Last week the Irish Data Protection Commission (DPC) notified its EU national data protection authority counterparts on the European Data Protection Board (EDPB) that it had made a draft decision to halt Facebook’s parent company Meta from transferring personal data from the EU to the U.S.
The ruling is reportedly “likely to send a chill through the wider business community” as the U.S. and EU hash out new data transfer guidelines. However, negotiations on a new data transfer framework have stalled, and a new deal may not be reached before the end of the year.
Meta has repeatedly warned a data transfer ban will likely leave it unable to offer significant services such as Facebook and Instagram in Europe without a new transatlantic data transfer framework. The decision does not affect Whatsapp.
This is the gradual culmination of a long running investigation by the DPC that has wound its way through the Irish and European courts over the past number of years and has been frequently reported upon in the BEERG Global Labor Newsletter.
Article 60 of the EU General Data Protection Regulation gives EDPB members across the EU four weeks to comment, or express "relevant or reasoned objection," on the DPC's draft decision, though moving from a draft to a final decision could take much longer as two-thirds of EDPB members must approve the decision. If two-thirds do not agree, another two weeks are allotted for a simple majority vote.
The Irish DPC move had been anticipated for some months. Speaking with Reuters back in February, Irish Data Protection Commissioner Helen Dixon said that she was expected to share a draft decision with fellow EU regulators in April and if none of them lodge an objection that "the earliest time we could have a final decision could be the end of May." Given the delay from April to July to share this draft decision, this would point to a late August timeline for a full EDPB decision.
Limited impact? Last February, Dixon specifically ruled out the possibility that the move against Meta would immediately hit other big tech companies saying: "The decision that the DPC will ultimately make in relation to Facebook will be specific to Facebook and addressed only to Facebook… The consequence of the CJEU (Court of Justice of the European Union) decision is that we can't make a broader and more sweeping finding. We have to go company by company by company.”