3 Min Read

EU-US data transfers under the microscope as Meta decision expected from Data Protection Commission Shortly

Read More

By Charlotte Burke


Published 18 May 2023


Transfers of personal data outside of the EU have been subject to significant scrutiny by EU regulators in recent years. Most notably, in 2015, the CJEU struck down the Safe Harbor EC adequacy decision which allowed for the transfer of data from EU to the US (known as the “Schrems I” decision), followed by the Privacy Shield (intended to replace Safe Harbor) in 2020 (the “Schrems II” decision). These mechanisms were invalidated by the CJEU on the basis that the potential for indiscriminate or bulk surveillance of EU data subjects’ data by the US was incompatible with the GDPR.

Post Schrems II, Ireland’s data regulator, the Data Protection Commission (“DPC”) has been keeping a close eye on US- third country data transfers. While there has been no enforcement decisions to date by the DPC in this regard, a significant decision suspending data transfers to the US by social media giant Meta is expected to be issued in the next week or so.

In the wake of Schrems II, Meta has relied on Standard Contractual Clauses (“SCCs”)  (standardised, pre- approved contractual clauses that allow controllers to transfer data to non-EU countries) to carry out EU-US data transfers. The DPC began an inquiry into Meta regarding the legality of this mechanism and published its preliminary draft decision in relation in this regard in 2022. In its draft decision, the DPC found that the SCCs relied on by Meta did not provide sufficient protection for EU data subjects and indicated it would require Meta to suspend its EU-US data flows. Consensus on the DPC’s draft decision could not be reached with the other concerned EU supervisory authorities, and the European Data Protection Board (“EDPB”) subsequently delivered a binding decision in this regard pursuant to Article 65 of the GDPR. The DPC’s decision, which will incorporate the EDPB’s findings is expected very shortly.

It appears that the DPC’s decision will have very serious consequences for Meta and may call a halt (albeit temporarily) to its operations within the EU. It is not clear as yet when that suspension will take effect. It also appears Meta may be subject to a significant fine.

Ultimately, it is likely that the DPC’s decision will have a lasting effect on EU-based organisations and EU customers. There is speculation that the decision may be the first step towards organisations being compelled to store, and customers expecting that their data is stored, within the EU. In those circumstances, EU companies will awaiting the publication of the DPC’s decision with interest.


Related Articles

There are no matching articles, please try a different filter.


3 Minute Read

State Bodies and Litigation: An Alternative Approach


5 Min Read

Duties of Expert Witnesses : Duffy v McGee T/A McGee Insulation and GMS Insulations Limited [2022] IECA 254


5 Min Read

Changes to Management of High Court Lists


2 Min Read

Dublin Commercial Litigation e-Zine - May 2023