On Thursday, Ireland's Data Protection Commission sent a draft decision to its EU data protection authority counterparts in which it proposes to halt Facebook parent company Meta from transferring personal data from the EU to the U.S. If approved by the other DPAs, Meta-owned services Facebook and Instagram may be shuttered in the EU.
In July 2020, the Court of Justice of the European Union invalidated the EU-U.S. Privacy Shield Framework and cast a shadow over the use of standard contractual clauses in what's commonly known as the "Schrems II" decision. In the wake of the CJEU decision, the DPC initiated an "own volition" inquiry under Ireland's Data Protection Act to consider whether Facebook's data transfers to the U.S. were legal.
With Shield's invalidation, many companies, including Meta, relied on SCCs to complete data transfers. According to Politico, the DPC's "own volition" draft decision means Meta can no longer rely on SCCs to transfer data to the U.S.
Thursday's news, however, will not have an immediate effect on Meta's services. The draft decision triggers the process under the Article 60 of the EU General Data Protection Regulation. This provides the other DPAs with four weeks to comment, or express "relevant or reasoned objection," on the DPC's draft decision, but ultimately, a final decision could take longer than four weeks.
In May 2021, in response to the Irish High Court judgment on EU-U.S. data flows, IAPP Chief Knowledge Officer Caitlin Fennessy, CIPP/US, wrote that, if after four weeks there are no objections to the DPC's draft decision to the relevant EU DPAs, the decision becomes binding. "If there are objections, the DPC must either submit a revised draft to the other concerned authorities that can object within two weeks or, if the DPC does not follow or believe the objection is relevant and reasoned, submit it to the consistency mechanism for a binding decision by the (European Data Protection Board)."
Under Article 65(2) of the GDPR, the EDPB would have one month to issue a binding decision, or be granted an additional month given "the complexity of the subject matter. Two-thirds of EDPB members must approve the decision. If two-thirds do not agree, another two weeks are allotted for a simple majority vote under Article 65(3)," Fennessy wrote.
Beyond this, the EDPB's secretariat could require any relevant parties "to complete data in the file," which could further extend the proceedings, Fennessy wrote. "Once the decision is adopted, the EDPB Chair must notify the concerned authorities 'without undue delay' pursuant to Article 65(5). The DPC would then be required to issue its final decision, on the basis of the EDPB’s, 'without undue delay' and no later than one month after notification of the EDPB's binding decision (Article 65(6)). Ultimately, cooperation with other authorities could add half a year."
Reacting to Thursday's news, Max Schrems, who filed the original complaint to the DPC, said, "We expect other DPAs to issue objections, as some major issues are not dealt with in the DPC's draft. This will lead to another draft and then a vote."
According to a spokesperson from Meta, "This draft decision, which is subject to review by European Data Protection Authorities, relates to a conflict of EU and U.S. law, which is in the process of being resolved. ... We welcome the EU-U.S. agreement for a new legal framework that will allow the continued transfer of data across borders, and we expect this framework will allow us to keep families, communities and economies connected."
The draft decision Thursday comes as the EU and U.S. continue to hammer out a new trans-Atlantic data transfer deal — originally announced as a preliminary political agreement in March by U.S. President Joe Biden and European Commission President Ursula von der Leyen. According to Politico, however, negotiations between the EU and U.S. have stalled and a final deal may not be reached before the end of the year.
