The European Data Protection Board (EDPB) announced that Meta, Facebook's parent company, has been fined a record EUR 1.2 billion (~USD 1.3 billion) for exporting EU users' personal data to the US without sufficient protections. The EDPB has also formally ordered Meta to cease all transfers of user data to the US.

Formally issued by the Irish Data Protection Commission (DPC; Meta’s EU regulator), the fine has been imposed for a breach of conditions set out in Chapter V of the European General Data Protection Regulation (GDPR), which outlines adequate protections for personal data transferred outside of the EU. EU Judges have previously ruled that US data surveillance practices conflict with the GDPR.

Meta plans to appeal the ruling, claiming the issue stems from a conflict between EU and US privacy laws and not its own policies. The US and EU are currently negotiating a data privacy framework.

The Irish DPC was originally not in favor of the ruling, disagreeing with other EU regulators and requiring an EDPB inquiry which has lasted since August 2022.

Prior to this ruling, Meta has been fined nearly EUR 1 billion (~USD I.077 billion) by the DPC for GDPR violations since September 2021.