Meta Fined Record €1.2 Billion by DPC for Unlawful EU-US Data Transfers

What happened

Ireland's Data Protection Commission fined Meta Platforms €1.2 billion for breaching the GDPR by transferring personal data to the United States without a valid legal basis. The regulator said the transfers violated the GDPR's international data‑transfer rules. Meta must now halt the unlawful transfers and bring its data‑processing practices into compliance. No additional penalties were announced.

Why it matters

Companies that rely on US‑based services must verify that their cross‑border transfers meet GDPR requirements, such as using approved SCCs or adequacy decisions, to avoid similar sanctions.

Business impact

Failure to remediate could lead to service disruptions and substantial fines, prompting firms to reassess data‑flow architectures and contractual safeguards.

Checklist

• Review all EU‑US data transfersHigh priority

  Map personal data flows to the US and confirm a valid legal basis for each transfer.

• Implement Standard Contractual ClausesHigh priority

  Adopt the latest EU‑approved SCCs for any transfers lacking an adequacy decision.

• Conduct Transfer Impact AssessmentsMedium priority

  Assess US recipient practices against EU standards and document findings.

• Update documentation and DPIAsMedium priority

  Ensure records of processing activities reflect the new transfer mechanisms.

Who reported it

Discussion