Facebook owner granted stay on order that it suspend Europe-US data transfers

Facebook owner Meta has been granted a short stay by the High Court on a decision that it must suspend the transfer and storage of user data from Europe to the United States.

Last month, the Data Protection Commission (DPC) fined Meta Platforms Ireland Ltd €1.2 billion and ordered it to cease unlawful processing and storage of personal data of millions of European Economic Area (EU countries along with Norway, Iceland and Liechtenstein) Facebook users.

That decision followed a successful legal challenge by Austrian privacy campaigner Max Schrems over concerns that EEA users’ data is not sufficiently protected from US intelligence agencies when it is transferred across the Atlantic.

While Meta updated its contractual terms with users following the Schrems decision, the DPC found these arrangements did not address the risks to the fundamental rights and freedoms of data subjects in accordance with a European judgment in that case.

Following an inquiry, the DPC issued orders that Meta suspend the data transfers and cease the processing and storage of the data.

Meta said the decision meant it would have to cease providing its Facebook service to EEA users by next October 25th and after that it willwould have to permanently delete all their accounts.

As a result, on Friday it sought leave from Mr Justice Denis McDonald, with only the Meta side represented, to bring judicial review proceedings challenging what it says is the DPC’s unlawful decision.

The judge said he was satisfied Meta established arguable grounds for the relief sought. He was satisfied to grant leave to bring judicial review proceedings on notice to the DPC.

He said the case could come back on June 19th.

Declan McGrath SC, for Meta, then asked the judge for an interim stay on the DPC decision because of the financial losses his client would incur without it.

The judge said he was only prepared to grant a stay, until June 19th, but stressed that in doing so it did not call into question the validity of the DPC. His order only meant Meta had established arguable grounds to suggest the decision is invalid, he said.

In an affidavit, Meta Ireland director and head of office Anne O’Leary said that suspending Facebook for hundreds of millions of EEA users – or even telling them suspension would occur – would result in the loss of a very significant number of users and advertisers to competing platforms.

She said the damage would begin to occur even before the October date when the orders are to take effect and would increase significantly once users were notified of the impending suspension and deletion of accounts.

Without a stay, she said, the estimated revenue loss would be about $714 million (€664 million).

Ms O’Leary said the US government and the European Commission had reached an agreement on a new framework for transatlantic data flows (known as the Adequacy Decision) and it was likely the EU would have that framework in place shortly.

In the event of an unexpected delay in the Adequacy Decision coming into effect, Meta would find itself having to suspend and engage in the “irreversible bulk deletion” of user data, which would have a massive impact on users, she said.

Without a stay on the DPC decision, she said, millions of users would be unable to connect with friends and family across the globe and millions of businesses would no longer be able to use Facebook to sell goods and services.

It would also have serious adverse consequences for Meta’s 4,700-strong EU workforce, including 4,470 in Ireland, she said.

Ms O’Leary said a significant factor in the balance of interests in this matter was that Meta Ireland was just one of many communications and technology businesses and organisations that transfer EEA personal data to the US.

Despite this, as far as Meta is aware, the DPC had not commenced own-volition inquiries or taken any steps to prevent the transfer to the US by these other businesses, she said.