Hello and welcome to this bite-size legal update from the team at Field Fisher in Silicon Valley.

I'm Natalie and I'm joined by my colleague Richard and we're going to be talking today about the Irish State Protection Commissioners decision against Porter.

You might have seen some headlines. They're pretty shocking. So 1.2 billion euros is difficult to ignore. And there's a very long history to this case. And we're not going to talk about that today. Instead, we're trying to delve in and cut

through some of the noise on this and really try to get to what this means. Why do we care about it?

What does this really mean from a legal perspective? Hand over to Richard. He'll give us some

specifics on the decision. Yeah, absolutely. So recently, the Irish Data Protection Commissioner issued a fine against META to the tune of

1.2 billion euros and determined that META had failed to comply with the GDPR when it transferred

personal data from the European Union to the United States,

in particular personal data relating to Facebook users in the EU.

And this decision has been a long time coming.

It has quite a long and complicated history.

And the outcome of the decision, well, at least the substantive part, maybe not the level of fine, was to some degree expected, so not a major surprise.

But effectively, what the DPC found was that META had violated Article 46 of the GDPR, that's the provision around international transfers of data. They found that META had failed to

ensure that the personal data of Facebook users in the EU is afforded an adequate level of protection

when it's transferred to META in the US. In particular, the DPC came to three important conclusions.

Firstly, it found that US law does not provide an

essentially equivalent level of protection to that guaranteed by EU law, and that's due to concerns

around downstream surveillance under Section 702 or Pfizer, which some of you may recall was the

focus of the Shrems 2 decision. The second important conclusion

was that META cannot rely on the SECs to transfer personal data to the US, not only because the

SECs didn't afford adequate protection, but also because the supplementary measures implemented

by META also didn't compensate for the inadequate level of protection.

...