13 April – A big day for the future of Meta and its EU-US transfers
On 13 April 2023, the EDPB adopted a dispute resolution decision in relation to the Irish Data Protection Commission's ("DPC") draft decision, as lead supervisory authority, against Meta, which proposed a suspension of data transfers to the US.
The EDPB was asked to review the DPC's draft decision on the basis of Article 65 of the GDPR, after a lack of consensus on objections from different Member State supervisory authorities. The EDPB decision confirms the approved approach and will ensure a consistent application of the GDPR's provisions in relation to restricted transfers. It is understood that the EDPB decision also settles the dispute on whether an administrative fine and/or an additional order to bring processing into compliance must be included in the DPC’s final decision.
The DPC now has one month to issue the final decision against Meta, after which the EDPB will publish its decision online.
As for the future of data transfers for Meta, this will remain unknown until the DPC's decision is announced. In the meantime, we await an adequacy decision by the European Commission on the EU-US Data Privacy Framework ("DPF").
On this topic, 13 April was a busy day for the future of EU-US data transfers as the Members of the European Parliament also adopted their formal opposition to the DPF. In its resolution, the European Parliament acknowledged that the DPF was an important step forward compared to the old Privacy-Shield framework but ultimately concluded that the DPF does not provide sufficient safeguards for the protection of personal data transferred to the US. The resolution is advisory only and will now be being presented at a future plenary session of the European Parliament where the draft adequacy decision in relation to the DPF will either be adopted or rejected.