Facebook Faces Irish Ruling on Suspension of EU-U.S. Data Flows
May 14 2021 - 5:43AM
Dow Jones News
By Sam Schechner
Facebook Inc. and other tech giants are awaiting an Irish ruling
that could help determine whether, and how quickly, they have to
suspend the flow of data about European Union residents to computer
servers in the U.S.
In the balance is billions of dollars of business in the
cloud-computing, social-media and advertising industries.
Ireland's High Court is expected to rule Friday on Facebook's
bid to derail a preliminary decision on data flows that it received
in August from Ireland's Data Protection Commission, the lead EU
privacy regulator for Facebook and other companies that have their
European headquarters in the country. The preliminary decision,
which hasn't been finalized because of Facebook's procedural
challenge, could force the social-media company to suspend sending
personal information about EU users to Facebook's U.S. servers.
To comply, Facebook would likely have to re-engineer its service
to silo off most data it collects from European users, or stop
serving them entirely, at least temporarily. In a securities filing
this year, Facebook said that applying the regulator's decision
would "materially and adversely affect our business, financial
condition and results of operations."
While Friday's court decision will be a procedural one, the
underlying questions are central to trans-Atlantic trade and the
digital economy. Legal experts say the logic in Ireland's
provisional order could apply to other large tech companies that
are subject to U.S. surveillance laws, such as cloud services and
email providers -- potentially leading to widespread disruption of
trans-Atlantic data flows.
Even if Facebook loses Friday, Ireland's Data Protection
Commission still needs to finalize its draft decision ordering a
suspension of data transfers and submit it to other EU privacy
regulators for approval before it becomes effective. That process
could take months, before counting any further court
challenges.
The Wall Street Journal reported on Ireland's preliminary
privacy decision in September. Facebook challenged the decision in
court days later, arguing that the regulator had suggested a
preliminary conclusion too hastily, without awaiting guidance from
other EU regulators.
The preliminary decision was the first significant step EU
regulators had taken to enforce a July ruling from the bloc's top
court about data transfers. That ruling restricted how companies
like Facebook could send personal information about Europeans to
the U.S., because it found that Europeans had no effective way to
challenge American government surveillance.
How Ireland's Data Protection Commission enforces the ruling is
being closely watched, because it leads EU privacy enforcement for
several other big tech companies, including Alphabet Inc.'s Google,
Apple Inc. and Twitter Inc., which have their European headquarters
in the country.
Friday's decision will come as countries world-wide increase
measures to take control of where data flows. Last year, the U.S.,
under former President Donald Trump, attempted to force the Chinese
parent of video-sharing app TikTok to divest the company to prevent
data on American users being shared with Beijing. The plan was
shelved under President Biden.
After the EU's Court of Justice decision last summer, tech
lobbyists initially signaled optimism that data flows might remain
largely unaffected, with only contractual changes necessary. But
since then, EU regulators, in addition to Ireland, have started
issuing orders to suspend some data transfers. In April, Portugal's
privacy regulator ordered the national statistics agency to stop
sending census data to the U.S., where it was being processed by
Cloudflare Inc.
Orders, even if only preliminary ones, to stop sending data to
the U.S. are a major shift in more than two decades of wrangling
over how to balance privacy and commerce when it comes to
trans-Atlantic data flows. In 2015, the EU's top court invalidated
a major legal mechanism for transferring such information to the
U.S. But the threat ended up being mostly theoretical: No company
faced a specific order to stop sending personal information, and
the data flows never stopped.
Now, some lawyers say resolving the issue could require changes
to U.S. surveillance laws to give more legal rights to Europeans.
It could also become a spur for the U.S. to adopt broader privacy
legislation.
"With trans-Atlantic data flows vital to both economies, the EU
cannot afford to become a data island, nor the U.S. a data pariah,"
Cameron Kerry, a former general counsel and acting secretary of the
U.S. Department of Commerce, said earlier this year.
If the Irish Data Protection Commission prevails in Friday's
decision, the process to finalize its preliminary decision could
restart. The commission had given Facebook until roughly
mid-September to file its response, according to people familiar
with the matter.
After that, the commission had told Facebook it would submit a
draft order to other EU regulators, the people said. That approval
process could take several months before the decision -- and its
order to suspend data flows -- would become final.
Write to Sam Schechner at sam.schechner@wsj.com
(END) Dow Jones Newswires
May 14, 2021 05:28 ET (09:28 GMT)
Copyright (c) 2021 Dow Jones & Company, Inc.
Meta Platforms (NASDAQ:META)
Historical Stock Chart
From Aug 2024 to Sep 2024
Meta Platforms (NASDAQ:META)
Historical Stock Chart
From Sep 2023 to Sep 2024