Ireland’s Data Protection Commission has told Facebook to suspend transfers of data on EU customers to the US, people familiar with the matter told the Wall Street Journal. The preliminary order was sent late last month, asking for the company’s response after an EU court ruled the Privacy Shield protecting EU-US data transfers was no longer valid.
To comply with Ireland’s preliminary order, Facebook would likely have to re-engineer its service to silo off most data it collects from European users, or stop serving them entirely, at least temporarily. If it fails to comply with an order, Ireland’s data commission has the power to fine Facebook up to 4 percent of its annual revenue.
Nick Clegg, Facebook’s top policy and communications executive in Europe, confirmed that Ireland’s privacy regulator has suggested, as part of an inquiry, that Facebook can no longer in practice conduct EU-US data transfers using a widely used type of contract.
Ireland’s Data Protection Commission declined to comment.
Clegg said in a statement for the company that Facebook was relying on standard contract clauses (SCCs) to continue the data transfers. The EU court upheld the use of such instruments if the parties involved could ensure the data was protected to EU standards. Facebook "has been working hard" to follow the steps set out by the court to maintain data flows, Clegg said. This includes "ensuring that we have robust safeguards in place, such as industry standard encryption and security measures, and comprehensive policies governing how we respond to legal requests for data."
He confirmed that the Irish Data Protection Commission is investigating such practices at Facebook and has suggested that SCCs cannot in practice be used for EU-US data transfers. "While this approach is subject to further process, if followed, it could have a far reaching effect on businesses that rely on SCCs and on the online services many people and businesses rely on," Clegg said.
Clegg said Facebook said it supports the development of new global standards on personal data handling and noted the EU and US are already in talks on developing a new form of the Privacy Shield.
