Record Fine in GDPR History: Irish Data Protection Commission’s Meta Decision

The decision by the Irish Data Protection Authority (Authority) dated 12.05.2023 on Meta Platforms Ireland Limited (Meta Ireland) (Decision) has been announced on 22.05.2023. Pursuant to the Decision, an administrative fine of 1.200.000.000 Euros was imposed on Meta Ireland. 

Following the decision of the Court of Justice of the European Union (CJEU) in “Data Protection Commissioner v Facebook Ireland Limited v Maximillian Schrems”, the DPC found that transfers made by Meta Ireland from the European Union and the European Economic Area to the United States infringed Article 46(1) of the GDPR.

The DPC concluded that, although data transfers subject to the Decision were carried out on the basis of the updated Standard Contractual Clauses (SCCs) adopted by the European Commission in 2021 and on the basis of additional measures implemented by Meta Ireland, there is no sufficient protection regarding fundamental rights and freedoms.

In conclusion, following items were decided by the Authority:

• Suspension of the transfer of personal data by Meta Ireland to the United States within a period of five months from the date of notification of the Decision pursuant to the GDPR;
• Imposition of an administrative fine of 1.200.000.000 Euros; and
• Stopping data processing activities contrary to the GDPR within 6 months and bringing them into compliance with Chapter V of the GDPR.