Update, October 2026: On 10 July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795). US companies certified under the Framework can rely on it for transfers from the EU.
Meta, the parent company of Facebook, has incurred a hefty penalty of €1.2 billion for violating the General Data Protection Regulation (GDPR) rules by transferring data of European users to servers located in the United States. This move goes against the GDPR rules that were implemented in May 2018.
The Imposed Penalty and Violation Details
In a decision dated 12 May 2023 and announced on 22 May, the Irish Data Protection Commission (DPC) fined Meta €1.2 billion (about $1.3 billion) for transferring Facebook users’ personal data from the EU to the US in breach of Article 46(1) of the GDPR. Meta made those transfers under the standard contractual clauses (SCCs) the European Commission adopted in 2021, together with its own supplementary measures. The DPC found that these did not address the risks the Court of Justice of the EU had identified.
Privacy Shield Agreement and Surveillance Concerns
Until July 2020, companies could transfer personal data from the EU to the US under the EU-US Privacy Shield. On 16 July 2020, in its Schrems II judgment (Case C-311/18), the Court of Justice of the EU invalidated the Privacy Shield because US law did not adequately protect EU data against access by US public authorities. The Court held that standard contractual clauses remain valid in principle, but that exporters must make sure the data is adequately protected in the destination country.
Meta’s Failure to Comply and the Imposed Penalty
Because Meta kept transferring data to the US after that judgment, the DPC also ordered it to suspend future transfers of personal data to the US within five months, and to stop the unlawful processing, including storage, in the US of EU and EEA users’ data already transferred within six months of being notified of the decision.
Meta’s Compliance Dilemma and Future Implications
The question remains: Will Meta, the parent company of the world’s largest social network, finally listen and abide by the rules? The answer is uncertain, as the inner workings of multinational data centers remain opaque. While many companies claim to prioritize user privacy and security, their actions often fall short when data breaches or rule violations occur.
Conclusion
The penalty imposed on Meta serves as a significant warning to other tech giants and emphasizes the importance of data privacy and compliance with GDPR regulations. The outcome of Meta’s compliance with the new rules will shape the future of data privacy and protection for users worldwide.
Correction, 26 October 2026: this article said the Court of Justice of the EU prohibited transfers of EU data to other countries after the Cambridge Analytica scandal, that the $1.3 billion fine was separate from the €1.2 billion penalty, and that GDPR requires data to stay in the region where it was generated; the Court invalidated the EU-US Privacy Shield in July 2020 over US surveillance law, the fine was a single €1.2 billion (about $1.3 billion) penalty, and the DPC’s orders concerned Meta’s transfers to the US, not a general data-localisation rule.