Cianan Brennan: Last roll of the dice for Meta as it awaits new data transfer system

The enormous €1.2bn fine handed out today by the Data Protection Commission to Facebook owner Meta is hugely noteworthy, but also something of a non-event. Picture: Brian Lawless 

The enormous €1.2bn fine handed out today by the Data Protection Commission to Facebook owner Meta is hugely noteworthy, but also something of a non-event.

It is noteworthy both because it is (as expected, by a distance) the largest fine handed out by a European regulator since the inception of GDPR in 2018, and also because the commission had to be told to hand out a fine by its own supervisor, the European Data Protection Board, having initially proposed a sanction and nothing more.

It is less relevant however, in that what happens elsewhere is of more importance than the fine itself, which will certainly be appealed. 

Meta has appealed all the financial penalties it received from the commission bar one. Prior to today, the company had been fined the following:

• January 2023: €5.5m over Whatsapp’s terms of service.
• November 2022: €265m over hacked Facebook user data.
• September 2022: €405m over issues with Instagram’s processing of underage users’ data.
• March 2022: €17m over Facebook data breaches.
• January 2022: €390m over issues with Facebook and Instagram’s data processing.
• September 2021: €225m regarding Whatsapp’s use of data.

That’s €1.307bn in total, and €2.5bn if you count today's fine. All of it, bar the €17m fine from March of last year, has been appealed.

It has been ten years since Austrian privacy activist Max Schrems first took action against Facebook and its system of transferring its users’ personal data back and forth across the Atlantic — the problem being the fact all that data was being intercepted by intelligence services at the American end.

There is now light at the end of the tunnel.

With this particular saga, what’s coming down that tunnel tends to be more important than what’s happening today. Meta has been given five months to delete all the data it holds on its users, and to discontinue its system of data transfers.

Should that actually come to pass, it would end the business. But it is unlikely to do so — a successor to the Privacy Shield system of transfers between Europe and the US, struck down by the European courts in 2020, has been in the works for some time. Meta is banking on that framework coming to pass and saving its bacon.

Whether it will or not, we’ll know inside the next five months. If it doesn’t, you can expect the world as we currently know it to change massively.

For Meta, it is the last roll of the dice.