Inquiry concerning data transfers from the EU/EEA to the US by Meta Platforms Ireland Limited for its Facebook service - May 2023

• Section: Decisions made under data protection act 2018

In the matter of the General Data Protection Regulation

DPC Inquiry Reference: IN-20-8-1

In the matter of Meta Platforms Ireland Limited (previously known as Facebook Ireland Limited)

Decision of the Data Protection Commission made pursuant to Section 111 of the Data Protection

Act, 2018 and Articles 60 and 65 of the General Data Protection Regulati on

Further to an own-volition inquiry under Section 110 of the Data Pr otection Act 2018

DECISION

Decision-Maker for the Commission:

Helen Dixon

________________________________

Commissioner for Data Protection

Dated the 12th day of May 2023

Data Protection Commission

21 Fitzwilliam Square South

Dublin 2, Ireland

ii

LIST OF ABBREVIATIONS

The following abbreviations appear in this Decision:

Abbreviation:

Used to Denote:

the 2018 Act

The Data Protection Act, 2018

The Article 60 Process

The cooperation procedure set out in Article 60 GDPR

The Article 65 Decision

The EDPB Binding Decision 1/2023 on the dispute submitted by the

Irish SA on data transfers by Meta Platforms Ireland Limited for its

Facebook service (Art. 65 GDPR), adopted 13 April 2023

The Article 65 Submissions

Meta Ireland’s submissions, dated 2 November 2022, on the

material that the DPC proposed to put before the EDPB for the

purpose of the Article 65 Process

the Board

The European Data Protection Board

the Charter

Charter of Fundamental Rights of the European Union

the CJEU

Court of Justice of the European Union

the DPC

Data Protection Commission (previously the Data Protection

Commissioner prior to the entry into application of the Data

Protection Act, 2018)

the Commissioner

Data Protection Commissioner established pursuant to the Data

Protection Acts, 1988–2003

the Complaint

Complaint filed by Mr Maximillian Schrems on 25 June 2013 as

reformulated and resubmitted on 1 December 2015, and as re-

scoped

in the context of the settlement of the judicial review

proceedings referenced at paragraph 2.45 below.

the CSAs

the supervisory authorities concerned, as defined by Article 4(22)

GDPR

iii

the Data Pol icy

Meta Ireland’s Data Policy (available at:

https://www.facebook.com/policy.php)

the Data Transfers

EU-US transfers of personal data relating to Users, made between

Meta Ireland and Meta US

the Directive

Directive 95/46/EC of the European Parliament and of the Council

of 24 October 1995 on the protection of individuals with regard to

the processing of personal data and on the free movement of such

data

the Draft Decision

the draft version of this decision that was circulated to the CSAs for

their views, in accordance with Article 60(3) GDPR

2015 DTPA

Meta US’s Data Transfer and Processing Agreement, dated 20

November 2015

2018 DTPA

Meta US’s Data Transfer and Processing Agreement, dated 25 May

2018

2021 DTPA

Meta US’s Data Transfer and Processing Agreement, dated 27

August 2021

the EDPB

The European Data Protection Board

EO 12333

Executive Order 12333

The Final Submissions

Meta Ireland’s submissions dated 8 May 2023 in relation to any

matters in relation to which the DPC was required to make a final

determination or, otherwise, exercise its own discretion, arising

from the Article 65 Decision.

FISA

Foreign Intelligence Surveillance Act, 1978

FISC

Foreign Intelligence Surveillance Court

GDPR

Regulation (EU) 2016/679 of the European Parliament and of the

Council of 27 April 2016 on the protection of natural persons with