Meta faces two compliance deadlines

Ireland’s Data Protection Commission announces a €1.2 billion fine against Meta Ireland on 22 May over Facebook’s US data transfers.

Photo: LPS.1, “Meta Platforms Headquarters Menlo Park California” (2022). CC0 1.0. Resized; cropped; responsive crops.

From notification, Meta has five months to suspend future transfers and six months to end unlawful US processing, including storage, of EU/EEA users’ data transferred in breach of the GDPR.

The European Data Protection Board’s 13 April decision explains why suspension alone isn’t enough: it doesn’t punish past breaches. The board required a fine and action on data already held in the US.

That second remedy isn’t a command to delete every affected record. The board leaves Meta to choose how to bring the processing into compliance. Deletion is one possible route, rather than the only prescribed measure.

Meta says it will appeal the substance, orders and fine, and seek a court stay. It says Facebook faces no immediate interruption during the implementation periods. Those are the company’s stated plans and assessment, not confirmation that a court has granted relief.

Meta also points to the planned EU-US Data Privacy Framework. It argues that implementation before the deadlines could prevent disruption. As of 22 May, that possibility remains conditional.