- Meta had standard contractual clauses and supplementary measures in place. They did not address the access risk Schrems II identified, which is the same risk a prompt faces at a US-operated model endpoint.
- The orders to suspend transfers and stop holding transferred data mattered as much as the fine. An AI architecture should be able to obey such an order with one policy change.
- Duration counts under Article 83(2)(a): the time between a known problem and traffic actually stopping is part of your exposure.
- Adequacy under the Data Privacy Framework is a dependency that can change, so keep it as data your routing reads.
What the decision found
On 22 May 2023 the Irish Data Protection Commission announced a EUR 1.2 billion fine on Meta Platforms Ireland, the largest GDPR fine at the time. The finding was that Meta had infringed Article 46(1) by continuing to transfer personal data of Facebook users in the EU and EEA to the United States on the basis of standard contractual clauses after the Court of Justice's Schrems II judgment of 16 July 2020. The DPC's draft decision had not proposed a fine. Other supervisory authorities objected, and the fine followed a binding decision of the European Data Protection Board under Article 65.
The money drew the headlines, but the orders were just as significant. Meta was told to suspend future transfers within five months and, within six, to bring its processing into compliance by ceasing the unlawful processing, including storage, in the US of data already transferred. Once the EU-US Data Privacy Framework took effect on 10 July 2023, Meta could rely on it for new transfers, which blunted the suspension order in practice. Meta has also challenged the EDPB's binding decision before the EU General Court. None of that changes what the decision says about how transfer risk is judged, and that is the part AI teams need.
Clauses were never the control
Meta was not transferring without paperwork. It relied on the 2021 standard contractual clauses and had adopted supplementary measures. The decision's conclusion, in substance, was that those measures did not address the problem the Court had identified: US surveillance law could reach the data, and people in the EU had no effective redress. A contract binds the parties who sign it. It does not bind a government that can compel one of them.
Hold onto that when you assess a model provider. A US-operated endpoint that receives prompts in the clear sits in the same structural position as Meta's US infrastructure did. EDPB Recommendations 01/2020 describe the case of a processor that needs data in the clear to do its job and conclude that no effective technical measure can be envisaged where the destination's authorities have disproportionate access. Inference is that case by construction, because a model cannot reason over ciphertext.
Where you rely on SCCs rather than the Data Privacy Framework, the transfer impact assessment has to say what actually limits access in the clear, not only what the contract promises. The US safeguards adopted alongside the framework, in Executive Order 14086, apply to transfers whatever the transfer tool, which helps such an assessment. It still has to be written, and it still has to match where your prompts go.
The order was the expensive part
Picture the equivalent order aimed at an AI feature: stop sending prompts to this provider within five months, and stop holding what you already sent. For a team that calls one provider's US endpoint directly from forty services, that is not a configuration change. It is a migration under deadline, with model behaviour shifting underneath every feature that depends on it.
Two design choices make an order like that survivable. First, send every model call through one control point, so the destination is a policy decision you change once rather than forty times. Second, know what already sits at each provider: inputs held for abuse monitoring, files uploaded for retrieval, fine-tuning data sets, batch job inputs and outputs. A cessation order reaches data already transferred, and you cannot delete what you never inventoried.
- One egress path for model traffic, enforced at the network layer rather than by convention.
- An inventory of every artefact stored at each provider, with its retention period and a deletion procedure.
- A tested alternative route for each use case that stays inside the jurisdiction.
Duration is a decision
Article 83(2)(a) tells supervisory authorities to weigh the nature, gravity and duration of an infringement. Meta's transfers continued for close to three years after Schrems II while the inquiry ran. For an AI team the lesson is procedural. When your DPO concludes that a route has no valid transfer basis, the time from that finding to the traffic actually stopping is part of your exposure, and it should be measured in days, not quarters.
That only works if stopping is cheap. Teams that encode transfer positions as policy can block a destination for every tenant in one reviewed change, and show from signed receipts the moment the last request went there. Teams that encode them in application code usually discover how many call sites they have during the incident.
Adequacy is a dependency, not a fact
Since 10 July 2023, transfers to US organisations certified under the Data Privacy Framework have rested on an adequacy decision, Implementing Decision (EU) 2023/1795. It has held so far. On 3 September 2025 the General Court dismissed Philippe Latombe's action for annulment, and he appealed to the Court of Justice at the end of October 2025. The two arrangements before it, Safe Harbor and Privacy Shield, were both invalidated by that court. Plan for the framework to survive, and build so that you could live without it.
In practice that means keeping the condition in a data document your routing reads, owned by the DPO's office, rather than hard-coded into each integration. If the framework falls, one field changes, the policy bundle ships, and every US-bound route for every tenant is refused at its next evaluation.
package acme.transfers
# data.adequacy.us_dpf.status is maintained by the DPO office.
# It reads "in_force" today and changes if Decision (EU) 2023/1795 is annulled.
destination_permitted if {
input.endpoint.country == "US"
input.endpoint.operator.dpf_certified == true
data.adequacy.us_dpf.status == "in_force"
}Read it next to Uber and TikTok
Two later decisions complete the picture. In August 2024 the Dutch AP fined Uber EUR 290 million for transferring European drivers' personal data to the US without a valid transfer tool. In May 2025 the Irish DPC fined TikTok EUR 530 million over transfers of EEA user data to China and transparency failures, in a case where remote access by staff in China was central. Uber shows that a gap in the transfer tool itself is fined at scale. TikTok shows that a transfer does not need a copy of the database: access from a third country is enough, which is exactly how support and abuse-review access to prompts works at many providers.
The amounts also put transfers in proportion. Meta and Uber together, EUR 1.49 billion, account for about a quarter of the EUR 5.88 billion in cumulative GDPR fines that DLA Piper counted from 25 May 2018 to January 2025. Transfers are not a niche enforcement topic, and the Article 83(5) ceiling of EUR 20 million or 4% of worldwide annual turnover applies to them in full.
- List every model endpoint your products call and the transfer basis for each.
- Find out which provider staff can access prompts, from where, and for how long inputs are kept.
- Measure how long it would take to stop one route for every tenant, then shorten it.