Data Protection Commission orders Facebook to halt sending of user data to the US

In July, the Court of Justice of the European Union ruled that the data transfer deal between the EU and the US - Privacy Shield - was invalid

Facebook CEO, Mark Zuckerberg, and Facebook vice president of global affairs, and former deputy UK prime minister, Nick Clegg. Picture: PA

Facebook has been sent a preliminary order to suspend the transfer of data of EU users to the United States.

Ireland’s Data Protection Commission (DPC) sent the order to the tech giant late last month, and Facebook now says the DPC has begun an inquiry into Facebook-controlled EU to US data transfers.

The DPC's order is the latest in a series of developments relating to Facebook's use and transatlantic transfer of EU user-data.

In a blog post, written by former UK deputy Prime Minister (now VP of global affairs and communications at Facebook) Nick Clegg, the social media giant said it believes that the mechanism it uses to transfer the data, a Standard Contractual Clause, (SCC) was deemed valid by the Court of Justice of the European Union (CJEU) in July.

“We will continue to transfer data in compliance with the recent CJEU ruling until we receive further guidance,” the company said.

But the Irish data protection commission says that Facebook's SCCs “cannot in practice be used." 

How Facebook uses the data of European users has been the subject of public scrutiny in recent months. Picture: File Picture/PA

In July, the CJEU ruled that the data transfer deal in place between the EU and the US, known as ‘Privacy Shield’, was invalid. 

The DPC’s statement stems from CJEU concerns that government surveillance practices the United States would run contrary to the data privacy rights of EU citizens.

The CJEU did, however, uphold the validity of the SCCs that Facebook uses.

Crucially, the CJEU also stated at the time that privacy watchdogs must suspend or prohibit the use of these SCCs, if the protection of EU citizens' data could not be guaranteed in the country it was being transferred to.

Facebook says the decision could have wider implications for other online-based companies.

It said: “The impact would be felt by businesses large and small, across multiple sectors. In the worst-case scenario, this could mean that a small tech start-up in Germany would no longer be able to use a US-based cloud provider. 

"A Spanish product development company could no longer be able to run an operation across multiple time zones. A French retailer may find they can no longer maintain a call centre in Morocco.” 

“If followed, it could have a far-reaching effect on businesses that rely on SCC and the online service many people and businesses rely on,” the statement added.