EU order to stop Meta data transfer to US is a bigger headache for Zuck than the $1.3 billion fine

Meta was fined a record-breaking $1.3 billion by EU regulators over the lack of data protection for European citizens. This battle started nearly 10 years ago in 2013 when former US National Security Agency contractor and whistleblower Edward Snowden outed the American authorities for frequently accessing people's personal information through tech companies. 

• Facebook's owner, Meta, is now bearing the brunt of lax American privacy policies, its own incompetence, and a tussle between Washington and Brussels over data privacy. 
• Reports say the fine is not a headache for Meta, which is estimated to be worth at least $640 billion. But the order to suspend US-EU data transfer is the bigger issue for the tech giant.
• Immediately, there will be no disruption to Facebook's operations in Europe. The decision pertains to user data such as name, email and IP address, messages, browsing history, geolocation data, and even financial information used for targetted online ads.

Why Meta was fined over a billion dollars?

• The fine was imposed by European Data Protection Board for violating the EU's General Data Protection Regulation (GDPR). The last highest fine imposed under GDPR was on Amazon for 746 million euros. 

Following the EDPB’s binding dispute resolution decision, Meta Platforms Ireland Limited was issued a 1.2 billion euro fine as a result of an inquiry into its Facebook service by the Irish DPA - the largest GDPR fine to date! Read all about it here: https://t.co/ti4iFMm73M pic.twitter.com/iJnKZNMp1x

— EDPB (@EU_EDPB) May 22, 2023

• For Meta, the $1.3 billion is not the highest fine imposed upon them. In 2019, the US FTC fined Facebook $5 billion. 
• The EU case against Meta was brought by Austrian privacy activist Max Schrems who sued Facebook for failing to protect his privacy nearly a decade ago after Edward Snowden revealed American authorities' ways of accessing the data. 
• Edward Snowden revealed that foreigners do not enjoy the privacy rights as American citizens in the US, leaving foreign persons' data stored in the country vulnerable to surveillance. 
• For a long time, data transfers between the EU and the US were governed by an agreement that was struck down as invalid by the European Court of Justice in 2020. 
• ECJ did allow companies to transfer data according to the standard contractual clauses (SCCs), however, with the latest fine it seems like Meta failed to adhere to the clauses. 

What Meta has to say?

• Meta said that the decision to fine has been unjust and unnecessary. Furthermore, Meta also said that they were singled out. 

• Meta said that they will appeal against the decision. 

What now? 

Today's Meta GDPR decision:

• Fine doesn't matter.
• Technically Ireland is imposing this, but VERY reluctantly.
• Meta must delete or "return" EU users' data. No idea how that second option can work.
• Meta says this is about a clash of EU/US law. This is basically true.

— Robert Bateman (@RobertJBateman) May 22, 2023

• Under the order, Meta has been given a five-month grace period to cease European data from being transferred and stored in the US. 
• Meta has 21 data centers, 17 of which are in the US; three are in Europe and one is in Singapore. 
• The biggest task for Meta is revamping its data transfer and storage operations, which is a costly affair. Moreover, Meta has to erase all the data stored for the past 10 years of European users on non-EU servers. 
• Meta is counting on the new Data Privacy Framework (DPF) in talks between the US and the EU to be able to keep smooth operations on in the region instead of revamping its own operations. 
• The new framework for data privacy is expected to be finalised "as quickly as possible" and likely by October. However, reports say it is unlikely to solve Meta's problems given that the US is unlikely to revamp its federal privacy policy for the data of foreigners that quickly. 

This decision is about the NSA and U.S. law, not about Facebook's practices. In the decision, Snowden is mentioned 10 times; the NSA, 10 times; PRISM, 32 times; FISA 58 times; 702, 75 times. 8/

— Anupam Chander (@AnupamChander) May 22, 2023

While the fine and the decision are only limited to Meta's Facebook and not other platforms like Instagram and WhatsApp, it sets a precedent for all other foreign companies operating in the EU to strengthen how they deal with user data. 

For Meta, transferring data to the US is crucial for its ad-targetting operations. In 2022, Meta warned EU policymakers that it would be forced to cease operations in the region if it is not allowed to transfer data across the Atlantic. EU had said then it would be Meta's loss.