Meta’s $1.3bn EU fine may go up
Mark Zuckerberg started Meta Platforms Inc to connect the world. Unfortunately for him, connecting people across continents clashes with differing rules about privacy.
His company got hit on Monday with the biggest monetary fine to date from the European Union’s data protection regulators, worth 1.2 billion euros (US$1.3 billion), due to a complaint about how the company processed European data in the US, where surveillance laws allegedly infringe on their privacy.
The ruling, theoretically, could impact other large US tech companies, such as Alphabet Inc and Amazon.com Inc, because it also requires that all European data that Meta has previously stored — about a decade’s worth — be made compliant in the next six months.
In other words, Meta no longer has a legal route in place to process European data on its US servers. And if lawmakers don’t agree to an alternative arrangement for legally transferring EU data in the next six months, Meta must delete all the EU user data it has stored in the US.
That’s no easy task, given that the company’s engineers have admitted in court filings that finding individual Facebook profiles — amongst the mountains of personal data the company has collected on billions of people — borders on impossible.
The good news for Meta is that there’s a decent chance it won’t have to disentangle its European user data and delete it.
The US and EU are currently negotiating a new data-transfer agreement that would render today’s order effectively moot. And the two sides are expected to have a deal by the end of this summer, according to sources close to Meta and EU data protection regulators.
If they don’t reach an agreement in time, and Meta’s efforts to appeal and delay the ruling in the court don’t work as the company hopes, then Meta will have to undergo an unprecedented effort to remove the data of hundreds of millions of people from its systems. How much that will cost, or how that data disentanglement will work in practice, is still unclear.
In one sense, this is a symbolic victory for privacy regulators because it shows the EU is serious about enforcing its law known as the General Data Protection Regulation (GDPR). For years, Silicon Valley’s biggest internet companies have managed to sidestep it by knocking regulatory rulings back into court with endless appeals.
Yet while $1.3 billion is a major blow at a time when Mr Zuckerberg is trying to make the company more efficient, the company can still chalk it up as a cost of doing business. It made $28.7 billion in revenue in the first quarter of 2023. The bigger punishment, if it isn’t preempted by a new trans-Atlantic agreement or court appeals, will be a major change to the way Meta processes Europeans’ data.
The ruling is the result of a case brought by Austrian privacy campaigner Max Schrems, who 10 years ago filed a legal challenge against Meta for failing to protect his privacy rights. Mr Schrems tells me that it’s hard for him to feel a sense of victory as there’s always a strong likelihood that Meta will appeal and delay the ruling for years with court action. It’s “another round in the hamster wheel”, he says.
Mr Schrems also warned there’s no guarantee that the US and EU will reach an agreement on data transfers. “Meta plans to rely on the new deal for transfers going forward, but this is likely not a permanent fix,” he said.
A spokesman for Meta said the company was assessing the decision and its implications. “This decision is flawed, unjustified and sets a dangerous precedent for the countless other companies transferring data between the EU and US,” Meta said in an official statement on Monday.
By and large, Meta will probably continue enjoying the status quo, cross-pollinating our data across continents for years to come and reaping billions in profits through its targeted ad business.
But there’s a chance things could get seriously upended. If politicians and courts don’t play the way Meta needs them to, Monday’s ruling could become far more painful.