Data giant Meta:
Between EU and US data protection law

Social media platforms and messaging services such as Facebook, Instagram or WhatsApp have become an integral part of our daily lives. Almost everyone today is registered with at least one of these services. A look at the user figures of parent company Meta underlines this: In the first quarter of 2022, almost three billion users used one or more apps in the Meta network every day. The countless data generated as a result are stored in 21 data centers worldwide. However, the US corporation has been criticized for years due to inadequate data protection.

How exactly is your data encrypted in leitzcloud?
Find out more on our website!

Learn more now

Meta faces a data export ban

The Irish Data Protection Commission (DPC) now intends to prohibit Meta from continuing to store user data of EU citizens on servers in the United States. On July 7, 2022, the DPC announced that it would block the transfer of all data between Meta and the USA in the future.

The data protection authorities of the other European member states were meanwhile asked to comment on this within one month. However, a quick solution is not to be expected, as amendments can be submitted and Meta has the option to appeal. The DPC justifies its legislative initiative by stating that the data protection regulations of the United States do not meet the high requirements of the European General Data Protection Regulation (GDPR).

Data protection in the EU & the USA

But how exactly does US data protection law differ from that of the EU? One key difference is that the USA still does not have a comprehensive, uniform data protection law. While EU member states have been legally bound by the GDPR since 2018 and must ensure its full implementation, data protection in the USA is governed by sector-specific data protection laws. This means there are different regulations for individual sectors.

The reason for the different approach: In the USA, the protection of personal data—unlike in the EU—is not regarded as a fundamental right, but as part of consumer protection law. Another key difference is that US data protection law grants intelligence services extensive access to stored data.

What happens next for Meta

A new bilateral data protection agreement between the EU and the USA is currently being negotiated. Until then, there is a question mark over Meta’s storage and use of European user data, especially as there are further hurdles the US corporation faces. In March this year, the EU Commission adopted two laws—the Digital Services Act (DSA) and the Digital Markets Act (DMA)—which impose stricter rules and due diligence obligations on digital corporations such as Meta. Illegal social media content, for example, must now be removed immediately.

Cloud providers: What you need to consider

Storing customer data on servers abroad has now become common practice among many cloud providers as well. In doing so, it can often not be ruled out that some sensitive data may be passed on to governments and other third parties.

This applies even more since the enactment of the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) in 2018. This law authorizes US law enforcement agencies to access customer data from US IT service providers, even if the data is stored outside the USA. This affects, for example, a cloud provider from the USA that stores its data in a data center in Europe.

To be able to rule out the disclosure of personal data to third parties, it is therefore essential—especially for companies—to use a German cloud provider. This provider should be 100% GDPR-compliant and host its customers’ data exclusively in German data centers.