Meta kept sending EU user data to the US after Schrems II — a €1.2B fine

Since the CJEU's 2020 Schrems II ruling, transferring EU users' personal data to the US on standard contractual clauses alone was legally shaky: US surveillance law gave American intelligence agencies access that no contract clause could override. Meta kept transferring Facebook users' data to US servers anyway, arguing its clauses and supplementary measures were enough.

Ireland's Data Protection Commission disagreed, and the European Data Protection Board's April 2023 binding decision pushed the DPC toward the maximum penalty. On May 22, 2023, the DPC fined Meta Platforms Ireland €1.2 billion — a GDPR record — and ordered it to suspend future EU-to-US transfers within five months and bring existing processing into compliance within six.

Meta called the fine 'unjustified and unnecessary' and said the underlying legal conflict — between EU privacy law and US surveillance law — was not one it could resolve alone. A new EU-US Data Privacy Framework, adopted two months later, gave it a fresh legal basis to keep transferring data without paying again.