The European Data Protection Board reports that following its binding dispute resolution decision in April 2023, the Irish Data Protection Authority (IE DPA) has issued Meta Platforms Ireland Ltd (Meta IE) with a 1.2 billion Euro fine following an inquiry into its Facebook service.

This fine, which is the largest ever GDPR fine, was imposed in relation to Meta’s transfers of personal data to the US based on standard contractual clauses (SCCs) since 16 July 2020. Meta has also been ordered to bring its data transfers into compliance with the GDPR.

Andrea Jelinek, EDPB Chair, said: “The EDPB found that Meta IE’s infringement is very serious since it concerns transfers that are systematic, repetitive and continuous. Facebook has millions of users in Europe, so the volume of personal data transferred is massive. The unprecedented fine is a strong signal to organisations that serious infringements have far-reaching consequences.”

In its binding decision of 13 April 2023, the EDPB instructed the IE DPA to amend its draft decision and to impose a fine on Meta IE. Given the seriousness of the infringement, the EDPB found that the starting point for calculation of the fine should be between 20% and 100% of the applicable legal maximum. The EDPB also instructed the IE DPA to order Meta IE to bring processing operations into compliance with Chapter V of the GDPR by ceasing the unlawful processing, including storage, in the US of European users’ personal data transferred in violation of the GDPR within six months following notification of the IE SA’s final decision.

The IE DPA’s final decision incorporates the legal assessment set out by the EDPB in its binding decision, which was adopted under Article 65(1)(a) of the GDPR, after the IE DPA, as lead supervisory authority (LSA), had triggered a dispute resolution procedure concerning the objections raised by several concerned supervisory authorities (CSAs). To read the EDPB’s press release in full and for a link to the IE DPA’s final decision, click here.