Meta anticipates EU-US data transfers suspension order

The company made the disclosure in reporting its first quarter 2023 financial results on Wednesday.

Earlier this month, the European Data Protection Board (EDPB) confirmed that it had issued a binding decision in relation to the legality of Meta’s reliance on standard contractual clauses (SCCs) for EU-US data transfers for Facebook. The EDPB intervened after national data protection authorities (DPAs) could not reach a consensus over the draft findings of the Irish Data Protection Commission (DPC), which is the lead supervisory authority in the cross-border case under the EU General Data Protection Regulation (GDPR).

Little detail was provided at the time by the EDPB on what had been decided, with the DPC having until 12 May to notify its final decision. However, it did say its intervention “settles the dispute on whether an administrative fine and/or an additional order to bring processing into compliance must be included in the Irish DPA’s final decision”.

In a statement issued on its quarterly results, Meta said it expects both a fine and a suspension order to be issued in the case. However, it also said it expects a new framework for transferring personal data from the EU to the US – ‘Privacy Shield 2.0’ – will be in force before the suspension order takes effect, though it said it “cannot exclude the possibility that it will not be completed in time”.

In taking questions from investors, chief financial officer Susan Li said Meta would need to see the final order to assess the impact a suspension order would have but suggested it could have a significant impact on the global advertising market if it results in a disruption to data flows.

Li said: “We continue to be hopeful that the new EU-US privacy framework will be implemented before a deadline for a suspension. But if it comes to that, there's a lot that we don't know in terms of the specifics of a final order and how long a suspension order would last, which would be important variables in determining the overall impact.”

“What we do know is that roughly 10% of worldwide ad revenue comes from ads delivered to Facebook users in EU countries. But there are more details that we would need to understand, including the impact on advertisers in EU countries before we'd be able to really provide a more accurate or fulsome estimate of that impact,” she said.

A DPC spokesperson told Out-Law that it cannot comment on the content of the decision in the case until 12 May.