Meta’s record-breaking fine and the future of international data transfers: What does it mean for sport?

On 22 May 2023, the Irish Data Protection Commissioner (“DPC”) announced the conclusion of an almost three-year long investigation into transfers of Facebook users’ personal data by Meta Ireland to the United States of America in connection with the Facebook service¹. Although the decision itself only directly affects Meta, the same legal principles apply to any organisation transferring personal data to third countries. Sports organisations regularly transfer personal data overseas, whether to owners, other clubs or suppliers, and the decision could have consequences for any of those transfers that are made in reliance on standard contractual clauses (“SCCs”).