CyphrQ
Menu

Meta's €1.2 Billion GDPR Fine Explained: DPC, EDPB and US Data Transfers

Meta's 2023 €1.2bn GDPR fine: what Ireland's DPC decided, why the EDPB stepped in, and what it means for EU-US data transfers.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: August 20209 min read

What was Meta's €1.2 billion GDPR fine? In May 2023, Ireland's Data Protection Commission (DPC) fined Meta Platforms Ireland €1.2 billion. It found that Meta kept sending Facebook users' personal data from the EU and EEA to the United States using a legal tool that did not protect that data well enough. Meta said it was appealing. This was a penalty, not a breach: nobody stole any data.

This post sets out what the DPC and the European Data Protection Board (EDPB) say they decided, what Meta says in reply, and what is still unknown. If GDPR is new to you, start with GDPR essentials for organisations. This is part of our Europe breaches and penalties coverage.

Case file

This is a penalty case, not a breach. Two rows of the usual case file are adapted: "Breach date" becomes "Infringement period" and "People affected" becomes "Data subjects concerned".

Field Value
Organisation Meta Platforms Ireland Limited ("Meta Ireland"), for its Facebook service
Region European Union and EEA (Ireland as lead authority)
Infringement period Transfers continuing after the Court of Justice of the EU (CJEU) judgment in the Schrems case. The DPC says its inquiry "was initially commenced in August 2020" (DPC)
Disclosed DPC announcement on 22 May 2023. The DPC adopted its final decision on 12 May 2023 (DPC)
Data subjects concerned Facebook users in the EU/EEA whose data was transferred to the US. The DPC announcement gives no number
Data types Personal data transferred in connection with Facebook. The DPC announcement does not itemise categories
Penalty/action A fine of €1.2 billion, an order to suspend future transfers to the US within five months, and an order to stop unlawful processing in the US within six months (DPC)
Regulator Irish Data Protection Commission, acting on a binding decision of the EDPB (13 April 2023)
Status Meta said it was appealing and would seek a stay. Meta's post, updated 7 September 2023, says the appeals continue. No outcome found in the cited sources

What did Ireland's DPC decide about Meta?

The DPC's inquiry looked at the legal basis on which Meta Ireland moved personal data from the EU/EEA to the US to deliver Facebook (DPC).

Meta Ireland relied on the updated standard contractual clauses (SCCs) plus extra safeguards it called supplementary measures. SCCs are pre-approved contract terms between the company sending the data and the company receiving it.

The DPC found that "these arrangements did not address the risks to the fundamental rights and freedoms of data subjects". It found that Meta Ireland infringed Article 46(1) of the GDPR by continuing to transfer data "following the delivery of the CJEU's judgment" (DPC).

The DPC did not set the punishment alone. It ordered Meta Ireland to:

  • suspend any future transfer of personal data to the US within five months of being notified (Article 58(2)(j))
  • cease "the unlawful processing, including storage, in the US" of data already transferred, within six months (Article 58(2)(d))
  • pay the €1.2 billion fine

What did the EDPB have to do with the fine?

The EDPB is the body that brings the EU's national data protection authorities together. It is why the fine exists in its final form.

The DPC sent a draft decision to the other concerned authorities on 6 July 2022. Under the GDPR's cooperation procedure (Article 60), those authorities can object. Four of the 47 concerned authorities did. All four wanted an administrative fine. Two also wanted action on data already transferred (DPC).

The authorities did not reach agreement, so the DPC referred the objections to the EDPB under Article 65, the GDPR's dispute-resolution route. The EDPB adopted Binding Decision 1/2023 on 13 April 2023 and published it on 22 May 2023 (EDPB). The DPC then adopted its final decision "on the basis of" it.

The EDPB's page says the decision covers whether more corrective measures were needed beyond the infringement itself: an administrative fine and an order covering European users' data already transferred in breach of the GDPR (EDPB).

This post does not quote the decision's reasoning or any fine-calculation range from its full text.

Step Date Source
Inquiry starts August 2020 DPC
DPC draft decision sent to other authorities 6 July 2022 DPC
EDPB Binding Decision 1/2023 13 April 2023 EDPB
DPC final decision 12 May 2023 DPC
Decision announced; EDPB decision published 22 May 2023 DPC, EDPB

What does Meta say about the decision?

Meta's president of global affairs, Nick Clegg, and its chief legal officer, Jennifer Newstead, published a reply on 22 May 2023. It says: "This decision is flawed, unjustified and sets a dangerous precedent." They add: "We are appealing these decisions and will immediately seek a stay with the courts" (Meta).

Meta argues the problem is "a fundamental conflict of law between the US government's rules on access to data" and European privacy rights. It also said there was "no immediate disruption to Facebook because the decision includes implementation periods" (Meta).

An update dated 7 September 2023 says Meta would use the new Data Privacy Framework for certain EU-to-US transfers, including Facebook user data, from that date. The same update says "our appeals against the decisions of the Irish Data Protection Commission and European Data Protection Board continue" (Meta).

This is Meta's account. No court ruling on the appeals was found in the cited sources, so this post does not report one.

Which parts are settled, and which remain open?

Question Status as of 25 October 2026
Did Meta Ireland infringe Article 46(1) GDPR? Decided by the DPC, on the basis of the EDPB's binding decision
Was a €1.2 billion fine imposed? Yes, per the DPC
Did the appeals succeed? Not established. Meta said they were continuing in September 2023, and no later outcome was found
Is the fine paid or suspended? No primary source found either way, so no claim is made

What does Meta's €1.2 billion GDPR fine mean for your own data transfers?

The practical point is narrow. A contract is not a shield on its own. The DPC found that standard contractual clauses plus supplementary measures did not cover the risks the CJEU had identified, in Meta's circumstances.

Three consequences follow for an ordinary organisation:

  1. Know which tool covers each transfer. For every supplier that processes your EU personal data outside the EU, write down the route you rely on. Your records should name it.
  2. Check the route, not just the clause. If you rely on SCCs, ask what you assessed about the destination country's rules on government access, and what you added.
  3. Treat this as an enforcement signal. The dispute shows that other European authorities can push a lead authority toward a fine. Four of 47 did here.

Meta's own move to the Data Privacy Framework, announced in September 2023, shows that the route a company relies on can change. If a vendor says it uses that framework, ask for evidence of its certification.

Going deeper: for security and IT teams

Legal mechanism, in the DPC's own terms. The infringement was of Article 46(1): a controller may transfer personal data to a third country only if it has provided appropriate safeguards and enforceable data subject rights and effective remedies are available. The DPC found that Meta Ireland's reliance on the updated SCCs and supplementary measures did not address the risks identified in the CJEU judgment. The corrective powers used were Article 58(2)(j), suspension of data flows, and Article 58(2)(d), an order to bring processing into compliance. The fine came on top.

Why the process matters to a practitioner. The sequence was Article 60 (draft decision, objections from four of 47 concerned authorities), then Article 65 (EDPB binding decision on the dispute). A lead authority's preferred outcome is not the final word when other authorities object. If you operate across several member states, your exposure is not set only by the authority where you are established.

What the orders mean technically. The DPC separated two things. Stopping future transfers is a data-flow change: routing, replication, support access, backups and analytics pipelines. Ceasing "unlawful processing, including storage, in the US" of data already moved is a data-location and deletion problem. Storage is named explicitly. That is a different workstream with a different deadline (six months, against five).

Controls you can verify in your own estate.

  • Transfer register. List each system, the vendor, the processing location including sub-processors, the Chapter V route relied on (adequacy decision, SCCs, or another tool) and the date you last reviewed it. Keep it with your Article 30 records.
  • Data-flow evidence. Check where data goes, not only where the contract says it goes. Review cloud region settings, replication targets, logging and telemetry exports, and remote-support access paths.
  • Exit plan. If a supplier's transfer route fails, can you stop the flow and retrieve or delete the data inside a period like the five and six months the DPC set here? Test it on one supplier.
  • Contract hygiene. Confirm which SCC version your contracts reference. The DPC page says Meta Ireland relied on the updated SCCs.
  • Framework certification. If a supplier relies on the EU-US Data Privacy Framework, check its entry on the official participant list, and which data types and entities it covers.

Detection and evidence. Transfers are rarely logged as "transfers". Useful signals are egress to non-EU regions in cloud audit logs, new sub-processor notices from suppliers, and support tickets that attach exports. Re-run the check when a vendor changes its sub-processors.

What to ask a vendor.

  • Which Chapter V route covers my data, and which entity in the chain is the importer?
  • Where is it stored, replicated and accessed from, including by support staff?
  • What assessment of destination-country access rules did you carry out, and can I see a summary?
  • If this route is invalidated, how fast can you stop transfers and delete what has been moved?

How should your data transfers change after the Meta fine?

  1. Build or update a list of every supplier that handles EU personal data outside the EU.
  2. Record the transfer route for each, and who last reviewed it.
  3. For SCC-based transfers, find the documented assessment. If none exists, start one with your highest-volume supplier.
  4. For Data Privacy Framework suppliers, check certification and scope.
  5. Run a tabletop on one supplier: transfers must stop, and stored data must be deleted. Time it.

Learn more

Key takeaways

  • The Irish DPC fined Meta Ireland €1.2 billion for continuing Facebook's EU/EEA-to-US data transfers on SCCs and supplementary measures it found inadequate (announced 22 May 2023).
  • The DPC also ordered transfers suspended within five months and unlawful US processing, including storage, stopped within six.
  • The EDPB's Binding Decision 1/2023 (13 April 2023) resolved objections from four of 47 authorities, all of whom wanted a fine.
  • Meta called the decision "flawed, unjustified" and said it was appealing. As of its September 2023 update, the appeals continued. No later outcome was found.
  • This is a penalty case, not a breach. No data theft is alleged.
  • Your task: know which legal route covers each transfer, and test that you could stop the flow and delete the data.

Sources