Meta Hit with Largest GDPR Fine Yet for Use of Standard Contractual Clauses

The Data Protection Commission (DPC) of Ireland has issued the largest fine under the EU’s General Data Protection Regulation privacy law against Meta.

Meta has expressed its intention to appeal against the ruling, claiming it to be unjustified and unnecessary. The crux of the decision is the use of standard contractual clauses (SCCs) for transferring European Union’s data to the US. SCCs are legal contracts established by the European Commission to ensure the protection of personal data during its transfer outside Europe.

However, there are concerns that these data flows still expose Europeans to the US’s weaker privacy laws. Most large companies have complex webs of data transfers, including email addresses, phone numbers, and financial information, to overseas recipients, and many depend on SCCs. The fine may make EU companies demand their US partners store data within Europe or switch to domestic alternatives. Despite the record-breaking size of the fine, experts have said they think Meta’s privacy practices will not change.