8 ms·

Ireland’s DPC set to hit Meta with record privacy fine over US data transfers

108 points by jruohonen 3y ago

ocfnash 3y ago
I note that this also appeared just days ago: https://www.irishtimes.com/business/2023/05/15/three-quarters-of-irish-data-watchdogs-data-privacy-decisions-since-2018-overruled-report/ https://www.irishtimes.com/business/2023/05/15/three-quarter... I'm not quite sure what conclusions to draw.
- TRiG_Ireland 3y ago
  Ireland's DPC might be taking the hint that it needs to get stricter. The big companies come to Ireland for tax reasons, not for lax enforcement. Enforcement can get a lot stricter without losing them.
  - tupac_speedrap 3y ago
    Nah, it's be another "cost of doing business" type fine, zero impact on Meta but it makes DPC look "tough" on enforcement.
  - deleted 3y ago
    [deleted]
  - joahua 3y ago
    The juxtaposition of those two ideas is interesting! It raises the spectre of low cost data transfer jurisdictions particularly from policy bloc arrangements. Essentially, what is the lowest cost data egress (defined in $/policy offence) from a given zone!
  - wkat4242 3y ago
    They should really tune down the tax breaks too though. They're basically screwing the rest of Europe by allowing these companies to avoid taxes in the whole EU. Just for a few measly jobs (even Apple only has a few thousand employees in return for literally billions of revenue going through the country). https://www.theguardian.com/technology/2020/sep/25/european-commission-appeal-against-apple-tax-ruling-ireland https://www.theguardian.com/technology/2020/sep/25/european-... That money could really have been put to good use in the EU. The EU should present a more united front here IMO instead of allowing companies to cherry pick countries and make them compete against each other for the lowest tax rates. Cory Doctorow had a good article about it a few days ago: https://pluralistic.net/2023/05/15/finnegans-snooze/#dirty-old-town https://pluralistic.net/2023/05/15/finnegans-snooze/#dirty-o...
    - lifeisstillgood 3y ago
      Ireland was one of the signatories to Yellands global minimum Corp tax of 15%. Yeah being at 15% sucks compared to where other european companies sit, but the race to the bottom got cut off. it's a win
      - wkat4242 3y ago
        Yes but these companies don't pay that 15%. They all get special deals paying pretty much nothing. That's what that ongoing lawsuit is about by the EU against Apple. They're still trying to get almost 14 billion euro paid.
        smugma 3y ago
        11%, below the Irish rate of 12.5% https://amp.theguardian.com/technology/2023/apr/09/profits-apple-irish-division-rise-to-69bn-corporation-tax https://amp.theguardian.com/technology/2023/apr/09/profits-a...
      - throwawaymobule 3y ago
        everywhere else in the EU also signed it, and the corporate tax rate wasn't even the lowest in the EU already. (Bulgaria was lower, and another eurozone country was tied)
    - negamax 3y ago
      It's by design. These companies can't pull this in any other EU country. Ireland was a relatively poor country 20 years ago. And is showered with money since then for its membership to the EU. Right question to ask is why did Germany, France allowed it. May be they foresaw that this was the only way to keep Ireland in the union or to get these companies in EU at the first place.
    - robertlagrant 3y ago
      > They're basically screwing the rest of Europe by allowing these companies to avoid taxes in the whole EU The EU was designed to allow countries to compete on this. > That money could really have been put to good use in the EU I really think this is a controversial statement. The money can be put to good use in Ireland as well, which is in the EU.
closewith 3y ago
Here's an article that's not paywalled: https://www.rte.ie/news/business/2023/0517/1384186-meta-to-face-record-eu-privacy-fine-over-data-transfers/ https://www.rte.ie/news/business/2023/0517/1384186-meta-to-f...
standing_user 3y ago
Nothing new, until a proper legal basis is defined for transatlantic data transfer all services with us based company and data centers are in violation of GDPR
- AlecSchueler 3y ago
  GDPR only comes into effect when the data is stored locally right? At my old company we worked on a bunch of private data from American citizens and were always careful to keep it in the cloud, since if we downloaded it onto our local computers we'd have to care about the people's privacy. Maybe it was just for show.
  - VWWHFSfQ 3y ago
    [flagged]
    - dang 3y ago
      Could you please stop posting unsubstantive comments and flamebait? You've unfortunately been doing it repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
      - VWWHFSfQ 3y ago
        I wasn't trying to be flippant or anything. My comment "Yeah that sounds like complete nonsense" was replying to: "Maybe it was just for show." > You've unfortunately been doing it repeatedly. I don't believe that I've been doing it repeatedly. I think I've contributed positively to conversations and topics
  - donohoe 3y ago
    ‘Locally’? No. GDPR comes into effect if you are dealing with personal information of EU residents, and you have legal exposure to the EU. (Not a lawyer)
bradleyjg 3y ago
Some of these giant fines on foreign corporations, when there’s no similar fines on domestic ones, have a backdoor tariff vibe.
- raizer88 3y ago
  It is hard to see an Irish company send data to the US, since US authorities only require US companies to do so.
  - jkaplowitz 3y ago
    And yet, many European companies do routinely send data to the US, primarily in the context of using US-based service providers. They pretend that disclosing this transfer to the customer and pointing out that the ECJ has deemed US data protection as unacceptable allows them to do it anyway. In practice this may be true, but that’s only because the theory of what the GDPR requires is so rarely enforced in meaningful ways.
- zpeti 3y ago
  Yeah, especially when in the case of the fine for consent about personal ads, the fine was for violations before the law was in place. That is an insane precedent. Most legal systems understand that applying laws retroactively is a really big no no, as it can create a massive overreach of power in the future, and also creates a hugely unpredictable present, if any time in the future you can be liable. The EU's obsession with getting money from US tech companies is leading it down really dangerous paths.
  - ChuckNorris89 3y ago
    >The EU's obsession with getting money from US tech companies is leading it down really dangerous paths. Yeah shame on EU for issuing fines for the anti-consumer, privacy abusive and illegal practices of the saint ad-ware empires of US big-tech companies. How dare they protect their citizens? Don't they know big-tech should be left unregulated to abuse people so billionaires can become trillionares? Speaking of double standards it's funny how the US keeps wanting to ban Chinese TikTok for doing the same abusive data collection Meta and Google was doing without issues. US shouldn't lecture anyone on tech regulations.
scandox 3y ago
Important context for those reacting to the headline: > The DPC, which oversees the EU operations of most Silicon Valley firms... Ireland has found itself the de facto privacy regulator for these companies in the EU...
- pjc50 3y ago
  They're also the de jure privacy regulator, because the EU presence of these companies is headquartered in Ireland. Because of the lower taxes. https://en.wikipedia.org/wiki/Apple%27s_EU_tax_dispute https://en.wikipedia.org/wiki/Apple%27s_EU_tax_dispute
  - lmkg 3y ago
    Note that there is a process for the regulators from other countries to object to DPC decisions, and this process has been used in the past to increase the fines issued by the DPC to Meta. Ireland doesn't want to scare away tax revenue from US tech companies, so they strategically under-fund the DPC, effectively making them a bottleneck for GDPR enforcement across the EU as a whole. This has been a point of contention with other regulators.
bitL 3y ago
Ireland wants to lose money US corps pay them in order to bypass higher EU taxes I guess. I am wondering if they did some game theory scenario about what fine Meta can absorb before it's easier for them to relocate elsewhere with laxer standards that would love some more tax income.
- bathtub365 3y ago
  Turning a blind eye to companies violating the law because they’re giving you money is corrupt.
  - bitL 3y ago
    I mean that's precisely how Ireland raised their GDP, they took all US companies and offered them low tax deals, making the rest of EU upset. Now they probably burned through all that money and are trying to outsmart those corps to get more money from them. Tax offices always project the same or higher income for the next year and when they get hit, they need to squeeze it out from somewhere.
- ben_w 3y ago
  The "G" in "GDPR" is the same as the one in "AGI": "General". As I understand it (not a lawyer), every country in the EU unified their data protection regulations to match it, and the penalties for non-compliance are the same in all cases. So, even maximal enforcement shouldn't cause any company to relocate. So long as the companies accept this as reality.
  - bitL 3y ago
    That's in theory; in practice countries often look the other way or delay actions when they see fit. I guess Ireland is running out of money they planned to get and are now trigger happy on Meta.
  - tremon 3y ago
    Actually, the GDPR only defines a minimal baseline for all the EU countries to meet. And countries didn't need to update their own laws to match it: since it is a Regulation rather than a Directive, the GDPR is enforcable in the entire EU even without a local law supporting it. Countries are still free to enact stricter policies if they want to, but those obviously wouldn't apply outside their own national borders.
hrpnk 3y ago
This was teased in Meta's recent quarterly report [1]: "On April 13, 2023, the European Data Protection Board (EDPB) issued a decision and we expect the IDPC to issue a final decision in this inquiry in May 2023. It is expected that in addition to the transfer suspension order, the IDPC will make an order requiring Meta Platforms Ireland to bring its relevant processing operations into compliance with the GDPR and imposing a fine. We continue to examine the decision and its potential impact on our operations. We expect that the deadlines to comply with the IDPC decision will be no earlier than the fourth quarter of 2023." [1] https://www.sec.gov/ix?doc=/Archives/edgar/data/1326801/000132680123000067/meta-20230331.htm https://www.sec.gov/ix?doc=/Archives/edgar/data/1326801/0001...
Havoc 3y ago
Why exactly does Meta need to haul the data back to the US at all? What sort of magic happens to it in the US that isn't feasible in the EU? Keep US data of US citizen on US servers, and same for EU side. It's not like Meta can't afford servers on both sides of the ocean.
- skybrian 3y ago
  When Europeans communicate with Americans as expected on a social network, where does the data live? Keeping the data solely in Europe only seems relevant for people who have no American friends who read their posts. As soon as there’s one American in the conversation, or even just someone visiting the US, it’s going to be delivered to the US. Also consider that posts are often reshared. To make this effective, it seems like there would need to be region restrictions in the UI? If there were a “Europe only” checkbox, how many would use it?
  - Havoc 3y ago
    This isn't about US guy messaging EU guy - that scenario exists across many jurisdictions for various companies and apps already. It's wholesale bulk transfers. >fears citizens’ data wasn’t safe once shipped to the US Bit like all the UK user data getting shipped over to the US previously: https://www.freevacy.com/news/independent/meta-to-relocate-uk-users-data-to-the-us-away-from-eu-jurisdiction/3369 https://www.freevacy.com/news/independent/meta-to-relocate-u... And Meta is so determined to do this that they're threatening to leave the EU. So again...what exactly is being done with this data that is impossible on EU turf but possible on US turf? I personally can't think of anything Kosher
    - skybrian 3y ago
      When there are hundreds of millions of Americans who are subscribed to the feeds of hundreds of millions of Europeans, and the Americans' feeds are generated via server-side queries, that seems roughly equivalent to a bulk transfer? It's querying a cache, at least, which is going to look rather like a database. I suppose they could serve all the Americans' queries out of Europe, but that's going to affect costs and latency, and the data still ends up in the US. I don't know what's going on at Meta, but possibly, they have a lot of technical debt and doesn't want to do a big rewrite of many of their systems for dubious benefits? And there would also be the issue of having lots of Americans' data in European jurisdiction. So it seems like what we're seeing here is supposedly "borderless" computer systems running up against legal realities. I suppose if it resulted in a breakup, it wouldn't be the end of the world, but it would be expensive.

108 points by jruohonen 3y ago

I note that this also appeared just days ago: https://www.irishtimes.com/business/2023/05/15/three-quarters-of-irish-data-watchdogs-data-privacy-decisions-since-2018-overruled-report/ https://www.irishtimes.com/business/2023/05/15/three-quarter... I'm not quite sure what conclusions to draw.

TRiG_Ireland 3y ago
Ireland's DPC might be taking the hint that it needs to get stricter. The big companies come to Ireland for tax reasons, not for lax enforcement. Enforcement can get a lot stricter without losing them.
- tupac_speedrap 3y ago
  Nah, it's be another "cost of doing business" type fine, zero impact on Meta but it makes DPC look "tough" on enforcement.
- deleted 3y ago
  [deleted]
- joahua 3y ago
  The juxtaposition of those two ideas is interesting! It raises the spectre of low cost data transfer jurisdictions particularly from policy bloc arrangements. Essentially, what is the lowest cost data egress (defined in $/policy offence) from a given zone!
- wkat4242 3y ago
  They should really tune down the tax breaks too though. They're basically screwing the rest of Europe by allowing these companies to avoid taxes in the whole EU. Just for a few measly jobs (even Apple only has a few thousand employees in return for literally billions of revenue going through the country). https://www.theguardian.com/technology/2020/sep/25/european-commission-appeal-against-apple-tax-ruling-ireland https://www.theguardian.com/technology/2020/sep/25/european-... That money could really have been put to good use in the EU. The EU should present a more united front here IMO instead of allowing companies to cherry pick countries and make them compete against each other for the lowest tax rates. Cory Doctorow had a good article about it a few days ago: https://pluralistic.net/2023/05/15/finnegans-snooze/#dirty-old-town https://pluralistic.net/2023/05/15/finnegans-snooze/#dirty-o...
  - lifeisstillgood 3y ago
    Ireland was one of the signatories to Yellands global minimum Corp tax of 15%. Yeah being at 15% sucks compared to where other european companies sit, but the race to the bottom got cut off. it's a win
    - wkat4242 3y ago
      Yes but these companies don't pay that 15%. They all get special deals paying pretty much nothing. That's what that ongoing lawsuit is about by the EU against Apple. They're still trying to get almost 14 billion euro paid.
      - smugma 3y ago
        11%, below the Irish rate of 12.5% https://amp.theguardian.com/technology/2023/apr/09/profits-apple-irish-division-rise-to-69bn-corporation-tax https://amp.theguardian.com/technology/2023/apr/09/profits-a...
    - throwawaymobule 3y ago
      everywhere else in the EU also signed it, and the corporate tax rate wasn't even the lowest in the EU already. (Bulgaria was lower, and another eurozone country was tied)
  - negamax 3y ago
    It's by design. These companies can't pull this in any other EU country. Ireland was a relatively poor country 20 years ago. And is showered with money since then for its membership to the EU. Right question to ask is why did Germany, France allowed it. May be they foresaw that this was the only way to keep Ireland in the union or to get these companies in EU at the first place.
  - robertlagrant 3y ago
    > They're basically screwing the rest of Europe by allowing these companies to avoid taxes in the whole EU The EU was designed to allow countries to compete on this. > That money could really have been put to good use in the EU I really think this is a controversial statement. The money can be put to good use in Ireland as well, which is in the EU.

closewith 3y ago

Here's an article that's not paywalled: https://www.rte.ie/news/business/2023/0517/1384186-meta-to-face-record-eu-privacy-fine-over-data-transfers/ https://www.rte.ie/news/business/2023/0517/1384186-meta-to-f...

standing_user 3y ago

Nothing new, until a proper legal basis is defined for transatlantic data transfer all services with us based company and data centers are in violation of GDPR

AlecSchueler 3y ago
GDPR only comes into effect when the data is stored locally right? At my old company we worked on a bunch of private data from American citizens and were always careful to keep it in the cloud, since if we downloaded it onto our local computers we'd have to care about the people's privacy. Maybe it was just for show.
- VWWHFSfQ 3y ago
  [flagged]
  - dang 3y ago
    Could you please stop posting unsubstantive comments and flamebait? You've unfortunately been doing it repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
    - VWWHFSfQ 3y ago
      I wasn't trying to be flippant or anything. My comment "Yeah that sounds like complete nonsense" was replying to: "Maybe it was just for show." > You've unfortunately been doing it repeatedly. I don't believe that I've been doing it repeatedly. I think I've contributed positively to conversations and topics
- donohoe 3y ago
  ‘Locally’? No. GDPR comes into effect if you are dealing with personal information of EU residents, and you have legal exposure to the EU. (Not a lawyer)

bradleyjg 3y ago

Some of these giant fines on foreign corporations, when there’s no similar fines on domestic ones, have a backdoor tariff vibe.

raizer88 3y ago
It is hard to see an Irish company send data to the US, since US authorities only require US companies to do so.
- jkaplowitz 3y ago
  And yet, many European companies do routinely send data to the US, primarily in the context of using US-based service providers. They pretend that disclosing this transfer to the customer and pointing out that the ECJ has deemed US data protection as unacceptable allows them to do it anyway. In practice this may be true, but that’s only because the theory of what the GDPR requires is so rarely enforced in meaningful ways.
zpeti 3y ago
Yeah, especially when in the case of the fine for consent about personal ads, the fine was for violations before the law was in place. That is an insane precedent. Most legal systems understand that applying laws retroactively is a really big no no, as it can create a massive overreach of power in the future, and also creates a hugely unpredictable present, if any time in the future you can be liable. The EU's obsession with getting money from US tech companies is leading it down really dangerous paths.
- ChuckNorris89 3y ago
  >The EU's obsession with getting money from US tech companies is leading it down really dangerous paths. Yeah shame on EU for issuing fines for the anti-consumer, privacy abusive and illegal practices of the saint ad-ware empires of US big-tech companies. How dare they protect their citizens? Don't they know big-tech should be left unregulated to abuse people so billionaires can become trillionares? Speaking of double standards it's funny how the US keeps wanting to ban Chinese TikTok for doing the same abusive data collection Meta and Google was doing without issues. US shouldn't lecture anyone on tech regulations.

scandox 3y ago

Important context for those reacting to the headline: > The DPC, which oversees the EU operations of most Silicon Valley firms... Ireland has found itself the de facto privacy regulator for these companies in the EU...

pjc50 3y ago
They're also the de jure privacy regulator, because the EU presence of these companies is headquartered in Ireland. Because of the lower taxes. https://en.wikipedia.org/wiki/Apple%27s_EU_tax_dispute https://en.wikipedia.org/wiki/Apple%27s_EU_tax_dispute
- lmkg 3y ago
  Note that there is a process for the regulators from other countries to object to DPC decisions, and this process has been used in the past to increase the fines issued by the DPC to Meta. Ireland doesn't want to scare away tax revenue from US tech companies, so they strategically under-fund the DPC, effectively making them a bottleneck for GDPR enforcement across the EU as a whole. This has been a point of contention with other regulators.

bitL 3y ago

Ireland wants to lose money US corps pay them in order to bypass higher EU taxes I guess. I am wondering if they did some game theory scenario about what fine Meta can absorb before it's easier for them to relocate elsewhere with laxer standards that would love some more tax income.

bathtub365 3y ago
Turning a blind eye to companies violating the law because they’re giving you money is corrupt.
- bitL 3y ago
  I mean that's precisely how Ireland raised their GDP, they took all US companies and offered them low tax deals, making the rest of EU upset. Now they probably burned through all that money and are trying to outsmart those corps to get more money from them. Tax offices always project the same or higher income for the next year and when they get hit, they need to squeeze it out from somewhere.
ben_w 3y ago
The "G" in "GDPR" is the same as the one in "AGI": "General". As I understand it (not a lawyer), every country in the EU unified their data protection regulations to match it, and the penalties for non-compliance are the same in all cases. So, even maximal enforcement shouldn't cause any company to relocate. So long as the companies accept this as reality.
- bitL 3y ago
  That's in theory; in practice countries often look the other way or delay actions when they see fit. I guess Ireland is running out of money they planned to get and are now trigger happy on Meta.
- tremon 3y ago
  Actually, the GDPR only defines a minimal baseline for all the EU countries to meet. And countries didn't need to update their own laws to match it: since it is a Regulation rather than a Directive, the GDPR is enforcable in the entire EU even without a local law supporting it. Countries are still free to enact stricter policies if they want to, but those obviously wouldn't apply outside their own national borders.

hrpnk 3y ago

This was teased in Meta's recent quarterly report [1]: "On April 13, 2023, the European Data Protection Board (EDPB) issued a decision and we expect the IDPC to issue a final decision in this inquiry in May 2023. It is expected that in addition to the transfer suspension order, the IDPC will make an order requiring Meta Platforms Ireland to bring its relevant processing operations into compliance with the GDPR and imposing a fine. We continue to examine the decision and its potential impact on our operations. We expect that the deadlines to comply with the IDPC decision will be no earlier than the fourth quarter of 2023." [1] https://www.sec.gov/ix?doc=/Archives/edgar/data/1326801/000132680123000067/meta-20230331.htm https://www.sec.gov/ix?doc=/Archives/edgar/data/1326801/0001...

Havoc 3y ago

Why exactly does Meta need to haul the data back to the US at all? What sort of magic happens to it in the US that isn't feasible in the EU? Keep US data of US citizen on US servers, and same for EU side. It's not like Meta can't afford servers on both sides of the ocean.

skybrian 3y ago
When Europeans communicate with Americans as expected on a social network, where does the data live? Keeping the data solely in Europe only seems relevant for people who have no American friends who read their posts. As soon as there’s one American in the conversation, or even just someone visiting the US, it’s going to be delivered to the US. Also consider that posts are often reshared. To make this effective, it seems like there would need to be region restrictions in the UI? If there were a “Europe only” checkbox, how many would use it?
- Havoc 3y ago
  This isn't about US guy messaging EU guy - that scenario exists across many jurisdictions for various companies and apps already. It's wholesale bulk transfers. >fears citizens’ data wasn’t safe once shipped to the US Bit like all the UK user data getting shipped over to the US previously: https://www.freevacy.com/news/independent/meta-to-relocate-uk-users-data-to-the-us-away-from-eu-jurisdiction/3369 https://www.freevacy.com/news/independent/meta-to-relocate-u... And Meta is so determined to do this that they're threatening to leave the EU. So again...what exactly is being done with this data that is impossible on EU turf but possible on US turf? I personally can't think of anything Kosher
  - skybrian 3y ago
    When there are hundreds of millions of Americans who are subscribed to the feeds of hundreds of millions of Europeans, and the Americans' feeds are generated via server-side queries, that seems roughly equivalent to a bulk transfer? It's querying a cache, at least, which is going to look rather like a database. I suppose they could serve all the Americans' queries out of Europe, but that's going to affect costs and latency, and the data still ends up in the US. I don't know what's going on at Meta, but possibly, they have a lot of technical debt and doesn't want to do a big rewrite of many of their systems for dubious benefits? And there would also be the issue of having lots of Americans' data in European jurisdiction. So it seems like what we're seeing here is supposedly "borderless" computer systems running up against legal realities. I suppose if it resulted in a breakup, it wouldn't be the end of the world, but it would be expensive.