META Meta Platforms Inc

By Sam Schechner 

Facebook Inc. and other tech giants are awaiting an Irish ruling that could help determine whether, and how quickly, they have to suspend the flow of data about European Union residents to computer servers in the U.S.

In the balance is billions of dollars of business in the cloud-computing, social-media and advertising industries.

Ireland's High Court is expected to rule Friday on Facebook's bid to derail a preliminary decision on data flows that it received in August from Ireland's Data Protection Commission, the lead EU privacy regulator for Facebook and other companies that have their European headquarters in the country. The preliminary decision, which hasn't been finalized because of Facebook's procedural challenge, could force the social-media company to suspend sending personal information about EU users to Facebook's U.S. servers.

To comply, Facebook would likely have to re-engineer its service to silo off most data it collects from European users, or stop serving them entirely, at least temporarily. In a securities filing this year, Facebook said that applying the regulator's decision would "materially and adversely affect our business, financial condition and results of operations."

While Friday's court decision will be a procedural one, the underlying questions are central to trans-Atlantic trade and the digital economy. Legal experts say the logic in Ireland's provisional order could apply to other large tech companies that are subject to U.S. surveillance laws, such as cloud services and email providers -- potentially leading to widespread disruption of trans-Atlantic data flows.

Even if Facebook loses Friday, Ireland's Data Protection Commission still needs to finalize its draft decision ordering a suspension of data transfers and submit it to other EU privacy regulators for approval before it becomes effective. That process could take months, before counting any further court challenges.

The Wall Street Journal reported on Ireland's preliminary privacy decision in September. Facebook challenged the decision in court days later, arguing that the regulator had suggested a preliminary conclusion too hastily, without awaiting guidance from other EU regulators.

The preliminary decision was the first significant step EU regulators had taken to enforce a July ruling from the bloc's top court about data transfers. That ruling restricted how companies like Facebook could send personal information about Europeans to the U.S., because it found that Europeans had no effective way to challenge American government surveillance.

How Ireland's Data Protection Commission enforces the ruling is being closely watched, because it leads EU privacy enforcement for several other big tech companies, including Alphabet Inc.'s Google, Apple Inc. and Twitter Inc., which have their European headquarters in the country.

Friday's decision will come as countries world-wide increase measures to take control of where data flows. Last year, the U.S., under former President Donald Trump, attempted to force the Chinese parent of video-sharing app TikTok to divest the company to prevent data on American users being shared with Beijing. The plan was shelved under President Biden.

After the EU's Court of Justice decision last summer, tech lobbyists initially signaled optimism that data flows might remain largely unaffected, with only contractual changes necessary. But since then, EU regulators, in addition to Ireland, have started issuing orders to suspend some data transfers. In April, Portugal's privacy regulator ordered the national statistics agency to stop sending census data to the U.S., where it was being processed by Cloudflare Inc.

Orders, even if only preliminary ones, to stop sending data to the U.S. are a major shift in more than two decades of wrangling over how to balance privacy and commerce when it comes to trans-Atlantic data flows. In 2015, the EU's top court invalidated a major legal mechanism for transferring such information to the U.S. But the threat ended up being mostly theoretical: No company faced a specific order to stop sending personal information, and the data flows never stopped.

Now, some lawyers say resolving the issue could require changes to U.S. surveillance laws to give more legal rights to Europeans. It could also become a spur for the U.S. to adopt broader privacy legislation.

"With trans-Atlantic data flows vital to both economies, the EU cannot afford to become a data island, nor the U.S. a data pariah," Cameron Kerry, a former general counsel and acting secretary of the U.S. Department of Commerce, said earlier this year.

If the Irish Data Protection Commission prevails in Friday's decision, the process to finalize its preliminary decision could restart. The commission had given Facebook until roughly mid-September to file its response, according to people familiar with the matter.

After that, the commission had told Facebook it would submit a draft order to other EU regulators, the people said. That approval process could take several months before the decision -- and its order to suspend data flows -- would become final.

Write to Sam Schechner at sam.schechner@wsj.com

(END) Dow Jones Newswires

May 14, 2021 05:28 ET (09:28 GMT)

Copyright (c) 2021 Dow Jones & Company, Inc.