Meta may reorganise its data transfers to placate the DPC
/
Meta may reorganise its data transfers to placate the DPC
‘What’s on your mind?’ It’s the prompt that greets everyone who logs into Facebook. But we may not be seeing it as much soon.
Barring something very unexpected, Facebook will be told by the Irish Data Protection Commissioner (DPC) that it must suspend data transfers between the EU and the US.
The Irish regulator has until May 12 to do it.
Either the US or the EU has to back down on their fundamental position
Enforced, this would mean no more Facebook interaction between people in Ireland and the US. Which seems tantamount to beginning of the end of the transatlantic internet.
And does it mean no more WhatsApps or Instagram posts, sister services to Facebook?
Then there’s the issue of whether it triggers Meta shutting down its European operations in Dublin, as the company has hinted at more than once.
But those starting to hyperventilate should calm down.
There’s a lot of drama around this subject with much of the detail mixed up by commentators.
For starters, and this is often missed by pundits, the decision only applies to Facebook. It does not apply to Instagram, WhatsApp or Meta services in general.
Yes, it’s a precedent that could potentially extend to lots of other online services (more on that below). But on its own, this is a specifically targeted decision aimed only at Facebook.
Nevertheless, Facebook remains the tech giant’s biggest earner. If ordered to stop the data transfers, will Meta regard its general services as unviable in the EU? Will it pull out, shutting down its Irish office with its more than 5,000 workers?
That, too, seems very unlikely, for a number of reasons.
The EU and the US are expected to sign a new treaty that will supersede the DPC’s decision
First, this columnist understands that it would be a big surprise if Meta were not to appeal the decision, possibly seeking a stay on the DPC’s order during the appeal. That is not Meta’s normal behaviour for DPC decisions, but the stakes are so much higher here, that it would be unusual for it to let that avenue pass.
Second, there is likely to be a period of adjustment time for Meta to give effect to the DPC’s decision. This could be 90 days or longer. That, again, gives some breathing space for it to consider its options.
But the biggest reason why a doomsday scenario (for Facebook’s EU-US traffic) is unlikely to happen is that the EU and the US are still expected to ratify a new treaty (called the ‘Data Privacy Framework’) that would supersede the DPC’s decision under current law.
This treaty was agreed, in draft form, between EU and US negotiators last year, with a view to implementation this year.
While there is still some opposition to it – a European Parliament committee urged its rejection until more explicit protection for fundamental privacy rights were clarified – most observers expect it to take effect in the coming months.
There is, of course, a chance the treaty might not be ratified.
In this case, would Facebook shut down its European operations? If so, would that automatically mean the loss of Instagram and WhatsApp too?
I’m very sceptical of this happening. Whatever about WhatsApp (which still can’t be monetised in the EU because of a DPC ruling against linking its data to Facebook), Instagram is very profitable. To walk away from that service in a market of over 500m mostly rich people seems very unlikely.
Neither Europe nor the US would allow a fundamental split in the internet open up between them
What seems more likely is that Meta would try to reorganise its Facebook data processing in a way that would appear to satisfy the DPC’s order. There would undoubtedly be challenges to that new structure, but those challenges might take months, maybe even years, to fully play out.
In the meantime, Meta would be waiting for a new transatlantic agreement to take shape.
Its logic would be that such a treaty is inevitable. After all, the data-transfer ban wouldn’t just hit Facebook, it would affect any data-transfer service that was challenged using the DPC’s Facebook decision as precedent.
It seems unimaginable that Europe and the US would sit back as a fundamental split in the internet opens up between them.
The online divisions between China and the West, and increasingly between India and the West, are already causing severe strains in commerce and relations.
To let something similar happen between America and us is simply not a runner.
Of course, that means that either the US or the EU has to back down on their fundamental position – for the EU, its citizens’ rights not to be indiscriminately surveilled by the US; for the US, its right to protect its security through, it argues, reasonable monitoring of threats.
The Data Privacy Framework is supposed to bridge this gap. Everyone knows it doesn’t fully do this. But it should be enough to buy us all a few more years of data transfers between us.