By Paul Ivsin, Senior Vice President, Analytics, Insights, and Media
On Monday, May 22, the European Data Protection Board ordered Meta, Inc. to pay a $1.3 billion fine for its mishandling of data and privacy violations related to the European Union’s General Data Protection Regulation (GDPR). This is based on Meta’s practice of transferring user data from Europe to the United States. Given that Meta’s Facebook and Instagram properties have consistently proven to be very effective channels to reach key patient populations, there’s a natural concern that this ruling or Meta’s actions, or both, may have a negative impact on the future of engaging interested clinical trial participants in Europe.
Our three major takeaways from the ruling are:
- This is not really about Facebook. Once you get past the sticker shock of the fine, what’s most remarkable is that Meta is not accused of any actual bad behavior. There are no data breaches here, no improper sharing, selling, or disclosures. Meta stands accused of doing exactly what thousands of other businesses do: transferring personal data from the EU to the US. The ruling – which rests upon a 2020 ruling by the Court of Justice of the European Union (CJEU) – in essence implies that all EU-US personal data transfers are by definition privacy violations.
- The stakes just got much higher. While the 2020 CJEU ruling did appear to invalidate any personal data moving to the United States, it did not have any immediate practical consequences – until today. This ruling starts a clock: Meta has five months to end its “non-compliant” transfers. If nothing changes, Meta will need to end operations in Europe, with a massive and painful domino effect for all other companies that also rely on these data transfers.
- The solution may be on the way. Not only is this decision not really about Facebook, but it’s pretty clear that Meta can’t actually solve this issue on its own. At its heart, this issue is about the lack of an agreement between the US and EU governments that provides the guardrails to permit data transfers. Two previous agreements have been invalidated by the courts, but version three has been “in the works” ever since 2020. The Biden Administration took an important step forward last October with an Executive Order that defined limits on controversial intelligence-gathering activities. The EU then issued a statement that they believe a new framework can be fully in place by this summer.
The new framework (which will undoubtedly have to survive more legal challenges after it’s implemented) should provide a solid foundation not just for Meta, but also for other tech companies like Google, and companies like Continuum Clinical that work hard to maintain the highest standards of privacy and security for the trial participants we help.
If you’re interested in more details, please read this excellent summary from the International Association of Privacy Professionals.
At Continuum Clinical, we will continue to monitor the progress of government negotiations while we work with our Sponsors and service providers to fully align our systems to the upcoming Data Protection Framework.
