Meta fined EUR 1.2 billion for continuing EU–US transfers after Schrems II
Subject: Meta Platforms Ireland Limited
What happened
After the CJEU’s Schrems II judgment, Meta continued to transfer EU/EEA users’ personal data to the US for the Facebook service, relying on the 2021 Standard Contractual Clauses together with supplementary measures it had implemented itself. The Irish DPC opened its inquiry in August 2020.
How it was handled
The DPC found those arrangements did not address the risks to data subjects’ fundamental rights and freedoms identified by the CJEU, infringing Art. 46(1). After the Art. 60 cooperation procedure, 4 of the 47 concerned supervisory authorities objected, taking the view that an administrative fine should be imposed. The DPC disagreed and referred the objections to the EDPB, which adopted its Art. 65 decision on 13 April 2023.
Outcome
The DPC adopted its final decision on 12 May 2023: an administrative fine of EUR 1.2 billion; an order to suspend any future transfers to the US within five months of notification; and an order to bring processing into compliance with Chapter V within six months by ceasing the unlawful processing, including storage, in the US of the data already transferred.
What it means for Chinese exporters
- · "Everyone uses the SCCs" is not a defence. The SCCs are only the starting point; what gets examined is whether the supplementary measures actually neutralise the government-access risk created by the destination country’s law — and that reasoning has to exist as a document, not as a contract annex.
- · The fine is not the painful part. A suspension order plus an order to stop processing data already transferred breaks business continuity directly. When designing an EU market architecture, prepare in advance a degraded mode that keeps the service running if transfers are suspended: an independent EU instance, local key management, a switchable data plane.
- · Where the lead authority and peer authorities disagree, the EDPB’s Art. 65 dispute resolution tends to raise the severity of the outcome. Do not treat an understanding reached with one national regulator as a safe boundary across the whole EU.
Related regulations
Sources (1)
- Irish DPC concludes inquiry into Meta Ireland with a EUR 1.2 billion fine for EU–US transfersData Protection Commission of Ireland (DPC) · published 2023-05-22 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.