By TechThop Team
Posted on: 12 Aug, 2022
The latest twist in a long-running data protection complaint saga related to a clash between U.S. surveillance laws and EU privacy laws has saved Facebook from being forced to shut down its service in Europe this summer.
Other regional DPAs who have been reviewing the draft order by Facebook's lead data protection authority have objected to it, delaying what was expected to be a suspension order. This development was reported earlier by the Irish Business Post.
Data controllers in affected regions are allowed to weigh in on draft decisions under the Data Protection Regulation (GDPR), which requires cooperation and at least consensus among them in cross-border complaints.
There have been some objections from Data Protection Authorities in this case, according to Graham Doyle, deputy commissioner of the Irish Data Protection Commission.
To resolve the issues raised, we will engage with the relevant authorities to assess the objections. Doyle couldn't provide specific details of the objections received.
Facebook's service in Europe will likely remain dormant for several more months. The development means the neverending saga over the legality of Facebook's data transfers will continue for several more months.
It took around nine months for a final decision on a previous cross-border GDPR complaint concerning WhatsApp, in which objections were raised to Ireland's proposed enforcement.
In addition, Meta will most likely challenge a suspension order in the Irish courts, and could also seek a stay, as it did previously, to continue to operate as usual. A preliminary suspension order was sent by the DPC in September 2020 over Facebook's data transfer issue - triggering a legal challenge.
Despite winning a stay, Facebook's judicial review challenge of the regulator's decision was rejected in May 2021, reviving the enforcement process - which has since ground on for years. In light of the objections to its draft, the DPC declined to comment on an expected timeframe for issuing a final decision.
As a matter of fact, that will depend on whether DPAs can settle differences on enforcement without the need for a formal dispute resolution mechanism under the GDPR, which can trigger an intervention by the European Data Protection Board.
The possibility of a final decision pushed into 2023 is not beyond the bounds of possibility if the DPAs cannot agree among themselves.
According to Max Schrems, the privacy campaigner and lawyer who lodged the initial complaint over Facebook's data transfer practices, enforcing any suspension order will be delayed considerably - particularly if Meta appeals.
Because Facebook may be banking on a new data transfer agreement between the EU and the U.S. landing, the tech giant may be under a lot of pressure to delay enforcement as long as possible.
It was announced in March that a new high-level agreement between the EU and the U.S would replace the defunct Privacy Shield on data transfers. European Commission earlier this year suggested it could be finalized this year.
The progress toward an agreement may not be as smooth as expected, so a replacement deal may not come as quickly as it had hoped. This would complicate Meta's ‘strategy’ of waiting for further delays to enforcement to buy time for switching to a new, unchallenged legal basis for European data transfers.
In the case of the latter outcome, the whole game of legal and regulatory whack-a-mole would be reset yet again. In other words, this saga may continue for years to come.
For more stories like this
Explore our website