Center for American Entrepreneurship and Small Business & Entrepreneurship Council Express Concern Following $1.3 Billion Fine Imposed on Meta by European Data Privacy Regulators

Washington, DC – John R. Dearie, president of the Center for American Entrepreneurship, and Karen Kerrigan, president and CEO of the Small Business & Entrepreneurship Council, today issued the following statement regarding the announcement of a record $1.3 billion fine imposed on Meta Platforms Ireland Limited (Meta IE) by the Irish Data Protection Authority (IE DPA) following an April 13, 2023 binding dispute resolution by the European Data Protection Board:

“On May 22, 2023, the European Data Protection Board (EDPB) announced a record fine of Meta Platforms Ireland Limited (Meta IE) regarding Meta’s transfers of user data to the United States.  The announcement alleges that Meta’s data transfers violated Article 46(1) of the European Union’s General Data Protection Regulation (GDPR).  The order includes: 1) a $1.2 billion Euro ($1.3 billion) fine as a penalty for data transfers since July 16, 2020; 2) an order for Meta to suspend data transfers by mid-October; and, 3) an order for Meta to bring its data processing/storing procedures into compliance with GDPR within six months.

In addition to the unprecedented magnitude of the fine, the EDPB’s decision is of concern to all U.S. companies operating in the European Union – and new and small businesses in particular – for several important reasons:

The free flow of data is critical to the information economy: The ability to transfer data across national borders is fundamental to the operation of the global information technology economy – and critical to the $7 trillion EU-U.S. economic relationship.  Thousands of businesses and other organizations transfer data between the European Union and the United States every day.  Without the ability to transfer data across borders, citizens in different countries would be subject to different and often conflicting data privacy regimes, unable to access many shared services.  For this reason, a sound legal basis for the secure transfer of data between the EU and the United States has been a major policy priority on both sides of the Atlantic for many years.

Meta relies on the same Standard Contractual Clauses (SCCs) as other U.S. companies: On July 16, 2020, the Court of Justice of the European Union (CJEU) invalidated the EU-US Data Protection Shield – a key legal mechanism for the transfer of user data between the EU and the United States – creating significant regulatory and legal uncertainty for thousands of U.S. companies and organizations.  At the time of its decision, the CJEU confirmed that an alternative legal mechanism called Standard Contractual Clauses (or SCCs) would continue to be valid subject to various legal safeguards.  Like thousands of other U.S. companies and organizations, Meta used SCCs believing them to be compliant with the General Data Protection Regulation (GDPR).

The Irish Data Protection Commission found that Meta acted in good faith: The EDPB instructed the IE DPA to impose a fine on Meta despite the fact that the IE DPA inquiry concluded that “Meta Ireland effected those transfers on the basis of the updated Standard Contractual Clauses (“SCCs”) that were adopted by the European Commission in 2021 in conjunction with additional supplementary measures that were implemented by Meta Ireland.”

EDPB ordered the fine despite significant progress by policymakers toward resolving legal uncertainty: The invalidation of the EU-US Data Protection Shield by CJEU in July of 2020 created a fundamental conflict between EU and U.S. data privacy rules – a conflict that neither Meta nor any other U.S. or European company can resolve.  Moreover, EDPB’s order comes despite significant progress made by EU and U.S. policymakers toward developing a new trans-Atlantic data privacy agreement called that European Union-U.S. Data Privacy Framework (EU-U.S. DPF).  In March of 2022, President Biden and Commission President Von der Leyen announced that they had reached an agreement regarding the principles of the new framework to enable the free flow of trans-Atlantic data.  On October 7, 2022, President Biden signed an Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, which enumerates steps the United States will take to implement its commitments under the EU-U.S. DPF announced by President Biden and European Commission President von der Leyen in March of 2022.

Given the unprecedented nature of the EDPB’s decision to fine Meta despite the confusion caused in 2020 by the CJEU, despite the IE DPA’s finding that Meta operated in good faith in transferring the disputed data, and despite the progress made by policymakers toward developing the EU-U.S. DPF – and the potential implications of the EDPA’s decision for American new and small businesses – we will continue to monitor the case with great interest.”

About the Center for American Entrepreneurship

The Center for American Entrepreneurship (CAE) is a nonpartisan research, policy, and advocacy organization whose mission is to engage and educate policymakers in Washington and across the nation regarding the critical importance of entrepreneurs and startups to innovation, economic growth, and job creation – and to pursue a comprehensive policy agenda intended to significantly enhance policy circumstances for new business formation, survival, and growth.

For more information, visit www.startupsUSA.org 

Follow CAE on Twitter: @startupsUSAorg

About the Small Business & Entrepreneurship Council

The Small Business and Entrepreneurship Council (SBE Council) is an advocacy, research, and education organization dedicated to protecting small business and promoting entrepreneurship. Its network of supporters, including entrepreneurs and small business owners, state and local business organizations, corporate partners and associations work to strengthen the environment for robust entrepreneurship, investment, innovation and small business growth.  Since its founding in 1994, SBE Council has worked both domestically and across the world to further its mission, and is viewed as one of the most powerful and effective organizations dedicated to protecting small business, and promoting entrepreneurship.

For more information, visit www://sbecouncil.org/

Follow SBE Council on Twitter: @SBECouncil