Meta hit with record €1.2 billion fine

European user data was not protected when it was moved to the US, regulators say

Meta will be forced to pay a record €1.2 billion fine over claims it abused its users’ data.

The Irish Data Protection Commission said that Meta had broken the EU’s data protection rules by moving data between Europe and the US.

It had failed to protect European users from having their data used under US law when it did so, regulators said.

It will now be fined €1.2 billion, as well as being required to delete the Facebook data or move it back into Europe.

That fine is easily a record under the EU’s General Data Protection Regulations, or GDPR. The previous record was held by Amazon – which was fine €746 million by regulators in Luxembourg – though the four biggest fines after that have been paid by Meta as part of data issues at Facebook, Instagram and WhatsApp.

Meta called the fine “unjustified and unnecessary”, and said that it would appeal the ruling. It also said that there would be no immediate disruption to the way Facebook works.

The company has repeatedly threatened that new limits on how data is transferred to the US could cause it to shut down Facebook and Instagram in Europe. Meta said in response to the new ruling that it will be able to continue to operate as it does today if a new data agreement between the EU and US is able to come into effect.

Previously, data sharing between the US and Europe was governed by a framework called the “Privacy Shield”, which allowed that data to flow if US companies showed they were using proper data protections. In 2020, however, that was scrapped after the European Court of Justice said that it was not properly protecting data.

Since then, lawmakers have been working on a new deal, known as the Trans-Atlantic Data Privacy Framework, though that is yet to go into effect. But lawmakers have indicated that it should be ready by October, when the deadline for Meta to delete the Facebook data at the heart of the fine is up.