Facebook faces the threat of being blocked across the European Union unless it radically changes the way it handles data in Europe.
Irish regulators have preliminarily ruled that the social media site is no longer allowed to send data from European users to the US, forcing them to set up local data centers or stop working until the problem is solved.
Irish Data Protection Commission (DPC) told Facebook its current setup violates GDPR rules, the EU laws governing how companies may use customer data. The decision is currently in draft status and Facebook now has four weeks to file any protests.
DPC spokesman Graham Doyle said: “I would not comment on the substance of the draft decision.”
A Meta spokesperson, on behalf of Facebook, said: “This draft decision, which is under review by the European data protection authorities, concerns a conflict between EU and US law that is currently being resolved.”
Ireland is the leading EU country regulating Facebook’s data practices in the bloc as it is Facebook’s legal headquarters in Europe. Any ruling in Ireland would apply to operations across the EU.
Data transfers between the EU and America were subject to a legal framework known as the Privacy Shield.
In 2020, EU courts destroyed the Privacy Shield, He said the deal could not guarantee EU citizens’ freedom from dragnet surveillance by US spy agencies. Since then, companies have been relying on standard contractual clauses for the transfer of personal data across the Atlantic without going against EU authorities.
Sources told the Telegraph that an EU-wide block on Facebook, or other Metaservices such as Instagram, is unlikely, but possible if the problem is not resolved.
Experts said Facebook would most likely challenge the DPC’s determination, causing a pause until a judicial review process could look into the legality of the decision.
WhatsApp, also owned by Meta, is not affected by the decision as it has a different parent company within the group.
Privacy campaigner Max Schrems, who was instrumental in bringing down Privacy Shield, said it could take up to a year for the DPC decision to be implemented.
“Facebook will use the Irish legal system to delay an actual ban on data transfers,” Schrems said, adding that Irish police “would have to physically cut the cords before these transfers actually stop”.
Ashley Winton, a data protection partner at London law firm Mishcon de Reya, said: “We have seen that data protection authorities in Germany, Austria and France are very critical of the transfer of personal data to the US, and so the outcome of this process will hopefully finally clarify what is and is not allowed.”