Meta slapped with $1.3 billion fine for sending EU user data to the U.S.

Facebook's parent company Meta has been fined 1.2 billion euro ($1.3 billion) for breaching the European Union's data protection rules.

The issue revolves around the way Facebook handled European user data. According to Ireland's Data Protection Commission (DPC), which announced the results of its inquiry into Meta Ireland on Monday, Facebook's transferring of user data from Europe to the U.S. was in breach of Europe's General Data Protection Regulation (GDPR) rules.

In a nutshell, when Facebook takes personal data from its customers in the EU, and transfers it over to the U.S., the data can potentially be shared with U.S. intelligence services. A deal called the Privacy Shield used to allow free transfer of EU user data to companies in the U.S. until 2020, when the EU's Court of Justice determined it didn't really protect EU users' data from U.S. surveillance. But Facebook continued to transfer EU users' personal data even after the Privacy Shield was invalidated, thus triggering the inquiry by the EU's regulators.

With this fine, Facebook will be the unwilling record-holder for the biggest ever fine handed by the EU, surpassing Amazon which was slapped with an $886 million fine over (surprise) a GDPR breach in 2021. According to Euronews, Meta plans to appeal the decision.

The DPC also banned Facebook (but not other Meta companies such as Instagram) from transferring users' personal data to the U.S. in the future. The company now has five months until it has to stop the data transfers, and six months until it has to delete the data it's already sent.

Meta previously said it might be forced to shut down Facebook and Instagram in Europe if the company is rendered unable to send user data to the U.S. But this might be averted if the EU and U.S. manage to reach a new agreement on data transfers from the EU to the U.S., which could happen over the next couple of months.