Meta Hit with Record 1.2 Billion Euro Fine Over Data Privacy

Meta, the American technology giant that owns Facebook, Instagram and WhatsApp, was fined 1.2 billion euros by Ireland's Data Protection Commission in May 2023. It remains the largest penalty ever handed down under the European Union's General Data Protection Regulation, known as GDPR. The case offers an important lesson for internet users around the world, including the hundreds of thousands of Mauritians who use Meta's platforms every day.

The fine was issued because Meta transferred personal data belonging to European Union users to servers located in the United States without adequate legal safeguards. Under GDPR, companies are only allowed to send personal data outside the EU if the destination country provides a comparable level of privacy protection. For years, regulators argued that US law did not meet that standard, largely because American intelligence agencies can access data held by US technology companies under national security legislation.

Ireland's Data Protection Commission, which acts as Meta's lead regulator within the EU because the company's European headquarters is based in Dublin, concluded that Meta had continued these transfers unlawfully even after a 2020 ruling by the Court of Justice of the European Union struck down the previous legal framework allowing them.

Meta was ordered to stop transferring EU user data to the United States and to bring its data storage practices into compliance within a set timeframe. The company appealed the decision but later reached a new position following a revised EU-US data transfer agreement known as the Data Privacy Framework, adopted in mid-2023.

GDPR, which came into force in 2018, gives individuals the right to know what data is collected about them, to request its deletion and to object to how it is used. Companies that breach the rules can be fined up to four percent of their global annual turnover, which in Meta's case amounts to billions of euros. The 1.2 billion euro penalty reflects both the scale of the breach and the company's enormous revenues.

What this means for Mauritius: Mauritius has its own data protection framework. The Data Protection Act 2017, administered by the Data Protection Office, sets out rules for how organisations must collect, store and use personal data belonging to residents. While Mauritius is not part of the EU and GDPR does not apply directly here, any Mauritian business that handles data belonging to EU residents, such as companies in the financial services or business process outsourcing sectors, must comply with GDPR or risk similar penalties. The Meta case is a reminder that data privacy enforcement is becoming more serious globally, and that both individuals and businesses should understand their rights and obligations.

For everyday Facebook and Instagram users in Mauritius, the case is a signal to review privacy settings, limit the personal information shared on these platforms and be aware that data shared online can travel far beyond national borders.

Source: Le Defi Media