Following the binding decision of the European Data Protection Board (EDPB) on the dispute brought by Meta's Irish subsidiary in relation to data transfers made by Meta Platforms Ireland Limited for its Facebook service (Binding Decision 1/2023) on April 13, 2023, the Irish Data Protection Commission (DPC) has issued its decision on the basis of the EDPB's ruling, dated May 12, 2023, and has agreed on the following:
1. An administrative fine of €1.2 billion is imposed.
2. Pursuant to Article 58(2)(j) of the GDPR, Meta is required to suspend international data transfers to the United States for a period of five months from the notification of the DPC decision against Meta Ireland.
3. Meta is required, in compliance with Article 58(2)(d) of the GDPR, to put an end to the unlawful processing of data, including the storage of personal data, of inhabitants of the European Economic Area transferred to the United States in breach of the GDPR. For this purpose, a period of six months is provided from the notification of the DPC's decision to Meta.
This is the highest fine to date imposed for breaching the GDPR, surpassing that of Amazon at 746 million.