Meta Fined €1.2 Billion for GDPR Violation: EDPB's Landmark Ruling Sends a Strong Message

In a significant development, the European Data Protection Board (EDPB) has dealt a hefty blow to Meta, imposing a massive fine of €1.2 billion for violating the General Data Protection Regulation (GDPR). This staggering penalty marks the largest ever issued under the European GDPR.

Meta, formerly known as Facebook, stands accused of flouting the requirements stipulated in the pan-EU regulation that governs the transfer of personal data to third countries. The company allegedly failed to ensure adequate safeguards to protect individuals' information during these transfers. As part of the penalty, Meta has been directed to halt the export of user data from the European Union to the United States for processing, as per the GDPR guidelines .

The EDPB's decisive action underscores the seriousness of Meta's transgressions. By breaching conditions in a regulation that applies to data transfers on a systematic, repetitive, and continuous basis, the company's actions have raised concerns. Given the substantial user base of Facebook across Europe, the scale of personal data involved in these transfers is massive. This unprecedented fine sends a strong message to organizations, making it clear that severe violations come with far-reaching consequences.

In revealing the penalty, Andrea Jelinek, the Chairman of the EDPB, made it clear that Meta's violation was a significant breach, saying:

“The EDPB found that Meta IE’s infringement is very serious since it concerns transfers that are systematic, repetitive, and continuous. Facebook has millions of users in Europe, so the volume of personal data transferred is massive. The unprecedented fine is a strong signal to organisations that serious infringements have far-reaching consequences.”

On April 13, 2023, the EDPB issued a binding decision, directing the IE DPA (Irish Data Protection Authority) to revise its draft decision and levy a fine against Meta.

“Given the seriousness of the infringement, the EDPB found that the starting point for calculation of the fine should be between 20% and 100% of the applicable legal maximum. The EDPB also instructed the IE DPA to order Meta IE to bring processing operations into compliance with Chapter V GDPR, by ceasing the unlawful processing, including storage, in the U.S. of personal data of European users transferred in violation of the GDPR, within 6 months after notification of the IE SA’s final decision,” Jalinek added.

Empowering Data Protection and Privacy in the EU and EEA

The General Data Protection Regulation (GDPR) stands as a crucial regulation within EU law, safeguarding data protection and privacy rights for individuals in the European Union (EU) and the European Economic Area (EEA). With its foundation rooted in EU privacy law and human rights law, specifically Article 8(1) of the Charter of Fundamental Rights of the European Union, the GDPR holds immense significance.

Encompassing the transfer of personal data beyond EU and EEA boundaries, the GDPR's primary objective is to amplify individuals' control over their personal data while streamlining the regulatory landscape for international businesses.

In 2019, Nigeria introduced the National Data Protection Regulation (NDPR), taking inspiration from the GDPR's framework. The aim behind the NDPR was to safeguard the data of Nigerian citizens. However, despite its introduction, the implementation of this regulation has yielded limited results, prompting calls for a comprehensive data protection law.

The Need for a Substantive Data Protection Law

Due to the challenges faced in effectively implementing the NDPR, there is a growing demand for a substantive data protection law in Nigeria. Such a law would provide a robust and comprehensive framework to protect the privacy and data rights of Nigerian individuals. By emulating the GDPR's principles and adopting best practices, a substantive data protection law could enhance data security, promote trust, and bolster Nigeria's position in the global digital landscape.

As Nigeria moves forward, there is a pressing need to prioritize the development and enactment of a substantive data protection law to ensure the effective protection of citizens' data and align with global standards in data privacy and security.