The Irish DPC has been forced to delay its final decision on Meta Platforms’ use of SCCs for international data transfers.
Despite several threats from the company Meta Platforms to shut down Facebook and Instagram in Europe due to concerns over the use of Standard Contractual Clauses (SCCs) for cross-border data transfers, this may in fact not happen just yet, or not at all. A draft decision by the Irish DPC to block all the company’s social media sites from transferring data from Europe to the US, which would have forced Meta Platforms to shut down operations in Europe, has been delayed as some other data protection authorities across Europe may not be in agreement with the decision.
The Irish DPC issued a draft decision prohibiting Meta Platforms from using SCCs to transfer large amounts of data from Europe to the US.
In July, the Irish DPC had decided to put a block on Facebook’s owner Meta Platforms, prohibiting the company from using the legal mechanism; Standard Contractual Clauses to transfer large amounts of data including photos and direct messages across the Atlantic. This decision by the Irish DPC followed a 2020 European Court of Justice ruling whereby, absent appropriate security measures, major flows of data between Europe and the U.S. would be illegal due to the exposure of Europeans’ data to U.S. government surveillance risks. This decision had been brewing for quite some time as Meta Platforms expressed that it could mean a shut down of its European operations if a final decision is reached that it may no longer transfer data to the US. Meta platforms would also still have the option of appealing the final decision by the Irish DPC.
While this decision threatens the company’s operations in Europe, a final decision is delayed.
Meta Platforms has repeatedly said that a decision blocking its transfers would force it to stop its Facebook and Instagram offerings in Europe. However, with a decision from the Irish DPC delayed, and still pending review by other European authorities, a forced shutdown is also delayed. A spokesperson for the Irish regulator mentioned that the Authority had received some objections from several other EU regulators to its draft order. This further delays a final decision by the Irish DPC to shut down data flows by Meta Platforms and buys the company more time.
With a new transatlantic data pact on the horizon, Meta Platforms may soon once again be able facilitate EU-US data transfers freely.
It will now take a few months for the Authority to resolve the objections made by other regulators. If the Irish DPC does not manage to resolve the conflicting opinions, an official dispute resolution mechanism would then need to be initiated. This would involve bringing in the European Data Protection Board, delaying the process by at least another month. These delays may actually work out in favor of Meta Platforms, allowing the company to maintain its data flows to the US, through to the implementation of a new transatlantic data pact, which is expected within the first quarter of 2023. A new deal for EU-US data transfers would facilitate cross-border data transfers for Meta and thousands of other companies, relinquishing their need for the use of SCCs.
