Ad sector, big tech prepare for ruling on Meta data transfer

Next week, Meta and other Big Tech companies will find out whether they will be able to keep transferring the personal information of European citizens to the US in the same manner.

The question at hand is whether Meta can continue data transfers utilizing normal contractual terms between the European Union and the United States. If not, the business may experience service interruptions in the EU until a legal transfer method is established, specifically a new data transfer framework that is anticipated to be finished and implemented soon, though no specific timeframe has been specified.

When the Irish Data Protection Commission (DPC) releases its ruling in the matter, which is scheduled by May 12, Meta stated in its first-quarter results statement posted on April 26 that it anticipates receiving a fine and suspension order from the DPC.

The statement also stated that Meta anticipates the new EU-U.S. data transfer framework to be in place before to the implementation of any suspension order, which would facilitate compliance, but it acknowledged that this is not a guarantee. Even after the transfer framework is in place, the company stated that it would consider how the Irish DPC's decision would affect its data processing operations.

The Irish DPC has not yet made public statements about the situation.

Since EU data protection authorities could not agree on what action the Irish DPC, as lead supervisory authority, should take, the European Data Protection Board (EDPB), the EU's overall regulator for the General Data Protection Regulation (GDPR), adopted an Article 65 dispute resolution decision on April 13. The Irish authority has one month to publish its decision following that process.

According to legal experts, the duration of any suspension order, as well as the application of corrective measures, would be crucial.

The Irish DPC's decision could "potentially have a serious impact for other tech firms which currently use standard contractual clauses for their EU-U.S. data transfers," according to Sarah Williamson, partner and head of the commercial and technology team at law firm Boyes Turner. However, she added that the new proposed framework "may give them an alternative mechanism for their data transfers to the U.S."

"All eyes will be on this decision, which could have significant ramifications for other Big Tech players and all other companies transferring personal data from the EU to the U.S.," stated Williamson. "If the Irish DPC orders Meta to halt data transfers from the EU to the U.S., companies will anxiously be waiting for the new proposed EU-U.S. data privacy framework to be signed off."

The fallout for tech companies, according to Louise Brooks, head of consultancy at DQM GRC, an expert data protection and privacy agency, is not the main issue: Advertising to Facebook users in the European Union and European Economic Area may be affected globally as a result of the ruling.

"Organizations that will be the most affected are those that rely on Meta products, like Facebook, for their marketing and promotion and the businesses that facilitate those adverts," said Brooks.

At the law firm Freeths, Will Richmond-Coggan, a partner with a focus on data privacy, concurred.

"If the current efforts to get an EU-U.S. bilateral data transfer arrangement in place cannot be agreed, more significant disruption to the advertising model of Meta and other large data-driven ad-sales businesses will ensue," he noted.

According to Richmond-Coggan, EU case law holds that every business that incorporates Meta/Google tracking or analytics technologies on its website is a joint controller of the data that is gathered. As a result, he stated, "Everyone will need to give careful consideration to the customary approach to tracking and targeting website visitors and prospective customers."

By fLEXI tEAM