That Meta GDPR fine is €1.2B. Plus biz must stop sending EU data to US

Ireland's Data Protection Commission (DPC) has levied a new record GDPR fine against Facebook parent company Meta for 'systematic, repetitive and continuous' transfer to the US of data belonging to EU residents. The record €1.2 billion ($1.3b) fine comes along with a decision that Meta will have to suspend data transfers from …

[steelpillow]

Honest question

So if meta decide to fsck the EU, how can they be stopped? "Our assets in the EU are less than the fine. Easier to let them go and leave the EU go figure how to deprive its citizens of the freedom to stick with us."

Now, I know the "honest question" phrase draws downvotes like a rotting skunk draws maggots, but hey, an apt simile is an apt simile so let's go with it.

[Lee D]

Re: Honest question

"You now cannot process EU credit cards, bank transfers, process EU salaries, accept advertising from the EU, do business inside the EU, nor claim to do so."

If you think they'll just shrug that off, I assure you that you don't understand how they make that money.

Their assets in the EU are neither here nor there when 50%+ of their income is literally barred overnight.

Not even Microsoft (convicted) or other large companies were dumb enough to just bow out of the EU entirely. They all end up complying. Because the alternative is that you literally cannot accept money from the EU because the EU banks will refuse all such transactions. A bit like trying to buy Bitcoin using certain UK bank accounts... ever tried to do so? It just gets blocked.

[mpi]

Re: Honest question

> how can they be stopped

Good question. Let me answer with another one: Can Meta afford to lose all users in the EU?

Because, the Union absolutely has the power to simply block services if they want to: https://gizmodo.com/chatgpt-ai-openai-italy-bans-chatgpt-investigate-openai-1850287210

Now, that would suck for the users, sure. But I have a hunch that it would suck even more for the people who have to explain to the board at Meta, why they suddenly lost every single user in the 3rd largest economy in the world.

[Doctor Syntax]

Re: Honest question

It would suck even more for the board explaining it to shareholders.

[Anonymous Coward]

Re: Honest question

The board is Zuck, and the shareholders is also Zuck, so no proiblem there...

[abend0c4]

Re: Honest question

Don't know why that got voted down. It's a very special kind of corporation in which Zuckerborg has a trump card when it comes to voting: shareholders have no meaningful control.

[Michael Wojcik]

Re: Honest question

Shareholders have no control, but they can sell shares, depressing the stock price, reducing equity and raising the cost of borrowing. A significant shareholder revolt could hurt Meta, in principle.

In practice, there won't be one. Institutional investors mostly move slowly, and Meta have the capital to pacify them with buybacks (or dividends, in theory, but dividends are passé). Unmanaged funds, such as index funds, that hold Meta shares buy and sell according to their rules, not sentiment. Big activist investors generally retain their holdings in the hope of having influence.

[MachDiamond]

Re: Honest question

" (or dividends, in theory, but dividends are passé)"

Everything our family trust holds pays dividends and we do pretty well doing it that way. Day trading is way too much work to try and glean a few pence a share can be frustrating. I see it as a tortoise and hare thing and we're quite low to the ground, our family.

[martinusher]

Re: Honest question

I don't like Facebook......

.....but I really abhor bureaucrats that act as prosecutor, judge, jury and executioner. There's something seriously wrong with 'due process' here, it looks more like a shakedown than a legal process.

[MyffyW]

Re: Honest question

No - given the bureaucratic to-and-fro it looks very much like a legal process to me. The sort a certain Franz Kafka wrote about in The Trial

Makes you proud to be European.

[Anonymous Coward]

Re: Honest question

You are referring to the fact that the Irish didn't fine Facebook and others before that when they blatantly broke the laws?

(explaining why this time the other countries started complaining loudly...)

[Elongated Muskrat]

Re: Honest question

I really abhor bureaucrats that act as prosecutor, judge, jury and executioner

As opposed to, say, a public prosecutor, and a judge. As far as I'm aware, no execution is on the cards, more's the pity.

As far as I can tell, the due process has been followed, which goes along the lines of a regulation being passed, it making its way into national law in member nations, an organisation being in breach of those laws, a national data protection agency neglecting to prosecute them, the bloc-wide regulator noticing this, and prosecuting in their stead, the company being found guilty, and being fined. Something like that. No star chambers, no "bureaucrats," whatever they are, and no avoidance of due process.

Now we turn to the next question in turn; who, or what, are you actually referring to when you throw around shibboleths like "bureaucrats"? I ask, because it's also thrown around in the company of words like "sovereignty," "taking back control," "migrant swarms," and all that other xenophobic bollocks, and often signifies an underlying lack of ability to think clearly and reasonably.

[Justthefacts]

Re: Honest question

You are holding two mutually incompatible beliefs in your head at the same time:

#1 Facebook are evil, because their entire business model depends on using people’s personal information, from which they earn billions via advertising, and that personal information isn’t theirs, it’s ours, so that’s theft.

#2 If we stop Facebook keeping and using our personal information, they will comply to continue in business, because they don’t want to lose the billions they are earning.

Can you see the logical problem with that? Once you stop Facebook storing personal information *there is nothing more for them to lose*.

There is literally no revenue at all for the business they have without that personal info. They could be a conventional online advertising business, but there are plenty of businesses already in that niche, Facebook has nothing. A list of personal info is literally what FB *is*. There may be *other* business models (although….nobody else has found one, otherwise they’d be in it), but whatever, that’s not Facebook.

That’s why they have shown no interest at all in complying. They have literally nothing to give here. If the EU choose to confiscate all FB assets in the EU, well sad, weepy face. But there’s no action for Facebook to take. I suppose they could engage a fire-sale, offering their entire European business as a going concern to….who? Who would pay them for it? Waste of management time to analyse this. If the business is done, it’s done, shut the doors, get as much cash out as possible, and concentrate on business outside EU.

[sabroni]

Re: Once you stop Facebook storing personal information......

The problem is where they store the information. They're not being told they can't have EU users, they're saying EU user informationhas to stay in the EU.

Read the fucking article.

[Justthefacts]

Re: Once you stop Facebook storing personal information......

I have read the article. The EU request to store the data in the EU is….well, interesting. Obviously, no company is going to do that. They weren’t going to do that before, and they’re *certainly* not going to do that now. It would be madness, in light of events. If somebody confiscates a billion euros from you in one jurisdiction,, and says “I’m going to confiscate another billion, unless you put another asset of even larger value within my control”, are you really going to comply? Then, they’d just confiscate it all. You’d have to be a total idiot.

It’s not just the data, the EU have insisted to put all the infrastructure into the EU too. Facebook would be spending couple billion of their own money to make it a completely going concern, fully independent, replicating FB and it’s profitability and user-base, inside the EU. Then in a couple years, once it’s all up and running, EU Commission just make a new rule forbidding “US HQ control” of such a “market dominant entity” etc, etc. Appeasement is always the wrong approach in these things. If you have to shoot your own foot off to escape the bear trap, do it before the bear is ten feet away.

[The Dogs Meevonks]

Re: Once you stop Facebook storing personal information......

Even your username is an oxymoron

[Elongated Muskrat]

Re: Once you stop Facebook storing personal information......

So what you are saying, is that you find the requirement (note: not request, but requirement by law) for personal information on EU citizens not to leave the EU for processing "interesting". Plenty of companies can manage that. The only reason to transport that data outside of the EU, where this company does have the infrastructure and ability to process it, would be to do something with that data that is not permitted under EU law, within the EU. Such as, for example, profiling a person's interests and selling that data on, without allowing the data subject access to that data, or recourse to have it corrected or deleted at their request. In other words, completely circumventing the point of data protection legislation in the first place, and going for the US model of "free for all, we own data about you, not you, and call flog it to the highest bidder". Add to that, the ability of the US government, under its own laws, to take control of any data held in its jurisdiction, under the auspices of "preventing terrorism" or some other such total bollocks, without the subject ever knowing, and the prospect of having any of my data held in the US, in the hands of a foreign power, and political entities of which I am probably not even aware, and certainly do not trust, becomes ever more terrifying.

this, I find "interesting", and by "interesting", I mean "backwards, and offering no protection to the citizenry". US adventurism of this type can fuck right off.

Oh, and the EU Commission doesn't "just make new rules". Any such power grab, as you describe, would require assent from all the member nations, and I think that, even for the more feverishly authoritarian amongst them (*cough* Hungary *cough*) that is a bit of a stretch of the imagination. All you have demonstrated with that bit of whataboutery is that you don't have a clue about what the EU Commission (and Parliament, and Council) is, or does.

[Justthefacts]

Re: Once you stop Facebook storing personal information......

The “keep data within jurisdiction” requirement in and of itself, seems fine. But to pretend that is what we are talking about, for FB, Google, Twitter etc, is just dishonest. This is a trade war, between US and EU Commission, let’s call it what it is. If this were really a dry question of data architecture, nobody would get steamed up about it, it would be a purely technical question with a relatively simple solution.

“The only reason to transport that data outside of the EU, where this company does have the infrastructure and ability to process it, would be to do something with that data that is not permitted under EU law, within the EU”.

Rubbish. The more obvious (and correct) reason is precisely the same as why Schrems et al, want the *data* here, but flipped from the other sides POV. In this case, Facebook are concerned about the “data sovereignty” of their core IP, algorithm, and business processes. If they locate those in the EU, they perceive they would be subject to arbitrary confiscation of their EU operation as a going concern. Therefore, they want the mountain to come to Muhammet, not vice versa. Your disingenuous hoots of derision at their “naivety” that this is a valid risk, when they have teams of hundreds of lawyers steeped in thousands of man-years of experience in corporate law across multiple jurisdictions….suggests that it is you who is naive not they.

Oh, BTW, in a former life, I personally *drafted* significant sections of the EU legislation that you now venerate. On behalf of my employer, in consultation with the teams of corporate lawyers that you sneer at. I assure you, at no time did we consider or consult with “the assent of member nations”. We did consider and lobby the Commission rather a lot. That’s the way the game is played.

[Elongated Muskrat]

Re: Once you stop Facebook storing personal information......

I think you might be labouring under the misapprehension of what a trade war is, there.

The US isn;' trying to undercut foreign trade in personal data, and nobody is trying to add some sort of tariff to imports, which would be akin to a trade war.

In the EU, it is illegal to sell on people's personal data without their explicit informed consent, and with several provisos (such as the subject being able to get that data deleted at any time, and it only being collected for specific, named, purposes, which are necessary for a service the user has consented to).

In the US, it is "personal data, yum yum $profit $profit", the subject has no rights.

Clearly these two models are incompatible.

[Justthefacts]

Re: Once you stop Facebook storing personal information......

“In the US, it is "personal data…. the subject has no rights.”

Totally, totally wrong. In the US there are *many* rights and privacy laws, and in some cases much more stringent than EU. The difference is that the *boundaries* just don’t align, so you can’t really compare them like-for-like. For example, much legislation is based on sector, rather than generalised. Check out Gramm Leach Bliley for Finance and Banks; HIPAA for health; or FRCA for credit info. Also, plenty of the *states* have their own personal info and privacy laws (of which California is probably the most stringent!), rather than federal. Saying “the USA doesn’t have any laws on use of personal data” is just highly misleading, and verging on meaningless. It’s quite similar to saying “the EU has no law against murder”. While that’s technically *true*, it’s rather meaningless, because all its constituent nations do.

Ironically, that’s one reason why many US medical companies often want use data from EU studies at all. Because in many cases, EU allows *with explicit informed consent*, but under the pressure “if you don’t give consent, you don’t get the potentially life-saving treatment” so really what choice do you have. Whereas in the USA it would be illegal to incorporate that data into commercial product *irrespective of consent*. So yeah, it’s not that the US is “using EU like guinea pigs”, it’s that EU legislation is intrinsically more lax than US legislation for really fundamental constitutional reasons (the US recognises some rights as “inalienable”, which many other jurisdictions do not).

[doublelayer]

Re: Once you stop Facebook storing personal information......

No company would store EU data in the EU? Because Meta already does. They have a bunch of servers in three EU countries which are used, unsurprisingly, to store and process data for their EU business. There are lots of reasons to do so, from access speed to geographic redundancy. The problem they have is that they're also storing data elsewhere, which they do because they don't want to follow the other parts of the privacy legislation.

"If somebody confiscates a billion euros from you in one jurisdiction,, and says “I’m going to confiscate another billion, unless you put another asset of even larger value within my control”, are you really going to comply?"

It's a reasonable question, despite your post not really going that way. After all, other countries try the same tactic and I wouldn't comply with them. The calculation you have to make is whether it's worth it to you complying with all the local regulations in order to get the benefits from doing business in that location. I don't have a problem putting assets in EU jurisdiction because I support the privacy legislation and I trust EU governments to follow that legislation, only punishing people under that legislation if they break it. I would not comply with similar orders from a country like China because I don't support a lot of their regulations and I don't trust them to stick to the letter of the laws. Other companies might make that decision based on a more commercial view, hence all the companies that cheerfully censor for Chinese customers, but they're still using the same methods to decide whether they will comply. In Meta's case, they have a pretty complicated decision to make; if they don't move their assets out of the EU, continue to operate in the EU, and continue to violate the GDPR in some of the most obvious ways, nothing saves them from the possible fines. They'll have to change one of those three things, or accept the risk that they may not always be able to keep Ireland's regulator loyal to them and one that is following the law more actively could be costly.

[MachDiamond]

Re: Once you stop Facebook storing personal information......

"EU Commission just make a new rule forbidding “US HQ control” "

I have the feeling it's more about that information being somewhere subject to UK/EU disclosure/subpoena without there being fights over other international laws and regulations.

[martinusher]

Re: Honest question

Facebook are just a major intelligence collecting operation that we allow into our lives by clicking "OK" on their Terms of Service.

I miss out on a lot of life because I don't use it while practically everyone I know does. I have a dormant account from its earliest days, back when its notion of graphing relationships to learn about connections and trends was a novel concept (not really that novel -- that's how traffic analysis and other intelligence gathering tools work). When it was a toy, in fact. Since then we know that its a bit of a monster.

But I still don't agree with shakedowns like this. First of all, the notion of "US" and "EU" data is nonsense -- apart from personally identifiable information which should be kept secure regardless of the storage medium its kept on the idea that data has a national identity is meaningless. Secondly, that "GDPR" thing is the tool that myriad website operators use to get you to click through to 'enable all cookies' by fair means or foul -- its just another tool for coercion and as a result when I come across it unless I'm in a sterile situation I just click away from the site. Not interested. Its not protecting my data, its just enabling more collection but with the "but you said it was OK" catch (try "Managing your settings -- its laughable.)

Anyway, you're not going to get rid of Facebook et al for the foreseeable future because its an indispensable arm of government. The problem we have in the US is that the government actions are restricted and can be questioned in court. Our way around this irritation is to get private corporations (preferably offshore ones) to do the work for us. Win / Win! The same will apply in Europe -- it will be different because of local customer but you can bet that government will want unrestricted access to all that tasty data and, furthermore, you'll have absolutely no say over what's collected or what its used for (you'll just get the occasional 'mistake' like the ones made at the Coronation).

[MachDiamond]

Re: Honest question

#1 is true to a point but while advertising brings in some bucks, more is made from selling that PII or "sharing it with their partners" as they put it. If enough of your activities are recorded, the Big Data companies can make very good assumptions about you. Scary accurate in some cases.

[doublelayer]

Re: Honest question

What makes you think that their assets are less than the fine? Here's one problem related to that: they've put most of their assets into their Irish company so they aren't paying tax in the U.S. for revenue from users outside North America. That's not just their EU customers, but everybody outside the U.S. and Canada (I'm not really sure why Canada isn't included, but I'm no tax lawyer). That's a large chunk of their revenue stored in an EU member state. Unless they quickly move all of it away and find a new place to incorporate, they have plenty of assets there. They also have three DCs built inside the EU, and their investment figures for a single one is higher than their fine. While it's certainly possible that there's been some depreciation of those, if those three were liquidated, it would come to more than their fine amount.

Even without considering that they earn plenty from having customers in the EU and they don't want to lose it, they have plenty of assets that could be taken if it came to it. Your question may be based on faulty assumptions.

[steelpillow]

Re: Honest question

Thanks, as the OP that's the first rational reply to me that I have yet seen here.

But if the bulk of their assets are in Eire, how come they feel such a burning need to send all the EU citizen data to the US? Logically, yhey would be sending all the US citizen data for storage/processing in Eire.

[Elongated Muskrat]

Re: Honest question

Simply because, once in the US, the oversight and data protections afforded by the EU regulations, and the national laws that implement them, do not apply.

Facebook can then happily do all sorts of analytics on that data without having to worry about pesky things like leaking people's personal and private information. They can then make a wedge-load of cash by selling on that profiled data to advertising (or, more likely, by holding onto that profiled data and selling advertising "space" based on it). This is where all those creepy adverts for things you were talking about in private come from. For instance, I never once told FB that my wife is doing a specific training course for her career progression, but all of a sudden it is showing me lots of adverts for courses from training providers doing exactly that.

We should be concerned with exactly how much data is being vacuumed up by Facebook, from where, and where it is going. I can guarantee that there is something going on there with collecting data from somewhere other than just what you post on your account*, and you can be pretty certain that it is undergoing the sort of processing that would not be allowed in the EU (or, for now, the UK), in order to produce that lucrative targeting data for the advertisers. This is, after all, Facebook's main revenue stream - targeted ads.

*I suspect that there is some sort of microphone snooping going on, from anecdotal reports of adverts appearing related to spoken conversations. My money is on the microphone on people's phones being used in the background when the Facebook app is running, even as a background task, and this being streamed to a data centre in the US for speech recognition and analysis. Probably using that old chestnut "AI" to pick out relevant words and phrases, and to build some sort of categorisation profile that can be used to direct advertising. That's how I'd do it if I was completely immoral, and let's face it, nobody gets to be a billionaire by being ethical.

[steelpillow]

Re: Honest question

Thanks again. As for the scraping, I notice that in the run-our-cross-site-scripting-or-die offers to site builders, FB appear to come second after the Big G. "Log in with [evil empire]" being a prime example. Once those active cookies are downloaded, your browser and personal data are pwned. "Anonymised, honest Guv" of course. The buyer of advertising space never gets to know who Dr. Evil just spammed, I mean targeted, for them, but that is small comfort.

[Elongated Muskrat]

Re: Honest question

It's almost as if the big players have worked out the 3-legged OAUTH is quite tricky to implement correctly, so they've stepped in with, "here, buddy, let us do the authentication leg for you, no monetary cost, all you'll pay us in return is your immortal soul".

[MachDiamond]

Re: Honest question

"I never once told FB that my wife is doing a specific training course for her career progression,"

In a way you did. If you communicated anything about it through FB, there you go, but that's not where it ends. FB tracks you outside of what you do on their site as well if you've signed up. All of the fine print that you didn't bust out the electron microscope to read has you giving your permission. FB's customers will be part of a program where they can read ID cookies set by FB as a means to identifying you and making money by selling FB the data they glean from your activities. User's aren't FB customers, they're the product being served up.

[EvaQ]

Re: Honest question

Indict their board members and directors (including international search warrants), confiscate assets, forbid services in the EU.

That's more costly and annoying than paying a lousy billion (which is just a percentage of their profit)

[I could be a dog really]

Re: Honest question

As already mentioned, they can throw their toys out of the pram and refuse to pay the fines - then the EU can confiscate any EU held assets and order all service providers to block traffic to/from Meta. facebook goes offline in the EU - to which I'd be organising a street party.

And if FeacesBorg goes offline in the EU ? I'm sure there will be some entrepreneurs interested in filling the void, but doing it legally*. So suddenly not only does Facebook loose it's EU income stream, suddenly there's a very large market of people who want "something like facebook but which isn't Facebook", meaning that whoever steps in with an alternative shouldn't have too much problem growing a significant user base very quickly. And why should that alternative stop at wooing EU citizens ? People all around the world will be feeling cut off from their friends/relatives in the EU, so many of those will be happy to sign up for an alternative that keeps them in touch. That would be really bad news for Facebook as it would no longer be the de-facto monopoly provider like it is now - and that would be very bad news for them.

* Apart from keeping the data in the EU, they might choose to offer a "for a modest subscription, you can have the benefits without the creepy data slurpage and sale" option. Actually, facebook could do that and become law abiding - but they've gone so far down the "free to end users, just don't look at how you're actually paying" route, not to mention the endless lies and dishonesty, that I don't think anyone would believe them if they tried.

[Justthefacts]

Re: Honest question

There will be no entrepreneurs interested in entering that business model, after confiscation. What *will* happen is that the EU Commission will finance a “start up”, which is actually just themselves with full read and write access to all your personal information. Imagine Twitter with 500 Elons determining what’s in your feed. Every day will start with some inspirational flag-waving, followed by an article explaining how bad the world is outside the EU, and how your EU representative is working so hard to make things even better.

That’s what you asked for, it’s what you’ll get.

[localzuk]

Re: Honest question

You got enough tinfoil over there?

[Justthefacts]

Re: Honest question

No need. I used to be a senior project manager, bidding various contracts let by the Commission. Way back in oooh, 2012-ish, Commission requested somebody build *exactly that* for them. We bid that contract but lost, Thales won. The system that you call “tinfoil hat” was indeed built by Thales, and exists, it’s just currently mothballed. Like so many Commission projects.

The way Commission works is: it doesn’t propose anything that it hasn’t planned for. Any legislation that goes forward, it has done first a PoC, followed by a project *with full implementation at scale* at least five years before that. Planning for these things starts at least ten years internally, before even a whisper hits external consultation. This one has had a particularly long gestation.

But yes, either Facebook sell them the wreckage of their EU operation, or Commission have several “start-ups” lined up, who will be gifted a fully operational FB clone from storage (as Commission imagine it). My god the requirements were a shitshow, I’m glad we didn’t win it TBH.

[localzuk]

Re: Honest question

Not that I don't believe a random person on the internet with no proof... But why exactly would a government (as effectively that's what the EU is) be building social media systems?

[Anonymous Coward]

Data is a bit like money laundering.

Government A gets Government B to collect the data then pass it back to Government A all nice and clean because they haven't broken any laws in their own countries. This was the whole idea behind prism.

So my question is who is actually going to pay these fines? I can't really see it being the companies working for governments so will it be extracted from us one way or another?

Just thinking out loud on this.

[Andre Carneiro]

The sheer arrogance of their statement is proof (if any more was needed) of the bunch of utter sleazeballs (I’m trying not to get carried away here) they are.

So glad I ditched them almost 10 years ago, I can’t wait to see them join MySpace.

[VoiceOfTruth]

Imagine if Facebook was a Chinese app/platform

These spies, everything is going back to Beijing. Facebook is a tentacle of American spying in Europe and should be banned immediately.

[Pascal Monett]

Re: Imagine if Facebook was a Chinese app/platform

I have to agree with that.

Anything that has been said about Wuawei/TikTok beholden to Beijing could not have those elements replaced by Cisco and the NSA and retain 100% of its threat level.

The USA has National Security Letters, with the legal obligations for companies being subject to one to shut up about it.

How's that for being beholden to the NSA ?

Why is that any better ? Because Beijing is not a democracy ?

You think the USA is ?

[Pascal Monett]

Grrr. There's a "not" too many in my previous post.

[cyberdemon]

And there's a "dot" too many in your namesake's pictures.

[MyffyW]

Upvote, Pascal, for that level of care over a post.

[Primus Secundus Tertius]

Re: Imagine if Facebook was a Chinese app/platform

I thought Google was the Internet branch of US Intelligence.

[MachDiamond]

Re: Imagine if Facebook was a Chinese app/platform

"I thought Google was the Internet branch of US Intelligence."

Don't just think that some company is a pawn of some government. It could make more sense to think of that big multi-national with those huge databases as being a free-floating entity that isn't beholden to any government defined by some red lines painted on a map. The Mars trilogy by Kim Stanley Robinson explores that scenario and I find it very plausible. The net worth and economic activity of something like FB is bigger than many countries. Will we see one of these megacorps one day locating in a country as a 'flag of convenience" and taking that country over for all intents and purposes?

[Mike 137]

Round and round the mulberry bush

"the suspension won't take effect if the DPF is enacted before the five-month deadline is up"

The DPF is likely to suffer the same fate as Privacy Shield and its predecessor, as it can not in principle override extant US federal law that allows privacy intrusion. I suspect any adequacy decision based on it will be very short lived.

However the basic position that the GDPR can be ignored in the interest of commercial advantage is so well established that I also suspect that little will actually change from the perspective of data subjects' rights regardless of what happens to the DPF.

[OhForF']

Re: Round and round the mulberry bush

If memory serves it was back when the US demanded additonal data about passengers from the european arilines that the then President of the Council of the European Union first told them to "operate and violate (european laws)". Since then protected european data has been handed to the US and nothing much changed (other than a few failed attempts to make that legal).

[Anonymous Coward]

There's no way the new agreement should be put in place

There's no way the new agreement should be put in place because NOTHING has changed in the U.S.A. Nothing at all.

[Anonymous Coward]

Re: There's no way the new agreement should be put in place

You are completely correct.

Only that means a number of typical daily activities (i.e. anything covered by GDPR) for multinational companies would need to stop and "business" revenue will slow significantly.

So instead we have the policy dance where neither side changes and a temporary sticking plaster is created to allow the status quo to continue until the next court decision tears off the stocking plaster, exposes the wound and forces the application of another sticking plaster...

Maybe the two sides are getting closer to a solution? Hahahaha hahaha.....

[Graham Lockley]

Privacy ? We've heard of it. Old vulture joke from the days when El Reg wasn't a dot com.

[Rich 2]

That will be when they spoke/wrote proper English too then?

[Winkypop]

And yet

People all over the world just can’t wait to pump in more and more PI to benefit these corrupt shlepps.

[Mr Dogshit]

What does Nick Clegg have to say about this?

[abend0c4]

Whatever he's told to, I would imagine.

[Elongated Muskrat]

The quote from him in the other article I read about this a couple of days ago was along the lines of, "we're squeaky clean, we did nothing wrong".

Which, from the guy who essentially destroyed any trust anyone had in the Liberal Democrats for over a decade, by being utterly dishonest and getting into bed with the Tories, is worth essentially zero pounds and nought pence.

Guilty as charged m'lud.

[Tubz]

Irish DPC is nothing short of a rubber stamp office for Mega Corps USA and the EU bigwigs should be kicking it's backside to get it to put people first and not businesses.

[Anonymous Coward]

In tangentially related news...

The EU is going to court to try to force Apple to pay Ireland EUR13B today:

https://www.rte.ie/news/business/2023/0523/1385086-cjeu-to-hear-eu-commission-appeal-of-apple-tax-case/

Ireland had won a judgment that they didn't have to take the money, but the EU are trying to force them. For reference, Ireland's total tax take in 2022 was about EUR82B.

https://www.revenue.ie/en/corporate/press-office/press-releases/2023/pr-010523-headline.aspx

[Diogenes8080]

Re: In tangentially related news...

They don't actually want their pot o' gold?

And if the judgement is for all FB European activity, shouldn't the spoils be shared out pro rata the EU member populations?

[Elongated Muskrat]

Re: In tangentially related news...

They don't want to sour their relationship with Apple, who is a large employer in Ireland, and has brought tech jobs there in preference to other places across the continent, attracted, essentially by the very low rate of corporation tax afforded to them (and other tech companies), as a trade-off against high-skilled high-wage employment which drives other sectors of the economy, such as housing, entertainment and tourism.

[Roland6]

Well given how Ireland dragged it feet over its sweetheart deal with Apple, it does seem Ireland is enacting another form of subsidy: come to Ireland and we won’t enforce EU laws or pursue payment of fines…

[First Light]

It's utterly embarrassing for those of us from the Emerald Isle. The Irish DPC is a case of regulatory capture at it's most acute.

[localzuk]

Incompatible laws

The DPF, even when agreed, will face the same problem as the previous 2 deals. That issue is that US federal law is directly incompatible with EU law. The only way to fix this is either the USA needs to change its law, or the EU needs to weaken its GDPR law, and member states agree to it and implement the change in law.

For example, the US Cloud Act is directly in conflict with GDPR. It explicitly gives supremacy to US law over the rights under EU GDPR, therefore rendering it incompatible as numerous demands for data can be made without a basis that would be legal under GDPR.

In reality, this affects more than Meta. Every US company that works with EU data, via subsidiaries or not, is technically breaking GDPR law at the moment. At the moment, the companies are simply lucky more haven't been dragged to the courts.

[Strahd Ivarius]

Re: Incompatible laws

So the EU could apply a yearly fine of 4% of USA's GP just to be on the safe side, and solve all its financing problems?

[Elongated Muskrat]

Re: Incompatible laws

Every US company that works with EU data, via subsidiaries or not, is technically breaking GDPR law at the moment.

Well, yes and no.

If that data contains personally identifying information (PID), or is not adequately anonymised to the extent that PID can be extracted, or individuals identified, and that PID is being sent to the US, then yes.

If the PID elements of the data are stored and processed in the EU, in accordance with GDPR rules, and only the outputs from the processing, which would have to contain no PID, or any way to identify individuals, or small groups, are sent to the US for processing, then that is probably okay.

If everything occurs on servers in the EU, in accordance with GDPR, and only the money goes off to the parent company in the US, then there's no problem there. This is why a lot of companies have incorporated subsidiaries in each country, or bloc, they operate in. (And, incidentally, because of the bloc bit there, yet another reason why Brexit is an act of economic self-harm for the UK)

Essentially, it's only a botherance for companies which make their business out of sweeping up as much PID as possible and analysing, in the US, it for profit. In this case, Facebook, but I'd not be surprised to see similar against the likes of Google Alphabet, Apple, et al. It makes sense, too, for the regulators to go after the most egregious offenders first, and then work their way down the list.

IANAL, of course, but this is my understanding.

[localzuk]

Re: Incompatible laws

The context of the article, and discussions here, is the transfer of personal data. So, my post was clearly referring to personal data when I said "EU Data"...

And no, you're incorrect. The US Cloud Act requires access to data held, even by subsidiaries with no US assets, for law enforcement agencies without any due process in the EU. There was a huge furore a few years ago about the US wanting access to Microsoft data from their Irish subsidiary. Microsoft resisted as the subsidiary was overseas and had to follow GDPR. The US persisted due to the Cloud Act.

[Elongated Muskrat]

Re: Incompatible laws

I'm incorrect? In what sense? Just because the US likes to try to impose US law overseas doesn't mean it has any jurisdiction to do so.

If they want to tell an EU subsidiary of a US company that they must send their data to the US, the law in the EU member state, which says they cannot do so, takes primacy. If they want to then prosecute or otherwise sanction the US branch of that company for the EU subsidiary not doing, then that's their business.

If they want to try to sanction the EU subsidiary as well, then they can have a go at that. I reckon they'd probably fall foul of several international agreements by doing so. WTO rules about fair trade spring to mind, for starters.

So, the tl;dr; here is that just because the US thinks it has jurisdiction over the whole world, doesn't mean that it does.

[localzuk]

Re: Incompatible laws

"Just because the US likes to try to impose US law overseas doesn't mean it has any jurisdiction to do so."

That is exactly why you're incorrect.

I stated the laws are directly incompatible due to this issue. For US companies, even their subsidiaries, the US law is supreme.

Companies being stuck between being prosecuted by the USA for failing to comply with the US law if they don't hand data over vs being prosecuted by the EU for handing that data over is not a tenable position. Companies have and will continue to do what the USA says regarding this. See the Microsoft case a while back with Microsoft Ireland.

This is exactly the problem, and is what has been stated in the rulings regarding the various attempts are aligning data rules already.

[Rich 2]

6 months to comply

In my mind the most ridiculous aspect of this is that Meta are being given 6 months to change their ways

So they are being granted 6 months of continuing to break the law!! Free, gratis and with the EU’s blessing!!!

Do you think if I was caught robbing a bank, I would be given 6 months to stop doing it?

[Evil Auditor]

...Meta said it was following the same rules as all the other US companies doing business in the EU and was "disappointed to have been singled out...

Ah yes, that is very disappointing, outright annoying, indeed. I know this all too well: recently I got caught speeding on a stretch of road notorious for speeding. Told the officer: but sir, everyone is doing the same here; it's very unfair that I got singled out. Officer was very unreasonable. And a couple of months later I told the judge: but Your Honour, everyone is speeding there! It's very unfair and disappointing that I got singled out for blablabla. Long story short: judge was very unreasonable, too. And I got deprived of my hard-earned money.

_{Not all of this story is fictitious. And well done for going after Meta.}

[Elongated Muskrat]

Quite.

They've been singled out because they are doing it on an industrial scale, in the same way that someone fly-tipping 100 tonnes of industrial waste into a river would be singled out over someone dropping a crisp packet.

This isn't to say that someone dropping a crisp packet won't get a fine if they happen to get caught, but it's likely to be something like a £50 on-the-spot fine, and the industrial polluter is likely to get imprisonment as a punishment (or we would at least hope so, under our government, they'd probably get a performance bonus, and public subsidy to clean up the mess).

Meta haven't been "singled out", they have been noticed, and prosecuted, according to the law, for a serious breach of it.