Facebook parent Meta was fined with a record amount of $1.3 billion (1.2 billion euros), on Monday (May 22). The fine was levied for the company’s failure to comply with a warning by the top European Union court related to the data transfer of Facebook’s EU users to servers in the United States, said Ireland’s regulator.&nbsp;

The social media giant has also been given orders to stop transferring user data across the Atlantic by October.&nbsp;

<h2>Why is Facebook being fined?</h2>

According to Ireland’s Data Protection Commission (DPC), which acts on behalf of the EU, the social media giant failed&nbsp;to heed a top court warning aimed at protecting users’ data from the security services in the US&nbsp;once it’s shipped to servers across the Atlantic.&nbsp;

The commission also alleged that Meta continued data transfers to the US without addressing “the risks to the fundamental rights and freedoms” of people whose data was being transferred to the US. The DPC had been investigating Meta Ireland’s transfer of personal data from the EU to the US since 2020.&nbsp;

The social media giant was given five months to “suspend any future transfer of personal data to the US” and six months to stop “the unlawful processing, including storage, in the US” of transferred personal EU data.

<h2>EU about the fine on Meta</h2>

The supposed privacy breach has prompted the largest fine “ever” under the EU’s General Data Protection Regulation (GDPR), said the European Data Protection Board (EDPB).&nbsp;

The European Data Protection Board (EDPB) chair Andrea Jelinek following the announcement said, Meta’s breach is “very serious since it concerns transfers that are systematic, repetitive and continuous.”

Jelinek also said that since Facebook has millions of users in Europe “the volume of personal data transferred is massive. The unprecedented fine is a strong signal to organizations that serious infringements have far-reaching consequences.”

The announcement also coincides with the fifth anniversary of the GDPR which is seen as the world’s benchmark for privacy.&nbsp;The penalty doled out for Meta surpassed the highest previous record fine imposed by the EU for Amazon $821 million (746 million euros). 
 
This comes after Amazon was forced to pay a fine of the previously mentioned amount by Luxembourg, in 2021 for similarly flouting the EU’s privacy standards.&nbsp;

<h2>Meta reacts to announcement</h2>

Meta following the announcement of the fine, on Monday, said it would appeal the decision, including the “unjustified and unnecessary fine,” and seek a stay of the orders through the courts.&nbsp;

Meta president of global affairs Nick Clegg and chief legal officer Jennifer Newstead said the company was “disappointed to have been singled out,” and called the ruling “flawed”. Meta’s representatives also warned that the ruling sets a “dangerous precedent for the countless other companies”.&nbsp;

They added, “There is no immediate disruption to Facebook in Europe.”&nbsp;

The company which also owns WhatsApp and Instagram had also previously warned that suspending data transfers on the basis of (SCCs) could have “a far-reaching effect on businesses that rely on SCCs (Facebook and other tech giants) and on the online services many people and businesses rely on”.

Earlier this year, Meta reiterated that without SCCs or “other alternative means of data transfers” it would “likely” not be able to offer access to social media platforms like Facebook and Instagram, across Europe.&nbsp;

<h2>DCP’s authority questioned</h2>

As per AFP, the Irish regulators only wanted to force Meta to suspend the offending data transfers and that the fine would “exceed the extent of powers that could be described as being ‘appropriate, proportionate and necessary’”. However, their EU counterpart, Concerned Supervisory Authorities (CSAs), disagreed and said, “All four CSAs took the view that Meta Ireland should be subject to an administrative fine.”&nbsp;

Since there was no consensus the matter was sent to the EDPB who ruled that Meta should not only stop the transfers but also pay the record amount of fine. Notably, this is the third fine imposed by the EU on Meta this year and the fourth one in the past six months.&nbsp;

Clegg and Newstead said the EDPB decision to overrule the DPC “raises serious questions,” adding that the US has done more than any other country to comply with EU’s standards and “their latest reforms, while transfers continue largely unchallenged to countries such as China.”&nbsp;

This comes as EU regulators back in December unveiled proposals to replace the previous “Privacy Shield” pact that had been rejected by the EU’s top court. This led to months of negotiations ending with US President Joe Biden’s executive order assuring EU citizens’ data is safe once it’s shipped across the Atlantic.&nbsp;

<h2>Why now?</h2>

The decision follows revelations by Edward Snowden, the former US National Security Agency contractor back in 2013 and a legal challenge brought by an Austrian privacy campaigner, Max Schrems.&nbsp;

Schrems has expressed concerns that European users’ data is not sufficiently protected from US’ intelligence agencies after Snowden disclosed that officials across the Atlantic have repeatedly accessed people’s information via tech companies like Facebook, Google, and so on.&nbsp;

Notably, Scherms’ lawsuit began a decade-long legal battle over the legality of transferring EU data to the US. According to Reuters, EU regulators led by Ireland’s Data Protection Commissioner Helen Dixon have also been in the midst of finalising the ban on a legal tool used by Facebook to transfer European user data.&nbsp;

This comes as the Irish DPC was given one month, back in April to chalk out the details of the order to block Facebook’s transatlantic data flows, as per which, the ban would take place sometime in mid-May, reported Reuters.&nbsp;

Europe’s highest court, the Court of Justice of the European Union (CJEU), also ruled in 2020 and repeatedly said that an agreement between the EU-US for data transfer was invalid and concluded that Washington does not have sufficient systems in place to protect European data.

However, the judges at the time did not strike down an alternative tool based on contractual clauses but prompted the Irish authorities to issue a preliminary order stating that Facebook can no longer move data to the US via this other method either.&nbsp;

(With inputs from agencies)&nbsp; 
&nbsp;

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" loading="”lazy”" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

Facebook parent Meta was fined with a record amount of $1.3 billion (1.2 billion euros), on Monday (May 22). The fine was levied for the company’s failure to comply with a warning by the top European Union court related to the data transfer of Facebook’s EU users to servers in the United States, said Ireland’s regulator.

Facebook parent Meta was fined with a record amount of $1.3 billion (1.2 billion euros), on Monday (May 22). The fine was levied for the company’s failure to comply with a warning by the top European Union court related to the data transfer of Facebook’s EU users to servers in the United States, said Ireland’s regulator. The social media giant has also been given orders to stop transferring user data across the Atlantic by October. Why is Facebook being fined? According to Ireland’s Data Protection Commission (DPC), which acts on behalf of the EU, the social media giant failed to heed a top court warning aimed at protecting users’ data from the security services in the US once it’s shipped to servers across the Atlantic. The commission also alleged that Meta continued data transfers to the US without addressing “the risks to the fundamental rights and freedoms” of people whose data was being transferred to the US. The DPC had been investigating Meta Ireland’s transfer of personal data from the EU to the US since 2020. The social media giant was given five months to “suspend any future transfer of personal data to the US” and six months to stop “the unlawful processing, including storage, in the US” of transferred personal EU data. EU about the fine on Meta The supposed privacy breach has prompted the largest fine “ever” under the EU’s General Data Protection Regulation (GDPR), said the European Data Protection Board (EDPB). The European Data Protection Board (EDPB) chair Andrea Jelinek following the announcement said, Meta’s breach is “very serious since it concerns transfers that are systematic, repetitive and continuous.” Jelinek also said that since Facebook has millions of users in Europe “the volume of personal data transferred is massive. The unprecedented fine is a strong signal to organizations that serious infringements have far-reaching consequences.” The announcement also coincides with the fifth anniversary of the GDPR which is seen as the world’s benchmark for privacy. The penalty doled out for Meta surpassed the highest previous record fine imposed by the EU for Amazon $821 million (746 million euros). This comes after Amazon was forced to pay a fine of the previously mentioned amount by Luxembourg, in 2021 for similarly flouting the EU’s privacy standards. Meta reacts to announcement Meta following the announcement of the fine, on Monday, said it would appeal the decision, including the “unjustified and unnecessary fine,” and seek a stay of the orders through the courts. Meta president of global affairs Nick Clegg and chief legal officer Jennifer Newstead said the company was “disappointed to have been singled out,” and called the ruling “flawed”. Meta’s representatives also warned that the ruling sets a “dangerous precedent for the countless other companies”. They added, “There is no immediate disruption to Facebook in Europe.” The company which also owns WhatsApp and Instagram had also previously warned that suspending data transfers on the basis of (SCCs) could have “a far-reaching effect on businesses that rely on SCCs (Facebook and other tech giants) and on the online services many people and businesses rely on”. Earlier this year, Meta reiterated that without SCCs or “other alternative means of data transfers” it would “likely” not be able to offer access to social media platforms like Facebook and Instagram, across Europe. DCP’s authority questioned As per AFP, the Irish regulators only wanted to force Meta to suspend the offending data transfers and that the fine would “exceed the extent of powers that could be described as being ‘appropriate, proportionate and necessary’”. However, their EU counterpart, Concerned Supervisory Authorities (CSAs), disagreed and said, “All four CSAs took the view that Meta Ireland should be subject to an administrative fine.” Since there was no consensus the matter was sent to the EDPB who ruled that Meta should not only stop the transfers but also pay the record amount of fine. Notably, this is the third fine imposed by the EU on Meta this year and the fourth one in the past six months. Clegg and Newstead said the EDPB decision to overrule the DPC “raises serious questions,” adding that the US has done more than any other country to comply with EU’s standards and “their latest reforms, while transfers continue largely unchallenged to countries such as China.” This comes as EU regulators back in December unveiled proposals to replace the previous “Privacy Shield” pact that had been rejected by the EU’s top court. This led to months of negotiations ending with US President Joe Biden’s executive order assuring EU citizens’ data is safe once it’s shipped across the Atlantic. Why now? The decision follows revelations by Edward Snowden, the former US National Security Agency contractor back in 2013 and a legal challenge brought by an Austrian privacy campaigner, Max Schrems. Schrems has expressed concerns that European users’ data is not sufficiently protected from US’ intelligence agencies after Snowden disclosed that officials across the Atlantic have repeatedly accessed people’s information via tech companies like Facebook, Google, and so on. Notably, Scherms’ lawsuit began a decade-long legal battle over the legality of transferring EU data to the US. According to Reuters, EU regulators led by Ireland’s Data Protection Commissioner Helen Dixon have also been in the midst of finalising the ban on a legal tool used by Facebook to transfer European user data. This comes as the Irish DPC was given one month, back in April to chalk out the details of the order to block Facebook’s transatlantic data flows, as per which, the ban would take place sometime in mid-May, reported Reuters. Europe’s highest court, the Court of Justice of the European Union (CJEU), also ruled in 2020 and repeatedly said that an agreement between the EU-US for data transfer was invalid and concluded that Washington does not have sufficient systems in place to protect European data. However, the judges at the time did not strike down an alternative tool based on contractual clauses but prompted the Irish authorities to issue a preliminary order stating that Facebook can no longer move data to the US via this other method either. (With inputs from agencies) WATCH WION LIVE HERE You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here.

Explained | EU fines Facebook parent company Meta record $1.3 billion over data transfer to US

India's Information Technology ministry on Friday (November 18) proposed a new draft of country's digital personal data protection bill. The provisions in the bill allow cross-border transfer of some users' data with "certain notified countries and territories". This is being considered a relief to Big Tech. Some social media giants have been at odds with Indian government in recent years over the issue of personal data.

The government in August withdrew the contentious Personal Data Protection (PDP) Bill that saw 81 amendments in the past three years, aiming to introduce a new, sharper bill that fits into the comprehensive legal framework and protects the data of billions of citizens.

"The Central government may, after an assessment of such factors as it may consider necessary, notify such countries or territories outside India to which a Data Fiduciary may transfer personal data, in accordance with such terms and conditions as may be specified," the new draft bill read.

The new bill has also has provision of harsh penalties of up to USD 30 million if companies fail to prevent data breaches.

"Failure of Data Processor or Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (4) of section 9 of this Act" will cost a maximum penalty of USD 30 million.

"Personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction of or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data," the draft bill said.

The bill has now been made public for consultation. The ministry will hear views and suggestions from the public until December 17.

"The purpose of this Act is to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process personal data for lawful purposes, and for matters connected therewith or incidental thereto," said the draft.

On the matter of data storage, the draft bill says that "the storage should be limited to such duration as is necessary for the stated purpose for which personal data was collected".

Similar to Europe`s GDPR, the proposed Indian bill will apply to companies operating in the country and to any entities processing the data of Indian citizens.

Rupinder Malik, Partner at law firm JSA, said that the draft bill has simplified the proposed data protection regime and done away with some contentious clauses which caused industry pushback in earlier versions.

"Particularly, data mirroring, data localisation requirements, and overall compliances appear to be limited compared to the previous Bill. The legislative intent appears to be tech and IT business friendly, focused on facilitating cross-border data flows," said Malik.

(With inputs from agencies)

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

WATCH WION LIVE HERE

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false"><iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" loading="”lazy”" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe><a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

&nbsp;
</div>

India's Information Technology ministry on Friday (November 18) proposed a new draft of country's digital personal data protection bill. The provisions in the bill allow cross-border transfer of some users' data with "certain notified countries and territories".

India's Information Technology ministry on Friday (November 18) proposed a new draft of country's digital personal data protection bill. The provisions in the bill allow cross-border transfer of some users' data with "certain notified countries and territories". This is being considered a relief to Big Tech. Some social media giants have been at odds with Indian government in recent years over the issue of personal data. The government in August withdrew the contentious Personal Data Protection (PDP) Bill that saw 81 amendments in the past three years, aiming to introduce a new, sharper bill that fits into the comprehensive legal framework and protects the data of billions of citizens. "The Central government may, after an assessment of such factors as it may consider necessary, notify such countries or territories outside India to which a Data Fiduciary may transfer personal data, in accordance with such terms and conditions as may be specified," the new draft bill read. The new bill has also has provision of harsh penalties of up to USD 30 million if companies fail to prevent data breaches. "Failure of Data Processor or Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (4) of section 9 of this Act" will cost a maximum penalty of USD 30 million. "Personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction of or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data," the draft bill said. The bill has now been made public for consultation. The ministry will hear views and suggestions from the public until December 17. "The purpose of this Act is to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process personal data for lawful purposes, and for matters connected therewith or incidental thereto," said the draft. On the matter of data storage, the draft bill says that "the storage should be limited to such duration as is necessary for the stated purpose for which personal data was collected". Similar to Europe`s GDPR, the proposed Indian bill will apply to companies operating in the country and to any entities processing the data of Indian citizens. Rupinder Malik, Partner at law firm JSA, said that the draft bill has simplified the proposed data protection regime and done away with some contentious clauses which caused industry pushback in earlier versions. "Particularly, data mirroring, data localisation requirements, and overall compliances appear to be limited compared to the previous Bill. The legislative intent appears to be tech and IT business friendly, focused on facilitating cross-border data flows," said Malik. (With inputs from agencies) You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here. WATCH WION LIVE HERE ×

India: New data privacy bill allows cross-border transfer but has harsh penalties too

Ireland's High Court on Friday rejected Facebook's bid to block a regulatory probe that could potentially stop data transfers from the European Union to the United States.

"I refuse all of the reliefs sought by (Facebook Ireland) and dismiss the claims made by it in the proceedings," read a statement from High Court judge David Barniville, dismissing its challenge against the Data Protection Commissioner's decision to hold a probe.

"FBI has not established any basis for impugning the DPC decision or the PDD or the procedures for the inquiry adopted by the DPC," the judgment said.

The case originates from EU concern that US government's surveillance may not respect privacy rights of EU citizens.

Ireland's Data Protection Commissioner (DPC) had launched an inquiry in August. It had issued a provisional order saying that the main mechanism Facebook uses to transfer EU user data to the United States "cannot in practice be used". Facebook had challenged the inquiry and the Preliminary Draft Decision (PDD).

Facebook had said that the inquiry threatened "devastating" and "irreversible" consequences for its business, which relies on processing user data to serve targeted online ads. The HIgh Court rejected the challenge.

While the decision does not trigger an immediate halt to data flows, Austrian privacy activist Max Schrems, who forced the Irish data regulator to act in a series of legal actions over the past eight years, said he believed the decision made it inevitable.

"After eight years, the DPC is now required to stop Facebook's EU-U.S. data transfers, likely before summer," he said.

A Facebook spokesman said the company looked forward to defending its compliance with EU data rules as the Irish regulator's provisional order "could be damaging not only to Facebook, but also to users and other businesses".

(With inputs from agencies)

Ireland's High Court on Friday rejected Facebook's bid to block a regulatory probe that could potentially stop data transfers from the European Union to the United States.

Ireland's High Court on Friday rejected Facebook's bid to block a regulatory probe that could potentially stop data transfers from the European Union to the United States. "I refuse all of the reliefs sought by (Facebook Ireland) and dismiss the claims made by it in the proceedings," read a statement from High Court judge David Barniville, dismissing its challenge against the Data Protection Commissioner's decision to hold a probe. "FBI has not established any basis for impugning the DPC decision or the PDD or the procedures for the inquiry adopted by the DPC," the judgment said. The case originates from EU concern that US government's surveillance may not respect privacy rights of EU citizens. Ireland's Data Protection Commissioner (DPC) had launched an inquiry in August. It had issued a provisional order saying that the main mechanism Facebook uses to transfer EU user data to the United States "cannot in practice be used". Facebook had challenged the inquiry and the Preliminary Draft Decision (PDD). Facebook had said that the inquiry threatened "devastating" and "irreversible" consequences for its business, which relies on processing user data to serve targeted online ads. The HIgh Court rejected the challenge. While the decision does not trigger an immediate halt to data flows, Austrian privacy activist Max Schrems, who forced the Irish data regulator to act in a series of legal actions over the past eight years, said he believed the decision made it inevitable. "After eight years, the DPC is now required to stop Facebook's EU-U.S. data transfers, likely before summer," he said. A Facebook spokesman said the company looked forward to defending its compliance with EU data rules as the Irish regulator's provisional order "could be damaging not only to Facebook, but also to users and other businesses". (With inputs from agencies)

Facebook may face prospect of data transfer ban after Irish ruling

A commercial data transfer pact provisionally agreed by the European Union executive and the United States in February received the green light from EU governments on Friday, the European Commission said, paving the way for it to come into effect next week. 
 
Its introduction should end months of legal limbo for companies such as Google, Facebook and MasterCard after the EU&#39;s top court struck down the previous data transfer framework, Safe Harbour, on concerns about intrusive U.S. surveillance. 
 
Representatives of European Union member states voted in favour of the EU-US Privacy Shield, which will underpin over $250 billion of transatlantic trade in digital services by facilitating cross-border data transfers that are crucial to international business. 
 
&quot;Today member states have given their strong support to the EU-US Privacy Shield, the renewed safe framework for transatlantic data flows,&quot; Commission vice-president Andrus Ansip and justice commissioner Vera Jourova said in a statement. 
 
The Commission, the EU executive, will formally adopt the Privacy Shield on Tuesday. 
 
The Privacy Shield seeks to strengthen the protection of Europeans whose data is moved to US servers by giving EU citizens greater means to seek redress in case of disputes. 
 
For 15 years Safe Harbour allowed both US and European firms to get around tough EU data transferral rules by stating they complied with European privacy standards when storing information on US servers. 
 
Cross-border data transfers by businesses include payroll and human resources information as well as lucrative data used for targeted online advertising, which is of particular importance to technology companies. 
 
Brussels and Washington intensified negotiations to hammer out a replacement for Safe Harbour after the Court of Justice of the European Union in October declared it invalid because it did not sufficiently protect Europeans&#39; data from US snooping. 
 
Revelations three years ago from former US intelligence contractor Edward Snowden of mass US surveillance practices caused political outrage in Europe and stoked mistrust of big US tech companies. 
 
&quot;It (the Privacy Shield) is fundamentally different from the old Safe Harbour: It imposes clear and strong obligations on companies handling the data and makes sure that these rules are followed and enforced in practice,&quot; Ansip and Jourova said. 
 
The United States will also create an ombudsman within the State Department to field complaints from EU citizens about US spying. 
 
EU data protection authorities in April demanded that the framework be improved, citing concerns with the leeway they said it left for the United States to collect data in bulk. 
 
(Reuters)

The Privacy Shield will underpin over $250 billion of transatlantic trade in digital services by facilitating crucial data transfers

A commercial data transfer pact provisionally agreed by the European Union executive and the United States in February received the green light from EU governments on Friday, the European Commission said, paving the way for it to come into effect next week. Its introduction should end months of legal limbo for companies such as Google, Facebook and MasterCard after the EU's top court struck down the previous data transfer framework, Safe Harbour, on concerns about intrusive U.S. surveillance. Representatives of European Union member states voted in favour of the EU-US Privacy Shield, which will underpin over $250 billion of transatlantic trade in digital services by facilitating cross-border data transfers that are crucial to international business. "Today member states have given their strong support to the EU-US Privacy Shield, the renewed safe framework for transatlantic data flows," Commission vice-president Andrus Ansip and justice commissioner Vera Jourova said in a statement. The Commission, the EU executive, will formally adopt the Privacy Shield on Tuesday. The Privacy Shield seeks to strengthen the protection of Europeans whose data is moved to US servers by giving EU citizens greater means to seek redress in case of disputes. For 15 years Safe Harbour allowed both US and European firms to get around tough EU data transferral rules by stating they complied with European privacy standards when storing information on US servers. Cross-border data transfers by businesses include payroll and human resources information as well as lucrative data used for targeted online advertising, which is of particular importance to technology companies. Brussels and Washington intensified negotiations to hammer out a replacement for Safe Harbour after the Court of Justice of the European Union in October declared it invalid because it did not sufficiently protect Europeans' data from US snooping. Revelations three years ago from former US intelligence contractor Edward Snowden of mass US surveillance practices caused political outrage in Europe and stoked mistrust of big US tech companies. "It (the Privacy Shield) is fundamentally different from the old Safe Harbour: It imposes clear and strong obligations on companies handling the data and makes sure that these rules are followed and enforced in practice," Ansip and Jourova said. The United States will also create an ombudsman within the State Department to field complaints from EU citizens about US spying. EU data protection authorities in April demanded that the framework be improved, citing concerns with the leeway they said it left for the United States to collect data in bulk. (Reuters)

EU-US commercial data transfer pact clears final hurdle

data-transfer

Data Transfer, News on Data Transfer, stories on Data Transfer, articles on Data Transfer, Data Transfer stories at Wion, Data Transfer news, Data Transfer latest news