Facebook in legal battle over ban on transatlantic data transfer

Facebook is fighting demands from European data regulators to stop transferring user data from the EU to US servers. In a lawsuit filed in Dublin, the company warned that it would not be able to provide services to EU users if forced to comply with the order.

 Earlier this month, the Wall Street Journal reported that Ireland’s Data Protection Commission had sent Facebook an order to stop transferring user data across the Atlantic, following a ruling from the European Court of Justice that the EU-US data transfer standard is insufficient for protecting the privacy of European Facebook users. This is because EU citizens have no effective means of challenging US state surveillance.

The Irish data watchdog could fine Facebook up to four per cent of its annual revenue ($2.8bn) if it fails to comply with the order. However, last week a judge accepted Facebook’s challenge and put a stay on the regulator’s ban on transatlantic data transfers.

Now, Facebook Ireland has filed a lawsuit in a Dublin court, arguing that the regulator’s demand would force the company to exit the EU region. According to Yvonne Cunnane, head of data protection and associate general counsel for Facebook Ireland, Facebook was unfairly singled out by the regulator, with no other big tech companies with similar practices being subjected to the same ruling. Cunnane said that if Facebook alone was being investigated, this could “create a serious distortion of competition.”

Cunnane also raised concerns that the decision had arguably been made solely by one person (Helen Dixon, data protection commissioner for Ireland); argued that the full investigative process had not been carried out by the regulator, and said that the three weeks Facebook had been given to respond to the ruling was “manifestly inadequate”.

Facebook hinted that it would not be able to continue offering services to its 410 million European Facebook and Instagram users if it were forced to stop transferring data across the Atlantic Ocean: “It is not unclear to the applicant how it could continue to provide its services at all in the event of a complete suspension of the transfer of users’ data to the US, as appears to be what the [regulator] proposes.”

It seems extremely unlikely that Facebook would withdraw from such a large and lucrative region, particularly as this could allow for the development of competitors in the social media and messaging spaces. Instead, it is more likely that – if the regulator’s demand is upheld – Facebook will be forced to establish EU-only data centres.

In a statement to Vice, a Facebook spokesperson said: “Facebook is not threatening to withdraw from Europe. Facebook, and many other businesses, organisations and services, rely on data transfers between the EU and the US in order to operate their services.”