Breaking: Facebook owner Meta fined €1.2bn for mishandling user information

Facebook’s owner, Meta, has been fined a record €1.2bn (£1bn) and ordered to suspend the transfer of user data from the EU to the US.

The fine imposed by Ireland’s Data Protection Commission (DPC), which regulates Meta across the EU, is a record for a breach of the bloc’s General Data Protection Regulation (GDPR).

The suspension of Facebook data transfers is not immediate and Meta has been given five months to enact it.

The DPC punishment relates to a legal challenge brought by an Austrian privacy campaigner, Max Schrems, over concerns resulting from the Edward Snowden revelations that European users’ data is not sufficiently protected from US intelligence agencies when it is transferred across the Atlantic.

The ruling does not impact data transfers at Meta’s other main platforms, Instagram and WhatsApp.

The DPC said Meta infringed the GDPR by continuing to transfer EU user data to the US despite a ruling by the European court of justice requiring strong protection of that information. The regulator said data transferred by Facebook under a measure called standard contractual clauses “did not address the risks to the fundamental rights and freedoms of data subjects that were identified by the [court of justice] in its judgment”.

Meta said it had been “singled out” by the DPC despite thousands of other business using the same data transfer mechanism.

“We are … disappointed to have been singled out when using the same legal mechanism as thousands of other companies looking to provide services in Europe,” wrote Nick Clegg, the Meta president of global affairs, and Jennifer Newstead, the Meta chief legal officer, in a blog post on Monday.

Clegg and Newstead added: “This decision is flawed, unjustified and sets a dangerous precedent for the countless other companies transferring data between the EU and US.”

The DPC said it had disagreed with other EU regulators over Meta’s punishment, which resulted in the European Data Protection Board, comprised of EU data watchdogs, stepping in to decide whether a fine should be imposed.