Facebook has thus avoided the risk of being compelled to shut down its service in Europe this summer following the latest twist in a long-running data protection complaint saga that relates to a clash between EU privacy and U.S. surveillance law.
That delays — in what's still broadly widely expected to be a suspension order to Meta, Facebook's parent, demanding it cease illegal data exports — comes after other DPAs that have been surveying a draft decision and objected to it. In an earlier report, it was picked up by The Irish Business Post.
The General Data Protection Regulation under the bloc, cross-border complaints would often require cooperation and at least a consensus from DPAs in the affected regions, so it would provide a right for interested authorities to weigh in on draft decisions by a lead data supervisor.
"We have received some objections from a small number of Data Protection Authorities in this case," confirmed the DPC deputy commissioner, Graham Doyle. "We are currently assessing the objections and will engage with the relevant authorities to try and resolve the issues raised."
Doyle refused to provide specific details on objections received.
The development means that a final decision on the (seemingly) never-ending saga over the legality of Facebook's data transfers — and the fate of its service in Europe — will be kicked down the road for several more months at least.
For a related earlier cross-border GDPR complaint — this one regarding WhatsApp where objections were also lodged concerning Ireland's intended enforcement- it took all of roughly nine months before an enforcement decision and sizeable penalty was made.
Meta is also likely to appeal any suspension order in the courts of Ireland-and might, once again, seek a stay so that it can continue as is in the interim.
Back in September 2020, the DPC sent a preliminary suspension order to Facebook over the data transfers issue — triggering a legal challenge. Facebook won a stay but its bid to roll back the regulator's decision via judicial review, challenging its procedure, was, eventually, dismissed in May 2021 reviving the enforcement process — which has been grinding on ever since.
The DPC would not provide further comment on an estimated date for a final decision to be made in light of its objections to the DPC's draft.
It, in any case will, depend on whether there could be a resolution of any disputes between DPAs' opinions on enforcement without necessarily relying on a formal dispute resolution under the GDPR, which may involve referral of the matter to the European Data Protection Board, as was indeed done in the WhatsApp matter.
If DPAs can’t come to agreement among themselves and the EDPB has to get involved it’s not beyond the bounds of possibility that a final decision gets pushed into 2023.
According to privacy campaigner and lawyer Max Schrems, who lodged the original complaint against Facebook over data transfers back in 2013!, there should be "substantial further delays" in the enforcement of any suspension order, including Meta's lodging appeals.
The tech giant has a specific incentive to delay enforcement as long as possible as it may be banking on-or, well, hoping for-a fresh data transfer deal between the EU and the U.S. landing to save Facebook's service bacon in Europe.
In March, it had already settled on a preliminary agreement over a new, high-level EU-U.S. accord on data transfers, which replaced the moribund Privacy Shield-the one very obvious casualty thus far of this complaint saga; its predecessor Safe Harbor, too. As far back as earlier this year, the European Commission was mentioning its completion by end-year.
Some have said since that reports show an easing up of negotiations may slow things down too much - with no final agreement in site soon - meaning the revised version won't come anywhere so soon after all and complicate Meta's rather lame 'strategy' for being on further delay to 'buy time' for 'change its European data transfers basis.
The latter outcome would reset the whole game of legal and regulatory whack-a-mole yet again. So, well, it's possible this saga could still have years, plural, to run……