Weekly Updates

Two takeaways from the latest Meta fine: uncertainty and internet fragmentation

From Financial Times:

Meta has been hit with a €1.2bn fine by the EU for privacy violations and ordered to suspend transfers of user data to the US, the biggest such penalty in the bloc’s history. Ireland’s Data Protection Commission, the regulator responsible for holding the Facebook owner to EU data protection law, handed down the fine on Monday. It said that Facebook, whose European headquarters is in Dublin, had violated rules requiring that transfers of personal data from the EU to the US had appropriate safeguards in place. It added that changes introduced by Meta Ireland in response to a 2020 ruling by the European Court of Justice “did not address the risks to the fundamental rights and freedoms” of such transfers — even though the transfers largely took place on the basis of contractual clauses endorsed by the European Commission.

The decision was delivered this Monday, and since then, many voices have mentioned how hard it is to feel sorry for Meta. As an opinion piece from the Financial Times best articulated:

Meta is unlikely to attract much sympathy following the ruling. Data protection is a vital issue. It is one that Facebook users — bombarded by targeted ads — have grown increasingly concerned about. Governments the world over fear foreign institutions’ use of their citizens’ data.

Indeed, if it weren't for the fine amount, the report that Meta was hit by yet another privacy-related fine wouldn't be surprising. This is the fifth time Meta has been fined for GDPR infringement in the last 14 months, to a total of €2.277 bn. It was the second time this year alone.

However, the circumstances around that fine are more nuanced than it may seem at first glance. In reality, it reveals, at best, power disputes between the US and the EU and between the different branches of the EU central authority. At worst, the case reveals a glimpse of the future of internet fragmentation.

So today, we are going to walk you through three points: (1) why this is happening now, (2) what the decision means for Meta in particular, and what it means(3) for the future of internet data flow in general.

1) Why was Meta fined? The 2020 CJEU Privacy Shield invalidation.

As many reports mention, this week's decision is a repercussion of a 2020 decision from the Court of Justice of the European Union (CJEU) invalidating a 2016 EU-US agreement known as “Privacy Shield”. The Privacy Shield put in place additional safeguards for European citizens’ personal data that were processed and/or stored in the United States, and effectively authorized personal data flow from the EU to the US under GDPR.

Agreements of this sort have existed since the late 1990s. The first one, the Safe Harbor principles, was invalidated by the CJEU in 2015 and replaced by the Privacy Shield in the following year. After GDPR became applicable in 2018, international personal data flows were only admissible in two cases: (A) where the European Commission had declared the adequacy of protection of European citizens’ private data in a foreign country, or (B) if the company responsible for the international flow made arrangements to guarantee the adequate protection of such data, which means, among other things, using EC-approved standard contract clauses (SCCs).

This is where the Privacy Shield came in. Covered by its additional safeguards, the EC declared that European private data would receive adequate protection in the US. That was a green light under GDPR that US companies could continue to store and process private data from European citizens in the US.

That was until 2020 when the CJEU decided the Privacy Shield was insufficient to protect Europeans from national security surveillance from the US government. We can only guess that Trump's "Enhancing Public Safety” executive order did not help. Immediately, US and EU companies could not rely on option (A) above to justify their transatlantic personal data flows.

This decision threw the continent into uncertainty as the main point in the decision was that no server in the US was safe from the national security exceptions to online privacy. So even though the Court explicitly mentioned that option (B) was still ok and the SCCs were valid, it did mention that, even if a company incorporated the SCCs, it would have to guarantee that GDPR-protected data would receive an equivalent level of protection abroad. Since the decision effectively said no US server was safe from national security surveillance, it was unlikely the European authorities would ever find that a US company could implement adequate measures to protect European personal data once it reached the US.

Shortly after being enacted president, Joe Biden revoked Trump's executive order, and in March 2022, US and EU reached a preliminary draft for a new transatlantic data flow deal and are expected to finalize it this Summer.

However, three years into this no-agreement phase, the European data protection authorities decided to make an example out of Meta and show how serious they take GDPR enforcement.

So now Meta is understandably and very publicly annoyed to be in the middle of this major geopolitics stalemate, as European authorities are understandably annoyed that their law, as interpreted by their High Court, was being ignored.

2) What does it mean for Meta?

Regarding the financial penalty, the over USD 1 billion fine doesn't seem much when compared to Meta's $ 630 billion market value. However, as Ben Thompson called out, Meta's latest earnings call data suggest its 2022 revenue in the EU was only $ 11.7 billion. So the most USD 2.5 billion in fines since last year could justifiably make executives think about alternatives. From Politico:

The U.S. tech giant previously warned that if it would be forced to stop using SCCs without a proper alternative data flow agreement in place, it could shut down services like Facebook and Instagram in Europe.

These threats are hard to take seriously since social media is a game ruled by network effects, meaning the value of Facebook and Instagram for US users is greater because EU users are also there. So even if the EU isn't a great market for ads, the underlying service which enables the ads business is highly dependent on the network's reach.

The fine was not the only outcome of Monday's decision, though. From Politico:

Meta has until October 12 to stop relying on SCCs for their transfers. (…) Meta also has until November 12 to delete or move back to the EU the personal data of European Facebook users transferred and stored in the U.S. since 2020 and until a new EU-U.S. deal is reached.

Without a deal, it could be the case that Meta has to suspend operations in Europe until it works out a compliance strategy or risk even bigger fines.

3) What does it mean for the future of internet data flow?

Firstly, about the 2020 decision, it’s quite disconcerting how little European Commission decisions mean in the European central authority scheme. The fact CJEU effectively has the last word on whether international commitments from other nations will likely be honored shouldn't be taken lightly. Especially when the Court is very liberal about the legal documents it can use to base its decisions, the facts of the underlying case required to make a decision, and how far it can expand the meaning of the explicit text of the law.

Secondly, the 2020 and this week's decisions represent an ongoing trend in internet regulation. This kind of decision creates artificial boundaries and effectively fragments the internet into country-bounded silos. From a human rights perspective, internet fragmentation makes the free flow of information lesser off. From a business perspective, it makes the scalability of aggregators and platforms lesser off. From a technology perspective, it's unclear how an information-sharing business could enable European users to communicate with users in foreign countries without the risk of foreign governments surveilling their communications. That is especially true given how vocal European authorities have been about their dislike of end-to-end encryption.

The Meta fine, uncertainty, and internet fragmentation