[MEDIA] Why was Meta fined a record 1.2 billion euros?

On May 24, 2023, Florence G’sell was Guillaume Erner’s guest on the program Les Matins de France Culture. The podcast is available here.

The article by France Culture:

This is a record fine: Meta will have to pay 1.2 billion euros for violating the GDPR, European data protection regulations. The decision is about a transfer of data from the European Union to the United States. How does Meta use our data?

With:

Florence G’sell Professor of Private Law at the University of Lorraine, co-holder of the Digital, Governance and Sovereignty Chair at Sciences Po and visiting professor at the Cyber Policy Center at Stanford University (California)

Financial penalty and ban on data transfer to the United States

What does this decision mean for Meta? “This is a financial penalty of 1.2 billion euros, which is unprecedented in the European Union”, analyzes Florence G’sell, co-holder of the Digital, Governance and Sovereignty Chair at Sciences Po. “But it’s not just that because Meta is also ordered to stop transferring data to the United States at short notice and is also ordered to erase data that has been stored in the United States since 2020.”

Why is it prohibited to transfer data to the United States? “It is not completely forbidden to transfer data to the United States,” says Florence G’sell. But Meta is supposed to provide guarantees of protection to European users, and in this case, the Irish authority considers that they are not sufficient for a simple reason which is that American legislation allows surveillance programs which are quite intrusive. . Under these conditions, the authorities of the European Union tend to consider that any transfer to the United States is problematic.

An “expected” decision

“For 25 years, several agreements between the European Union and the United States have been signed to regulate data transfers and which allowed companies to transfer data, explains Florence G’sell. The last agreement that had been concluded was canceled in 2020 by the Court of Justice of the European Union and since then, companies that wish to transfer data to the United States do so based on their own general conditions which must protect users. . And there, we tell Meta that it is not enough“.

Meta has therefore been in the spotlight for some time. This fine was partly expected. “It is a decision that comes after a very long journey and which is still subject to appeal, specifies Florence G’sell. Things will still drag on and Meta is counting on the last agreement concluded between the European Union and the United States, which should be finalized, in any case validated at Union level by the summer and which could come out of ‘business business’.

What will be the consequences of such a sanction?

If this data can no longer be transferred, what will happen? “We are seeing a kind of data localization movement, that is to say that today, the decision is not isolated but is part of a more general logic which wants data to remain in Europe, says Florence G’sell.

She adds: “The founding idea is that of the “sovereign cloud”, which poses an economic problem and an industrial problem. ” Why? “To develop innovative technologies, we need data to be able to circulate. So, in this case, this decision does not only concern the tip of the iceberg, ie Meta or Twitter. But it also concerns all the technology companies that work from data and which, for a large number of them, need to be able to circulate it. And it is on this point that I would personally tend to be a little critical of decisions that are certainly spectacular, but may be problematic in their economic effects,” concludes the law professor.