So last week, the Irish privacy watchdog, acting on its own initiative, informed its counterparts of plans to halt Facebook parent company Meta from transferring personal data from the EU to the U.S.
The draft decision follows legal proceedings on the lawfulness of Meta's EU-U.S. transfers in the wake of the Court of Justice of the European Union's "Schrems 2" decision. Following on the heels of the recent Google Analytics decisions in Austria and France, this is the next act in the Greek tragedy of international data transfers from the EEA to notably the US following the annihilation of the EU-US Privacy Shield.
Rather alarmingly, Politico raises the spectre of a near future in which our ability to share summer holiday pictures with friends and family via Facebook or Instagram may be severely compromised.
In truth, things may not unravel quite as fast as all that. The GDPR does not allow national DPA’s to operate in a vacuum. The Irish DPA may be the lead authority (by virtue of Meta’s ‘main establishment’ in that country), in cases of cross-border processing it is required to observe the rules on cooperation as described in Article 60 and following of the Regulation.
The essence of this cooperation procedure is exactly what happened this week: the supply of a draft decision by the lead authority (Ireland) to other concerned DPA’s (i.e. the DPA’s of all other Member States in this case), which may trigger comments, a ‘reasoned objection’ from another DPA or simply agreement to the draft decision.
According to Max Schrems himself (who lit the fuse to the privacy powder keg that became Schrems 2 two years ago), it is to be expected that other DPA’s will in fact have substantial comments to be dealt with. This would then trigger further procedural steps to be taken and (depending on the outcome) could activate the consistency mechanism of Article 65 and, ultimately, a final binding decision by the Eu
ropean Data Protection Board (EDPB). If that (likely) scenario transpires, half a year may easily pass without a final decision in this matter.
Rather than a real threat to the availability of our Facebook walls, the events put in motion by the Irish DPA draft could be a catalyst for the Privacy Shield negotiations, the conclusion of which is already long overdue in the minds of many international companies.
Let’s hope for a “like” on that.