Meta kept moving EU data to the US after the law changed — a record €1.2B GDPR fine

On 22 May 2023 Ireland's Data Protection Commission fined Meta €1.2 billion — the largest fine ever issued under the GDPR. Meta Ireland had kept transferring EU users' personal data to the United States after the European Court of Justice invalidated the EU–US Privacy Shield in its 2020 Schrems II judgment.

Meta relied on updated Standard Contractual Clauses and supplementary measures, but the DPC ruled they did not address the risks to fundamental rights the court had identified — a breach of Article 46(1) of the GDPR. The inquiry opened in August 2020; in April 2023 the European Data Protection Board imposed the fine through a binding dispute resolution after four national authorities objected to the DPC's draft decision, which had proposed none.

Meta was ordered to suspend future EU-to-US transfers within five months and to stop unlawfully processing already-transferred data within six. It said it would appeal, calling the decision flawed and unnecessary; Facebook president Nick Clegg argued that thousands of companies use the same clauses. The fight began with a complaint first pursued by privacy campaigner Max Schrems in 2013.