Facebook, the EU, and the future of data privacy

On Monday, Ireland’s Data Protection Commission fined Meta, Facebook’s parent company, more than a billion dollars for breaching the European Union’s data-privacy rules, and ordered the social network to stop sending data that it has collected from European Facebook users to the United States. The fine is one of the largest to have been levied since the EU adopted the General Data Protection Regulation, a data-privacy law more commonly known by the initials GDPR, in 2016. The Irish decision calls into question not just Facebook’s data-collection apparatus—and the multibillion-dollar business model that it supports—but the similar data-handling and monetization practices of almost every other global social network and online service. Nick Clegg, the head of global affairs for Meta and a former deputy prime minister of the UK, said that the ruling risks carving the internet “into national and regional silos.”

Despite the apocalyptic tone of its response, Meta’s data-handling practices won’t have to change any time soon. The ruling offers a grace period of five months before the company has to take action; Meta has also said that it plans to appeal the decision

As part of the negotiations over the regulation, the US and the EU came up with a bilateral agreement known as the Privacy Shield, also known as the “adequacy decision,” which required that the transfer of personal data could only take place if the receiving country “ensures an adequate level of protection.” What this entails has been the subject of much debate

Last year, President Biden announced a new agreement, called the Data Privacy Framework. This was supposed to address the ECJ’s decision by making it more difficult, at least in theory, for US intelligence agencies to gain access to the personal data of non-US citizens. But the latest decision from the Irish court effectively ruled that even this new framework doesn’t go far enough.

So what happens now?

More From CJR: