Meta, Google, other American tech giants face EU data blackout as ruling looms on their contracts to transfer vast amounts of user information to US
- Ireland’s Data Protection Commission is soon to weigh in on the legality of so-called standard contractual clauses
- These contracts are used by Facebook parent Meta, Alphabet’s Google and other tech giants to legally transfer swathes of user data to the US for processing
Privacy experts said the imminent decision could eliminate one of the only remaining options for Meta and potentially thousands of other companies that rely on shipping vast amounts of commercial data across the Atlantic.
The Irish authority already cast doubt on the legality of the SCCs in an interim opinion, saying they failed a key test of protecting European citizens from the prying eyes of US agencies.
Facebook generated US$8.2 billion, about 25 per cent of its global revenue, in Europe over the December quarter. While the UK will count for a significant portion of that and will not be affected by the ruling on SCCs, the region is a serious moneymaker for Meta, beaten only by its home market of the US and Canada.
Meta’s business model, like that of Alphabet’s Google, relies on collecting enough data to discern what users might be interested in or want to purchase, and to serve them relevant advertisements. The company is already hampered by Europe’s privacy rules and a ban on SCCs would likely make its business model more expensive and less effective to run.
“What’s at stake here are the entire data transfers to the US and the services that depend on them,” said Johannes Caspar, an academic who recently stepped down as one of Germany’s top data protection regulators.
Despite its latest comments in its annual report that it would “likely be unable” to offer Facebook and Instagram in Europe if regulators ruled that SCCs were unfeasible, Meta has also stated – most recently in a blog post – that it is “absolutely not threatening to leave Europe”, a plea that former UK Deputy Prime Minister Nick Clegg, now Meta’s president of global affairs and communications, originally made in September 2020.
Meta declined to comment.
Google pointed to a January blog post by Kent Walker, its head of global affairs, which called for a rapid end to the impasse over a replacement to a EU-US privacy pact that was struck down by the EU’s top court in 2020 over long-standing fears that citizens’ data was not safe from American surveillance.
“The stakes are too high – and international trade between Europe and the US too important to the livelihoods of millions of people – to fail at finding a prompt solution to this imminent problem,” Walker said.
A surprise 2020 ruling by the EU’s highest court toppled the so-called Privacy Shield, a transatlantic transfer pact, over concerns about American surveillance.
But while the separate, contract-based system was upheld, the EU Court of Justice’s doubts about American data protection already made this a shaky alternative.
Beyond Europe’s GDPR: how Beijing has forged a formidable data regime
“For many companies it is virtually impossible to fully comply” with the 2020 EU court ruling, said Tom De Cordier, a technology and data protection lawyer at CMS DeBacker in Brussels. “So, often it is a matter of mitigating your data compliance risks rather than trying to be 100 per cent compliant.”
Should the Irish authority double down on its interim opinion over the contractual clauses, the doomsday scenario for Meta and its rivals of a tech blackout has started to emerge.
The Irish authority’s decision “could now be a precedent which will cause the whole situation to slide”, former German regulator Caspar said. “It’s up to politicians in the US to avoid plunging their tech industry into chaos.”
