Experts’ Contributions

Since ESG and sustainability have become increasingly important to both consumers and businesses, a need has arisen for undertakings to work together in contributing to a sustainable future. New guidelines and specific regulation from the EU provide for increased opportunities to cooperate on such matters without infringing the prohibition of anti-competitive agreements.

On 22 May 2023, the Irish Data Protection Commission (DPC) issued Meta Platforms Ireland Limited (Meta Ireland) with a EUR 1.2 billion (approximately 1.3 billion U.S. dollar) fine for breaches of the GDPR with respect to EU-U.S. personal data transfers associated with its Facebook service.

Meta Ireland has also been ordered to suspend all Facebook-related personal data transfers from the EU to the U.S., and to bring the processing of any previously transferred data into compliance.

Article 38 of the Personal Information Protection Law stipulates four compliance paths for cross-border transfer of personal information, namely: (1) passing the security assessment organized by the Cyberspace Administration of China (the “CAC”); (2) obtaining the protection certification by a specialized agency; (3) entering into a standard contract formulated by the CAC; and (4) meeting other conditions set forth by laws and administrative regulations and by the CAC.