Meta Platforms — €1.2B GDPR fine (2023)

Largest GDPR fine ever — EU→US data transfers under invalidated Privacy Shield framework

What happened

Ireland's DPC fined Meta €1.2B for transferring Facebook user data from the EEA to the US using Standard Contractual Clauses that, post-Schrems II, did not adequately protect against US surveillance access. Meta was ordered to suspend transfers and bring processing into compliance within 6 months.

Root cause

• Relied on SCCs without supplementary technical measures post-Schrems II (2020)
• No documented Transfer Impact Assessment (TIA) for US destination
• No fallback to EU-based processing while EU-US Data Privacy Framework negotiated

What every team should do

1. Run a Transfer Impact Assessment (TIA) for every non-EEA processor/sub-processor
2. Pair SCCs with supplementary measures (encryption, pseudonymisation, access controls)
3. Maintain an EU data-residency option for enterprise customers as a sales accelerator
4. Re-validate transfer mechanisms whenever ECJ or EDPB issues new guidance

Related enforcement actions