Regulator action · 12 May 2023
Irish DPC decision on Meta Platforms Ireland (EU-US transfers)
DPC Inquiry IN-20-8-1, final decision 12 May 2023 · Data Protection Commission (Ireland), following EDPB binding decision 1/2023
On appeal. Meta has challenged the decision.
What it means for your code
Signing SCCs is not enough; you need a transfer impact assessment and supplementary measures, or an adequacy mechanism such as the EU-US Data Privacy Framework.
What happened
Meta continued transferring Facebook users' data to the US on Standard Contractual Clauses after Schrems II without measures addressing US surveillance risk.
What was decided
Transfers relying on SCCs without effective supplementary measures infringed Article 46(1) GDPR; Meta was ordered to suspend transfers and bring processing into compliance.
⚖ EUR 1.2 billion administrative fine
The legal test applied
- Continuing SCC-based transfers without measures addressing the destination's surveillance law infringes Art. 46(1)
What would have changed the outcome
- Transfers to DPF-certified recipients after July 2023
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.