European DPAs get Facebook Data Transfer Decision by Irish DPC
As the DPC informed journalists today, it issued a Draft Decision under Article 60 GDPR, concerning Facebook's (Meta's) EU-US data transfers in light of FISA 702 and the Snowden disclosures. The Draft Decision is part of the "own volition" procedure that the DPC initiated in parallel to the original complaint by Max Schrems. noyb has agreed to not disclose details on this specific procedure and can therefore only comment on publicly known information.
No immanent stop. The DPC's Draft Decision will not lead to an immanent stop of data transfers. In fact the Draft Decision will trigger the process under Article 60 of the GDPR, giving other data protection authorities ("DPAs") a month to comment on the decision. Usually other European DPAs have objected to major decisions coming from the DPC. This then triggers a procedure under Article 65 GDPR, with a vote on the final decision.
Max Schrems: "We expect other DPAs to issue objections, as some major issues are not dealt with in the DPC's draft. This will lead to another draft and then a vote. In other cases this took another year overall, as the DPC did not implement comments from other DPAs voluntarily and took more than half a year to forward the case for a vote."
Two years from CJEU decision, 9 years into procedure. The original case brought by Max Schrems in 2013 was pledged to be run in "parallel" with a newly opened "own volition" case. The draft decision is only concerning the "own volition". The complaints procedure was not sent to the EDPB. It is unclear what happened to the original case at this stage, as the DPC typically withholds details of these cases from noyb.
Max Schrems: "Our original complaints procedure got split into two procedures: a complaints procedure and a second ex officio procedure. We asked the DPC for comments on what happened to the complaints procedure. Overall the complaints procedure is pending for 9 years now, with not even a draft decision so far."
No fine - despite 9 years of illegal data transfers? A major question of the procedure will be if only data transfers going forward should be banned, which Facebook / Meta will fight in the Irish Courts for years, or if any final decision will also include a fine for the illegal data transfers of the past years.
Max Schrems: "Facebook will use the Irish legal system to delay any actual ban of data transfers. Ireland will have to send the police to physically cut the cords before these transfers actually stop. What would be however easy to do, is a fine for the past years, where the CJEU has clearly said the transfers were illegal. It is strange, that the DPC seems to 'forget' about the only efficient penalty in this case. You could get the impression, that the DPC just wants to have this case go in circles again and again."
