EU Court Says Transatlantic Data Transfer Invalid, Facebook And Instagram Object Because Their Services Will Be Disrupted

Transatlantic data transfers done by Facebook and Instagram can no longer be done. (photo: unsplash)

JAKARTA – The transfer of data from the European Union to the United States by Meta Platform Inc., the owner of Facebook and Instagram, could be stopped as soon as May. But the move won't immediately apply to other big tech companies. This was revealed by Ireland's data privacy regulator in an interview.

Europe's Supreme Court ruled in 2020 that the EU-US data transfer pact was invalid due to concerns that US government oversight might not respect EU citizens' right to privacy.

That has prompted Ireland's Data Protection Commission (DPC), Meta's main regulator in Europe, to issue a provisional order that the mechanisms Facebook and Instagram use to transfer data from EU users to the United States are "in practice unusable."

The order, the suspension comes after the emergence of a lawsuit that was resumed last May when the Irish High Court rejected Meta's claim. But the command does not apply to WhatsApp because that platform has a different data controller in the Meta group

This updated decision could be shared with fellow EU regulators in April and none of them raise any objections. "The earliest time for us to be able to have a final decision is at the end of May," Helen Dixon, Ireland's Data Protection Commissioner, told Reuters.

Any objection can add several months to the timeline.

"If there is a scenario that the data flow is considered illegal and must be stopped, it is clear that the impact will be large," he said.

But it's unlikely the investigation could lead to an automatic shutdown of similar data flows at major rival Meta, many of which also have European headquarters in Ireland.

"The decisions that DPC will ultimately make regarding Facebook will be specific to Facebook and intended only for Facebook," Dixon said.

"The consequence of the CJEU (Court of Justice of the European Union) decision is that we cannot make broader and more comprehensive findings. We have to go, company by company," he said.

There are potentially "hundreds of thousands of entities" to look at, Dixon added, starting with the other big internet platforms.

Meta has warned the shutdown would likely prevent it from offering significant services like Facebook and Instagram in Europe without a new transatlantic data transfer framework.

There is a parallel political process between the US Department of Commerce and the EU Commission on such a solution, but Irish regulators have not been informed of its progress.

Dixon's office has so far completed only two investigations into multinational companies under new EU privacy rules introduced in 2018, including hitting WhatsApp with a fine of 225 million euros last year.

"By 2022 the DPC will likely complete nine or 10 of the 30 open investigations," said Dixon, an acceleration he attributed to nearly doubling his staff in three years and would act in response to critics who said his office was under-resourced. to handle large workflows.

“The staff in our office will increase to 260 by the end of 2022 from 195 currently and only 27 in 2014 but should continue to increase for years to come”, said Dixon.