At the beginning of July 2022, the Irish Data Protection Commission (“DPC”) drafted a decision that could block Facebook and Instagram from transferring user data from the European Union to the United States.
The proposed decision has to do with a ruling by the European Court of Justice (“CJEU”). In 2020, it prevented the transfer of personal data to the United States under the so-called “Privacy Shield”.
CJEU decision on data transfer to the US
In issuing the ruling, the CJEU cited inadequate protection against access by government authorities to the data transferred to the US. The Privacy Shield placed the national security, public interest and law enforcement requirements of the United States above the rights of individuals. This arrangement allowed interference with the rights of individuals whose data was transferred to the US, including the rights of users from the European Union.
Once the ability to rely on the Privacy Shield was eliminated, data transfers to the US were largely based on so-called “standard contractual clauses”. They were used by Meta (owner of Facebook and Instagram) and many other US companies.
Irish regulator’s decision is under consultation
Other European data protection authorities are currently being consulted on the DPC’s decision. If it is adopted in unchanged form, Facebook and Instagram will be forced to stop using the aforementioned standard clauses. In practice, this could mean a significant reduction in the services that Meta will be able to offer to its users in Europe. The decision could also affect the business conducted by other companies transferring data from Europe to the US.
Regardless, the EU and the US are currently in the process of negotiating a new agreement that would provide a lawful basis for data transfers to the US. The Irish Data Protection Commission’s draft decision is increasing the pressure on the US and European negotiators. There is, however, a high risk that an agreement will not be reached before the DPC’s decision takes effect. This puts into question the ability of Facebook and Instagram to continue operating in Europe.
