The EU issues Meta a record €1.2B GDPR fine for sending European user data to the US and orders stopping the transfers and unlawful processing within six months
but only for 15 minutes European Data Protection Board : Binding Decision 1/2023 on the dispute submitted by the Irish SA on data transfers by Meta Platforms Ireland Limited for its Facebook service (Art. 65 GDPR) Louise O'Reilly TD / Sinn Féin : DPC fine should be a wake-up call for government Arjun Kharpal / CNBC : Meta fined a record $1.3 billion over EU user data transfers to the U.S. Pete Syme / Insider : Meta hit with a record-breaking $1.3 billion fine over data privacy breaches Financial Times : Facebook owner Meta hit with record €1.2bn fine over EU-US data transfers Real Facebook Oversight Board : Meta Fails Yet Again To Protect Users Data in Major New €1.3b GDPR Order Daniel Cooper / Engadget : Meta hit with $1.3 billion fine over Facebook's EU-US data transfers Dan Milmo / The Guardian : Facebook to be fined £648m for mishandling user information Dan Milmo / The Guardian : Facebook owner Meta fined €1.2bn for mishandling user information LinkedIn: Colin Deacon : This just keeps on getting more intriguing. In determining the $1.75 billion fine, the EU Data Protection Board said it took the view that … Lisa Borgeson : In a PR tour of Silicon Valley companies last week, Graham Doyle of the Irish Data Protection Commission, previewed that this eye-popping 👀 Meta decision would be published today. … Patricia Clark : As someone who brought privacy products to market at Meta, here are a few insights into what's happening with the catchy headline about a $1.3B GDPR fine. … Matt Burgess : Meta has been fined $1.3 billion in the biggest ever GDPR enforcement action. But you should ignore the money. — First, it's obviously small change to Meta. … Jakub Turowski : Our response to the Decision on Facebook's EU-US Data Transfers. — https://about-fb-com.cdn.ampproject.org / ... Luiza Jarovsky : 🔥 THE LARGEST GDPR FINE EVER IS OUT — How much is it? What does it mean in practice? Read this: … Mastodon: David Carroll / @profcarroll@federate.social : '"Unless U.S. surveillance laws get fixed, Meta will have to fundamentally restructure its systems," Mr. Schrems said in a statement on Monday. The solution, he said, was likely a “federated social network” … Tweets: Anupam Chander / @anupamchander : The largest data protection fine in EU history stems from the transfer of data across borders—to the US—with no showing of any ongoing access by impermissible third parties (such as the NSA) beyond that in Snowden disclosures or any deceptive use of information by Meta. 1/ Mark Scott / @markscott82 : Boom — record 1.2 BILLION euro fine for @meta under Europe's privacy rules. Takes collective fines under #GDPR to just under 4 billion euros since regime started in 2018. FWIW, that's less than @FTC's $5 billion fine against Facebook https://www.politico.eu/... Robert Bateman / @robertjbateman : To comply with today GDPR order, I think Meta has two options: • Delete all EU Facebook users' data • Migrate all EU Facebook users' data to EU servers and restrict access to Meta Ireland There are issues with the second option. Some further thoughts... James Titcomb / @jamestitcomb : Punchy response by Nick Clegg to Meta's €1.2bn GDPR fine “The internet risks being carved up into national and regional silos, restricting the global economy and leaving citizens in different countries unable to access many of the shared services we have come to rely on.” @om : Amazing that after being fined the Meta stock is up $5/share. Tells you what market thinks of the the “fines” and “regulators” and their impact on actually reigning in the “big tech.” Wolfie Christl / @wolfiechristl : Max Schrems and his tiny nonprofit NOYB deserve limitless praise for their extraordinary persistence and achievements. But it's a shame for EU policy that GDPR enforcement against big tech and in the broader digital economy relies on a nonprofit and that much of it fails so hard. Johnny Ryan / @johnnyryan : I spoke to The New York Tomes' @satariano about the big problem for Meta after today's decision. Not the fine. https://www.nytimes.com/... [image] @dpcireland : Latest News: Data Protection Commission announces conclusion of inquiry into Meta Ireland https://www.dataprotection.ie/ ... [image] @eu_edpb : Following the EDPB's binding dispute resolution decision, Meta Platforms Ireland Limited was issued a 1.2 billion euro fine as a result of an inquiry into its Facebook service by the Irish DPA - the largest GDPR fine to date! Read all about it here: https://europa.eu/!p4VBjB [image] Jason Kint / @jason_kint : ps this was missed by all press reports and Facebook in its blog posts. https://twitter.com/... @birgitsippelmep : Important decision by @DPCIreland @EU_EDPB to fine #META for breaching #GDPR, but this process has taken a decade! @DPCIreland needs to adapt its procedures and react faster to potential breaches of Europeans' data. https://twitter.com/... Malte Engeler / @malteengeler : The fine against #Meta is more valuable for the EU data economy than for data rights of EU individuals. The DPC did not rule against the surveillance based business model but against it being conducted by a US-based company. The GDPR has become a tool for economic protectionism. @birgitsippelmep : The worst part? The fine doesn't improve the situation for Europeans - the EU-US #DataPrivacyFramework will be in place by the time Meta has to act. Instead of creating change, the transition period allows Meta to lean back while the new deal accommodates its practices. Patrick Hedger / @pat_hedger : EU upset about the WW part of the WWW. https://twitter.com/... Congressman David N. Cicilline / @repcicilline : Today, the EU took a key step in holding Meta accountable because no one is above the law. Failing to hold Meta accountable for their egregious behavior would undermine the GDPR & its effectiveness. Meta needs to reform their systems to ensure they can protect users' privacy. https://twitter.com/... Estelle M. / @estelmp : It could be a huge problem for Meta as they would have to assess which data they can keep or not. Keep in mind that former employees have said that Meta does not really know where data are stored or where do they go... https://www.vice.com/... Estelle M. / @estelmp : Ordering an immediate deletion of this data would have been a strong signal from data protection authorities to both Meta and all tech companies. The level of the fine is a great news but the overall decision is bittersweet for data rights. @mbarczentewicz : This is not a “Meta problem”: all services that rely on US-EU data transfers are at risk. EU privacy regulators are fixated on constraining US-EU data transfers, when more serious privacy risks come from domestic surveillance and from unfriendly powers.🧵 https://dataprotection.ie/... Benedict Evans / @benedictevans : The fact these privacy rules don't apply to the EU's own governments is also very funny Andrew Selbst / @aselbst : The goal of the GDPR was to protect rights of data subjects, irrespective of whether business models of the internet giants have to change to do it. Not much has changed so far...mostly bc internet giants have assumed the law can't actually mean what it means. https://twitter.com/... Robert Bateman / @robertjbateman : Today's Meta GDPR decision: • Fine doesn't matter. • Technically Ireland is imposing this, but VERY reluctantly. • Meta must delete or “return” EU users' data. No idea how that second option can work. • Meta says this is about a clash of EU/US law. This is basically true. Mark Cuban / @mcuban : @bgurley @om 💯x💯x💯 Andy Stone / @andymstone : We will appeal the ruling - including the unjustified and unnecessary fine. https://about.fb.com/... Berin Szóka / @berinszoka : Meta was fined for being a 🇺🇸 company that the 🇺🇸 government could spy on Every 🇺🇸 company risks huge fines. Worse, unless 🇪🇺 quickly determines that 🇺🇸 data protection law is now “adequate,” 🇺🇸 tech companies will stop “processing” 🇪🇺 data—serving 🇪🇺 users 🪦open 🌐 Internet https://twitter.com/... Vincent Manancourt / @vmanancourt : This is the latest EU privacy fine that's been significantly boosted and altered by the European Data Protection Board, the bloc's privacy regulator umbrella body. Are we seeing the de facto centralisation of GDPR enforcement in cross-border cases involving Big Tech? https://twitter.com/... Bill Gurley / @bgurley : @om Regulation is the friend of the incumbent. Especially US regulation. Ashley Gorski / @ashgorski : Huge news: Facebook will be required to halt data flows from the EU to the U.S., due to the staggering scope of U.S. government surveillance and lack of adequate remedies for people subject to illegal spying: https://www.reuters.com/... Natasha / @riptari : @jason_kint Not so fast; EDPB told me: “The Binding Decision does not specify whether [fixing storage compliance] has to be achieved by means of deletion.” Oh and guess who gets to decide? DPC... https://techcrunch.com/... John Cusack / @johncusack : Meta data is the new oil - https://twitter.com/... Benedict Evans / @benedictevans : I know we all hate Meta, kids, but the EU's data transfer rules are really a wish that the internet did not cross borders. (For bonus points, note that while E2EE is the most straightforward solution here, other parts of the EU are trying to ban E2EE.) https://twitter.com/... Mark Scott / @markscott82 : @Meta @FTC Fun fact: Ireland's @DPCIreland used @maxschrems and his repeated privacy complaints against @Google, which led to no fines, to argue that it shouldn't impose a fine on @Meta. So that's Dublin using arguably Europe's leading privacy campaigner as a reason why NOT to impose levy. Adam Kovacevich / @adamkovac : As I said when this was reported last week, this is like fining someone for jaywalking while city planners repaint the crosswalk, all while a thousand other people cross at the same spot. The Irish Court has weaponized the law against FB even as a US-EU agreement on data is... https://twitter.com/... @progresschamber : EU courts struck down an EU-US data flow agreement. As the EU and US finalize a new agreement, an EU court is weaponizing the law against Meta for data practices in the interim. It's no mystery why the best tech firms have their home in the US, not the EU https://www.nytimes.com/... Ian Brown / @1br0wn : I'm baffled @DPCIreland thinks it not “appropriate, proportionate and necessary” to fine #Facebook ANYTHING for a major GDPR breach, now changed to €1.2bn thanks to the @eu_edpb; nor to require the deletion of data Facebook illegally transferred since 🤷♂️ https://www.dataprotection.ie/ ... Jason Kint / @jason_kint : BAM. There it is, PAGE 253 of the order. Facebook has to delete all of its illegally collected EU data from storage. They're also being fined $1.3 BILLION but as I've said that's the insignificant hit to its surveillance capitalism business model. [image] Nick Clegg / @nickclegg : Today's @DPCIreland decision is not about one company's privacy practices - there is a fundamental conflict of law between the US government's rules on access to data & European privacy rights, which policymakers are expected to resolve in the summer. See our blog here:... https://twitter.com/... Lukasz Olejnik / @lukolejnik : The clock counter on Facebook is now ticking. #GDPR https://www.tickcounter.com/ ... [image] Liam Herrick / @liamherrick : noyb win: € 1.2 billion fine against Meta over EU-US data transfers. Worth looking at noyb account of how this decision finally came about... https://noyb.eu/... Adam Tooze / @adam_tooze : Facebook owner Meta Platforms META was fined $1.3 billion by European Union regulators for sending user information to the U.S. -> increase pressure on US to conclude a data protection/sharing deal with the EU. https://www.wsj.com/... Lukasz Olejnik / @lukolejnik : Six months. That's how much time Facebook/Meta has to adapt to the decision. If they don't (or the EU doesn't get along with the US) - Facebook/Instagram will have to be shut down in Europe. Facebook a hostage in the negotiations between the European Union and the US? #GDPR https://twitter.com/... Jeremy Kaplan / @smashdawg : Wow an enormous slap in the face(book) ... and a repudiation of the traditional borderless flow of data on the Internet. https://www.nytimes.com/... Neville Hobson / @jangles : Can they collect, though? Plus FB will appeal so this will drag on for months if not years. https://twitter.com/... Paolo Balboni / @balbonipaolo : It's interesting to note that “Given the seriousness of the infringement, the EDPB found that the starting point for calculation of the fine should be between 20% and 100% of the applicable legal maximum.” See https://edpb.europa.eu/... [image] Gavan Reilly / @gavreilly : €1.2bn fine for Meta from the Data Protection Commission over unlawful transfer of European customer data to the United States. Biggest ever regulatory fine handed out by the Irish data watchdog. (Incidentally, that goes to the Irish exchequer...) https://www.dataprotection.ie/ ... Johnny Ryan / @johnnyryan : The Irish DPC's peers across Europe voted by majority to say “the Irish SA” (supervisory authority) failed to comply with the GDPR by refusing to tell Meta to ban the unlawfully transferred data. Paragraph 278 of EDPB Decision. [image] Johnny Ryan / @johnnyryan : Here is the text where the EDPB orders the Irish DPC to force Meta to delete data (p. 73 of EDPB decision) https://edpb.europa.eu/... [image] Sam Clark / @sgclark92 : A crucial element of the orders is that they are about Meta's legal basis for transfers and storage. The Irish DPC has found that Meta does not have a legal basis for these activities, but once it does, it can in theory resume those activities. Sam Clark / @sgclark92 : Worth looking out for some of Meta's other appeals against Irish enforcement, e.g. the WhatsApp 225 million euro fine. If it succeeds there - one of its arguments being that due process wasn't followed - that might spell bad news for the EDPB/DPC in this case. Sam Clark / @sgclark92 : The application for a stay will also be crucial. The appeals don't automatically suspend the orders, so Meta getting a stay will give it breathing room to wait for the EU-US DPF. @noybeu : Today, a decade-long (2013 - 2023) case on Meta's involvement in US mass surveillance has lead to a first direct decision. Meta must stop any further transfers of European personal data to the United States, given that Meta is subject to US surveillance laws (like FISA 702). @noybeu : ❗Breaking ❗ noyb win: € 1.2 billion GDPR fine for Meta over US mass surveillance. Decision required 10 years and 3 court procedures against Irish DPC. https://noyb.eu/... @privacymatters : 2/ “EDPB instructs the @DPCIreland to include in its final decision an order for Meta IE to bring processing operations into compliance with Chapter V GDPR, by ceasing the unlawful processing, including storage, in the US of personal data of EEA users transferred in violation of Mark Scott / @markscott82 : @Meta @FTC Worth remembering: Dublin did not want to impose a fine on @Meta. It only did so after other European #privacy regulators got involved. [image] Mark Scott / @markscott82 : @Meta ... Can't get more clear than this: Europe's #privacy watchdogs “take the view that Meta IE committed the infringement at least with the highest degree of negligence and this has to be taken into account when deciding whether an administrative fine should be imposed.” Dave Lee / @daveleebbg : “Hanging in the balance are tens if not hundreds of billions of dollars in trade in industries such as advertising, artificial intelligence, human resources, and cloud services.” https://www.wsj.com/... @deitaone : META PLATFORMS INC SHARES DOWN 0.6% PREMARKET AFTER REPORT META FINED $1.3 BLN BY EU OVER DATA TRANSFERS TO U.S. $META https://twitter.com/... @metanewsemea : The ability for data to be transferred across borders is fundamental to how the global open internet works. Read Meta's response to the decision regarding EU-US data transfers here 👇https://about.fb.com/... Vincent Manancourt / @vmanancourt : And crucially, what will the EU's highest court think about this? The Irish privacy watchdog has already appealed previous decisions saying the EDPB is overstepping its jurisdiction. Remember that under the GDPR, Ireland is supposed to have a lead role in regulating tech cos. Joe Tidy / @joetidy : This is quite the graph.... https://twitter.com/... [image] @riptari : Goodness! Another selective leak of the fb data flows decision! We are being spoiled - assuming your interest is headline fines only 😋 @riptari : EDPB binding decision on Fb data flows has now been published: https://edpb.europa.eu/... Johnny Ryan / @johnnyryan : I spoke to The Guardian's @DanMilmo about the Meta decision. Even a billion+ Euro parking ticket is of no consequence to a company that earns many more billions by parking illegally. FB was fined $5B by the US FTC in 2019. Its stock rose the next day. https://www.theguardian.com/ ... [image] Mark Scott / @markscott82 : It's always fun when reporters don't respect embargoes. Sam Schechner / @samschech : In something of a test case, that led Ireland's privacy regulator in Sept. 2020 to issue a preliminary draft order for Meta to suspend Facebook's data transfers to the U.S.: https://www.wsj.com/... Sam Schechner / @samschech : This is part of a long-running saga over EU-US data transfers that could affect thousands of multinational companies, stemming from a 2020 EU court decision: https://www.wsj.com/... @deitaone : Facebook Owner Meta Fined EUR1.2B for EU Privacy Violations Over Data Transfers to U.S. — Sources — WSJ EU Privacy Regulators Rule Meta Illegally Stored Data About EU Facebook Users on U.S. Soil — WSJ Decision Doesn't Apply Directly to Instagram, WhatsApp — WSJ $META Sophia Ignatidou / @sophiaignatidou : GDPR breaches relate to how data is processed. Evidence of harm may make the implications of these violations more easy to digest by the public (& they probably mean we spotted them too late), but the violations themselves should lead to regulatory action: https://www.theguardian.com/ ...