DP News – Week 33. Facebook and Instagram offerings are to stay in the EU. At least for now.

In early July 2022, Ireland’s Data Protection Commission (DPC) issued a draft decision banning Meta from performing international data transfers from the EU to the U.S. on the basis of standard contractual clauses (SCCs). The draft was then sent out to other supervisory authorities in the EU (in the GDPR terminology – ‘supervisory authorities concerned’) to seek their approval, thus triggering the four-week ‘cooperation’ procedure under the GDPR Article 60.

During this period, those ‘supervisory authorities concerned’ had a right to express ‘a relevant and reasoned objection to the draft decision’ (if any) to the DPC.

If approved, the decision obviously leads to the blocking of Facebook and Instagram services in the EU, as the Meta representatives explained.

However, as of mid-August, it does not seem to happen – at least, very soon. As the DPC confirmed, some ‘relevant and reasoned objections’ have already been raised by peer supervisory authorities. This means that the DPC will have to review them and decide whether or not it will follow them, as Article 60(4) provides for. If yes, then the DPC will have to tweak its initial draft decision and again submit it for the review. Otherwise, if the DPC finds the objections are not relevant or reasoned, the specific dispute resolution process will be triggered under Article 65, thus requiring the EDBP to step in.

The EDPB’s binding decision is to be taken within one month that might be extended by a further month on account of the complexity of the subject-matter.

Regardless of the final decision (that might further be appealed), the overall process may take several months, thus allowing Meta to continue the data transfer process during this time. At the same time, even in case of a decision to completely ban the transfers, it will not necessarily make a long-lasting substantial effect, given the currently discussed and long anticipated new data transfer mechanism between the EU and U.S. that should replace the invalidated Privacy Shield. It is expected that the new mechanism will be ready in Q1 2023.