On Thursday, Ireland's Data Protection Commission sent a draft decision to its EU data protection authority counterparts in which it proposes to halt Facebook parent company Meta from transferring personal data from the EU to the U.S. If approved by the other DPAs, Meta-owned services Facebook and Instagram may be shuttered in the EU. 

In July 2020, the Court of Justice of the European Union

With Shield's invalidation, many companies, including Meta, relied on SCCs to complete data transfers. According to Politico, the DPC's "own volition" draft decision means Meta can no longer rely on SCCs to transfer data to the U.S. 

ADVERTISEMENT

Cassie IAPP Leaderboard - Future-proofing your data, 2025 and beyond

Thursday's news, however, will not have an immediate effect on Meta's services. The draft decision triggers the process under the Article 60 of the EU General Data Protection Regulation. This provides the other DPAs with four weeks to comment, or express "relevant or reasoned objection," on the DPC's draft decision, but ultimately, a final decision could take longer than four weeks. 

In May 2021, in response to the Irish High Court judgment on EU-U.S. data flows, IAPP Chief Knowledge Officer Caitlin Fennessy, CIPP/US,

Under Article 65(2) of the GDPR, the EDPB would have one month to issue a binding decision, or be granted an additional month given "the complexity of the subject matter. Two-thirds of EDPB members must approve the decision. If two-thirds do not agree, another two weeks are allotted for a simple majority vote under Article 65(3)," Fennessy wrote. 

Beyond this, the EDPB's secretariat could require any relevant parties "to complete data in the file," which could further extend the proceedings, Fennessy wrote. "Once the decision is adopted, the EDPB Chair must notify the concerned authorities 'without undue delay' pursuant to Article 65(5). The DPC would then be required to issue its final decision, on the basis of the EDPB’s, 'without undue delay' and no later than one month after notification of the EDPB's binding decision (Article 65(6)). Ultimately, cooperation with other authorities could add half a year."  

Reacting to Thursday's news, Max Schrems, who filed the original complaint to the DPC, said, "We expect other DPAs to issue objections, as some major issues are not dealt with in the DPC's draft. This will lead to another draft and then a vote."

According to a spokesperson from Meta, "This draft decision, which is subject to review by European Data Protection Authorities, relates to a conflict of EU and U.S. law, which is in the process of being resolved. ... We welcome the EU-U.S. agreement for a new legal framework that will allow the continued transfer of data across borders, and we expect this framework will allow us to keep families, communities and economies connected." 

The draft decision Thursday comes as the EU and U.S. continue to hammer out a new trans-Atlantic data transfer deal —