Facebook warns multinationals face billions in privacy costs

Senior Facebook executive warns of huge costs for firms following Data Protection decision

Facebook offices

Adrian Weckler

US multinationals could face billions in extra costs if the Irish Data Protection Commissioner directs Facebook to suspend its data transfers from Europe to the US, a senior executive in Facebook has said.

"It would be very expensive to divide out data so that it's stored only in Europe," said the executive, who did not wish to be named. "We would have to build new data centres [in Europe]."

Facebook recently unveiled plans for a €200m data centre in Meath, its second European facility. Google has also announced plans for a new €150m data centre in Dublin.

"We would probably also have to halt some product development while we rethink the architecture of how the data was stored and dealt with," said the executive.

The comments come days after the European Court of Justice told the Irish Data Protection Commissioner to re-examine a case involving the privacy of European users' Facebook data in the US. The court said that because US authorities engage in mass surveillance of European personal information on site such as Facebook, the Irish regulator may have to "suspend" data transfers on the social network between the EU and US.

But such a decision would prove costly and difficult for companies based here.

"We store several copies of each photo uploaded to Facebook in several different data centres in case one site goes down," said the Facebook executive.

But these backups, which are part of Facebook's 'redundancy' capacity, are stored in different data centres around the world, said the executive.

"Facebook is a free service," said the executive. "That's a lot of added new cost for a free service."

Like other data-intensive companies, Facebook has previously said that the European Court of Justice ruling, which strikes down the US-EU 'Safe Harbour' data-transfer agreement, would not significantly affect Facebook's operations straight away.

Instead, it said that the company could revert to other legal methods, such as user consent or 'model contracts', to ensure legal compliance with existing European rules.

However, the European Court of Justice said that 'Safe Harbour', which gave Facebook and 4,400 other companies legal cover to transfer data from the EU to the US, was thrown out because it did not protect fundamental European privacy rights. Respect for those rights, said the court, is incompatible with US mass surveillance practices exposed by the NSA whistleblower, Edward Snowden.

In this context, the court said that the Irish Data Protection Commissioner may have to suspend Facebook data transfers from the EU to the US.

The case is likely to have global ramifications for Microsoft, Google, Apple and other giant tech corporations based in Ireland. It may also affect internet users' experience.

Irish regulator Helen Dixon is unlikely to complete any investigation until late 2016.