Ireland’s Data Protection Commission (DPC) has issued a draft decision to Facebook’s parent company Meta, regarding its data transfers from the EU to the US.

This development is the latest in a dispute between Meta and the DPC regarding its data-sharing practices. In August 2020, the DPC said Facebook’s use of standard contractual clauses in respect of European user data does not comply with GDPR and proposed that the company may have to cease its EU-US transfers.

DPC deputy commissioner Graham Doyle said Meta has 28 days to make submissions on this draft decision, after which the DPC “will prepare a draft Article 60 decision for other Concerned Supervisory Authorities (CSAs). I’d anticipate that this will happen in April”.

Earlier this month, Meta said that it may have to pull Facebook and Instagram from the EU market if regulation around data transfers between Europe and the US does not come to fruition soon.

A Meta spokesperson confirmed that the DPC has asked for “further legal submissions” and said the latest decision is part of an “ongoing process that has some way to run”.

“Suspending data transfers would be damaging not only to the millions of people, charities, and businesses in the EU who use our services, but also to thousands of other companies who rely on EU-US data transfers to provide a global service,” the Meta spokesperson said. “A long-term solution on EU-US data transfers is needed to keep people, businesses and economies connected.”

EU-US data transfer issues

This development comes amid a wider data protection and privacy debate about transatlantic data flows. The Schrems II case in 2020 struck down Privacy Shield, a data privacy tool that allowed for the transfer of European data to US companies, and said transfers of personal data from the EU could only take place if there is a sufficient level of protection.

The EU does not consider US data protection to be adequate, and so data transfers can only take place through mechanisms such as the standard contractual clauses used by companies including Google and Facebook.

Meta is worried that in the absence of a data protection arrangement such as Privacy Shield, or Safe Harbour before it, and if it is unable to rely on standard contractual clauses or alternative means of data transfer, there would be an impact on its data-reliant business.

Meta is not the only Big Tech company worried about the current lack of a data transfer deal between the EU and US. The Austrian data protection authority, DSB, recently found that the use of Google Analytics by an Austrian website did not comply with EU data protection law.

The DSB concluded that measures put in place to protect personal data transferred to the US via Google Analytics, such as encryption, were not sufficient to address that risk of privacy infringement by US intelligence agencies.

Earlier this month, France’s privacy regulator concluded that data transfers to the US via Google Analytics breach GDPR rules and ordered a French website manager to stop using the service under certain conditions.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

The post Meta sent a draft decision by Irish regulator on EU-US data transfers appeared first on Silicon Republic.