Facebook has avoided the risk of being forced to close its service in Europe this summer as a result of the latest twist in a long-running data protection lawsuit over a clash between EU privacy and US supervisory law.
The delay — in what is still widely expected to be a suspension order to Meta, Facebook’s parent company, to stop illegal data exports — follows objections to a draft decision from the lead data protection authority by other regional data protection authorities who have reviewed it.
The Irish business mail the development earlier.
Under the bloc’s General Data Protection Regulation (GDPR), cross-border complaints typically require cooperation and at least consensus from data protection authorities in the affected regions, so that interested authorities have the right to participate in draft decisions of a lead data controller.
“We have received some objections in this case from a small number of data protection authorities,” confirmed Irish Data Protection Commission (DPC) deputy commissioner Graham Doyle. “We are currently assessing the objections and will engage with the relevant authorities to resolve the issues that have arisen.”
Doyle declined to provide details of specific objections received.
The development means a final decision on the (seemingly) never-ending saga about the legality of Facebook’s data transfers — and the fate of its service in Europe — will be delayed for at least several more months.
In a previous cross-border GDPR complaint related to WhatsApp, which also raised objections to Ireland’s proposed enforcement, it took a total of about nine months for a final decision (and hefty fine) to be issued.
Meta is also very likely to challenge a suspension order in the Irish courts – and could also ask for a postponement, as before, to try to keep working as it is in the meantime.
In September 2020, the DPC sent a preliminary suspension order to Facebook over the data transfer issue — raising a legal challenge. Facebook won a suspension, but its attempt to reverse the regulator’s decision through judicial review, challenging the proceedings, was ultimately rejected in May 2021, reinvigorating the enforcement process — which has continued to grind ever since.
The DPC declined to comment on an expected timetable for a final decision to be made in light of the objections to its draft.
That will, in any case, depend on whether differing views on enforcement between DPAs can be resolved without the need for a formal dispute resolution mechanism in the GDPR – potentially requiring the European Data Protection Board to intervene (as happened in the WhatsApp case).
If DPAs can’t come to an agreement among themselves and the EDPB has to get involved, it’s not beyond the realm of possibility that a final decision will be pushed into 2023.
Max Schrems, the privacy activist and attorney who originally raised Facebook’s data transfer complaint (all the way back in 2013!), has said he expects significant further delays in executing a suspension order — including by Meta on appeal. to go – as we reported earlier.
The tech giant has a specific incentive to delay enforcement as long as possible, as it may be counting on (or hoping for) a new EU-US data transfer deal to save Facebook’s service in Europe.
A preliminary agreement on a new EU-US high-level agreement on data transfers – replacing the defunct Privacy Shield (which has so far been a very tangible victim of this Facebook complaint about data transfers so far; its predecessor Safe Harbor is another) – was reached in March. And earlier this year, the European Commission suggested it could be completed by the end of this year.
Since then, some reports have suggested that progress in agreeing on a final text may not be as smooth as hoped, so a replacement deal may not be coming anytime soon – which would complicate Meta’s “strategy” (if we can call it that) to further banking enforcement delays giving it sufficient time to convert its European data transfers to a new undisputed legal basis.
The latter outcome would, of course, reset the whole game of legal and regulatory whack-a-mole. So, it’s possible that this saga could last for years, plural…