Ireland's Data Protection Commission fines Meta €1.2 billion over unlawful EU-US data transfers

What happened

• Ireland's Data Protection Commission fined Meta Platforms €1.2 billion for breaching the GDPR by transferring personal data to the United States without a valid legal basis.
• The regulator said the transfers violated the GDPR's international data‑transfer rules.
• Meta must now halt the unlawful transfers and bring its data‑processing practices into compliance.
• No additional penalties were announced.

Why it matters

Companies that rely on US‑based services must verify that their cross‑border transfers meet GDPR requirements, such as using approved SCCs or adequacy decisions, to avoid similar sanctions.

Business impact

Failure to remediate could lead to service disruptions and substantial fines, prompting firms to reassess data‑flow architectures and contractual safeguards.

What to check

1. 1

   Review all EU‑US data transfersHigh priority

   Map personal data flows to the US and confirm a valid legal basis for each transfer.

2. 2

   Implement Standard Contractual ClausesHigh priority

   Adopt the latest EU‑approved SCCs for any transfers lacking an adequacy decision.

3. 3

   Conduct Transfer Impact AssessmentsMedium priority

   Assess US recipient practices against EU standards and document findings.

4. 4

   Update documentation and DPIAsMedium priority

   Ensure records of processing activities reflect the new transfer mechanisms.