Meta Platforms

What happened

The Irish DPC fined Meta €1.2 billion for transferring EU user data to the United States without adequate safeguards following the Schrems II ruling. Meta continued relying on Standard Contractual Clauses (SCCs) despite the CJEU finding that US surveillance laws did not provide adequate protection for EU citizens' data. This is the largest GDPR fine ever issued.

Articles violated

Lessons learned

Companies transferring personal data outside the EU must ensure the destination country provides adequate protection or implement supplementary measures beyond SCCs. The Schrems II ruling fundamentally changed transatlantic data transfers — relying solely on SCCs is insufficient when the recipient country's surveillance laws conflict with EU data protection standards.