck down an EU-US data transfer pact called Privacy Shield due to concerns about US surveillance practices. In its ruling, it also made it more difficult to use another legal tool that Meta and many other US companies use to transfer personal data to the US, called standard contractual clauses (SCCs). This week's decision to withdraw from Ireland means Facebook is forced to stop relying on SCCs as well.
Meta has repeatedly warned that such a decision would shut down many of its services in Europe, including Facebook and Instagram.
"If a new framework for transatlantic data transfer is not adopted and we are unable to continue to rely on SCCs or other alternative means of data transfer from Europe to the United States, we will probably not be able to offer some of our most significant products and services, including Facebook and Instagram, in Europe "
Meta said in a filing with the US Securities and Exchange Commission in March of this year.
The Irish blocking order, if upheld by Europe's panel of national data protection regulators , is also likely to send a chill through the wider business community, which has been scratching its heads over how to continue sending data from Europe to the US following the EU's supreme court ruling in 2020.
The EU and the US are negotiating a new data transfer text that would allow companies like Meta to continue shipping data across the Atlantic regardless of the Irish order. Brussels and Washington agreed on a preliminary agreement at the political level in March, but negotiations in the legal press have stalled and a final agreement is unlikely to be reached before the end of the year.
A spokesperson for the Irish DPC confirmed that the draft decision has been sent to other European privacy regulators, who now have one month to contribute, but will not discuss the details of the decision.
"This draft decision, which is subject to review by European data protection authorities, refers to a conflict between EU and US law that is in the process of being resolved," a spokesperson for Half. "We welcome the EU-US agreement for a new legal framework that will allow for the continuous transfer of data across borders and we expect this framework to enable us to keep families, communities and economies connected."
No imminent halt. The DPC's draft decision will not result in an imminent halt to data transfers. In fact, the draft decision will trigger the process under Article 60 of the GDPR, giving other data protection authorities ("DPAs") one month to comment on the decision. Other European DPAs have typically opposed important decisions from the DPC. This then triggers a procedure under Article 65 of the GDPR, with a vote on the final decision.
Max Schrems: " We expect other DPAs to raise objections, as some important issues are not addressed in the DPC draft. This will lead to another draft and then a vote. In other cases, this took another year in total, as the DPC did not voluntarily implement the comments of other DPAs, and it took more than six months to submit the case for a vote ."
Two years since the CJEU's decision, nine years since the proceedings. The original case filed by Max Schrems in 2013 was committed to being conducted in parallel with a recently opened "self-determination" case. The draft decision concerns only "self-determination." The complaints procedure has not been forwarded to the EDPB.
It is unclear what happened to the original case at this stage, as the DPC typically hides the details of these cases.
Max Schrems: " Our original complaints procedure was split into two procedures: a complaints procedure and a second ex officio procedure. We asked the DPC for comments on what happened to the complaints procedure. In total, the complaints procedure has been pending for nine years, with not even a draft decision yet ."
No fine – despite 9 years of illegal data transfers? A key question in the proceedings will be whether only future data transfers should be banned, something Facebook/Meta will be fighting for years in Irish courts, or whether a final decision will also include a fine for illegal data transfers in recent years.
Max Schrems: " Facebook will use the Irish legal system to delay any effective ban on data transfers. Ireland will have to send the police to physically cut the cables before these transfers actually stop. What would be easy to do, however, is a fine for recent years, where the CJEU has clearly stated that the transfers were illegal. It's strange that the DPC seems to "forget" the only effective sanction in this case. One might get the impression that the DPC just wants to keep this case going in circles ."
Could it be just the tip of the Iceberg?
