Privacy & Information Security Law Blog

On July 7, 2022, the Irish Data Protection Commission (the “DPC”) sent a draft decision to other EU data protection authorities, proposing to block Meta’s transfers of personal data from the EU to the United States.

The DPC commenced an inquiry to assess the legality of Meta’s EU-U.S. transfers in the wake of the invalidation of the Privacy Shield in the 2020 Schrems II decision. The DPC’s draft decision, issued under the cooperation mechanism under Article 60 of the EU General Data Protection Regulation (“GDPR”), indicates that it does not consider the Standard Contractual Clauses relied on by Meta for its transfers to provide sufficient protection for personal data. Other EU data protection authorities have four weeks to comment on or object to the draft decision. Privacy activist Max Schrems observed that objections from other EU regulators are expected, stating that “some major issues are not dealt with in the DPC’s draft.” Such objections would delay the DPC’s decision from becoming binding.