Home / Issues / Irish DPC decision fining Meta Platforms Ireland €1.2 billion over EU-US data transfers (2023)
Irish DPC decision fining Meta Platforms Ireland €1.2 billion over EU-US data transfers (2023)
Decidedas of 31 Oct 2026Ireland / European Union / EEAMeta Platforms Ireland Limiteddraft
Current status
Confirmed fact · as of 22 May 2023
The DPC's decision (adopted 12 May 2023, announced 22 May 2023) found an infringement of Article 46(1) GDPR, imposed a €1.2 billion fine and issued suspension and bring-into-compliance orders, giving effect to the EDPB's 13 April 2023 Article 65 binding decision.
A Data Protection Commission (Ireland), Data Protection Commission announces conclusion of inquiry into Meta Ireland (press release) (22 May 2023) · archived · retrieved 31 Oct 2026
Confirmed fact · as of 31 Oct 2026
This was an administrative/regulatory data-protection enforcement action; it is not a criminal matter and involves no criminal conviction.
A Data Protection Commission (Ireland), Data Protection Commission announces conclusion of inquiry into Meta Ireland (press release) (22 May 2023) · archived · retrieved 31 Oct 2026
Unanswered question · as of 31 Oct 2026
The outcome of Meta's judicial review of the DPC decision has not been confirmed from a primary court record in the checked sources; the only confirmed step is the grant of leave and a short interim stay of the suspension order on 9 June 2023.
C The Irish Times, Meta seeks judicial review of DPC's €1.2bn fine; granted short High Court stay on transfer-suspension order (9 Jun 2023) · retrieved 31 Oct 2026
Superseding event · 10 Jul 2023
On 10 July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework (IP/23/3721), establishing a new lawful basis for EU-to-US personal-data transfers to participating US organisations; this changed the forward-looking legal position for such transfers but did not vacate the DPC's decision or fine.
A European Commission, Data protection: European Commission adopts adequacy decision for the EU-US Data Privacy Framework (IP/23/3721) (10 Jul 2023) · retrieved 31 Oct 2026
Last reviewed 31 Oct 2026. An initial allegation is not the final event; this block is always shown.
How it unfolded
Issue raised · 22 May 2023
Proposition: The Irish Data Protection Commission (DPC), as lead supervisory authority and following a binding decision of the European Data Protection Board under Article 65 GDPR, found that Meta Platforms Ireland Limited infringed Article 46(1) GDPR by continuing to transfer personal data of Facebook users from the EU/EEA to the United States on the basis of Standard Contractual Clauses that, in the circumstances, did not ensure a level of protection essentially equivalent to that guaranteed in EU law.
Affected parties: Meta Platforms Ireland Limited, Data Protection Commission (Ireland), European Data Protection Board, Facebook users in the EU/EEA
Originating record: A Data Protection Commission (Ireland), Data Protection Commission announces conclusion of inquiry into Meta Ireland (press release) (22 May 2023) · archived · retrieved 31 Oct 2026
Response · Meta Platforms Ireland Limited · 9 Jun 2023
Attributed claim · as of 9 Jun 2023
Meta stated publicly that it considered the fine and orders unjustified and unnecessary and that there was no immediate disruption to Facebook in Europe, and it moved to challenge the decision. On 9 June 2023 the Irish High Court granted Meta leave to bring judicial review proceedings against the DPC's decision, the judge being satisfied that Meta had established arguable grounds; Meta was also granted a short interim stay of the suspension order, which the judge said did not question the validity of the DPC decision. Reported by the Irish Times. — Meta Platforms Ireland Limited
C The Irish Times, Meta seeks judicial review of DPC's €1.2bn fine; granted short High Court stay on transfer-suspension order (9 Jun 2023) · retrieved 31 Oct 2026
Outcome · Data Protection Commission (Ireland), giving effect to a binding Article 65 decision of the European Data Protection Board · 12 May 2023
official findingbinding
Confirmed fact · as of 22 May 2023
The DPC adopted its final decision in the inquiry on 12 May 2023 and announced it publicly on 22 May 2023. The decision found that Meta Platforms Ireland Limited infringed Article 46(1) GDPR when it continued to transfer personal data from the EU/EEA to the USA. The DPC imposed an administrative fine of €1.2 billion, an order under Article 58(2)(j) GDPR requiring Meta Ireland to suspend any future transfer of personal data to the US within five months of notification, and an order under Article 58(2)(d) GDPR requiring Meta Ireland to bring its processing operations into compliance with Chapter V of the GDPR by ceasing the unlawful processing, including storage, of such data in the US within six months of notification. The fine and the orders followed a binding decision adopted by the European Data Protection Board on 13 April 2023 under the Article 65 dispute-resolution procedure. This is an administrative data-protection matter, not a criminal proceeding.
A Data Protection Commission (Ireland), Data Protection Commission announces conclusion of inquiry into Meta Ireland (press release) (22 May 2023) · archived · retrieved 31 Oct 2026
Remedy: Administrative fine of €1.2 billion; an order to suspend future EU/EEA-to-US transfers within five months of notification (Art. 58(2)(j)); and an order to bring processing into compliance with Chapter V GDPR within six months of notification (Art. 58(2)(d)).
Appeal/review: pending — Meta sought judicial review of the DPC decision before the Irish High Court, which granted leave and a short interim stay of the suspension order on 9 June 2023 (reported by the Irish Times). No final judgment concluding the review has been identified in the checked records as of the review date; the appeal/review is recorded as unresolved. C The Irish Times, Meta seeks judicial review of DPC's €1.2bn fine; granted short High Court stay on transfer-suspension order (9 Jun 2023) · retrieved 31 Oct 2026
How to read this. Allegation, response and outcome are separate, dated records. "Decided/resolved" appears only where a cited outcome supports it. Materially affected parties can request a correction via Corrections & response.